Tracking down Data Execution

Question

I have some malware infecting one of our machines at home. It first showed up as winulty.exe. After investigating, I am of the opinion that winulty.exe itself is an uninfected file but is being modified after it has loaded into memory. Turning on Data Execution Prevention for all processes and services has confirmed this to be true.

How do I track down the process responsible for this? I've used File Monitor from sysinternals.com to monitor winulty.exe and see this being accessed by the svchost.exe instance hosting most of the system services and also by dfrgntfs.exe. How do I know which service or which DLL has been infected?

Answer 1

Are you sure it is the correct instance of SVCHOST.EXE? How did you determine it? What version of Windows is it?

Repeat what you did before, but this time, look at the PID of the instance of SVCHOST.EXE that wrote to WINULTY.EXE’s memory, then run Process Explorer—also from Sysinternals—(make sure to run it as administrator), and double-click on the instance of SVCHOST.EXE that has the PID you noted. Now look in the Services tab to see what services that instance is hosting. Hopefully there won’t be too many services (ideally just one) in that instance. Depending on what services are hosted by it, you can try stopping them to see if it continues. If WINULTY.EXE only gets infected after booting, then again, depending on what services are hosted (you can post them in a comment for advice or refer to Black Viper’s guides), you can try disabling them to see if it continues after rebooting.

Answer 2

The easiest way is to just run an antivirus scan; you can't really know how many files have been infected so deleting them yourself might be problematic. It should pick up and quarantine all the infected files.

You can find quite a few good free antivirus applications, such as Microsoft Security Essentials or avast!

Answer 3

An alternative to installing several antiviruses is online scan.

Some that I like are Trend Micro House Call, Kaspersky Labs Free Virus Scan and Panda. Please note that each takes some hours to complete and that they might require you to use Internet Explorer as your browser

Also some anti-adware software scans would be useful, such as ad-aware and spybot.

Answer 4

winulty is not detected up by ad-aware, spybot, AVG. The best way to get rid of it is with a Trojan detector, such as Trojan-Remover that lets you test-drive it for 30 days. I have encountered this virus this week and in October of last year, and my wife got one last week and I found another on her machine today.

Answer 5

You are best to use a bootable AV CD, boot from it and scan the drive while the OS is offline, then use MBAM or other scanner after you boot back into windows to finish the cleanup.

Bootable AV CD http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

MBAM http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

.