forged google-analytics.com/ga.js

I am running the free version of Avast 6.0.1367, with today’s virus database 120219-0.
I have the same issue than this post http://forum.avast.com/index.php?topic=74637.0 .

My understanding is that my host file is corrupted and points to a forged IP for google-analytics. The ga.js file there is a virus, and gets correctly blocked up by avast on every web page I visit.

I try to find the host file on my machine, but I don’t see it in C:\Windows\System32\drivers\etc (screenshot attached ).

I will attache the results of MBAM, OTL and aswMBR in my next post.

Please find the logs for MBAM, OTL and aswMBR.

Thank you in advance for your help !

Hi,

While I am reviewing the logs you provided do the following…

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.

Run OTL.exe

[*]Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL


:Services

:OTL
O1 - Hosts: 74.55.76.230 www.google-analytics.com.
O1 - Hosts: 74.55.76.230 ad-emea.doubleclick.net.
O1 - Hosts: 74.55.76.230 www.statcounter.com.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin]  File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin]  File not found
O33 - MountPoints2\{2ed431d4-58fe-11df-9b59-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{2ed431d4-58fe-11df-9b59-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Setup.exe -- [2007/07/06 17:53:05 | 000,303,792 | R--- | M] ( )
O33 - MountPoints2\{559dab68-5c11-11df-b6ca-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{559dab68-5c11-11df-b6ca-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{5e61936b-5bb7-11df-bb54-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{5e61936b-5bb7-11df-bb54-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{814557e6-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{814557e6-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{81455821-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{81455821-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{8145587f-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{8145587f-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{8145588f-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{8145588f-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{b3547878-b684-11df-8117-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{b3547878-b684-11df-8117-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{f65d7deb-5bb3-11df-b184-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{f65d7deb-5bb3-11df-b184-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{f90cdceb-5e18-11df-8f63-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{f90cdceb-5e18-11df-8f63-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe
[5 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[5 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[451 C:\*.tmp files -> C:\*.tmp -> ]

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[start explorer]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot when it is done
[*]Then run a new scan and post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )

Thanks for the help.

I ran ERUNT.

Then I ran OTL with the code, but there are a few things:

  • my version is French, so the buttons are not excatly the same. I suppose the “Run Fix” is the red button at the top ?
  • I clicked that one and I got an error message : “can not create file Hosts”. Should I run OTL as admin ?
  • After this message appeared, it seems to be hanging. The feedback is stuck on “processing O1- Hosts: 74.55.76.230 www-google-analytics.com…” and OTL is not responsive. Should I try to restart the process “as admin” ?

Hi tcu,

Go ahead and stop OTL.

I suppose the "Run Fix" is the red button at the top
yes it should be the button with the red lettering.

Please do the following…

Run OTL.exe

[*]Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL


:Services

:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin]  File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin]  File not found
O33 - MountPoints2\{2ed431d4-58fe-11df-9b59-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{2ed431d4-58fe-11df-9b59-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Setup.exe -- [2007/07/06 17:53:05 | 000,303,792 | R--- | M] ( )
O33 - MountPoints2\{559dab68-5c11-11df-b6ca-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{559dab68-5c11-11df-b6ca-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{5e61936b-5bb7-11df-bb54-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{5e61936b-5bb7-11df-bb54-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{814557e6-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{814557e6-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{81455821-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{81455821-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{8145587f-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{8145587f-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{8145588f-5a90-11df-b912-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{8145588f-5a90-11df-b912-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{b3547878-b684-11df-8117-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{b3547878-b684-11df-8117-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{f65d7deb-5bb3-11df-b184-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{f65d7deb-5bb3-11df-b184-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{f90cdceb-5e18-11df-8f63-c80aa92bd89c}\Shell - "" = AutoRun
O33 - MountPoints2\{f90cdceb-5e18-11df-8f63-c80aa92bd89c}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe
[5 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[5 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[451 C:\*.tmp files -> C:\*.tmp -> ]

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[start explorer]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered. There will be a log created when it completes that I will need in your next reply. Reboot when it is done.
[*]Then run a new scan and post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )

My solution to this is simply. Turn off active scripting in your browser. That way you can not get infected from a script and spyware monger Google can not track you.

I went better this time, but still hanging at the end ( for 15 minutes). This time, the bottom window was stuck at the last three lines:

[emptytemp]
[start explorer]
[reboot]

Gonna try again.

