Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

New ACCDFISA Protection Center ransomware called Malware Protection


  • Please log in to reply
189 replies to this topic

#1 Grinler

Grinler

    Bleep Bleep!


  • Admin
  • 40,187 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:15 PM

Posted 13 March 2012 - 12:09 PM

A new variant of the ACCDFISA Protection Center ransomware has been released called Malware Protection. The malware developers target Windows servers and appear to hack them in order to install the software. Once the Malware Protection ransomware is installed, it will lock you out of computer and create password-protected RAR archives out of your data that you can no longer access unless you pay a $300 ransom. When installed, the Malware Protection ransomware will scan your computer for all files using certain file extensions and will use the command line RAR program to turn them into a password protected RAR archive. These files will be renamed with the .aes extension and are supposed encrypted with the AES encryption. You will then be prompted to pay a ransom in order to get the decryption key to restore your files. The decryption key starts with aes987156 and then the password for the RAR files is appended to it. The decrypt.exe program will read through the list of encrypted files and extract them to the proper location using the RAR password. In the past version of this malware, there have been some cases reported that the decrypt process actually deleted the files, so once you have the RAR password it is suggested that you use a manual method restore the files. A manual method using a batch file can be found in the How to remove and decrypt the ACCDFISA Protection Program guide. The files that this infection installs can be found in the following locations:

C:\decrypt lock\decrypt.exe C:\how to decrypt aes files.lnk %System%\csrss32.exe %System%\csrss64.exe %System%\svschost.exe C:\security lock\svchost.exe C:\decrypt lock\decrypt.exe C:\ProgramData\system files\ntbavtnjs.bat C:\ProgramData\system files\vpkswnhisp.dll C:\ProgramData\mssupport\aes256crypter.exe

As these are 32-bit programs, if you are using an x64 version of Windows, they will be installed in the C:\Windows\SysWOW64 folder instead. This infection will also create a service with the Display Name User Profile Services and a Service Name of ProfSvcs. Some people have reported that they have found the aes256crypter.exe process running. This is a command line RAR program and if you see it running you may be able to launch Sysinternals Procmon and look for Process Start operation for one of the above files. Double-click that line and you can see the command line used to start it. If the process was for aes256crypter.exe, there is a good chance the password will be shown on that line. I hope this helps those of you struggling with this. If you have any other information to share, please let us know here.



BC AdBot (Login to Remove)

 


#2 nid15

nid15

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 13 March 2012 - 02:13 PM

Hello,

Thanks for all the tips. We have had a number of clients affected with both variants. All these clients had kaspersky installed! Does anyone know the source of these infections? Is it via email/web/RDP or manual?

Thanks
Nihar

#3 IT Enthusiast

IT Enthusiast

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:15 AM

Posted 13 March 2012 - 02:37 PM

Hi, my client got hit with this on Sunday. It has encrypted most of the file share data.

Do we have a full unlock password yet?

For the moment, it looks like I was able to remove the virus with malware removal software. (Not sure if I'm allowed to type the name here.)

What I'm left with is a server that can't run key services any longer, like Backup Exec, SQL services, MTA Stacks and others.

Email and internet are working once I changed the adapter to the right IP info.

Thanks.

#4 Grinler

Grinler

    Bleep Bleep!

  • Topic Starter

  • Admin
  • 40,187 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:15 PM

Posted 13 March 2012 - 03:16 PM

Yeah you can mention AV programs. Thanks for mentioning the IP address changes. I forgot to mention that in the original writeup.

There is no default unlock password as of yet.

#5 Grinler

Grinler

    Bleep Bleep!

  • Topic Starter

  • Admin
  • 40,187 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:15 PM

Posted 13 March 2012 - 03:51 PM

Maybe this is what has been exploited?

http://technet.microsoft.com/en-us/security/bulletin/ms12-020

#6 IT Enthusiast

IT Enthusiast

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:15 AM

Posted 13 March 2012 - 04:17 PM

SuperAntiSpyware seemed to clear the threats.

It's just now trying to deal with the aftermath of the encrypted files and the services that won't start.

#7 Grinler

Grinler

    Bleep Bleep!

  • Topic Starter

  • Admin
  • 40,187 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:15 PM

Posted 13 March 2012 - 07:55 PM

At this point I know of no universal rar password or a way to generate it. I have asked some people to further look at it. If i hear back I will let everyone know here.

#8 IT Enthusiast

IT Enthusiast

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:15 AM

Posted 14 March 2012 - 10:35 AM

Day 2 after running SuperAntiSpyware, the server seems to be clear of current threats.

I'm dealing with the aftermath of services not being able to start due to Data Execution Prevention errors.

The SQL Server (BKUPEXEC) service terminated with service-specific error 17113 (0x42D9).

In regards to no rar password, I had to install Backup Exec on a workstation (broken on server) and restore file share data to a USB drive...:( until I know the server is clear of malware.

#9 Grinler

Grinler

    Bleep Bleep!

  • Topic Starter

  • Admin
  • 40,187 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:15 PM

Posted 14 March 2012 - 10:40 AM

I know this sucks. We are still trying to figure this one out. Those who are infected, if you can, hold off on paying the ransom for a little bit while we work on this.

#10 Mattb7

Mattb7

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:15 AM

Posted 14 March 2012 - 10:57 AM

Does paying the ransom even work? I'm also on day 2 of this I really really dont want to have to rebuild this server.

#11 adamstotalit

adamstotalit

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:15 PM

Posted 14 March 2012 - 11:13 AM

As I posted in this thread (which it would seem has migrated here): http://www.bleepingcomputer.com/forums/topic446008.html

I've been working on this since Monday night. The decision was made to rebuild yesterday, and I currently sit here still trying to pull backup files from Carbonite. So here's your baseline of "what if I had just rebuilt from the get go?" The answer is, my customer is still production down. Carbonite definitely saved the day here, but their downloads come in chunks, so it's a slow recovery. This is a bad one.

One other plug for a total rebuild is that if you've physically partitioned your data (os files on the C:\ drive and data files on the D:\ drive), all you're really up against is a couple hours to reinstall the OS and setup whatever shares you had. Your data shouldn't be touched. Again, that only applies to a PHYSICAL partition different. (Mine was a PERCS100 software based Raid, so they were only virtual partitions, which were eaten alive by the rebuild.) That also doesn't address those whose files were actually encrypted.

I just don't understand how people can be so terrible...

#12 Mattb7

Mattb7

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:11:15 AM

Posted 14 March 2012 - 02:33 PM

im now stuck in a reboot loop on my server now. As of monday I was able to boot into safe mode after modifying the boot.ini file now I am no longer able to do even that. I can still boot to miniXP but that's it.

#13 IT Enthusiast

IT Enthusiast

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:15 AM

Posted 14 March 2012 - 02:50 PM

Just to add to my first post, I was able to delete the decrypt.exe file by booting off a Bart-PE CD with RAID drivers.
Once I deleted the decrypt.exe file, I was able to log into the server and run Super AntiSpyware to remove the malicious items.

#14 Grinler

Grinler

    Bleep Bleep!

  • Topic Starter

  • Admin
  • 40,187 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:15 PM

Posted 15 March 2012 - 10:06 AM

Good news! If you are still struggling with the encrypted files you can send me your reference # and I will be able to send you a password for your RAR files.

Thanks to Arief of Emsisoft for helping with this.

#15 tonyus

tonyus

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:15 AM

Posted 15 March 2012 - 10:26 AM

Please Help

Can you help me with the aes encryption password? What information do I need to provide?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users