Thursday, March 29, 2012

GEMA - Germany (Ransom Trojan) - 03.29.2012 - Analysis and Removal

 Once you are infected with GEMA, you will be prompted a white screen with text that reads:
"Please wait while the connection is beeing established."
and then the German translation...
Do not bother trying Safe Mode(s), they will not work. You need to boot using a CD or slave the hard drive to a working computer to remove one file and a few bad registry values.

I used Farbar's Recovery Scan Tool (FRST) for this.
 Here are the items that need fixing:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\K3aRyluP6SiCkoR Value deleted successfully.
HKEY_USERS\owner\Software\Microsoft\Windows\CurrentVersion\Run\\K3aRyluP6SiCkoR Value deleted successfully.
HKEY_USERS\owner\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableTaskMgr Value deleted successfully.
HKEY_USERS\owner\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DisableRegistryTools Value deleted successfully.
HKEY_USERS\owner\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit Value deleted successfully.
HKEY_USERS\owner\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit Value was restored.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value was restored.
C:\Documents and Settings\owner\Application Data\flint4ytw.exe moved successfully.
The tool does not fix everything that needs to be corrected, but from here you can at least open Explorer again and the Please wait while the connection is beeing established screen is gone.

Even though you are still somewhat limited due to no desktop icons, you will be able to launch Windows Explorer so you can launch Malwarebytes' Anti-Malware.

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
Even after MBAM repaired this item and I rebooted, I was still missing my desktop icons.

I simply right-mouse clicked anywhere on the desktop and selected "Show Desktop Icons".
After that, everything was back to normal :-)
Misc notes:
You will be unable to right-mouse click the desktop and receive the pop-up menu until the above policy (NoDesktop) is fixed.

Update: April 28th, 2012 || file name is changed to ram_reserver64.exe (VirusTotal) Same location as listed above.

Update: May 5th, 2012 || file name is changed to itunes_service01.exe (VirusTotal) Same location as listed above.

Update: May 5th, 2012 || file name is changed to itunes_service86.exe (MajorGeeks) Same location as listed above.

Update: May 15th, 2012 || file name is changed to BSI.bund.exe (VirusTotal . MajorGeeks) Same location as listed above.

No comments:

Post a Comment