Cleaning up after the WMF exploit
OK, I mentioned that I infested a virtual machine with the current WMF 0-day exploit. First I should probably clarify. An exploit is a means of getting in to a system. The payload is the software that is installed. In the case of my experience there was a long list of pests installed. Given that the exploit enables any software to be installed, your experience may be different. That’s the first thing I want to make clear, depending on where and when you were affected you may see vastly different malware.
The second thing I want to make clear is that the best solution for a badly infested system is to clean the hard drive and reinstall. Remote access trojans and keyloggers are many and varied and it’s entirely possible that many (or at least one) will be missed in the cleaning process. That much said, a cleaning of this image is what I did. (Although after I’m done looking at it, it will be replaced with it’s clean copy.)
The next series of articles will deal with the problems I ran into trying to clean the system. I’ll try to keep them in continuous order, but won’t be giving “part x” names for the most part. As we speak the image is booting up with full networking and I’m keeping an eye on it to so if it’s really clean. It appears that the infestation is over, but I don’t trust it yet.