Virus Cleaning Tool - av.exe - v0.5

ripdad · March 11, 2010

av.exe is a rogue anti-virus. it has infected a ton of computers in the last few weeks.

many websites that are infected with it - comes through java with your web browser.

first attempts to deal with the virus by most, ended up in failure, mainly because one

can delete the virus, but not know how to deal with the mess it left behind. it has

manifested itself in many different forms over the past year. do a search for it on

yahoo or google - you'll see what i mean.

Not sure why -- but most Legit Anti-Viruses are not detecting it. The only one

that has attempted to do so is --> http://www.malwarebytes.org

Do a check on Norton Anti-Virus Forum and you'll see how upset their customers are.

They range from home users to Corporate IT's. Something's wrong with this picture!

* symptoms are a half dozen popups that want to sell you their fake product.

* if you kill it in task manager -- then delete it -- you can't start anything,

except to right-click on a file and left-click "start" (something that shouldn't be)

* Firewall and Anti-Virus OverRide

* Firewall and Anti-Virus Disabled

* Internet Settings Changed to Include Virus Startup on IE and FF

* Is NOT in the RUN keys - executes when you click on any program via shell

This program attempts to reverse most variants (not all - still a work in progress) of this virus.

every week another variant of this virus is released. you might have to modify it as this happens.

anyone is welcome to help develop this program - because, it will only get worse.

i've only tested it on XP-sp2. Would someone be willing to test it on Win7 and Vista? TIA!

If you decide to test on another OS - hopefully it will be in a virtual environment.

I've tested this code many times and it works like it's suppose to in XP.

If you want to nit-pik at the code -- have at it! I need it double-checked anyways!

Usual Disclaimer: Use At Your Own Risk!

