If you have any additional information regarding this virus, please contact us. Contents: Latest update: |
2003 July: We were informed about a virus that was packaged using our freeware tool GSfx Wizard. This virus seems to cause several different problems to Windows users whom computers are infected by this virus: until anti-virus software companies update their signatures, you can find how to remove it below. Some user reports: "GSfx archive C:\winnt\system32\sys data\sys folders\klsys.exe." << I am receiving a error on my computer with "GSfx
Archive" in the title bar. The message reads "Error C:\WINNT\system32\sys data\sys
folders\klsys.exe". The error occurs again and again, but initially upon
start-up. >>
First a folder called "sys data\sys folders" is not an "official" folder in
Windows, and we don't think that software engineers are going to store files in
the System32 directory, as it is reserved for shared files.
The malicious user created a virus that contains several component and files, and to distribute it over the Internet, he used GSfx to compress all of the virus files into a single executable file that he could distribute to his victims. Thanks to an user who sent us the GSfx package file that contains the file, we could analyse it: Size: 734368 bytes. the PE executable file contains the following version information (you can access it using Windows Explorer: select the file, right click using the mouse button to access to the context menu and click on File Properties, then on the "Version" tab):
You can open the .exe file using 7-Zip, WinZip or WinRAR like any regular Self-Extracting (SFX) archive. The contents of the GSfx package file is:
We do not know what are the roles played by all of these files: what we only
know is taken from the analyse of the GSfx package file. 1) extract all of its files to %SYSTEM%\sys data\sys folders (%SYSTEM% designates the Windows System folder, like C:\WINNT\system32\ or C:\Windows\System on W9X/WME).
2) run klsys.exe. The klsys.exe seems to be the program that initializes the virus components. According to Panda software, this is the main file of the worm. This file is an IRC client that runs hidden. It is used to spread via IRC, using NEXE.CPL as configuration file. And the fact that the "error occurs again and again, but initially upon start-up" seems to indicate that the malicious user created a program (one of the files extracted by the GSfx package file or an external one?) that adds an entry to the Windows Registry: the latter makes Windows run the GSfx package file in order to certainly ensure the Virus horse is installed each time the user logs on.
>>> Use an antivirus program:
Or if you don't have one: 1) klsys.exe may be running on your computer.
If you are unable to get rid of klsys.exe, then you need to exit Windows and log in the "safe mode", then you will be able to delete klsys.exe safely as Windows will not run it. 2) open REGEDIT (the tool that edits Windows registry keys). You will need to know how Windows registry works... Do a search for the entry "klsys.exe", you may find several entries. Look especially in this key:
klsys.exe should be listed in such a key because Windows runs klsys.exe each time at startup. Possible entries: >> Delete all entries pointing to klsys.exe as Windows may run this file. Some users reported these keys too: "HKEY_CLASSES_ROOT\ChatFile\DefaultIcon" and "HKEY_CLASSES_ROOT\ChatFile\Shell\open\command"
and "HKEY_CLASSES_ROOT\irc\DefaultIcon" and "HKEY_CLASSES_ROOT\irc\Shell\open\command"
and "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\DefaultIcon" and "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChatFile\Shell\open\command"
and "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\DefaultIcon" and "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\irc\Shell\open\command"
and
Now the virus should not be run at Windows startup anymore but... 3) we need to identify the GSfx package file on your computer. This GSfx package file installs klsys.exe and certainly the virus will create a copy of it somewhere on your system. In fact, some users reported that the virus was back even after they deleted "klsys.exe". Unfortunately the virus seems to copy the GSfx package file with a random filename. But it is always in three directories:
See this screen shot sent by a user who found 'ran.exe':
We received reports telling about files named "ran.exe", "hulkz.exe" that would be stored in the three directories as told above. Otherwise you will need to do a search on your computer: look for ".exe" files having the size "734368 bytes". If you find additional filenames, please send us these names by e-mail so we can publish them here. Note: the file rano.exe seems to be a worm called Cult and is part
of the virus. More information available at:
4) reboot your computer (if you was in safe mode, you can log in the normal mode). IMPORTANT: unfortunately this will not clear or repair the possible damages caused by the Virus. >> Possible damages due to the virus: << Our organization, [...], was hit very hard by the
virus. It seems to be a variation of the Randon virus (see below), which among
other things, scans port 445 and distributes itself through network shares,
looking to exploit administrator profiles with simple passwords. While the
primary user accounts have unique passwords, our administrative ones shared a
common simple password, and thus opened our workstations to the exploit. The
executable responsible for our situation seemed to be something named hulkz.exe.
This was not only placed in the root C: drive of the workstations, but often in
the winnt/system32 directory and other places as well. NT 4.0 systems seemed not
to be affected. Only our Windows 2000 boxes were infected.
>>
As soon as we get more information about this virus, we will publish them here. Do not hesitate to use an antivirus solution on your computer. There are several commercial ones with daily signatures updates, but also some free ones: visit Webattack for some listings (both shareware and freeware).
We really regret that some malicious users like this virus author decide to
use freeware programs to distribute their work. If you know any additional information about this virus, or if your
anti-virus is able to detect it, please
contact
us.
|
