Latest News Latest News

Critical Unpatched VMware Flaw Affects Multiple Corporates Products

VMware has released temporary workarounds to address a critical vulnerability in its products that could be exploited by an attacker to take control of an affected system.

Read More...

Microsoft Releases Windows Security Updates For Critical Flaws

Microsoft formally released fixes for 112 newly discovered security vulnerabilities as part of its November 2020 Patch Tuesday, including an actively exploited zero-day.

Read More...

Researcher Discloses Critical RCE Flaws In Cisco Security Manager

Cisco has published multiple security advisories concerning critical flaws in Cisco Security Manager (CSM) a week after the networking equipment maker quietly released patches with version 4.22 of the platform.

Read More...

Cisco warns of actively exploited IOS XR zero-days

Cisco warned on Saturday about two zero-day vulnerability impacting the Internetwork Operating System (IOS) that ships with its networking equipment.

Read More...

New Chrome 0-day Under Active Attacks – Update Your Browser Now

Attention readers, if you are using Google Chrome browser on your Windows, Mac, or Linux computers, you need to update your web browsing software immediately to the latest version Google released earlier today.

Read More...

Google Warns of Zero-Click Bluetooth Flaws in Linux-based Devices

Google security researchers are warning of a new set of zero-click vulnerabilities in the Linux Bluetooth software stack that can allow a nearby unauthenticated, remote attacker to execute arbitrary code with kernel privileges on vulnerable devices.

Read More...

India Witnessed Spike in Cyber Attacks Amidst Covid-19 - Here's Why?

The COVID-19 outreach is turning out to be not only health, social, and economic hazard but also a cybersecurity crisis. The pandemic has presented new challenges for businesses in the areas of remote collaboration and business continuity.

Read More...

FIN11 Hackers Spotted Using New Techniques In Ransomware Attacks

A financially-motivated threat actor known for its malware distribution campaigns has evolved its tactics to focus on ransomware and extortion. "Recent FIN11 intrusions have most commonly led to data theft, extortion and the disruption of victim networks via the distribution of CLOP ransomware".

Read More...

Microsoft Releases Patches For Critical Windows TCP/IP and Other Bugs

Microsoft on Tuesday issued fixes for 87 newly discovered security vulnerabilities as part of its October 2020 Patch Tuesday, including two critical remote code execution (RCE) flaws in Windows TCP/IP stack and Microsoft Outlook.

Read More...

Watch Out — Microsoft Warns Android Users About A New Ransomware

Microsoft has warned about a new strain of mobile ransomware that takes advantage of incoming call notifications and Android's Home button to lock the device behind a ransom note.

Read More...

Contact Us Contact Us

Free Call[OH]: 933

Phone Number: +251-993939270,

                            +251-936825343,

                            +251-944-33-68-02

E-mail: ethiocert@insa.gov.et

P.O.Box: 124498

Download PGP Keys


Report an Incident

Tool Tool

Back

Shortcut Virus Removal

Shortcut Virus Removal tool

Malware description

The malware has different names but they all start with "cc" and has extension of one of the following.

       i.  .exe

      ii.  .pif

     iii.  .cmd

     iv.  .com

     v.  .scr

    vi.  .bat

It hides contents of removable drives and creates a shortcut and sets its name as target of the shortcut. It creates a hidden nameless folder and then moves all the removable drive contents in to the nameless folder. It always stays on memory and detects when a removable media is inserted.

It copies itself on to temp directory and creates registry value to enable automatic startup of the malware when computer starts.

It also communicates with other malicious servers and sites around the world to download and spread more malware.

Removal method

Manual

  • Start task manager
  • Find one of the following two processes (if they are running) under explorer.exe process and then kill (terminate) the process. 

                    -  Wuauclt.exe (for 32 bit windows)

                    -  Svchost.exe (for 64 bit windows)

  • Checkthe current "user account" name and then use it as Userprofile on the next step also, Check the "all users account" name and then use it as Allusersprofile on the next step
  • Check paths of registry keys (Userprofile\local settings\Temp or Allusersprofile\local settings\Temp) and look for malware path value. (\local settings\temp\cc(variable_name).(exe, com, cmd, scr, pif, bat)
  • Go to the malware path and delete it

Using shortcut removal tool

About Shortcut removal tool

  • Developed using C
  • It first checks whether the processes (\windows\system32\wuauclt.exe or \windows\syswow64\svchost.exe) are running and infected. It does this by retrieving the load address of the process on the memory and check the PUSHfollowed by RET signature, If found it will kill the infected process.
  • Then opens the registry key values (Userprofile\local settings\Temp or Allusersprofile\local settings\Temp) and checks "\local settings\Temp" is present on the path. Also checks "cc" is present on the name of the file from the path value and the extension is one of (exe, com, cmd, pif, scr,bat). If case is matched, it will delete the malware and then correct the registry settings or removes the value entry from registry

ScreentShots

 

 


Values Values

  • Trustworthiness
  • Innovation
  • Scientific
  • Democracy
  • Synergy
  • Saving