Containment

1. Check how many endpoints are affected by doing the following.
   1. Filter Virus Logs / Anti-Malware Events by their detection name.
   2. Create a Pivot Table similar to the following.

      

      ^{Click the image to enlarge.}

2. Identify Infection sources by filtering through Source Host which can be done either on the pivot table or on the web portal.

   

   ^{Click the image to enlarge.}

3. Isolate the endpoints for cleanup.
4. For a larger outbreak, Outbreak Prevention Policies can be utilized.

Cleanup

For Endpoints with functional and updated Security Software:

1. Configure Real Time Scan, Scheduled Scan, Manual Scan, and Scan Now with the following Settings.
   • Set scan target to "All scannable files".

     

     ^{Click the image to enlarge.}

   • Set scan actions to customized actions.

     

     ^{Click the image to enlarge.}

   • Remove scan exclusions.

     

     ^{Click the image to enlarge.}

2. Perform a network-wide scan.

For Isolated Endpoints or Endpoints without Functional AV Software:

• Option 1: ATTK Offline Clean Tool
  1. Download Trend Micro Anti-Threat Toolkit – Offline Clean Tool:

     32-bit
     64-bit

  2. Since the malware infects .exe files, change the extension of the tool to .com. It is recommended to run it inside C:\Windows\.
  3. Click Fix on the detected items, and click Restart once prompted.

     

     ^{Click the image to enlarge.}

• Option 2: Trend Micro Rescue Disk
  1. For Cleanup choose Scan for Security Threats.

     

     ^{Click the image to enlarge.}

  2. Perform a Full Scan.

     

     ^{Click the image to enlarge.}

  3. A message should appear once the files are cleaned. For files that are not cleaned, this can be deleted manually or sent to Trend Micro for analysis.

     

     ^{Click the image to enlarge.}