What is this German (?) virus and how can I get rid of it?

Question

UPDATE

I've posted my solution below.

---

This thing popped up on the computer of one of my employees on Friday. I've spent most of the weekend scanning the computer with Avira AntiVir, Avira Boot Sector Repair Tool, Kaspersky Virus Removal Tool, Malwarebytes, Spybot, McAfee Stinger, and something else I forgot and all of them found something. Overall they all cleaned about 400 malicious items, except for this one.

This screen shows up right after the computer boots up and the user logs in. There's a slight lag while the OS is loading the profile and after that this pops up. I think it's something along the lines of a browser hack because I saw Firefox (3.6.18 I think) start up right before it appeared.

I can do CTRL+ALT+DEL and bring up Task Manager, but as soon as I do the virus screen overlays it.

What is this virus and how can I get rid of it?

Answer 1

As it's been said over and over again, the only sure-fire way to ensure that a virus is gone is to format your computer, and re-install things one by one.

That said, this isn't technically a virus, but a new kind of malware that makes you pay to remove it, which you should not do under any circumstances, because you're contributing to organised crime.

Answer 2

How much time have you spent already trying to fix the PC?

You may just find that booting with something like an Ubuntu live CD to copy all data to a removable USB hard drive, then formatting the disk and re-installing is actually the fastest way to solve this problem.

I've seen it happen time and time again where so many more hours are spent trying to remove viruses or malware than what it takes to simply backup, format and re-install.

I know you don't want to do this, you would rather use a tool to fix the problem, but I think you'll save time by doing a clean install and you'll also know that the malware is really gone.

You computer will probably run faster as well as this is usually the case on a fresh install.

Answer 3

It seems to be the BKA Trojan (the first couple of results are links to the scareware’s site, so don’t use those). It seems that the consensus is to either reinstall, or use more anti-malware software.

Re-installing should be a last resort; trying to remove it is better. The worst that can happen is that you end up re-installing anyway and “waste” some time learning some stuff.

It may seem silly/obvious, but have you tried pressing Alt+F4 on the window?

---

I can suggest trying a few more softwares to try (run them in safe-mode to for better results):

• SUPERAntiSpyware (use the portable version)
• Autoruns (to weed out where it is running from)
• HijackThis (to analyze the system fairly throughly)
• WinSpy++ (to remove the topmost attribute from the window, though it may reset it every couple of seconds)
• ComboFix (scorched-Earth last resort)

Another thing to try is to quickly look in the Task Manager’s Processes tab to try to figure out which process(es) the trojan is running from, and try to kill it (you don’t need to see it the Task Manager to kill it, you can type out the first several letters of the EXE name, and press Del, then Space), though make sure that the Task Manager’s Always-On-Top option is selected; just in case.

---

(Side note: I find it amusing that the trojan is using the Windows 7 logo even though the Alex has indicated that it is an XP system. sigh)

Answer 4

So, after spending several days fighting this thing, I finally got rid of it. I'm pretty sure I got the right one, but along the way I found some suspicious items that could have contributed. Here's the steps it took to clean it up.

First thing I did was to check all of the autostart locations on windows. I followed this article here. Most of the locations where clean except for:

1. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
   • This key had a second path on it pointing to C:\Documents and Settings\NetworkService\Application Data\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe
2. HKLM\Software\Microsoft\Windows\CurrentVersion\Run
   • This node had a REG_SZ key named 2C508BD5-F9C6-4955-B93A-09B835EC3C64 which was pointing to the msvcs.exe file in the Userinit key.
3. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
   • This node had two other nodes that looked suspicious to me. They were named \toldvw32 and torlfsvses. Both nodes had keys that pointed to a toldvw32.dll file and were set with a WlStartupEvent event. Looking these up on Google didn't produce any meaningful results at the time, so I went ahead an removed them. There doesn't seem to be problems with having done that yet.

The real issue is that msvcs.exe file. If one manages to survive it will replicate it self across all user profiles on the machine. Since it was hooked up into the NetworkService profile it would always make sure it existed in the other profiles.

There's three locations where msvcs.exe exists. They are:

1. {PROFILE}/Application Data/09A52917-B4FC-4f02-AE3B-BF55D9351F4A
2. {PROFILE}/Start Menu/Programs/Startup
3. WINDOWS\Prefetch
   • Not 100% sure on this one, but I did find two suspicious files: MSVCS.EXE-0CA809BA.pf and MSVCS.EXE-301B4EC0.pf. I went ahead and removed them without issues (so far at-least).

I hope this helps someone in the future. It worked for me. If you have a computer that had/has this and it's hooked up to a domain make sure to check the user's profile folder on the server as well, there's a copy there too. Needless to say, don't login into that profile directly on the server because you're just going to have a very fun time after that...

Also, you can't clean it through Safe Mode if the profile you're logging into has been infected. I used UBCD4Win to clean up what I saw, then I did the rest through Safe Mode.

Now, I know the general consensus is to nuke the computer and start from scratch, but that is not always possible in a business environment. After I had it cleaned up and confirmed clean by several antivirus tools I ran chkdsk /f /r on the drive, defragmented it with MyDefrag (4.3.1) and the computer works perfectly as if it never happened. So, nuking the computer is not always the best course of action as @Synetech pointed out him/her self.

Lastly, Kaspersky was installed on the computer, but somehow was turned off and that's how the virus (malware?) got through and did what it did. I'm not a fan of antivirus software at all, in fact I don't have any on my 6 or so machines that I have, but in an environment where you have technically challenged personel, it is a good idea to have it and its also a very good idea to make sure it's actually turned on and updated.

That is all fellow awesome people. I hope someone else can benefit from this answer in the future.

Answer 5

This seems to be a brand new scareware. As far as I see, it has not been described by the antivirus specialists yet. It threatens to delete the contents of the disk and sue you for using an illegal copy of Windows.

I propose you turn off the infected computer, remove the disk and copy the contents of the disk to some safe spot. Then you can also retry a virusscan while attached to a different computer (not booting this infected disk).

Personally, I would backup the data and go for a fresh install. Once a malware was on a windows, there is no way to make sure all traces have been removed, because once they have a hold of your computer they will continue to try and use it / your data / your bank account. In cases like this, it seems to be usual to load more malware onto the computer.

Users of this computer should change their passwords, if banking has been done, check their bank accounts and set a new PIN.

Oh, and dont pay. If you do, it might ask for admin permissions to "fix" your windows, and then rootkit you for good.

Answer 6

Most, but not all, malware can be manually removed with autoruns.

Try the following procedure:

• download autoruns from the above link and run it straight from the zip archive
• let it scan (if it can)
• look for two types of entries - ones with no signature and more importantly entries which say 'file not found'. The second kind is typical for viruses that insert themselves into various parts of the system that get executed during start time (but upon startup they temporarily remove the infected file and make it accessible only on the next restart). By unticking the problematic/suspicious entries you can cripple the malware to the point that it will not be active in the system anymore (and if you untick something that is needed you can always tick it back on).

Now, if you can not run autoruns that would be due to the virus already blocking it - however viruses will rarely do that.

This procedure is surprisingly efficient, but of course this is only due to viruses not targeting it. You can always try it.

After going through it you can use

• process explorer to check if there are strange processes running on you system
• tcpview to audit and monitor your network activity

Using these tools is not trivial (does require knowledge of the normal system behavior), but in case that

• the regular anti-virus software does not recognize the threat yet neither will booting to linux and trying to clean with clamav
• you really want to try to clean it and try to avoid re-format

you can try to follow the procedure I gave.