Another fool with a Malware problem

Viruses and worms
1

At least I think so. Been having some problems for a few days, with a laptop only bought a few weeks ago. Started to notice it was running a little slower and giving me trouble when trying to upload files that weren’t extremely small - or sending files by email attachment.

The last 2 days, have been very odd. Virtually every major website I visit is showing banner ads for ‘Travelgirls’. I’m talking about best position banners on homepages of the Telegraph, The Mail, The Sun and loads of other sites. They suddenly seem to be everywhere.

I joined this site about a month ago, but then immediately found out they wanted a hefty subscription fee so I didn’t bother with it. They have been spamming me with emails ever since and they don’t come across as a firm who can afford banner ads on the homepages of the big newspapers. I may well have clicked their ad on a newspaper site though, thinking about it, so it is possible that it is just a coincidence.

Anyway, earlier today I did a deep scan with avast. It picked up a malware win32 flvplayer virus and claimed to have gotten rid of it. I’m not convinced it has, although there may be something else it has missed. The ads are still on nearly every site I visit and I still can’t upload files. Performance is still sluggish I think. Avast (freebie) says everything is fine.

Here is some technical stuff.

This is the message I get after failing to send an email with an attachment over about 1meg:
An error occurred while sending mail. The mail server responded:
4.3.0 Temporary problem {mp-us010}. Please check the message and try again.

I tried to upload a 2 minute youtube video, earlier today. About 5% appeared to have loaded, but then it just stopped and gave me an ‘unknown error’ message, or similar.

I ran the aswmbr tool recommended by essexboy to another user and got this result:

22:33:25.662 OS Version: Windows x64 6.1.7600
22:33:25.662 Number of processors: 8 586 0x2A07
22:33:25.662 ComputerName:****** UserName: *****
22:33:30.202 Initialize success
22:33:30.888 AVAST engine defs: 11082000
22:33:41.402 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IAAStorageDevice-1
22:33:41.402 Disk 0 Vendor: WDC_WD64 01.0 Size: 610480MB BusType: 3
22:33:41.418 Disk 0 MBR read successfully
22:33:41.418 Disk 0 MBR scan
22:33:41.418 Disk 0 Windows 7 default MBR code
22:33:41.434 Service scanning
22:33:42.120 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys LOCKED 32
22:33:43.009 Modules scanning
22:33:43.009 Disk 0 trace - called modules:
22:33:43.025 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
22:33:43.025 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0xfffffa8004add060]
22:33:43.040 3 CLASSPNP.SYS[fffff8800120143f] → nt!IofCallDriver → [0xfffffa800480ae40]
22:33:43.040 5 ACPI.sys[fffff88000f5a769] → nt!IofCallDriver → \Device\Ide\IAAStorageDevice-1[0xfffffa800480e050]
22:33:46.067 AVAST engine scan C:\Windows
22:33:51.823 AVAST engine scan C:\Windows\system32
22:34:58.686 AVAST engine scan C:\Windows\system32\drivers
22:35:12.476 AVAST engine scan C:\Users\Dan
22:38:35.698 AVAST engine scan C:\ProgramData
22:39:12.264 Scan finished successfully
22:42:13.624 Disk 0 MBR has been saved successfully to “C:\Users.…”
22:42:13.687 The log file has been saved successfully to “C:\Users.…”

It didn’t offer me the option of fix, only ‘fix mlb’, or something similar. I wasn’t going to fix it anyway as I have no idea if the tool is designed for 1 piece of malware, or all. I also scanned with the TDSS Killer, but it found nothing.

I have just clicked on properties on one of the banner ads and got: http://googleads.g.doubleclick.net/pagead/imgad?id=COWZpt27_vq0AhDYBRhaMghFKfeiYt1S7g

Any advice, other than avoiding dodgy dating sites? I know my princesss is out there, somewhere…

;D

2

Even if it did offer those options, you shouldn’t select anything unless advised to do so by someone familiar with the aswMBR log.

There doesn’t appear to be anything obvious in the aswMBR log, were there any Yellow or Red lines in the original aswMBR window ?

Banner ads generally aren’t paid for by the site as they get revenue by having the banner ads on their site. The problem being it is easy for crafted banner ads (some of the big ad farms have been compromised) to be used to direct to malicious content. So aside from I basically block all ads, I never click on them.

But in this case it would appear to be malware inserting banner ads. What browser are you using ?

So further analysis is required:

Note: this says attach the file (to big for copy and paste, use the Additional Options in the Reply window to attach the file.

3

some of these FLVplayer installers containe adware

http://www.virustotal.com/file-scan/report.html?id=f6364f19cde3769762c09001d5f5e27bfe0fd78f85d33d89f316f22194638157-1305572883

run a quick scan with malwarebytes…remeber to update the program first
http://filehippo.com/download_malwarebytes_anti_malware/

and post the log here

4

Thanks for your help.

5

For the time being run MBAM and post the log, as it is 01:10am in the UK, so essexboy won’t be back on-line until later today to check out your OTS log file.

6

Malwarebytes’ Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7525

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/21/2011 9:20:25 AM
mbam-log-2011-08-21 (09-20-25).txt

Scan type: Quick scan
Objects scanned: 213280
Time elapsed: 2 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

7

Hi I will need to use a stronger tool for this one

Do the problems only occur in firefox ?

Download and Install CombofixDownload ComboFix from one of the following locations:

Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop *

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

8

hi, no this is an explorer issue. haven’t tried firefox but have trouble with moz thunderbird email. will update soon.