The ORT Thread (aka Sea Turtle Thread)

OaksLabs

Well-Known Member
Reaction score
280
Location
USA
Howdy!


A number of people have shown interest in ORT (The OaksLabs Removal Tool, www.oakslabs.com), so this thread is for suggesting fixes, features, and troubleshooting issues you may have with ORT.


I have titled this thread the "Sea Turtle Thread" because it is a name that is non-technical, so when a forum search is done it can be found quickly. It is my hope that this thread will serve as a technical reference and a sounding board for improvements and features for ORT.


About ORT:


I designed ORT to be a stand alone program -- no internet connection required. It also has no external dependencies (.NET, Windows Installer, etc...). This means that it uses a lot of native Windows command line programs (like "sc" for services). Thus, only Windows versions post Windows XP work.


ORT is designed to clear the way for other anti-malware scanners. It is not a replacement for a full anti-malware scanner. ORT is designed to get a PC on the network and ready for scanning, along with a "quick and dirty" (non-registry) malware removal.



Removal Information:


ORT takes no prisoners. It kills (ruthlessly). I have a warning message that it is a powerful tool each time it runs because of this. Malware doesn't play around, and neither does ORT. It's hard to keep up with malware, so ORT uses a "skunk test" with certain things, and in some cases does delete innocent files (in the startup folder, scheduled tasks, etc...). Most items in these folder are not critical, and compared to the damage malware does to a system, and loosing a custom maintenance scheduled task is relatively minor.


ORT cleans out temp files. This makes any subsequent malware scans faster, and deletes any traces of malware installers (and some malware that exists purely in temp folders).


Issues:


ORT looks like malware. Because of this, firewalls, routers, and anti-virus programs like to "eat" ORT. It can be quite difficult to download ORT because of this. As a fix, download ORT from the Tor Browser (https://www.torproject.org/projects/torbrowser.html.en).

EDIT: As of 9/12/17, ORT uses a different compiling method, and this should no longer be an issue. ORT is also re-compiled and uploaded every hour.

Other notes:


I host all the servers (web, e-mail, etc...) for ORT. Because of this, power outages and other events may disrupt services. I'll do my best to get the word out if services are offline.

EDIT: Hosting has been moved to the cloud gradually over the last few months. As of September 2017 all critical functions are in the cloud.

ORT is designed to be resistant to malware attacks. I take care to keep sensitive details of ORT's operation private so that malware writers won't be able to target ORT (like some malware targets Combofix).
 
Last edited:
Hello world!

FYI:

I have published the latest version of ORT. Build 106 forgot to clean up after itself, and left some temp files from runtime on the PC it ran on. These files are completely harmless, but build 107 will clean them up. You'll see a message towards the end of the cleaning process alerting you to this. The process takes a while, so I'll remove it in upcoming builds.
 
Update: Build 108 is ready for download. It cleans out the %temp% folder (as long as malware known to hide your icons in that folder is not detected) and I have added (and fine tuned) some definitions. Download, enjoy, and post your feature requests here!
 
Also, I'd like an opinion. I'm thinking about adding support for browser malware removal (most likely starting with chrome). Would you prefer ORT to:

A. Backing up user settings, nuke the browser, and import the settings into a clean slate of the browser.

or

B. Gently remove the malware from the browser without modifying with user data.

From a user perspective, the nuking of the browser is a more consistent fix (no definitions required, just a squeaky clean browser!).

What are your thoughts?
 
Same here.

Well, it is up and ready for you to try out! I added a very basic Google Chrome reset function, and a batch file to undo it in the C:\ORT folder in case something bad happens.

Currently, only the bookmarks, history and the "Login Data" are imported into the post-ORT Chrome browser. I can't tell you exactly what is stored in the Login Data file, but I suspect it is the stored password collection -- it uses a custom format, unlike the regular SQL format of the other files.

I have gotten this feature to work with a Conduit/Trovi search infection with good results, so let me know what you think!
 
Update: The file submission tool on www.oakslabs.com is now a drag-and-drop utility (aka it uses the first command line parameter). If you'd like to send a malware sample or a log to me to have added to ORT, download the tool and send it on over!
 
Well, it is up and ready for you to try out! I added a very basic Google Chrome reset function, and a batch file to undo it in the C:\ORT folder in case something bad happens.

Currently, only the bookmarks, history and the "Login Data" are imported into the post-ORT Chrome browser. I can't tell you exactly what is stored in the Login Data file, but I suspect it is the stored password collection -- it uses a custom format, unlike the regular SQL format of the other files.

I have gotten this feature to work with a Conduit/Trovi search infection with good results, so let me know what you think!

Sorry I totally forgot about this thread. Jumped on my Test Bench that I hadn't been on for awhile and ran the tool. It worked out great so far.
 
Build 110 is available for download. It fixes the issue where ORT does not close when an unsupported OS is detected.
 
Build 111 is available for download. It adds more definitions and it also adds more to prevent malware from tampering with ORT.

I also fixed a bug in the file submit tool where it would corrupt any binary file that was submitted.
 
**IMPORTANT** If you like ORT, grab a copy for your toolkit now and keep it in a safe place. I got a nasty-gram from my ISP about my equipment being infected -- and I think when I try to explain that ORT is a legitimate program things aren't going to go well, and my hosting might go down...

Anybody have suggestions for bullet-proof hosting?

EDIT: After a call to the security department at my ISP, I seem to have the situation cleared up. I'll keep you advised to any other possible interruptions in my hosting.
 
Last edited:
Build 115 is available for download. It added support for Windows 10 (still not tested 100%, but no problems yet). A few definitions and code optimizations are added to this release as well.
 
Build 117 is available for download. This build includes cleaning support for the Firefox web browser (it removes the items that have the potential to be malicious, the squeaky clean style removal that I do in Google Chrome won't work in Firefox). As with Google Chrome, an undo tool for this can be found in the C:\ORT folder.
 
Build 120 is available for download! It is mainly a definition update -- although it does include some changes for interfacing with my malware removal automation framework, but that's a whole different project that I have cooking in the malware research lab.
 
Build 121 is available for download. It adds improved scheduled task cleaning and it also resets the DNS servers to DHCP (after backing up the information).
 
Back
Top