{"id":51,"date":"2009-06-02T09:51:00","date_gmt":"2009-06-02T09:51:00","guid":{"rendered":"http:\/\/mayanktrivedi.net\/technotes\/2009\/06\/02\/mysterious-new-virus-spyware-grayware\/"},"modified":"2022-04-06T20:23:49","modified_gmt":"2022-04-06T20:23:49","slug":"mysterious-new-virus-spyware-grayware","status":"publish","type":"post","link":"http:\/\/mayanktrivedi.net\/technotes\/2009\/06\/02\/mysterious-new-virus-spyware-grayware\/","title":{"rendered":"Mysterious New Virus \/ Spyware \/ Grayware"},"content":{"rendered":"
Strange but true,<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
Yesterday I happen to identify a new virus \/ spyware \/ grayware that is interestingly a mysterious stuff. \u00a0I suddenly suspected something fishy on my machine and the initial diagonosis using Trend Micro revealed Nothing. \u00a0I restarted my machine and there while the processes were being started saw a new process – “Beast.Exe” being initiated.<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
Tried looking for beast.exe in the location where the process was getting triggered for, result – Nill.<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
Trend Micro, Symantec and McAfee, seemingly the leading AV don’t have any signatures for it. \u00a0Interesting isn’t that?<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
Well the steps followed then were –\u00a0<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
1. Used sysinternals Process Explorer to identify the processes running – Beast.exe was indeed running<\/span><\/span><\/span><\/div>\n
2. Location of Beast.exe was confirmed to be – C:DATAFILES, the entire tree being Hidden Directory and with misleading Folder Icons.<\/span><\/span><\/span><\/div>\n
3. Beast.Exe not visible at the Location, though is present and to unveil that I used – Simple File Shredder that I use to wipe the data (that was not a smart move, that was interestingly accidental discovery)<\/span><\/span><\/span><\/div>\n
4. Killed the Process using sysinternals Process Explorer\u00a0<\/span><\/span><\/span><\/div>\n
5. Wiped the traces of Beast.exe from the reported folder using Simple File Shredder.<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
Symptoms and impacts are something that I didn’t actually make note of, but a slight research on goolgle reveals that the it impacts the Microsoft Office Files and corrupts them. \u00a0Though I was working on some Excel Sheets when the incident happened, luckily they were opened from Outlook and were residing in the “temp” folder.<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
As stated above, it was interesting to not find any definition from the three leading AV product companies.<\/span><\/span><\/span><\/div>\n

<\/span><\/span><\/span><\/div>\n
<\/div>\n","protected":false},"excerpt":{"rendered":"

Strange but true, Yesterday I happen to identify a new virus \/ spyware \/ grayware that is interestingly a mysterious stuff. \u00a0I suddenly suspected something fishy on my machine and the initial diagonosis using Trend Micro revealed Nothing. \u00a0I restarted my machine and there while the processes were being started saw a new process – …<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,64,39,62],"tags":[],"class_list":["post-51","post","type-post","status-publish","format-standard","hentry","category-beast-exe","category-grayware","category-spyware","category-virus","entry entry-center"],"_links":{"self":[{"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/posts\/51","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/comments?post=51"}],"version-history":[{"count":1,"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/posts\/51\/revisions"}],"predecessor-version":[{"id":192,"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/posts\/51\/revisions\/192"}],"wp:attachment":[{"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/media?parent=51"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/categories?post=51"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/mayanktrivedi.net\/technotes\/wp-json\/wp\/v2\/tags?post=51"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}