kerbalspaceprogram.net malware/trojen in the wild

Viruses and worms
21

Hey Essexboy, Hmm thats strange is it connected to steam from that website? or the .com version?

There is a geniune site thats the .com and the fan site which is a .net

22

In addition ive not done a reboot as of yet so it may be different on bootup. We might need to consider clearing the temp files to be safe (is that something OTL can do?)

23

The site is not noted just the initiating programme

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0C4BA23D-C455-489D-ABCF-8A84DA02C8CE}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\cart life\cart life.exe | "{1BF98EDD-B3E3-4E5F-9F9F-9F7A34A0314F}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\kerbal space program\ksp.exe | "{1ECEC093-B9AF-49AB-81D8-F2069C42D5CD}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\cart life\winsetup.exe | "{30B4F6CF-D449-43FA-BB65-BF616D435EC4}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\showdown\binaries\showdown.exe | "{3C207BE3-BA94-4375-AB8A-2D5C7C409C39}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\cart life\winsetup.exe | "{46370B9A-BA47-4F84-90A3-8AC4A00A1D3A}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\natural selection 2\ns2.exe | "{55762D33-CF30-4611-BBA4-FEA49950E394}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\dota 2 beta\dota.exe | "{6AE287C0-B9D3-4CF8-BE38-311443E74F24}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\aceofspades\aos.exe | "{756C2B88-F1CA-4345-8A63-79979A2EB589}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\natural selection 2\ns2.exe | "{79DDEB7F-474A-4C4D-BB31-6EDF7BF5D574}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\showdown\binaries\showdown.exe | "{90C31E6F-DB32-42CE-A997-E367A5149ABA}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\dota 2 beta\dota.exe | "{9A1D8EC6-2381-4548-BD30-4E5FBE01C2A8}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\aceofspades\aos.exe | "{A3DCE30F-2E80-4373-B88D-AF65ABC6FBED}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\kerbal space program\ksp.exe | "{B28FCE29-6412-48AE-9869-422924246E3F}" = protocol=6 | dir=in | app=d:\steam\steamapps\common\organtraildc\organtrail.exe | "{BBFBCE0E-B40D-4296-B431-0FAF7B92AC3B}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\cart life\cart life.exe | "{FDD22A26-98A4-46FF-9968-BDB0144913C3}" = protocol=17 | dir=in | app=d:\steam\steamapps\common\organtraildc\organtrail.exe | "TCP Query User{6E732AD8-A1FB-48D5-8484-35085EA41403}D:\steam\steamapps\common\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=d:\steam\steamapps\common\tribes\binaries\win32\tribesascend.exe | "UDP Query User{04D57EF2-1719-4CD8-B21E-CBE88056E4BD}D:\steam\steamapps\common\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=d:\steam\steamapps\common\tribes\binaries\win32\tribesascend.exe |

Have a reboot and let me know if the system is behaving any different

24

Ok, commencing reboot :slight_smile:

25

Rebooted, Seemed to be slower than normal did freeze at the login screen however recovered after 40 seconds. In addition that reference your seeing is the game i downloaded. I went to this site thinking it was part of that game only to find out its an infected adwords site.

26

Go for another reboot and see if the behaviour is the same or if it has returned to normal

27

Ok rebooting now…

28

Rebooted, Seems to be slow to close down now and on reboot it did the same thing as before so no improvement. Ill recontact you tommorow. :slight_smile:

29

Running OTL, shall post logs asap.

30

OTL log attached should i run an mbam scan too?

Running MBAM will post results here

31

Still looks clean, have you just updated the Nvidia driver ?

32

For that URL: http://urlquery.net/report.php?id=1549978

pagead2.googlesyndication dot com/pagead/ads.js benign
[nothing detected] (script) pagead2.googlesyndication dot com/pagead/ads.js
status: (referer=www.kerbalspaceprogram dot net/)saved 13500 bytes 90301aa70934a676dce1ba83637b1cfa56cc6c0c
info: [decodingLevel=0] found JavaScript
error: line:4: SyntaxError: missing ; before statement:
error: line:4: ;“,lb,“impl=true;id=”,I.id,';id=”‘,L,’“;key=”‘,Q,’";time=',
error: line:4: .^
suspicious: (browser dependent just for IE on XP)

polonus

33

Nope but got some bad news or good news. MBAM has found something.
C:\Users\Oliver\AppData\Local\Temp\services.exe.mui (Heuristics.Reserved.Word.Exploit)

Should i upload the file to VT?

34

Also no ive not updated the nvidia driver in the past 7 days.

35

also getting orange popups showing up around the cursor, this may be connected to the threat.

36

As it stands I can see no problems

But we can dig deeper

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

37

Qaurenteened the file in MBAM as requested. I can restore it or delete it. (Should i delete it?)

Thanks will run combofix in a second.

38

Combofix has finished its scanning

39

Again shows clean, so I do not believe that the website gave you an infection

40

Strange That new file that appeared when MBAM did a scan appeared last night, Ok Should i uninstall combofix and clear up OTL now? :slight_smile: