"Emergency Exit Map Email Virus" removal guide
What is "Emergency Exit Map Email Virus"?
The "Emergency Exit Map Email Virus" scam (a spam email campaign) is used by cyber criminals/scammers to infect computers with Gootkit, a banking trojan that steals account information by hijacking HTTPS. The scam targets mainly European banks and its main goal is to trick email recipients into clicking a link that leads to download of the aforementioned malicious program.
Scammers present the "Emergency Exit Map Email Virus" scam as an urgent matter - urging recipients to leave the building where they are living/residing. They are encouraged to click the "Emergency Exit Map" link, which supposedly leads to download of an exit plan. In fact, the presented file is not a map but an executable file used to install the Gootkit malicious program (trojan). Once installed, this trojan can be found running in Task Manager as a process named "Includesix" (32-bit or 64-bit). As mentioned above, this is a banking-related trojan designed to steal account information. Having these infections installed can lead to serious privacy issues and financial loss. Trojan-type viruses are often capable of opening "backdoors" for other infections to infiltrate, thus causing chain infections. Therefore, do not click the "Emergency Exit Map" link within the "Emergency Exit Map Email Virus" scam. Also ignore any similar spam campaigns in future.
There are many spam campaigns on the internet. Examples of other similar scams are Christmas Greetings Email Virus, A2 Trading Corp Email Virus, and Brexit Email Virus. They often trick recipients into opening dubious attachments or clicking links that lead to malicious files. The emails are proliferated to infect computers with high-risk viruses (such as Adwind, FormBook, TrickBot, and so on). These computer infections usually cause privacy/browsing safety issues, financial loss, and they can steal personal data such as banking details, passwords, logins of social networks, etc. If you suspect your computer might be infected with one of these viruses, take immediate action and remove it.
How did "Emergency Exit Map Email Virus" infect my computer?
In this particular case "Emergency Exit Map Email Virus" infects computers by tricking recipients into clicking a link that leads to a malicious program. Once the file is downloaded and executed, it installs the Gootkit trojan-type program. In other cases, spam campaigns include malicious Microsoft Office documents (such as Word, Excel), PDF documents, archive files (ZIP, RAR) or executable files (.exe). If, for example, the downloaded and opened attachment is an MS Office document, it will ask to enable macro commands. If enabled, these commands install malicious programs. Some MS Office products have Protected View mode, which prevents malicious documents from downloading and installing infections. Therefore, only use MS Office versions that have this feature.
How to avoid installation of malware?
Do not download or open (execute) files that are attached to emails received from suspicious, untrustworthy, or unknown email addresses. Emails sent by scammers (cyber criminals) can easily be identified: most do not concern their recipients and are irrelevant. Have a reputable anti-virus or anti-spyware suite installed and keep it enabled at all times. These tools can prevent computer infections with viruses before they can do any harm and proliferate. If you have already opened a "Emergency Exit Map Email Virus" attachment, we recommend running a scan with Spyhunter for Windows to automatically eliminate infiltrated malware.
Text presented in the "Emergency Exit Map Email Virus" email message:
Subject: Urgent to all residents of the building
Urgent to all Residents,
Please find below the Up to date emergency map.
Emergency Exit Map.
Screenshot of a Gootkit malicious process ("Includesix") in Windows Task Manager:
Update January 23, 2019 - Crooks started using this spam campaign to proliferate GandCrab 5.1 ransomware instead of the aforementioned GootKit trojan. At the time of research we've found two variants of emails from this spam campaign: one contained an attached infectious .doc file, while the other one contained a download link of a similar document. Ransomware-type viruses like GandCrab 5.1 are designed to encrypt stored data and restoring it is virtually impossible. Therefore, if you have opened attachments distributed using "Emergency Exit Map" spam campaign and your files have been encrypted, the only thing you can do is restore everything from a backup.
Screenshot of an email with a malicious .doc attachment:
Text presented within this email:
Subject: Up to date emergency exit map
Please find bеlow the Uр tо date еmеrgency exit maр.
Please see Emergency exit map in the attachment..
Rоsie L. Ashton,
Screenshot of an email with a download link of a malicious document:
Text presented within this email:
Subject: Up to date emergency exit map
Pleаsе find below the Uр tо date emergеnсy еxit mар.
Emergency exit map.
Rosiе L. Ashtоn,
Screenshot of a malicious MS Word document distributed using these two emails (enabling macros results in infiltration of GandCrab 5.1):
Instant automatic removal of Exit map virus:
Manual threat removal might be a lengthy and complicated process that requires advanced computer skills. Spyhunter is a professional automatic malware removal tool that is recommended to get rid of Exit map virus. Download it by clicking the button below:
- What is "Emergency Exit Map Email Virus"?
- STEP 1. Manual removal of Gootkit malware.
- STEP 2. Check if your computer is clean.
How to remove malware manually?
Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Spyhunter for Windows. If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:
If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:
Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:
Restart your computer into Safe Mode:
Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.
Video showing how to start Windows 7 in "Safe Mode with Networking":
Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup. Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings". Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.
Video showing how to start Windows 8 in "Safe Mode with Networking":
Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options". In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.
Video showing how to start Windows 10 in "Safe Mode with Networking":
Extract the downloaded archive and run the Autoruns.exe file.
In the Autoruns application, click "Options" at the top and uncheck the "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.
Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.
You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".
After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.
Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs. These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software.
To be sure your computer is free of malware infections, we recommend scanning it with Spyhunter for Windows.