Srizbi rootkit removal instructions
FireEye researchers have tested and thus recommend the following steps for victims of Srizbi to remove the infection. Some basic level of expertise with Windows system administration is required to perform these steps. This material is provided "as is", with absolutely no warranty expressed or implied.
Note: These instructions have only been tested for Windows XP and Windows 2000. These instructions may not work for other Windows versions.
Step 1: Backup the system (recommended)
For Windows XP users,
we strongly recommend creating a System Restore point before starting this disinfection
process. System Restore can help users revert back all the changes to the system
in case something goes wrong (such as a random power loss). For more information on System Restore, please
refer to http://support.microsoft.com/kb/306084.
If system restore is
not yet enabled on your system, please follow the instructions here http://support.microsoft.com/kb/310405
Windows 2k (Professional and AS)
Unfortunately, the System Restore feature is not available in Windows 2000, so users must back up all of their important files using other tools before continuing the disinfection process.
Step 2-1: Start the
system in Safe Mode
Step 2-2: Verify Srizbi Infection
Once the infected
system is rebooted in Safe Mode, we can try to find some files created by Srizbi. One particular file to look for is
a batch (.bat) file, having content like the following:
del "C:\D7641A4046742F3294AD4600B15C5E20.exe"
if exist
"C:\D7641A4046742F3294AD4600B15C5E20.exe" goto abc
rmdir "C:\"
del "C:\DOCUME~1\worm\LOCALS~1\Temp\_it.bat"
Of the hundred+ samples
analyzed in FireEye labs, the file that Srizbi executed was in the root directory - C:\. A unique feature of this batch file is the string ":abc" at the beginning
of the file. Search for such a batch file on the system disk.
a)
Make
sure the "Show Hidden Files" option is enabled. If not, follow these
steps to turn it on:
b)
In
the "File Name" box, enter *.bat
c)
In
the "A word or phrase in the file" box (just below the name box), enter :abc
d)
You will also
need to tell Windows to search for hidden files and folders, by going to 'More
Advanced Options' in the lower part of the Search bar. Click it and check the
"Search the hidden files and folders option".
e)
Press
the "Search" button and wait to see if system can find any such files. Normally
this file only has 3 or 4 small characters in its name, similar to:
svs.bat
If the search finds
any such files on the Windows system drive, the system is almost certainly
infected by Srizbi for which our removal instructions below will help.
NOTE: If the
search fails to find such files, the system may be infected by another Srizbi variant which can hide its files even under Safe Mode. In this case, the user should boot from some other bootable media (like Knoppix) that can read the hard drive directly, as at that time the infected OS will not be able to hide the Srizbi infection. A later article will describe this in more detail.
Approach 1. System
Restore (Only available for Windows XP)
The
idea here is to locate a driver (.sys) and an executable (.exe) which was
created just before or after the creation of this .bat file (within a minute). In Windows we can search based on the creation dates.
a) Type *.sys, *.exe
as the file name for which to search.
b) Go to the
"When was it modified" option in the search bar. Check 'specify
dates', Select "Created Date". Now the type the same date when that
'bat' file was created, both in the “to” and “from” dates.
c) Press 'Search'. If
one or more .sys or .exe files are found , check the creation date for each
file. Files which were created just before the .bat are likely to be Srizbi
kernel level drivers and their backup binaries. For further confirmation, the
user can submit these .sys and .exe files to their AV, or better yet to many AV vendors at once at http://www.virustotal.com. Of course, you will need to be online to do this, so you may want to try to copy the files off by a USB stick or something similar.
Some of the random names for these files are like this:
vtprwlro.sys
jstxhtwt.sys
akjrjbj.exe
AKJBJRJR.exe
Most of the files seen by us have a size less than 200 KB.
d) Delete these .sys and
.exe files, then restart Windows in Normal mode.
e) After you restart, try to search for the .bat again with the same criteria as in Step 2-2. If the search finds the file successfully, it means that the rootkit is uninstalled successfully. This bat is harmless now; you can simply remove it. If it does not appear, but it did in same mode, you may to format and reinstall Windows to be sure you are not infected.
Atif Mushtaq, Haroon W Malik @ FireEye Malware Intelligence Labs
Comments/Questions to research@fireeye.com
Comments