No replies to this topic

[Metallica]

Content is republished with permission from Malwarebytes.

What is FlowSpirit?

The Malwarebytes research team has determined that FlowSpirit is riskware.
This particular one uses your computer to generate traffic to certain websites.

How do I know if my computer is affected by FlowSpirit?

You may see these screens while the application is running:







You may also see some alarms or reports regarding outgoing connections to many different domains and your system may be very slow and unresponsive.

How did FlowSpirit get on my computer?

Riskware use different methods for distributing themselves. This particular one was offered as a SEO enhancer.

How do I remove FlowSpirit?

Our program Malwarebytes can detect and remove this riskware.

• Please download Malwarebytes to your desktop.
• Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
• Then click Finish.
• Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
• If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
• When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
• Restart your computer when prompted to do so.

Is there anything else I need to do to get rid of FlowSpirit?

• No, Malwarebytes removes FlowSpirit completely.

How would the full version of Malwarebytes help protect me?

We hope our application and this guide have helped you eradicate this riskware.

As you can see below the full version of Malwarebytes would have protected you against the FlowSpirit riskware. It would have warned you before the riskware could install itself, giving you a chance to stop it before it became too late.

and it blocks the traffic to many of the domains the software tries to visit:

Technical details for experts

Note that the name and the location of the file may be different from case to case.

Possible signs in FRST logs:

 (精灵软件) C:\Users\{username}\Desktop\jingling.exe
 HKCU\...\Run: [urlspace] => C:\Users\{username}\Desktop\jingling.exe [649728 2017-03-23] (精灵软件)
 C:\Users\{username}\AppData\Roaming\Spiritsoft

FirewallRules: [{B0F3CC9A-A947-4CB2-80BF-B0F6DAB7E74B}] => (Allow) C:\Users\{username}\Desktop\jingling.exe
FirewallRules: [{E87455BD-A5EB-4F45-9870-B356FAD34132}] => (Allow) C:\Users\{username}\Desktop\jingling.exe

Alterations made by the installer:

File system details [View: All details] (Selection)
---------------------------------------------------
    Adds the folder C:\Users\{username}\AppData\Roaming\Spiritsoft\urlspirit
       Adds the file bd.dat"="3/23/2017 11:14 AM, 13952 bytes, A
       Adds the file product.dat"="3/23/2017 11:14 AM, 197 bytes, A
       Adds the file tcfg.dat"="3/23/2017 11:14 AM, 1915 bytes, A

Registry details [View: All details] (Selection)
------------------------------------------------
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
       "urlspace"="REG_SZ", "C:\Users\{username}\Desktop\jingling.exe -h"

Malwarebytes log:

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 3/23/17
Scan Time: 11:28 AM
Logfile: mbamFlowSpirit.txt
Administrator: Yes

-Software Information-
Version: 3.0.5.1299
Components Version: 1.0.43
Update Package Version: 1.0.1575
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 366384
Time Elapsed: 8 min, 33 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 2
PUP.Optional.FlowSpirit, C:\USERS\{username}\DESKTOP\JINGLING.EXE, Quarantined, [8098], [121961],1.0.1575
PUP.Optional.FlowSpirit, C:\USERS\{username}\DESKTOP\JINGLING.EXE, Quarantined, [8098], [121961],1.0.1575

Module: 2
PUP.Optional.FlowSpirit, C:\USERS\{username}\DESKTOP\JINGLING.EXE, Quarantined, [8098], [121961],1.0.1575
PUP.Optional.FlowSpirit, C:\USERS\{username}\DESKTOP\JINGLING.EXE, Quarantined, [8098], [121961],1.0.1575

Registry Key: 0
(No malicious items detected)

Registry Value: 1
PUP.Optional.FlowSpirit, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|urlspace, Delete-on-Reboot, [8098], [121961],1.0.1575

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.FlowSpirit, C:\USERS\{username}\APPDATA\ROAMING\SPIRITSOFT\URLSPIRIT, Delete-on-Reboot, [8098], [302708],1.0.1575

File: 4
PUP.Optional.FlowSpirit, C:\USERS\{username}\DESKTOP\JINGLING.EXE, Delete-on-Reboot, [8098], [121961],1.0.1575
PUP.Optional.FlowSpirit, C:\USERS\{username}\APPDATA\ROAMING\SPIRITSOFT\URLSPIRIT\PRODUCT.DAT, Delete-on-Reboot, [8098], [302708],1.0.1575
PUP.Optional.FlowSpirit, C:\Users\{username}\AppData\Roaming\Spiritsoft\urlspirit\bd.dat, Delete-on-Reboot, [8098], [302708],1.0.1575
PUP.Optional.FlowSpirit, C:\Users\{username}\AppData\Roaming\Spiritsoft\urlspirit\tcfg.dat, Delete-on-Reboot, [8098], [302708],1.0.1575

Physical Sector: 0
(No malicious items detected)


(end)

As mentioned before the full version of Malwarebytes could have protected your computer against this threat.
We use different ways of protecting your computer(s):

• Dynamically Blocks Malware Sites & Servers
• Malware Execution Prevention

Save yourself the hassle and get protected.