Member Avatar for kc0arf

Hello,

At work, I am seeing three new variants of deviant behavior on our network. The machines are Windows 2000 and XP Pro, and they are patched to recent patch levels. Norton Antivirus does not detect these viruses, and the internet is really skimpy on details.

SYSTESM32.EXE
-- yes it is spelled correctly
-- found several times with regedit, but only in safe mode
-- prevents regedit and task manager from staying open
-- floods the network trying to re-infect (I did not sniff, no tech detail)
-- Had to use Procview from www.prcview.com to kill this in normal mode
-- was infected on Sept 28, so is new to us
-- Key name is Winsock, and the value is systesm32.exe
-- Was able to kill it off booting into safe mode, and scanning registry.

BLING.EXE and UPDATES32.EXE
-- both are worms found in regedit using the key name "psYko"
-- floods the network trying to re-infect (I did not sniff, so no tech detail)
-- UPDATES32.EXE "harder" to remove. Has survived a few reboots
-- need to boot to safe mode to remove from registry and kill off exe file
-- Read Microsoft KB 296405 and 246261.
-- We are testing RestrictAnonymous at level 2
-- Usually 3 to 4 instances of files in the registry.
-- Can be seen in Computer Management, under shared folder sessions. Look for the head without a username... that is an anonymous connection.


If others have any other information to add, please post.

Christian

  • 2 Contributors
  • 2 Replies
  • 263 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by Gothmog

Dani AI

Generated

Useful follow-up for the admins here (notes for and and anyone hitting the same symptoms):

These filenames (Bling.exe / Updates32.exe and variants placed in System32) are commonly used by IRC/backdoor bot families that spread via network shares and drop autorun registry entries — that matches what you describe. Network floods and many short-lived process instances are typical for those families. (bleepingcomputer.com)

Immediate containment / triage: isolate affected machines (physically or via VLAN/firewall) before doing further cleanup, and preserve logs and memory if you need a later forensic review — don’t keep them live on the same flat network. Run the Windows session/file checks from an elevated prompt to find anonymous/null sessions and open remote files. Example commands to start with:

net session
net file
netstat -ano | find ":5555"

Use these to identify which remote hosts are connected or which PID is speaking on an unusual port. (pubhtml5.com)

Local cleanup workflow (safe mode + tooling): use Sysinternals Autoruns to find and remove all suspicious auto-start entries (hide MS entries first), use Process Explorer to inspect handles and kill processes that block regedit/Task Manager, and reset/inspect Winsock if the malware registered itself as an LSP: 

netsh winsock show catalog
netsh winsock reset
certutil -hashfile C:\Windows\System32\bling.exe SHA256

Collect the file hash and submit it to a multi-engine scanner (VirusTotal) or vendor submission if you need attribution; run an up-to-date offline rescue scanner if the file cannot be removed from the running OS. (learn.microsoft.com)

Prevention & follow-up: enforce strong share passwords / disable anonymous/null-session enumeration via the appropriate security option (or Group Policy), disable legacy SMBv1 where possible, push AV/EDR updates and consider re-imaging any host you cannot confidently disinfect. If this is an outbreak, follow an incident-response playbook (isolate, contain, eradicate, recover) and collect evidence for lessons learned. (support.microsoft.com)

If desired, supply one infected machine’s file hash and a short timeline of actions taken and I can suggest the next exact steps for removal or escalation.

Member Avatar for kc0arf

Update 10/3:

Starting to see the bling.exe registry value assigned to a new key name: Microsofts Updates.

It is possible to have two instances of Bling running... one of them under the psyko key, and the other on Microsofts Updates.

To kill it off, we have been going to safe mode, and killing the file's listings in the registry. We are also changing the RestrictAnonymous value from 0 to 2.

So far, we have not seen a re-infection when the value = 2.

Christian

Member Avatar for Gothmog

Yeah, I've been running into the 'updates32.exe' too on my network too.

This is the 1st post I've run across that references it, I'm glad I found it, kc0arf, I was beginning to think it was my imagination.

It's giving me fits. Haven't been able to successfully clean it off of any of the systems, I've been using 'HijackThis' and a few other tools, but I can't seem to kill it.

I'm going to give that 'RestrictAnonymous=2' thing a try now.

Any other info would be greatly appreciated.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.