Sign Nebraska Terms of Use Agreement Now

Document type sign terms of use agreement nebraska now

all right welcome back to nikonos tech uh purpose of this video will be to cover the idle buddy service i buddy service aka bridal bottles um basically it's a notorious um new kind of uh revamp of a 2015 uh malware it's technically a rootkit also it's a trojan downloader slash dropper slash adware bitcoin miner it's kind of a lot of slashes anyway this isn't notoriously hard to remove for a lot of my viewers even people using a transcript often seen that it's difficult to remove anyway i have a one of my viewers in my discord community who happens to have the ibuddy service and has volunteered to let me fix the machine and so in turn i'm going to take this opportunity to show you how you can remove it yourself and so we're going to go dig right right into this as you can see right here let me zoom out for you here as you can see right here the ibuddy service is showing up in the task manager sometimes you'll see it in add remove programs but in this case it's not there's about four different variants that i've seen with this one sometimes you'll see the ibuddy service sometimes you see idle buddy service sometimes you see nothing because this has a lot of stealth tech in it so the tools that we're going to use and i'll see you'll see the link in description i've already downloaded here and we get them from leavingcomputer.com because i trust the domain specifically we're going to go out after the these are very specific to the type of infection they are for example these are root kit detectors so they will install a driver that can detect these it also has a rogue feature because it's a fake software so that's what a rogue is and then adware cleaner and we found that these scanners when using them one at a time are very effective at removing um the bridal bottles malware some precautions to take there are occasions where this has caused machines to go into a boot loop i found that to mitigate this the most is to go through these scanners one at a time and to go through the reboots when it's scheduled also something that i like to do is i like to open up a command prompt by going to the search here or win r type cmd.ex and to run this administrator hold ctrl left shift hit enter and it's the command prompt now just to make sure that the machine is as stable as possible i'm going to run sfc forward slash scan now one word this is a system file checker and this is going to scan all the system32 about a couple registry issues too to make sure the system is uh it doesn't have any kind of corruption and this is a best thing you can do really is to try to make it as stable as possible for removal now i'm going to speed up a little bit okay looks like we're almost done and this will tell us also if uh the system was corrupted and um it should fix things automatically it's a pretty good tool this is uh this runs at the tail end of uh transcript good thing we didn't find any integrity violations means we're in good shape we can continue with the fix if it does show up in integrity issues it'll fix it automatically but you need to do a reboot so if it said it found resource by um corruption and then it fixed it that's okay just reboot and then you can come back to this okay what we're going to run first is tdss killer and this is run by transcript but we're going to activate a few more features on it so we can go a little bit more in depth let's accept accept through here and under change parameters we're going to enable load modules this is going to trigger a reboot so we're going to go ahead and reboot our friend's machine right now and we'll come right back okay all right our buddy is rebooted and we can go back to tds killer we'll open up change parameters again we're going to enable all of the check boxes verified digital signatures very important and loaded modules is enabled this is going to instill install a root level driver it'll give us the ability to scan for stealthy root level root kits okay we'll just start the scan and this scanner ironically is um was designed only to detect the tdss virus but we found over the years that it's very effective at rooting out pretty much all root kits what root kit is is a we call it root because that's like super admin privileges and they're designed to be completely undetectable and they're designed also to be persistent but most of all they give the malware or the malware user um master super administrator privileges they can do whatever they want so for that reason you'll often get an access that's denied when trying to um interact with these things and oftentimes these things will have a reaction or a self-defense when you mess with them in the wrong in the wrong order or the wrong sequence the method we're going through is going to handle this it's already detected the ibuddy service and we're going to change this to you can do copy to quarantine if you want to do analysis but in this case we're going to we're going to copy to quarantine so i'm going to take this home take your work home with you okay and we're going to delete hit continue we've neutralized two threats so they're essentially essentially two traces and like i said before we are going to take this slow in order to prevent a boot loop so at this time we're going to reboot and then come back okay our buddy roz has rebooted and it has completed its removal so we will do one more scan i don't expect to detect anything which is perfectly fine these scanners are quick because they're only scanning for very specific things for example we're scanning just for root kits so we're not scanning the entire hard drive because we're not looking for every single trace we already know from our experience with this particular malware exactly where to look for it and what to look for so that's why we're running these very specific tools and yep yeah root kits traditionally would infect the boot sector this particular one does tend to infect the boot partition but it really depends on which stage of the threat that it's on but either way we've found that taking it slow like this is the best way to remove it and to prevent a boot loop okay it did not find another threat which means that it's not going to be persistent for us today at least for that portion of the infection next i'm going to go and i'm going to open mbar which is a basically it is the root kit detection portion of malwarebytes with a few extra drivers for detecting some hard to detect rootkits we're going to update first all right it's done updating we're gonna hit next and then we're going to scan we're gonna leave everything the way it was and idle buddy service when and uh or bridal bottles as we've known it tends to have um anywhere from three to five infections