Malicious file disappeared?

Viruses and worms
1

Hello. I have a question regarding a malicious file that seemingly “disappeared”.

While browsing a website, both Windows Defender and Avast! told me that there was a suspicious/malicious file detected. Avast! then warned me about a malicious file that was trying to execute on my PC, and asked if I wanted to open it using sandbox. I wrote down the location of the file and exited out of the Avast “warning window”. I checked out the file myself; I scanned it with Avast! and MBAM. Avast! found it safe, MBAM detected the file as malicious. However, for some reason I wanted to check to make sure, so I scanned the file with VirusTotal for a second opinion. Thus, I didn’t quarantine the file using MBAM beforehand. After scanning the file with VirusTotal, it detected the file as malicious. I went to delete said malicious file a few minutes later to find that it was missing. Here is the location and name of the file:

C:\Users\Family PC\AppData\Local\Temp\8812824
Malicious file in question is named: 8812824
It was an .exe file.

I was able to find said file by “searching temp folder” before, but after what I described above, I could no longer find it. I later did a up-to-date full scan using MBAM and it detected 4 malicious files (the log for that is attached below), but none of them were the “8812824” file above.

Should I be worried about this file? Or is it safe to assume that it’s gone?

Thanks in advance!
Best regards.
-Misuzu

2

send the files to virus lab please…

Open avast user interface>>open maintainence tab>>chest>>right click and click add>>browse the files and select them and click open>>right click on the files added to chest and click send to virus lab>>update definations manually to send them>>on next update>>scan the file again added in the chest and if not detected send it again…

You would have to restore the files from Mbam quarantine first…open MBam>>select quarantine tab>>and click restore all

files will be restored back here:
C:\Users\Family PC\AppData\Local\Temp\8806693.exe
C:\ProgramData\OynibzecCafs.dll

The above 2 files are to be sent to virus lab.

3

Thank you for the fast reply!

Are you saying that the two files you asked me to restore and send to virus lab are responsible for the disappearance/originated from said disappeared file or something?

I cannot find the disappeared file, as stated. So I couldn’t send it in.
I’m sorry if I’m misunderstanding your post, I’m not very knowledgeable about this kind of stuff. My apologies.

Thanks again! :slight_smile:
Best regards.

4

You will have to restore the 2 files in mbam quarantine to their orginal locations these 2 things are need to be sent…[locations to which they are restored in previous post…]

Whats next?? follow the guide to ensure you are clean: http://forum.avast.com/index.php?topic=53253.0

5

I understood that. The missing file is “8812824”, not the two files you are asking me to send in. I was curious why I needed to send those two files when the file I was asking about was the missing file? Will sending in those two files help me determine if I somehow quarantined the “missing file”? Or did I unsuccessfully quarantine those two files?

I’m so sorry, I’m having difficulties understanding. I appreciate your help, I’m just kind of slow about these type of things… Sorry for bothering you with this.

Thanks for all your help!
-Misuzu

6

Nope…we wanna help avast improve protection…by sending those 2 files you help avast improving their protection.

after sending those files folow the guide and attach all logs here: http://forum.avast.com/index.php?topic=53253.0

7

did you run any other programs?
did you clean the temp folder?

8

Pondus,

This could have been a possible path of a Ukash or Spyware.Zbot infection, so I would advise a qualified remover should look into the issue, also because the file has a random file name. Don’t you agree with me here?

polonus

9
also because the file has a random file name. Don't you agree with me here?
yepp. ;)
10

Thanks for all the replies guys!

So the “random file name” malware thing (Ukash or Spyware.Zbot infection) might have caused the “disappearance” of the file in question?

Nonetheless, I’ll try doing another full MBAM scan, but what else should I do about this?

Thanks!

11

We could have a quick look at the system ;D

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Local\AutoProxyCache /s
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Post both logs

12

Hi essexboy!

I use Firefox and it, by default, downloads files to the “Downloads” folder, not the desktop. Can I just download OTL and move it from the “downloads” folder to the desktop, or must I directly download it to the desktop?

Also, I did do an up-to-date MBAM full scan and it didn’t find anything.

Thanks!
-Misuzu

13
Can I just download OTL and move it from the "downloads" folder to the desktop, or must I directly download it to the desktop?
you can move it...... and the logs will arrive at same place as OTL
14

I am so sorry for such a long delay. The OTL logs are too large to attach in one post, so I’ll post both logs as attachments in different posts. It wouldn’t let me attach a log onto this post for some reason … ?

Other Things: (skip if you wish)
Also, Avast! kept trying to scan/terminate OTL in fear that it was malicious. It terminated OTL twice before I turned off Avast!. I’m not sure if this would have affected the scan at all?

I’m also painfully aware that my family’s PC is very out of date (I’m pretty sure anyway?). My relatives assumed that the newest Windows Update (at the time) was preventing this one program my relative needed to use (for her telemarketing job) from working. So we disabled any further Windows Updates. I know this was a bad decision, but since I’m not smart at technical computer stuff, and because my relative’s work is important, I went along with it.

Anyway, sorry for the long post.
Thanks for everything! :smiley:

15

Here’s the OTL log.

16

… And here’s the Extras log.

Do you see any malicious/other problems? (Besides the out-of-date issue)
Thanks everyone! :smiley:

17

Hi there is still malware on the system so lets kill that first. There is also Norton running on the system

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

 

:Files
C:\Users\Family PC\AppData\Local\{9a63ac42-5acb-f4c2-1f90-46a955d779fb}

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

FINALLY

run farbar service scanner

https://dl.dropbox.com/u/73555776/FSS.GIF

Tick “All” options.
Press “Scan”.
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

18

When I pasted in the CODE you posted and hit “Run fix”, soon after, a Windows pop-up said Windows was about to shut down the PC and to save anything I was working on. OTL continued to run, but about a minute later Windows restarted. Was this from OTL or did Windows restart itself WHILE OTL was still working?

Will this cause problems if it’s the latter?

After Windows restarted…
I also noticed my PC started up and is moving slightly slower and these “faded” icons appeared suddenly in the library (see attachment) and two files called “desktop.ini” appeared in my library AND on the desktop. All the files names went from something like “sunset” to “sunset.png” or “song” to “song.mp3” and so on. I know these are the normal extensions (I think that’s what their called?) for these files, but for some reason their appearing in the files name, which didn’t happen before.

Is this normal? Did I do something wrong?
Besides what I listed, mostly the PC is acting normal.

19

That is normal as OTL has reset some system settings for the duration of the fix… They will be rehidden on completion

Once combofix has run you should be fairly clean and FSS will let me know if your services are OK

20

Oh good. Glad everything is okay. :slight_smile:

I’m going to run a Quick Scan with OTL soon. Should I paste in the code (or whatever it’s called?) that you posted in your first post when I Quick Scan or not?