towardsWisdom

I had mentioned in my last post that I had removed the winupd01 virus but not completely. And yesterday, it returned as feared. However I realized it was a silly mistake of mine to miss 2 more of its files that were starting up even after removing the winupd01.exe

So here is the removal process:

(I should mention, this is for Windows XP as I have XP and have never used vista or windows 7. I don’t know if this is applicable for Vista and win7 as the paths may be different.)

First, get this tool: “Autoruns” http://technet.microsoft.com/hi-in/sysinternals/bb963902(en-us).aspx
It shows all the programs that run automatically when you start your computer. Extract the zip file to some folder. Now again, the virus auto-closes this software so just rename the Autoruns.exe to any other name like Autorunsss.exe and run it. There will be several startup entries of the viruses which are as follows:

1) In “Image Hijacking” tab: winupd01.exe
2) In “Winlogon” tab: 1 or 2 entries for szywo.exe and/or knauct.exe and/or ahrg.exe
(All these files are in C:Documents and Settings[username]Application Data
OR C:Documents and Settings[username])
3) In “Logon” tab: (Somewhat same as those in Winlogon tab but more entries.
4) In “Drivers” tab, there might be 1 or 2 .sys files of the virus. The name is random. So you will need to find any suspicious .sys file. In the list, check for those entries for which the ‘Publisher’ and ‘Description’ column has no value. For such an entry if the filename is totally weird like ijlocpvb.sys or lbrtfdc.sys, note it down.

Do not delete these startup entries for now as its no use deleting them now; the virus will simply rewrite them. Now to delete these files, start your computer in another OS like linux. You can use a linux live DVD like Ubuntu live so that you dont have to install it. Just put the dvd/cd in and boot up your computer. (Make sure the first boot device is CDROM in your BIOS setting to boot from the cd. Google it if you don’t know how to do it.)

Then delete the following:
1) Delete C:WindowsSystem32winupd01.exe
2) Delete all .exe files in C:Documents and Settings[username]
3) Delete all .exe files in C:Documents and Settings[username]Application Data
(This is probably where you’ll find the szywo.exe)
4) Delete all .exe files in C:Documents and Settings[username]Local SettingsTemp
5) Delete all .exe files in C:Documents and Settings[username]Local SettingsTemporary Internet Files
6) If you had noted down any suspicious .sys file from the Drivers list, then remove it also. It will be in: C:WindowsSystem32drivers
Just to be on the safe side, take a backup copy of that file before deleting it so that after restarting into windows if u find something not working properly, you realize that .sys file was actually a Windows needed file and you can restore it back.

Thats it, now restart in Windows again.
The virus wont be running now. Now delete all its startup entries using the Autoruns tool.

*The virus may have made changes to the hosts file (C:WindowsSystem32driversetchosts) which affects internet browsing.
Check the size of the hosts file. If it is about 4.7mb then open it with notepad and delete all its contents and add this line which is the default content:
127.0.0.1 localhost

If you have multiple users on your XP, then you should check for and delete the exe files in all the users’ Documents and Settings folder as given above. Also, delete the startup entries for each user. To delete the startup entries for another user, in the Autoruns program, click on the ‘User’ menu and then click the another user’s name. And then delete the startup entries of the virus as mentioned above.

Thats it! You’ve gotten rid of the stubborn email spamming virus.

Leave a comment if you have any problems.

My Friday evening was spoiled thanks to this stubborn virus. I was just browsing (just ebay and no suspicious sites) and suddenly my avira antivir detected a file called 205.exe in the Temperory Internet Files folder; i chose to deny access to it. But still my cursor changed to ‘processing’ indicating something running in background. After looking at the ‘Temperory Internet Files’ folder I found out there were in all, 5 exe files with weird names one of which was 205.exe
After some investigation of these files in my virtual machine i concluded that 205.exe was not run but another of those 5 was causing the damage…. And that was fol.exe which installed itself as winupd01.exe
I still have no idea how these files entered and executed on my system.

About winupd01.exe:
Size: 208,896 bytes
MD5 Hash: 5224bc60f8a486d895ff584d647897e7
Is a Malware!

Based on what I noticed when my system was infected and on the packets I sniffed here’s some details:

What it does:
1) Keeps searching for email addresses on the net
2) Continuously sends spam viagara emails to email addresses which it found probably in step 1.
As a result ur net slows down.
3) Kills your antivirus’s guard/protection. (I had avira antivir)
4) Hides itself from running processes. (That was the biggest hurdle in finding it.)
5) Auto-closes packet sniffers as soon as u open them. (I found a workaround to this by renaming the default filename of the sniffers)
6) Autocloses hijackthis, killbox.
7) Keeps ticking the ‘Do not show hidden files and folders’ option in folder options.
8) Writes some big crap to the hosts file making it 4.87mb

How it ensures it starts up with windows.
1) It copies itself to C:Windowssystem32winupd01.exe
2) Adds the following registry entry to HKLMSoftwareMicrosoftWindowsCurrentVersionRun:
Name: ctfmon.exe Data: ctfmon.exe
3) Adds the following registry entry to HKLMSoftwareMicrosoftWindows NTCurrentVersionImage File Execution Optionsctfmon.exe
Name: winupd01.exe Data: C:windowssystem32winupd01.exe
Thats how it starts with windows.
There are a few more entries in regedit if u search ‘winupd01.exe’ but i dont think they r significant.
It keeps adding these entries continuosly so u cant delete them

How to remove it:
1) Restart computer in another OS (I used a Ubuntu linux live dvd)
2) Delete the file C:windowssystem32winupd01.exe and C:windowssystem32ctfmon.exe
3) Delete all the crap added to your hosts file (C:windowssystem32driversetchosts). i.e. just delete all the contents and add this line:
127.0.0.1 localhost
4) Restart your comp in windows. Now the virus wont run. But you should clean the registry of its traces. So remove the above said entries. And also search the entire registry for ‘winupd01.exe’ and delete all you find.

However, it seems the virus hasnt been completely removed even after I have done this… coz my explorer.exe tries downloading fol.exe from 89.149.253.xxx on startup which is nothing but the winupd01.exe file. But fortunately, it gets a File Not Found error.

Also see the PrevX info on this file: http://www.prevx.com/filenames/X1212390081188608968-X1/WINUPD01.EXE.html
EDIT: See my new post on how to remove this virus completely here.