sometimes more depending on which stage of the infection this is on um it can be um it could be one trace or it could be as many as ten traces throughout our entire skin really depends on how long it's been infected and even then it's kind of unpredictable we really never know exactly how far along it is [Music] and if you'll notice that it's scanning mostly this system 32 it's all drivers root kits love to hide themselves as drivers it gives them first off root access to the system and then second it's a lot easier to uh to hide when it's hiding as a device as opposed to an app okay we've got our first detection and it is again the ibuddyservice.exe and we've also found this is actually a false positive it's called riskware and we have found a infected user directory in a recycle bin which lets me know that we had more than just a um idle i buddy service we actually had a remote access trojan which means that our friend roz was the victim of a remote intruder so lucky for him we're going to solve that for him today but when you see these things as a riskware hack tool that's uh antivirus language for somebody's not paying for their software but it's by no means necessarily malware however you can get malware if you download the wrong tool because malware actors love to disguise their their malware as hacks cheats um cracks things like that yeah this uh this this user directory right here is actually a hidden folder in this directory you can't see it right now it's actually you have to go into view hidden items it's still not going to show up but if you go into options you should be an expert if you go messing with this but i'm just going to give you a peek i apply i can see where the recycle bin is and these guys should not be here these are i believe they are hidden uh user directories for remote intruders so we're gonna let them get taken by the scanner and we're going to put that back so that we don't see annoying hidden files all the time and you'll see here this is the adware portion it's still a rootkit but it is adware this is a multi-faceted malware to say the least it's a very profitable malware for the user i um estimate that the person or the organization that created a malware has successfully infected over a million people and as long as it makes more than one dollar which it has it's extremely profitable if you ever wonder why me why are they infecting me well this is why because it's profitable all right the scan is completed and we've detected a few more pieces of which we were expecting to find which is the bitcoin miner portion and more of the adware portions of it and we're going to go ahead and click cleanup it's going to create a restore point and when this is completed it's most likely going to require us to reboot in which we are going to reboot like i said we're going to take it slow okay it's finished the cleanup and now it's asking us to reboot so we're going to reboot our friend's machine now and we'll be right back all right we're back and our friend roz is successfully rebooted and our bite's anti-root kit has removed those traces upon rebooting he noticed that internet explorer has popped up and i was letting him know that this is very common because the hijack has been removed so this is basically resetting it and you can just use recommended settings and then close the application we're gonna go back into the downloads folder where we've downloaded our tools and the next thing we're going to run is roguekiller next here leave that checked we're just gonna hit next here you don't have to get an email accept the agreement next next and next an install this one is an installed scanner unlike the others that are standalones so you may need to uninstall this afterwards if you don't want to keep it [Music] you just choose a browser it's going to take you to the real killer website to close it and close this window and then you'll just hit scan when you hit scan you're gonna click here over to scan everything and then you're going to click this driver loaded icon over here and that's going to load the rootkit scanner driver this one usually detects anywhere from one to six detections um but taking into consideration that he has other infections other than the idle buddy um service and its associated choices we may get more okay we've started to get some detections here and we've also detected more traces of ibuddy which is what we want so [Music] okay we've detected about eight more source eight more traces and of course we found ibudi which was what we were looking for as well as a few things that uh a few other types of threats that we found here so we're going to go ahead and remove these threats now we're going to hit removal and it has finished successfully removed all of them and we're good to go we can click finish here and then close out of this now the final scanner we're going to run before we start repairs is going to be availa cleaner and this is another product by malwarebytes and we're just going to click agree right here and then we're going to hit scan this is going to remove the adware portions that are left behind okay these are yes they're part of it okay we can these can go but the others are okay by the way guys if you're getting detections um from this and this is being helpful to you go ahead and hit that like button and consider subscribing we're gonna have a lot of content more than just malware but in tech in general really useful stuff i like to try and put a lot of content that people can actually use that you don't have to have a ton of knowledge for but a lot of the stuff that i teach here a lot of the pros don't even know about so you're getting a lot of first-hand um first-hand stuff that uh you don't get in other channels all right we've finished the sfc command and now the next command we've run is the dism tool and to run that you're going to type right here dism space forward slash online space forward slash cleanup dash image this is all case sensitive i've already put i'm going to put the command in the in the description so you can just copy and paste this and this is going to compare um your windows installation with what microsoft windows update has if there's anything wrong with it it's going to automatically fix it this is also something that's run by transcript and after that you should be good to go you'll have removed ibuddy and all of its traces and you can go ahead and use your machine if you found this helpful please consider hitting that like button and consider uh subscribing it greatly helps on the channel and uh if you'd like to support us you can um support me on patreon the link down there and you can also join us on discord if you'd like to chat with us or if you have any more issues and we'd love to hear from you thanks [Music] [Music] you