What to remove by hand
Traces differ by variant, so treat this as a list to compare against, not a promise.
A Trend Micro analysis of one variant names these files, where %System% means the Windows system folder and %System Root% the drive root:
%System Root%\AUT0EXEC.BAT (with a zero in the name)
%System%\M5VBVM60.EXE
%System%\rund1132.exe
%System%\dllcache\Regedit32.com
%System%\dllcache\Shell32.com
%System%\dllchache.exe
%System Root%\(Read Me)Pendekar Blank.txt
The same analysis lists a folder %System%\dllchache (also spelled dllcache) holding a copy of msvbvm60.dll and decoy files named Empty.jpg, Blank.doc, Zero.txt, Hole.zip and Unoccupied.reg. Other write-ups add copies in the user’s application data folder and programs named after their folder, for example documents\documents.exe, on all drives, including USB drives and mapped network drives.
Autostart entries in that analysis:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, value Blank AntiViri
HKCU\Software\Microsoft\Windows\CurrentVersion\Run, values Secure64 and Secure32
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, value Userinit (an extra M5VBVM60.EXE after userinit.exe)
HKLM\SYSTEM\ControlSet001\Control\SafeBoot, value AlternateShell (changed from cmd.exe to AUT0EXEC.BAT)
Settings it changes, all under the Explorer key of the current user:
CabinetState, value FullPath set to 1
Advanced, value Hidden set to 1 (the default is 2)
Advanced, value HideFileExt set to 1
Advanced, value ShowSuperHidden set to 0
The worm also disables the Registry Editor and Folder Options, and the policy values behind that are reset by a clean up.
Reports mention a scheduled task for some variants, so check Task Scheduler for tasks you did not create.
We found no published browser extensions, hosts file lines, search engines or certificates tied to Brontok. Where a trace is not named, look in Settings, Apps, Installed apps, in Startup apps and in the Task Scheduler Library. Use the steps in this guide for the clicks, and do not edit the registry on a PC where the worm may still be running. Scan first.
