Hello,
I have a very perplexing problem that I need your help with. Although I do not profess to be a security/vulnerability expert, I have done my fair share of disinfections over the years for friends and colleagues. By trade, I am a database administrator, and I also have experience programming discreet microcontrollers (for light industrial controls, etc. - not PLC’s, but actual MCU chips) - so, I do consider myself to be relatively tech savvy.
I am helping a long-time friend who, at this point, is out of his depth (and actually, I’m reaching the limits of my talents, too [smile]). Recently, he received an automated email notice from his ISP indicating that he had used 75% of his monthly bandwidth (which is 100GB!) - so, he contacted me to have a look at things, since that was definitely not normal. In reviewing his ISP history, we have determined that the problem started to occur several weeks ago (around February 11th) and went totally undetected. We have been working with support people at Malwarebytes and Avast since we discovered it - but to no avail (more details on that, below).
Between us, we have done a lot of experimenting to determine as much about the symptoms etc. as we can. Oh - at this point, I should probably mention that this is a WinXP SP3 system.
Something that has me very perplexed about this infection, is that it managed to insert itself somehow into the user-level account, and it is account-specific; the Administrator account does not appear to be infected, nor do any of the other accounts.
One of the things you should know is that, as a rule, he does not run with an admin-level account (not even Power User level - all as per my advice [smile]). Naturally, from time to time, he does have to switch over to Administrator to complete something. But, as I described above, it would seem that the infection did not occur in the Admin account.
The major symptom of the infection is that, when Internet Explorer is launched/used, 2 additional (unprovoked) instances of iexplore.exe eventually show up in the Task Manager. These other two instances are responsible for automatically generating huge amounts of what appears to be click-through traffic - as in, tens and tens of thousands of clicks per day. We can see this by looking at real-time statistics in Avast.
Before I even approached anyone for support, I ran several different types of scans, using several different products, and with only one exception, the scans all came back clean. Here is what I did:
-
Removed the hard drive, and scanned it (fully) as a benign/external drive attached to a totally different system, using Malwarebytes Antimalware, SUPERAntiSpyware, and Avast; results were clean in all cases.
-
With the hard drive back in the system, ran full system/drive scans using Malwarebytes Antimalware, SUPERAntiSpyware, Kaspersky TDSSKiller, and Avast - nothing found. I also used Malwarebytes AntiRookIt BETA - and it found remnants of Sirefef; these were tagged and removed … yet, the symptoms still remain.
-
Using Malwarebytes (paid), we I also performed a Flash scan - while the system was misbehaving - and it found nothing either.
We have worked with Malwarebytes Support, and they quickly reached a point where they were convinced that there is “no trace of malicious elements installed on this computer”. Yet, the problem continues - so, it is obviously something that they are unable to detect or help with.
We also worked with Avast Support, but apparently they do not provide disinfection support - so they have directed us to use this forum.
When the symptoms occur, we can eliminate them by ending all processes of iexplore.exe in Task Manager. So long as we end all of them, everything is under control. But of course, the next time Internet Explorer is used, the symptoms do come back. No other program (including Outlook Express) triggers the problem.
I have tried completely uninstalling Java and removing all of its cache files, and I also tried removing Flash - in case it was really some kind of Java-based or Flash-based infection. However, there was no change in the symptoms.
It really is isolated to Internet Explorer, and only under the normal/daily (restricted) user account.
At this point, I am totally stumped. I need your assistance to track this down and get rid of it.
I was going to attach 3 screenshots in a ZIP file - but, apparently, the forum will not accept that file type Also, with the 3 TXT logs that I need to attach (as per your sticky), I only have one file slot left (since the forum also restricts attachments to a total of 4). So, am attaching one screenshot which shows a sample of the Avast real-time activity.
As per the instructions in the sticky at the top of this forum, I have run the Malwarebytes Premium scan, the OTL scan, and the aswMBR scan - and I have attached those results to this message, too.
Hopefully, armed with all of the above info, I’ve given you a head-start to being able to help. I am certainly looking forward to any insight you may be able to provide [smile].
Regards,
Brant
