BleepingComputer.com: desktoplayer.exe

Hello

I would like to know how I can remove this infection desktoplayer.exe because its so hard !
Which tools I can use ? I tried with OTLPE for remove files and ComboFix to replace infected system files but I was obliged to format my VM ^^

Thanks

Nico

I'm afraid I have very bad news.

That file is an indication of a serious viral infection known as Ramnit. For specific details about that file please refer to these threat assessments:

• Greatis Malware Analysis of DesktopLayer.exe
  
• Microsoft MPC Threat Research of DesktopLayer.exe

Win32/Ramnit.A / Win32/Ramnit.B are file infectors with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files. The infected .HTML or .HTM files may be detected as The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A or VBS/Generic. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.

-- Note: As with most malware infections, the threat name may be different depending on the anti-virus or anti-malware program which detected it. Each security vendor uses their own naming conventions to identify various types of malware.

• Understanding virus names
  
• Threat aliases for W32/Ramnit.a!35B43CB537D0
  
• Threat aliases for W32/Ramnit.a!5343A023502C

With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of damage can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies Worm:Win32/Ramnit.A with a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.

Ramnit is not effectively disinfectable, so your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. Security vendors that claim to be able to remove file infectors cannot guarantee that all traces of it will be removed as they may not find all the remnants. If something goes awry during the malware removal process there is always a risk the computer may become unstable or unbootable and you could loose access to all your data.

Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:

• When should I re-format? How should I reinstall?
  
• Where to draw the line? When to recommend a format and reinstall?

Quote

Backdoors and What They Mean to You

This is what Jesper M. Johansson at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.

Quote

Hello quietman7

Thanks for this perfect explanation ! If i understood, the formatting its the only solution ? Dr Web CureIT can disinfect system files ?

Regards,

Nico

This post has been edited by NicoDev: 22 October 2010 - 04:51 AM

I do not know of any security vendor who will guarantee complete removal of file infectors like Virut or Ramnit. Even vendors like Kaspersky say there is no guarantee that some files will not get corrupted during the disinfection process. In my experience, users may find their system performing better for a short time after attempted disinfection only to have it become progressively worst again as the malware continues to reinfect thousands of files. Some folks will try every tool or rescue disk they can find which eventually leaves the computer in an unbootable state as a result of futile attempts to repair critical system files and drivers. In the end most folks end up reformatting out of frustration after spending hours attempting to repair and remove the infected files.

This post has been edited by quietman7: 22 October 2010 - 06:40 AM

Ok thanks a lot !

Nico

Not a problem...I wish the information could have been more positive.

Not a problem it was my VirtualMachine who had this infection not my computer

NicoDev

This post has been edited by NicoDev: 23 October 2010 - 03:28 PM

Then I guess you can say it was a learning experience.

Tips to protect yourself against malware and reduce the potential for re-infection:

• Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

• Avoid gaming sites, porn sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, uTorrent). They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Porn sites can lead to the Trojan.Mebroot MBR rootkit and other dangerous malware. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

• P2P Software User Advisories
  
• Risks of File-Sharing Technology

• Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs install themselves and spread infections, read How Malware Spreads - How did I get infected.

• Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. To learn more about this risk, please read:

• When is AUTORUN.INF really an AUTORUN.INF?
  
• Nick Brown's blog: Memory stick worms
  
• USB-Based Malware Attacks
  
• Danger USB! Worm targets removable memory sticks

Many security experts recommend you disable Autorun as a method of prevention. Microsoft recommends doing the same.

Quote

Microsoft Security Advisory (967940): Update for Windows Autorun
How to Maximize the Malware Protection of Your Removable Drives

• Change all passwords: Anytime you encounter a malware infection on your computer, especially if that computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised and change passwords as a precaution in case an attacker was able to steal your information when the computer was infected. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.

• Security Resources from Microsoft:

• Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP
  
• Threats and Countermeasures: Security Settings in Windows Server 2008 and Windows Vista
  
• Microsoft Solutions for Security: The Antivirus Defense-in-Depth Guide

• Other Security Resources:

• Simple and easy ways to keep your computer safe and secure on the Internet
  
• Malware Prevention - Preventing Re-infection
  
• Hardening Windows Security - Part 1 & Part 2
  
• How to Stop 11 Hidden Security Threats
  
• Your Guide To Staying Safe Online

• Browser Security Resources:

• Configuring Internet Explorer for Practical Security and Privacy
  
• How to Secure Your Web Browser
  
• Safe Web practices - How to remain safe on the Internet
  
• Use Task Manager to close pop-up messages to safely exit malware attacks

• Finally, if you need to replace your anti-virus, firewall or need a reliable anti-malware scanner please refer to:

• Bleeping Computer's Freeware Replacements For Common Commercial Apps
  
• Bleeping Computer's List of Virus & Malware Resources

Hello

Yes It was a learning experience and I infect voluntarily my VM for study malwares ( files/folders create by them )

Thanks

Nico