Malware accessing sites

Viruses and worms
1

Avast alerted me to a problem that nothing else since (including Avast) hasn’t been able to detect. Avast said that Spybot Search & Destroy exe was somehow infected with these malwares. When I looked at Avast’s realtime data items scanned last would include an ever updating list of dubious websites. Avast, Malwarebytes, ESET, Ad-Aware SUPERAntiSpyware, Spybot found nothing but still these sites were constantly showing up in last scanned.

At this point I only had Windows firewall and Tinywall guarding me. After installing ZoneAlarm the sites stopped showing on Avast’s last scanned times and ZoneAlarm’s firewall started blocking these attempts, which amounted to around 1800 access attempts in a day. Since putting ZoneAlarm on I haven’t seen anything suspicious on Avast’s last scanned list. I also found a temp folder in Programdata, deleting it prompted 20 more Avast alerts but I can’t seem to find a way to access a log which would tell me where they were originating. OTL doesn’t seem to want to create a fresher Extras.Txt than one from when I first discovered the problem. I also omitted a couple of beta products from OTL list on which I’m under NDA.

Included are OTL and Malwarebytes, aswMBR.exe doesn’t seem to work on Windows 8.1. I’d be grateful for any help.

Here are links Avast sent me to:

http://www.avast.com/fi-fi/lp-fr-virus-alert?p_ext=&utm_campaign=Virus_alert&utm_source=prg_fav_90_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Ffi-fi%2Fvirus-alert-default&p_vir=JS:ScriptIP-inf%20[Trj]&p_prc=C:\Program%20Files%20(x86)\Spybot%20-%20Search%20&%20Destroy%202\SDFSSvc.exe&p_obj=h_www_sex--mature_com__st__st_php?id=35&url=h_www_wannawatch_com__hosted__index_php?ws__stanxxx__pleasebangmywife_mov91&p=55&p_var=.%2Ffa%2Ffi-fi%2Fvirus-alert-default&p_elm=7&p_lex=357&p_lid=fi-fi&p_lng=fi&p_lqa=0&p_lqe=0&p_lst=0&p_lsu=24&p_pro=0&p_bld=empty&p_vep=9&p_ves=0&p_vbd=2018&p_hid=872a666d-e21b-4523-930c-bdda95882f86&p_ram=8048&p_cpu=-1%2C0

http://www.avast.com/fi-fi/lp-fr-virus-alert?p_ext=&utm_campaign=Virus_alert&utm_source=prg_fav_90_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Ffi-fi%2Fvirus-alert-default&p_vir=HTML:Iframe-inf&p_prc=C:\Program%20Files%20(x86)\Spybot%20-%20Search%20&%20Destroy%202\SDFSSvc.exe&p_obj=h_www_sicksisters_com__|{gzip}&p_var=.%2Ffa%2Ffi-fi%2Fvirus-alert-default&p_elm=7&p_lex=357&p_lid=fi-fi&p_lng=fi&p_lqa=0&p_lqe=0&p_lst=0&p_lsu=24&p_pro=0&p_bld=empty&p_vep=9&p_ves=0&p_vbd=2018&p_hid=872a666d-e21b-4523-930c-bdda95882f86&p_ram=8048&p_cpu=-1%2C0
2

OTL was so big I couldn’t put all three in the same post.

3

replace SpyBot with Malwarebytes … you dont need it when you have MBAM

At this point I only had Windows firewall and Tinywall guarding me. After installing ZoneAlarm the sites stopped showing on Avast's last scanned times and ZoneAlarm's firewall
are you running 3 firewalls?
Avast said that Spybot Search & Destroy exe was somehow infected
what malware name did avast give?
4

Yes I forgot to mention I uninstalled Spybot after running it when I Avast notified me of malware. It wasn’t in active use at any point though.

I had two, Windows and Tinywall (which acted really as more of a outbound filter in my use). Uninstalled TinyWall and then installed ZoneAlarm, it’s the only one in use.

You can see what Avast said in the links:
URL: h_www_sicksisters_com__|{gzip}
Infection: HTML:Iframe-inf

and

URL: h_www_sex–mature_com__st__st_php?id
Tartunta: JS:ScriptIP-inf [Trj]

5

That isn’t related to MBAM or SBS&D. My guess is a rpcss.dll infection or svchost.

Post OTL to wikisend.com and give a DL link

Remover notified

6

OTL was included in the first post. It was small enough to fit alone, but not big enough with the other two.

7

Could you uninstall Adaware antivirus please. Then let me know whether or not ZA is still blocking

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF


:Commands
[CREATERESTOREPOINT]
[resethosts]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

8

Essex has arrived :slight_smile:

9

Script needed for ZA

10

Zone Alarm = ZA :slight_smile:

11

Uninstalled Ad-Aware, ran with OTL fix with included script.

Still getting some blocked inbound access attempts in ZoneAlarm (69 in 10 minutes) but no outbound, don’t know if that’s relevant. I tested by only having Windows firewall on and no suspicious sites seem to show up on Avast last scanned list.

12

I believe it was Adaware trying to update unencrypted virus definitions. Inbound attempts can be ignored if ZA is blocking them. How is the computer behaving otherwise

13

Well, that’s embarrassing. The system is operating optimally, haven’t had any performance issues. I’m guess the only malware I’m a victim of is my own paranoia. Thanks.

14

Better to be safe than sorry :slight_smile:

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

15

All right. Thanks.