Actually I didn’t retry. Here is what happened:

  • it hang at the end ( see previous post ), so much that I had to hard reboot.
  • after reboot, when trying to launch OTL, this file pops up:

Files\Folders moved on Reboot...
File move failed. F:\Setup.exe scheduled to be moved on reboot.
File move failed. C:\Users\Léon\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
C:\Users\Léon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UGTYEUJF\background-banner-middle-v9a[1].jpg moved successfully.
C:\Users\Léon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UGTYEUJF\background_banner_green_50_v9a[1].jpg moved successfully.
C:\Users\Léon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T5F06WPS\background_button_green_full[1].png moved successfully.
C:\Users\Léon\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DK9QEDRZ\background-banner-right-v9a[1].jpg moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

  • then, I launch OTL again, do a scan . Please see logs attached.

I hope this helps !

The good news is

  • I now see a “Hosts” file in windows32/system/drivers/etc/ ( with localhost in it )
  • the forged google-analytics.com popup alerts are gone !

Hi,

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

[*]Please go here then click on:
http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS1.gif

[*][quote]Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
[*]Select the option YES, I accept the Terms of Use then click on:
http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS2.gif

[*]When prompted allow the Add-On/Active X to install.
[*]Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
[*]Now click on Advanced Settings and select the following:

[*]Scan for potentially unwanted applications
[*]Scan for potentially unsafe applications
[*]Enable Anti-Stealth Technology

[*]Now click on:
http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS3.gif

[*]The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
[*]When completed the Online Scan will begin automatically.
[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
[*]Now click on:
http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS4.gif

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

In your next reply please post the logs made by Malwarebytes and ESET online scanner… Also let me know how your system is running. :slight_smile:

Thank you for the follow up and clear instructions !

I attached the results of the latest MBAM quick scan , and the ESET Online scan.

The computer seems fine since running your OTL script. the avast alerts have stopped. is it safe to bet there is nothing else than the bogus host file ?

Hi tcu,

Those look good as well. The hosts file that was picked up is in the OTL quarantine so that will be removed later. Lets get some updates on your system…

Please download JavaRa to your desktop and unzip it to its own
folder
[*]Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
click Remove Older Versions.
[*]Accept any prompts.
[*]Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
[*]Select Update Using Sun Java’s Website then click Search and click on the Open Webpage button. Download and install the latest
Java Runtime Environment (JRE) version for your computer.


Run a fresh scan with OTL and post that log into your next reply so we can have one last look. :slight_smile:

Ok, I installed the latest Java JRE. ( Is there a particular security reason that Java JRE should be up-to-date compared to other softwares ? )

and I ran a OTL quick scan, which is attached.

Can I leave all these logs in the thread, there is nothing sensitive in them ?

Hi,

Is there a particular security reason that Java JRE should be up-to-date compared to other softwares ?
Yes...Java is used every time that you get on the internet and Java is one of the software programs that makes the internet look so good. :) Having outdated Java will leave you open to re-infection. ----------

If there are no other malware problems…

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :smiley: SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :smiley:

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the …X and the /U that needs to be there.)

http://i1224.photobucket.com/albums/ee380/jeffce74/CF.jpg


Clean up with OTL:

[*]Right-click and Run as Administrator OTL.exe to start the program.
[*]Close all other programs apart from OTL as this step will require a reboot
[*]On the OTL main screen, press the CLEANUP button
[*]Say Yes to the prompt and then allow the program to reboot your computer.


Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren’t cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

[*]From within Internet Explorer click on the Tools menu and then click on Options.
[*]Click once on the Security tab
[*]Click once on the Internet icon so it becomes highlighted.
[*]Click once on the Custom Level button.
[*]Change the Download signed ActiveX controls to Prompt
[*]Change the Download unsigned ActiveX controls to Disable
[*]Change the Initialize and script ActiveX controls not marked as safe to Disable
[*]Change the Installation of desktop items to Prompt
[*]Change the Launching programs and files in an IFRAME to Prompt
[*]Change the Navigate sub-frames across different domains to Prompt
[*]When all these settings have been made, click on the OK button.
[*]If it prompts you as to whether or not you want to save the settings, press the Yes button.
[*]Next press the Apply button and then the OK to exit the Internet Properties page.

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
[*]Open Internet Explorer
[*]Click on Tools > Internet Options
[*]Press Security tab
[*]Select Internet zone then place check next to Enable Protected Mode if not already done
[*]Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
[*]Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found [color=blue]here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

7. WOT (Web of Trust) As “Googling” is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT’s color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

8.Finally, I strongly recommend that you read TonyKlein’s good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

That sounds good.

Give me until Saturday to look at your guidelines and I’ll get back to you for closure :slight_smile:

Thank you for your great help, that was priceless !

Sounds good. :slight_smile:

I followed your last email’s instructions, except that I didn’t have combofix installed in the first place.

Thanks for the precise guidelines for staying safe in the future. I’ll have most of them covered and will definitely keep them in mind.

Again, thank you for your helpful assistance !

You are more than welcome! I am glad I could help. :slight_smile: