1 reply to this topic

[Metallica]

Content is republished with permission from Malwarebytes.

What is Sysinternals Antivirus?

The Malwarebytes research team has determined that Sysinternals Antivirus is a fake anti-malware application. These so-called "rogues" use intentional false positives to convince users that their systems have been compromised. Then they try to sell you their software, claiming it will remove these threats. In extreme cases the false threats are actually the very trojans that advertise or even directly install the rogue. You are strongly advised to follow our removal instructions below.

How do I know if I am infected with Sysinternals Antivirus?

This is how the main screen of the rogue application looks:



You will find these icons on your desktop and in your taskbar:



And see these warnings:







How did Sysinternals Antivirus get on my computer?

Rogue programs use different methods for spreading themselves. This particular one was pushed by an exploited website.

How do I remove Sysinternals Antivirus?

Our program Malwarebytes' Anti-Malware can detect and remove this rogue application.

• Please download Malwarebytes' Anti-Malware to your desktop.
• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to the following:
  
  
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected. Reboot your computer if prompted.
• When completed, a log will open in Notepad. The rogue application should now be gone.

Is there anything else I need to do to get rid of Sysinternals Antivirus?

• No, Malwarebytes' Anti-Malware removes Sysinternals Antivirus completely.

How would the full version of Malwarebytes' Anti-Malware help protect me?

We hope our application has helped you eradicate this malicious software. If your current security solution let this infection through, you might please consider purchasing the FULL version of Malwarebytes' Anti-Malware for additional protection.

As you can see below the full version of Malwarebytes' Anti-Malware would have protected you against the Sysinternals Antivirus rogue. It would have warned you before the rogue could install itself, giving you a chance to stop it before it became too late.

Technical details for experts

Signs in a HijackThis log:

C:\Users\{username}\AppData\Roaming\svchost.exe
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
C:\Users\{username}\AppData\Roaming\alggui.exe

O4 - Startup: svchost.exe

Alterations made by the installer:

File system details
---------------------------------------------
	In the existing folder C:\Users\{username}\AppData\Roaming
	   Adds the file alggui.exe"="6/3/2010 8:42 PM, 49152 bytes, A
	   Adds the file nuar.old"="6/3/2010 8:43 PM, 9 bytes, A
	   Adds the file svchost.exe"="6/3/2010 8:42 PM, 40448 bytes, A
	   Adds the file wp3.dat"="6/3/2010 8:49 PM, 1 bytes, A
	   Adds the file wp4.dat"="6/3/2010 8:49 PM, 84 bytes, A
	In the existing folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
	   Adds the file svchost.exe"="6/3/2010 8:42 PM, 40448 bytes, A
	Adds the folder C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sysinternals Antivirus
	   Adds the file Sysinternals Antivirus.lnk"="6/3/2010 8:49 PM, 2015 bytes, A
	Adds the folder C:\Users\{username}\AppData\Roaming\scdata
	   Adds the file dbsinit.exe"="6/3/2010 8:47 PM, 150576 bytes, A
	Adds the folder C:\Users\{username}\AppData\Roaming\scdata\images
	   Adds the file i1.gif"="11/21/2008 3:17 PM, 1744 bytes, A
	   Adds the file i2.gif"="11/21/2008 3:17 PM, 1663 bytes, A
	   Adds the file i3.gif"="11/21/2008 3:17 PM, 1689 bytes, A
	   Adds the file j1.gif"="11/21/2008 3:12 PM, 3957 bytes, A
	   Adds the file j2.gif"="11/21/2008 3:12 PM, 47 bytes, A
	   Adds the file j3.gif"="11/27/2008 4:33 PM, 3857 bytes, A
	   Adds the file jj1.gif"="11/21/2008 3:14 PM, 114 bytes, A
	   Adds the file jj2.gif"="11/21/2008 3:14 PM, 48 bytes, A
	   Adds the file jj3.gif"="11/21/2008 3:40 PM, 105 bytes, A
	   Adds the file l1.gif"="11/21/2008 2:39 PM, 3749 bytes, A
	   Adds the file l2.gif"="11/21/2008 2:39 PM, 92 bytes, A
	   Adds the file l3.gif"="11/21/2008 2:40 PM, 468 bytes, A
	   Adds the file pix.gif"="11/21/2008 3:44 PM, 70 bytes, A
	   Adds the file t1.gif"="11/21/2008 2:47 PM, 621 bytes, A
	   Adds the file t2.gif"="11/21/2008 3:17 PM, 1015 bytes, A
	   Adds the file Thumbs.db"="10/19/2009 2:02 PM, 36864 bytes, HSA
	   Adds the file up1.gif"="11/21/2008 2:28 PM, 5568 bytes, A
	   Adds the file up2.gif"="11/21/2008 2:29 PM, 696 bytes, A
	   Adds the file w1.gif"="11/21/2008 2:56 PM, 3028 bytes, A
	   Adds the file w11.gif"="11/21/2008 3:08 PM, 3431 bytes, A
	   Adds the file w2.gif"="11/21/2008 2:56 PM, 47 bytes, A
	   Adds the file w3.jpg"="11/27/2008 4:34 PM, 1912 bytes, A
	   Adds the file word.doc"="10/9/2009 1:19 PM, 27136 bytes, A
	   Adds the file wt1.gif"="11/21/2008 2:57 PM, 176 bytes, A
	   Adds the file wt2.gif"="11/21/2008 2:57 PM, 51 bytes, A
	   Adds the file wt3.gif"="11/21/2008 2:57 PM, 119 bytes, A
	Adds the folder C:\Users\{username}\AppData\Roaming\Sysinternals Antivirus
	   Adds the file Sysinternals Antivirus.exe"="6/3/2010 8:40 PM, 1388544 bytes, A
	In the existing folder C:\Users\{username}\Desktop
	   Adds the file Sysinternals Antivirus.lnk"="6/3/2010 8:49 PM, 2023 bytes, A


Registry details
------------------------------------------
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Sysinternals Antivirus_RASAPI32]
	   "ConsoleTracingMask"="REG_DWORD, -65536"
	   "EnableConsoleTracing"="REG_DWORD, 0"
	   "EnableFileTracing"="REG_DWORD, 0"
	   "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
	   "FileTracingMask"="REG_DWORD, -65536"
	   "MaxFileSize"="REG_DWORD, 1048576"
	[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Sysinternals Antivirus_RASMANCS]
	   "ConsoleTracingMask"="REG_DWORD, -65536"
	   "EnableConsoleTracing"="REG_DWORD, 0"
	   "EnableFileTracing"="REG_DWORD, 0"
	   "FileDirectory"="REG_EXPAND_SZ, "%windir%\tracing"
	   "FileTracingMask"="REG_DWORD, -65536"
	   "MaxFileSize"="REG_DWORD, 1048576"

Malwarebytes' Anti-Malware log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4167

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

6/3/2010 8:55:06 PM
mbam-log-2010-06-03 (20-55-06).txt

Scan type: Quick scan
Objects scanned: 118330
Time elapsed: 4 minute(s), 10 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 6

Memory Processes Infected:
C:\Users\{username}\AppData\Roaming\Sysinternals Antivirus\Sysinternals Antivirus.exe (Rogue.WindowsPolicePro) -> Unloaded process successfully.
C:\Users\{username}\AppData\Roaming\svchost.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe (Backdoor.Bot) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Sysinternals Antivirus (Rogue.SysinternalsAntivirus) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sysinternals Antivirus (Rogue.SysinternalsAntivirus) -> Quarantined and deleted successfully.

Files Infected:
C:\Users\{username}\AppData\Roaming\Sysinternals Antivirus\Sysinternals Antivirus.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\Users\{username}\Desktop\PC_protect.exe (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sysinternals Antivirus\Sysinternals Antivirus.lnk (Rogue.SysinternalsAntivirus) -> Quarantined and deleted successfully.
C:\Users\{username}\Desktop\Sysinternals Antivirus.LNK (Rogue.SysinternalsAntivirus) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

As mentioned before the full version of Malwarebytes' Anti-Malware could have protected your computer against this threat.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.

[Metallica]

In some cases rogues and other malware will stop processes like mbam.exe from running to make removal more difficult.

This one produces a warning:
Warning!
Running of application is impossible.<Name of the program executable> is infected.

In this case it is enough to kill the main rogues process to get the removal started.
Use Ctrl-Alt-Del to bring up a choice screen like this:



Select the taskmanger and on the processes tab find the rogues process which matches that of the first icon, here PC_Protect.exe
Select the process and click the End Process button.



This will bring up a prompt asking you to confirm the action. If you selected the correct process click End Process.



That will stop the rogue and you will have your hands free to remove it.
We will use task manager to start Malwarebytes' Anti-Malware
Click File and select New Task (Run)



This will open an explorer windows allowing you to browse for the program to start.



In this case we went to C:\Program Files\Malwarebyte'Anti-Malware\mbam.exe



Select it and click OK in the prompt as shown below.



And after a short while rescue is roaring to go.



Proceed with the procedure as described in the previous post.
Don't forget to get the latest updates!