After Action Report - W32.Rontokbro.Z@mm

After Action Report - W32.Rontokbro.Z@mm

20060408ST
1200-1400
1700-2030

Symptoms: Subject complained of the computer shutting itself down.

In most situations, auto restart on Windows XP is caused by the 'Restart after failure' option checked in the error settings of My Computer. This was found to be true, and was left for simplicity as subject does not know the Three Finger Salute.

The possibility of the root of the problem being a virus infection is very high as the Rontokbro virus is spreading across Malaysian universities and campuses. This virus prevents any attemps to clean it (except in Safe Mode) and lowers the overall security settings. It infects itself onto thumbdrives as well.

My first attempt to clean up the virus was to use the pre-installed Trend PC-cillin, only to find the virus definition fikle for it unupdated as the copy of anti-virus was illegal. I then proceeded to uninstall it and put AVG Anti-Virus in its place instead. The virus must have detected the process because as I attempted to update the definition file (for AVG), the computer restarted.

Instead of starting up normally, I went to Safe Mode only to find that the update process was not completed. Hoping for the best, I restarted the computer in normal mode. The update process went well, then I restarted the computer yet again for the clean up process in Safe Mode, as the virus masquaredes itself as importantn Windows Processes.

On its first run, AVG detected 28 viruses of which none was healed and 21 deleted. Since it is possible that several files escaped detection during the first run of the test, I restarted Windows and entered Safe Mode again. This round, 16 viruses were found and 12 healed. Attempts to access msconfig and regedit failed because the virus has locked both application.

I started the Microsoft System Recovery console and deleted several of the virus known file. This opens up the door to further clean the system. I downloaded regtmcmdrestore.vbs and showhiddenfiles.vbs from http://www.kellys-korner-xp.com/xp_tweaks.htm. This unlocks msconfig and regedit, and I was able to neutralise the virus more. The worse part is registry editing, since I basically have to navigate through a lot of stuff to get to the correct registry key.

I have run the sixth scan and I am pleased to say that the number of infected files has dwindled down to two. Both were deleted. Afterwards, I logged into the normal mode and ran a scan. No more anamolies detected. The system is cleaned.

I re-enabled System Restor and made a restore poin. I leave AVG Anti-Virus and Spybot Search & Destroy in place to ward off any further attempts, hopefully.

Infected/virus' files (may vary according to computer and infected users):
C:\Brengkolang.com
C:\Documents and Settings\Administrator\Local Settings\Application Data\csrss.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\inetinfo.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\services.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\smss.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\winlogon.exe
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\Empty.pif
C:\Documents and Settings\Administrator\Templates\Brengkolang.com
C:\Documents and Settings\NetworkService\Local Settings\Application Data\csrss.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\inetinfo.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\lsass.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\services.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\smss.exe
C:\Documents and Settings\NetworkService\Local Settings\Application Data\winlogon.exe
C:\Documents and Settings\NetworkService\Start Menu\Programs\Startup\Empty.pif
C:\WINDOWS\eksplorasi.exe
C:\WINDOWS\ShellNew\sempalong.exe
C:\WINDOWS\SHELLNEW\sempalong.exe
C:\WINDOWS\ShellNew\sempalong.exe
C:\WINDOWS\system32\Administrator's Setting.scr
C:\WINDOWS\system32\System's Setting.scr
C:\WINDOWS\system32\user's Setting.scr
F:\Data ADMINISTRATOR.exe
F:\Data USER.exe
F:\選�.exe

Resources:
http://www.symantec.com/region/jp/avcenter/venc/data/jp-w32.rontokbro.z@mm.html
http://www.compactbyte.com/brontok/ (Older version of Rontok)
http://daniwhy.blogs.friendster.com/daniwhy/2005/11/win32rontoxbro_.html (Older version of Rontok)
http://www.kellys-korner-xp.com/xp_tweaks.htm
http://vaksin.com/remove_rontokbro_n.htm
http://www.kaer-media.org/penawar-brontok/