Perwall.*, Worm_Autorun.Buk, SillyFDC virus, Global.exe, …

Virus again!

I got stress with it, especically it was “This computer is being attacked” virus that i faced once, the same machine, the same user, :( . But now I can kill it manually.

First, her PC always show up by Symantec Anti Virus that “C:\Windows\Cursors\boom.vbs” contain a virus named SillyFDC, but can not clean, it counting up and up ,..

I start with googling “C:\Windows\Cursors\boom.vbs” and find some Chinese sites talking about it. I’m reading …. and BOOM! the fucking flying windows appear when i tried to kill Global.exe in Task manager!

A lot of process named: Fonts.exe, Global.exe, Svchost.exe in task manager!

:( Logging off, I continue searching by my pc, and luckily it has solution to remove this: It is HERE – Yes, it’s Chinese, and a little bit different from the one i have – may be a new variant.

Panda Security can detect Perwall.A which is similar, but file size is 225,280 bytes. It is same with Worm Autorun.BUK detected by TrendMicro. I’m sure that i face a new variant/verson of its.

Here is how to remove it manually:

STEP 1: - Seach and delete the below files, it SHOULD BETTER DONE by another PC and map the infected drives using Total Commander:

1.a. autorun.inf and MS_DOS.COM at root folder of each drives. And NOTED its size: mine is 233472 bytes

C:\autorun.inf, C:\MS-DOS.com

D:\autorun.inf, D:\MS-DOS.com

…

1.b. Search all file in harddrive has same size as 1.a  (233472 bytes) and delete if you think it’s doubtful, don;t worry it’s easy and you may delete most of them. Here are somes:

c:\windows\fonts\font.exe
c:\windows\system32\drivers\drivers.cab.exe
c:\windows\Media\rndll32.pif
c:\windows\system\KEYBOARD.exe
c:\windows\pchealth\binaries\HelpHost.com

c:\windows\pchealth\Global.exe

C:\WINDOWS\system32\dllcache\Recycler.(645FF040-5081-101B-9F08-00AA002F954E)\system.exe
…

1.c Serach again all files have 233472 bytes size to make sure that you don’t miss any one.

STEP 2: Remove Registry Items – Also should run remotely from another machine:

Browsing HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options go through its one by one subkeys to delete if you found anykey that has pointed to files that located as step1. Here are somes:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options
<auto.exe> <C:\WINDOWS\system32\drivers\drivers.cab.exe> <auto.exe> <C:\WINDOWS\system32\drivers\drivers.cab.exe>

<autorun.exe> <C:\WINDOWS\system32\drivers\drivers.cab.exe> <autorun.exe> <C:\WINDOWS\system32\drivers\drivers.cab.exe>

<autoruns.exe> <C:\WINDOWS\system32\drivers\drivers.cab.exe> <autoruns.exe> <C:\WINDOWS\system32\drivers\drivers.cab.exe>

<boot.exe> <C:\WINDOWS\Fonts\fonts.exe> <boot.exe> <C:\WINDOWS\Fonts\fonts.exe>

<ctfmon.exe> <C:\WINDOWS\Fonts\Fonts.exe> <ctfmon.exe> <C:\WINDOWS\Fonts\Fonts.exe>

<msconfig.exe> <C:\WINDOWS\Media\rndll32.pif> <msconfig.exe> <C:\WINDOWS\Media\rndll32.pif>

<ProcessManager.exe> <C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com>

<ProcessManager.exe> <C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com>

<procexp.exe> <C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com> <procexp.exe> <C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com>

<rundll32.exe> <C:\WINDOWS\Fonts\Fonts.exe> <rundll32.exe> <C:\WINDOWS\Fonts\Fonts.exe>

<taskmgr.exe> <C:\WINDOWS\Fonts\tskmgr.exe> <taskmgr.exe> <C:\WINDOWS\Fonts\tskmgr.exe>

…

OK, You can restart that PC. It should remove that virus.

This is one virus that I’ve ever remove manullay with a lot of searches and deletes from files to registry