Executable is at this link

; Virus Cleaning Tool - av.exe, ave.exe - v0.5
; Released: April 19, 2010 - by ripdad
;
If Not (@OSVersion = 'WIN_XP') Then
    MsgBox(16, 'Virus Cleaning Tool - av.exe', 'This Program has only been tested on Windows XP' & @CRLF & @CRLF & 'Click OK to Exit', 15)
    Exit
EndIf
;
Local $answer = MsgBox(4, 'Virus Cleaning Tool - av.exe', 'Kill and Clean "av.exe virus" ?')
If $answer = 7 Then Exit
;
; [ - Target Virus Files - ]
Local $Virus1 = 'av.exe'
Local $Virus2 = 'ave.exe'
Local $VSFile1 = 'WRblt8464P'
Local $VSFile2 = 'T115idJ1tP4Dl'
;
; [- Target Registry Mainkey and Subkeys -]
Local $TargetMainkey = 'HKU'
Local $TargetSubKey1 = '.exe'
Local $TargetSubKey2 = 'secfile'
Local $TargetSubKey3 = '\Software\Microsoft\Windows\CurrentVersion\Policies\System'
Local $TargetSubKey3Value = 'DisableTaskMgr'
;
; [- Set Defaults -]
Global $Virus = ''
Local $VirusPath = ''
Local $VSFile = ''
Local $count1 = 1
Local $count2 = 1
Local $count3 = 1
Local $count4 = 1
;
; Check if virus is active
If ProcessExists($Virus1) Then $Virus = $Virus1; primary virus
If ProcessExists($Virus2) Then $Virus = $Virus2; alias-1
;
Select
    Case ($Virus = ''); If $Virus equals null (empty string)
        $answer = MsgBox(4, 'Virus Cleaning Tool - av.exe', 'The virus is Not Active' & @CRLF & @CRLF & 'Continue with Cleaning Registry?')
        If $answer = 7 Then Exit
    Case Else; Get the Necessary Information on Variant
        $ProcessPath = _ProcessGetPath($Virus); Get full path with filename
        If $Virus = $Virus1 Then $VirusPath = StringTrimRight($ProcessPath, 6); primary virus path
        If $Virus = $Virus2 Then $VirusPath = StringTrimRight($ProcessPath, 7); alias-1 virus path
        If FileExists($VirusPath & $VSFile1) Then $VSFile = $VSFile1; "Virus Support File" Variant #1
        If FileExists($VirusPath & $VSFile2) Then $VSFile = $VSFile2; "Virus Support File" Variant #2
EndSelect
;
Local $Logfile = FileOpen(@DesktopDir & '\VCT-AV.log', 1)
Sleep(1000)
;
; Get an exact count of subkeys (every system is different)
Do
    $InitCount = RegEnumKey($TargetMainkey, $count1)
    If @error <> 0 Then ExitLoop
    $count1 += 1
Until @error
;
; We have the count - Now we can loop and search through the subkeys for matches and delete those affected
;
TrayTip('Virus Cleaning Tool - av.exe', 'Pre-Cleaning Registry', 5, 1); # Stage 1 #
Do
    $subkey1 = RegEnumKey($TargetMainkey, $count2)
    $count3 = 1
    $count4 = 1
    Do
        $subkey2 = RegEnumKey($TargetMainkey & '\' & $subkey1, $count3)
        If @error <> 0 Then ExitLoop
        If ($subkey2 = $TargetSubKey1) Or ($subkey2 = $TargetSubKey2) Then
            RegDelete($TargetMainkey & '\' & $subkey1 & '\' & $subkey2); Delete Matched Keys
            FileWriteLine($Logfile, 'DELETED: ' & $TargetMainkey & '\' & $subkey1 & '\' & $subkey2); and Log it
        EndIf
        $count3 += 1
    Until @error
    Do
        $rev = RegEnumVal($TargetMainkey & '\' & $subkey1 & $TargetSubKey3, $count4)
        If @error <> 0 Then ExitLoop
        If $rev = $TargetSubKey3Value Then
            RegDelete($TargetMainkey & '\' & $subkey1 & $TargetSubKey3, $rev); Delete Matched Valuename
            FileWriteLine($Logfile, 'DELETED: ' & $TargetSubKey3Value); and Log it
        EndIf
        $count4 += 1
    Until @error
    $count2 += 1
Until $count2 = $count1
Sleep(1000)
;
$PID = ProcessExists($Virus)
;
; Terminate the Virus if Active - (if not active, then skips this stage and goes to Stage 3)
If $PID Then
    TrayTip('Virus Cleaning Tool - av.exe', 'Terminating Virus', 15, 1); # Stage 2 #
    ProcessClose($PID); Kill Virus Process
    Sleep(1000)
    $attrib = ('attrib -s -h -r ' & '"' & $ProcessPath & '"')
    Run(@ComSpec & ' /c ' & $attrib, '', @SW_HIDE); Remove Attributes
    Sleep(2000)
    If FileExists($ProcessPath) Then FileMove($ProcessPath, $ProcessPath & '.bak', 1); Rename in Case Fail
    Sleep(2000)
    If FileExists($ProcessPath & '.bak') Then FileDelete($ProcessPath & '.bak'); Delete if Not Locked
    Sleep(1000)
    If Not FileExists($ProcessPath) Then
        If Not FileExists($ProcessPath & '.bak') Then FileWriteLine($Logfile, 'DELETED VIRUS: ' & $ProcessPath); Check if Deleted and Log it
    EndIf
    If FileExists($ProcessPath & '.bak') Then FileWriteLine($Logfile, 'RENAMED VIRUS: ' & $ProcessPath & '.bak'); Should Not Happen - But Just In Case
    If FileExists($ProcessPath) Then FileWriteLine($Logfile, 'RENAME FAILED - DELETE FAILED: ' & $ProcessPath); Should Not Happen - But Just In Case
    Sleep(1000)
    If ProcessExists($VSFile) Then ProcessClose($VSFile); Kill "Virus Support File" if Active
    Sleep(1000)
    If ($VSFile = '') Then
