McAfee Releases Free Tool That Removes Pinkslipbot Leftovers That Use Your PC as Proxy

Last week, McAfee released a tool named AmIPinkC2, a Windows command-line application that removes remnant files of Pinkslipbot infections that allow the malware to continue to use previously infected computers as proxy relays, even if the original malware's binary has been cleaned and removed from infected hosts.

The malware in question is Pinkslipbot, a banking trojan that appeared in 2007 and is also tracked under three other names, such as Qakbot, Qbot, and PinkSlip.

http://www.mcafee.com/activate

Pinkslipbot is a well-known and dangerous threat

Pinkslipbot is a well-known threat on the malware landscape, mainly due to its specific targeting. Its authors aren't going after regular users, but have historically targeted North American companies, especially those in lucrative industry sectors, such as corporate banking, financial institutions, treasury services, and others.

This banking trojan isn't always active, and it keeps coming back in waves, as part of very well-planed campaigns. In the past years, numerous cyber-security companies have tracked its attacks and broken down its different versions [1, 2, 3, 4, 5, 6, 7, 8, 9, 10].

mcafee.com/activate

The most recent campaign was spotted by IBM security researchers, who noticed Pinkslipbot versions that caused Active Directory lockouts on infected computers.

McAfee finds new wrinkle in Pinkslipbot infections

One of the companies that have historically tracked Pinkslipbot campaigns is McAfee. Its researchers presented an analysis of the trojan's C&C server infrastructure and its method C&C communications at last year's Virus Bulletin security conference.

Last week, while looking over past and present Pinkslipbot campaigns, researchers found a new wrinkle in the trojan's mode of operation.

McAfee Activate

Researchers say Pinkslipbot authors are much clever than they initially thought. According to McAfee, besides stealing the user's  data, the banking trojan also uses infected hosts as proxy servers to relay information from the central C&C server to other infected hosts, in a mesh-like network.

New McAfee tool removes last remnants of Pinkslipbot infections

According to McAfee, most security tools remove only the malware's main binaries, crippling the trojan's ability to collect passwords from infected hosts.

These Pinkslipbot removal procedures leave intact the code that creates these proxy servers, which run via the Windows UPnP (Universal Plug and Play) service.

McAfee's new tool will remove these remaining files and prevent Pinkslipbot from using users' PCs to relay C&C commands or to hide the exfiltration of stolen data through a mesh of proxies.

Get More Help- Redeem McAfee Retail Card