{"id":4573,"date":"2011-06-20T10:51:54","date_gmt":"2011-06-20T16:51:54","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=4573"},"modified":"2018-01-30T13:21:33","modified_gmt":"2018-01-30T20:21:33","slug":"windows-troubles-killer-salvage-system-rogue-of-the-week","status":"publish","type":"post","link":"https://www.webroot.com/blog/2011\/06\/20\/windows-troubles-killer-salvage-system-rogue-of-the-week\/","title":{"rendered":"Windows Troubles Killer \/ Salvage System: Rogue of the Week"},"content":{"rendered":"

By Stephen Ham and Andrew Brandt<\/strong><\/p>\n

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"Windows<\/a>This week’s rogue, once again, mimics a system utility and not merely an antivirus product. Either way, the scam is the same: Convince the victim that their computer is broken, then coerce them to pay for useless snake oil.<\/p>\n

These rogue system utilities go by the names Windows Troubles Killer<\/strong> or Windows Salvage System<\/strong>; They are, for all intents and purposes, identical programs which have been “skinned” with different names. They actually appear to be a hybrid rogue, carefully blending a customized mix of malarkey<\/em> and baloney<\/em> into some sort of shenanigans smoothie. The program claims not only to be able to scan your computer for problems with software settings and other system optimization-sounding stuff, but also to perform some sort of check of your “Computer Safety” and “Network Security.” Oh yes, and there’s an antivirus component too, just to round out the complete package.<\/p>\n

All in all, it’s a fairly rudimentary rogue to remove (whether you choose to do it manually or use our software), but it performs some unique system modifications that disable some legitimate security software, turns off some important Windows features, mimics some of Microsoft’s own software, and generally acts as a nuisance while reducing the actual security level of an infected computer. I’ll detail those after the jump.
\n<\/p>\n

\"\"<\/a><\/p>\n

The software installs itself to the %appdata%Microsoft<\/strong> path, using a random, six-alphabetic-character filename.The icon looks like a wooden shipping crate…because there is no material known to humankind with a better reputation for strength, protection, and durability than wood<\/em>, amirite?<\/p>\n

\"\"<\/a><\/p>\n

Once installed, the rogue looks like yet another variation on the typical ransomware-type rogue app theme: It starts up with Windows, prevents the Desktop from loading, and only grants access to its “fix error” features if you pay for a license key.<\/p>\n

\"\"<\/a><\/p>\n

The Settings tab in the rogue’s user interface has some options which allows the victim to close the app temporarily and continue loading the Desktop. But just getting to the desktop doesn’t mean you’ll be able to do anything on the computer once you get there: The rogue prevents most Windows apps from loading, such as the Task Manager, Command Prompt, or Internet Explorer.<\/p>\n

\"\"<\/a><\/p>\n

For power users, the rogue also “detects” Microsoft’s Process Explorer<\/a> as malware, and suppressed or killed other manual removal or analysis apps like HijackThis<\/a>, Process Monitor<\/a>, TCPView<\/a>, or PEiD<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

The rogue also executes itself when you reboot into Windows’ Safe Mode, sadly with no loss in functionality. In fact, when you boot into Safe Mode, the rogue displays a handy little dialog box that explains (from the perspective of an illiterate malware clown) what Safe Mode is (even though the rogue refers to it as Safe Boot<\/strong>).<\/p>\n

\"\"<\/a><\/p>\n

The rogue also suppressed 3 other process viewers that I tried to use — Process Hacker<\/a>, PrcView, and NirSoft CurrProcess<\/a> — though it didn’t immediately suppress any of them like it did Process Explorer. Instead, the rogue allowed each process monitoring tool to run long enough until it was used to try to kill the rogue, then it tried to terminate the tool. NirSoft CurrProcess was able to kill the rogue’s process before the rogue could fight back, and the rogue did not automatically reload until Windows rebooted.<\/p>\n

In addition to actively suppressing analysis tools, the rogue also sets several so-called IFEO (image file execution options) keys in the Registry. When the debugger<\/strong> value is set in any IFEO key, it launches the filename specified in that debugger value instead of the program named in the key. While IFEO keys in general serve a valid purpose, they have been abused for years by rogues and password stealers that want to prevent certain antivirus products from starting up or functioning properly.<\/p>\n

\"\"<\/a><\/p>\n

IFEO keys are in the following location in the Registry:<\/p>\n

HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionimage file execution options(program name)<\/pre>\n
Among the programs targeted by the rogue’s IFEO keys were Avast Firewall, Avast Antivirus, Eset Smart Security, Windows Defender<\/strong> (the real one from Microsoft), and Microsoft Security Essentials<\/strong> (msascui.exe<\/strong> shown above). On an infected system, these programs would fail to start after a reboot, and you’d see svchost.exe<\/strong> start up momentarily and then quit — if you could get to the Task Manager. The rogue also terminates the Microsoft Malware Protection Service<\/strong> and the Windows Defender<\/strong> service (if present), then sets the services to disabled so they can’t restart after a reboot.<\/p>\n
\"\"<\/a><\/p>\n
In addition, the rogue sets the following keys that disable functionality on the system:<\/p>\n
HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem | enablelua<\/strong> | 0\r\nHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem | consentpromptbehavioradmin<\/strong> | 0\r\nHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem | consentpromptbehavioruser<\/strong> | 0\r\nHKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionsystemrestore | disablesr <\/strong>HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversioninternet settings | warnonhttpstohttpredirect<\/strong> | 0<\/pre>\n
These keys, when set as shown above, disable User Account Controls, turn off all the prompting that happens when you try to run a program that needs administrative access, disable the System Restore feature on the computer, and stops IE from warning you when you are entering data into a form that is being submitted to an unsecured HTTP Web site — for example, the order form for Trouble Killer\/Salvage System.\"Webroot<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
By Stephen Ham and Andrew Brandt This week’s rogue, once again, mimics a system utility and not merely an antivirus product. Either way, the scam is the same: Convince the victim that their computer is broken, then coerce them to pay for useless snake oil. These rogue system utilities go by the names Windows Troubles […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[4263,3453,8603,8601,8589,7823,8599,4193,4179,4893,8597,5827,8593,3467,3819,8595,8591,3471,3951,8605],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4573"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=4573"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4573\/revisions"}],"predecessor-version":[{"id":13304,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/4573\/revisions\/13304"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=4573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=4573"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=4573"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=4573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}