    Else
        If FileExists($VirusPath & $VSFile) Then
            $attrib = ('attrib -s -h -r ' & '"' & $VirusPath & $VSFile & '"')
            Run(@ComSpec & ' /c ' & $attrib, '', @SW_HIDE); Remove Attributes
            Sleep(2000)
            FileMove($VirusPath & $VSFile, $VirusPath & $VSFile & '.bak', 1); Rename in Case Fail
            Sleep(2000)
            FileDelete($VirusPath & $VSFile & '.bak'); Delete if Not Locked
            Sleep(1000)
            If Not FileExists($VirusPath & $VSFile & '.bak') Then FileWriteLine($Logfile, 'DELETED VSF: ' & $VirusPath & $VSFile)
            If FileExists($VirusPath & $VSFile & '.bak') Then FileWriteLine($Logfile, 'RENAMED VSF: ' & $VirusPath & $VSFile & '.bak')
        EndIf
    EndIf
EndIf
;
; Directly Restore Windows Default Settings in Registry
Sleep(1000)
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring: AntiVirusOverride', 5, 1); # Stage 3 #
Sleep(1000)
RegWrite('HKLM\SOFTWARE\Microsoft\Security Center', 'AntiVirusOverride', 'REG_DWORD', '0')
FileWriteLine($Logfile, 'Restored: AntiVirusOverride')
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring: FirewallOverride', 5, 1)
Sleep(1000)
RegWrite('HKLM\SOFTWARE\Microsoft\Security Center', 'FirewallOverride', 'REG_DWORD', '0')
FileWriteLine($Logfile, 'Restored: FirewallOverride')
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring: FireWallAutoStart', 5, 1)
Sleep(1000)
RegWrite('HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess', 'Start', 'REG_DWORD', '2')
FileWriteLine($Logfile, 'Restored: FireWallAutoStart')
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring: EnableFirewall', 5, 1)
Sleep(1000)
RegWrite('HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile', 'EnableFirewall', 'REG_DWORD', '1')
FileWriteLine($Logfile, 'Restored: EnableFirewall')
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring: StartMenuInternet\FIREFOX.EXE', 5, 1)
Sleep(1000)
RegWrite('HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command', '', 'REG_SZ', '"' & @ProgramFilesDir & '\Mozilla Firefox\firefox.exe"')
FileWriteLine($Logfile, 'Restored: StartMenuInternet\FIREFOX.EXE')
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring: StartMenuInternet\FIREFOX.EXE -safe-mode', 5, 1)
Sleep(1000)
RegWrite('HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command', '', 'REG_SZ', '"' & @ProgramFilesDir & '\Mozilla Firefox\firefox.exe" -safe-mode')
FileWriteLine($Logfile, 'Restored: StartMenuInternet\FIREFOX.EXE -safe-mode')
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring: StartMenuInternet\IEXPLORE.EXE', 5, 1)
Sleep(1000)
RegWrite('HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command', '', 'REG_SZ', '"' & @ProgramFilesDir & '\Internet Explorer\iexplore.exe"')
FileWriteLine($Logfile, 'Restored: StartMenuInternet\IEXPLORE.EXE')
TrayTip('Virus Cleaning Tool - av.exe', 'Restoring Done', 5, 1)
Sleep(1000)
FileClose($Logfile)
TrayTip('', '', 5)
MsgBox(64, 'Virus Cleaning Tool - av.exe', ' - Finished - ' & @CRLF & @CRLF & 'VCT-AV.log is on Your Desktop' & @CRLF & @CRLF & 'Please Restart Your Computer', 30)
Exit; All Done
;
; Some Code I Borrowed! - Not Sure Where? - Thanks!
Func _ProcessGetPath($PID)
    If IsString($PID) Then $PID = ProcessExists($PID)
    $Path = DllStructCreate('char[1000]')
    $dll = DllOpen('Kernel32.dll')
    $handle = DllCall($dll, 'int', 'OpenProcess', 'dword', 0x0400 + 0x0010, 'int', 0, 'dword', $PID)
    $ret = DllCall('Psapi.dll', 'long', 'GetModuleFileNameEx', 'long', $handle[0], 'int', 0, 'ptr', DllStructGetPtr($Path), 'long', DllStructGetSize($Path))
    $ret = DllCall($dll, 'int', 'CloseHandle', 'hwnd', $handle[0])
    DllClose($dll)
    Return DllStructGetData($Path, 1)
EndFunc
;

v0.2

1. corrected "c:\program files" to @ProgramFilesDir

2. corrected valuename (Default) access to blank string ""

v0.3

1. added Restore Task Manager

2. added Code for another variant

3. added File Attributes Removal

v0.4 Updated to include "ave.exe" alias

v0.5 Updated Made a few code improvements and fixed a minor issue

Notice: I'm finished with updating this particular code - check website for details

I will leave this one here as an example.

Edited April 21, 2010 by ripdad

nugame · March 11, 2010

I am a consultant and work with people on computers. I have experienced this pesky one many times. I have been able to remove if worked on early enough. I have seen the extent of the damage. I would like to work with you on this. I have xp, vista, 7, 2003, and 2003. I have client to see this Friday with this same problem.

Virus Cleaning Utility - av.exe - v0.1

av.exe is a rouge anti-virus. it has infected a ton of computers in the last few weeks.