Malware attack

avastuser3796 · 2014-04-20T18:25:45.000Z

samlemx post:1:

Hi All,
I am hoping someone can help me out with this. I am trying to clean up a friends computer and after installing avast to help with that process, the web shield just went crazy with “…blocked a harmful webpage or file.” If I am not connected to the internet it doesn’t do it. Even if IE isn’t open, it will set and cycle through those blocks. As I am typing this, it has logged 51 blocks.

The PC is a Windows 7 Home Premium SP1, 32 bit. I know I could reinstall the OS, which would probably be easier, but since this isn’t my PC, I would prefer to not have to do that and make sure I put everything back.

So far I have tried:
Avast
Malwarebytes
CCleaner
Microsoft Security Essentials
combofix

Malwarebytes picked up on a lot of things, I quarantined them, then ran CCleaner to finish cleaning registry issues. Avast found nothing, nor did MSE. Combofix appeared to clean some things up. After Combofix rebooted the PC, the Avast popups started right back up with blocking things. I am not really sure what else to try on this. Seems like this malware is set in and ready to fight. Any ideas?

Thanks Much,
Sam

Combofix should only be run with a qualified person with you. Not solo.

system · 2014-04-20T18:41:03.000Z

Monitoring the situation. Looks like another Blackbeard issue. Attach the OTL.txt and Extras.txt when done.

system · 2014-04-20T18:57:11.000Z

I know I probably shouldn’t have gone solo with combofix, maybe not a great judgment call, but the PC still works so I must not have done too bad. Anyway, here are the other files. Sorry for the delay, got distracted with other stuff.

system · 2014-04-20T19:01:54.000Z

Please be patient while I analyze you logs. Since I am a mentee my replies need to be approved by an expert here to ensure you the best result. Thank you for your forbearance.

system · 2014-04-20T19:05:21.000Z

thank you all very much for taking this time to help me out. Maybe I can learn a thing or two. Viruses, malware, etc. are definitely not my specialty. Thanks again.

Sam

avastuser3796 · 2014-04-20T19:43:27.000Z

Mentee means Trainee by the way

system · 2014-04-21T03:17:54.000Z

I have submitted my fix for you to my teacher and will post it here after his approval.

@Michael, I love playing with words. ;D

system · 2014-04-21T10:56:45.000Z

Hi samlemx,
If you still experience avast! alerts, it is normal. Stay with me till the end.

[*]Step #1 Fix with OTL
[*]Re-run OTL by right clicking and choosing Run as administrator;
[*]Under the Custom Scans/Fixes Box copy and paste the following contents inside the code box.

:Commands
[createrestorepoint]

:OTL
IE - HKU\S-1-5-21-2670899690-1136335791-712615611-1000\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80798&lng=en
IE - HKU\S-1-5-21-2670899690-1136335791-712615611-1000\..\SearchScopes\{EF4312C2-87D6-40DE-BDF0-C47FDF81B391}: "URL" = http://websearch.shopathome.com?user_id=%guid&q={searchTerms}
[2014/04/01 18:44:22 | 000,000,064 | ---- | M] () -- C:\Windows\System32\eclydv.own
[2014/04/01 18:44:22 | 000,000,000 | ---- | M] () -- C:\Windows\System32\ulwhr.cso
[2014/04/01 18:27:53 | 000,299,344 | --S- | M] () -- C:\Windows\System32\dxhceav.baq
[2014/04/01 18:27:53 | 000,000,000 | --S- | M] () -- C:\Windows\System32\cdmfnjy.ysk
[2014/04/01 18:27:53 | 000,000,000 | --S- | M] () -- C:\Windows\System32\aaaj.mcg
[2014/04/01 18:55:58 | 000,000,078 | ---- | C] () -- C:\Windows\System32\fkzzesn.pqa
[2013/10/04 18:02:35 | 000,000,000 | -HSD | M] -- C:\Users\Compouter\AppData\Local\Google\Desktop\Install\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\❤≸⋙\Ⱒ☠⍨\<U+202E>ﯹ๛\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\L
[2013/10/04 18:02:35 | 000,000,000 | -HSD | M] -- C:\Users\Compouter\AppData\Local\Google\Desktop\Install\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\❤≸⋙\Ⱒ☠⍨\<U+202E>ﯹ๛\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\U
[2009/07/13 23:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

:Commands
[emptytemp]

[*]Click on “Run Fix” and let the program run unhindered;
[]Your PC will reboot automatically and a log will be opened;
[]Please attach it in your next reply.
[/list][/list]

[*]Step #2 Run ComboFix Script
Make sure that you still have Combofix on your Desktop. If not, download it from here.
[list][*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –

FCopy::
c:\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll | c:\windows\System32\rpcss.dll
Reboot::

[list]
[*]Click on File > Save as…
[list][*]Inside the File Name box type CFScript.txt;
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Make sure your security programs are disabled while performing the actions. If you have difficulties, peruse this thread;
[*]Drag CFScript.txt into ComboFix.exe as shown in the screenshot below –

http://users.telenet.be/bluepatchy/miekiemoes/images/CFScript.gif
[/list]
ComboFix will now run a scan on your system. After the scan finishes, it will execute the script and reboot your computer automatically. Don’t reboot your computer manually, let ComboFix do it. Once your computer is rebooted, ComboFix will start preparing a log. Please let it do so unhindered. After a few minutes, it shall produce a log for you. Please attach the C:\ComboFix.txt in your next reply.

[*]Step #3 Scan with Farbar Recovery Scan Tool
[*]Please download Farbar Recovery Scan Tool by Farbar to your Desktop from the link below.
Download link for 32 bit system
Download link for 64 bit system
[*]Right-click on the program and choose Run as administrator;
[*]Put tick-mark on all boxes under Whitelist and Optional Scan;
[*]Click on Scan;
[]After the scan two notepad files will be opened –
[list][]FRST.txt;
[]Addition.txt[]Attach the contents of the logs in your next reply.[/list]

[*]Step #4 Scan with RogueKiller
[*]Download Rogue Killer from one of the suitable links below to your Desktop.
Download link for 32 bit system
Download link for 64 bit system
[*]Let the pre-scan finish. After that click on Scan;
[*]The scan won’t take long;
[*]A log has been created on your Desktop;
[*]Attach the content of the log in your next reply.

[*]Required Log(s):
[]OTL Fix Log;
[]ComboFix Log;
[]Farbar Recovery Scan Tool Log(s)–
[list][]FRST.txt;
[]Addition.txt
[]RogueKiller Report
[/list]

Regards,
Valinorum

system · 2014-04-21T22:49:07.000Z

Hi Valinorum,
Thank you for the post. Sorry for my delay. Trying to do this after work and the PC was running pretty slow. I did know the reference to being a “Mentee”

Per your request, I have attached the logs produced by the various programs. 4 attachments on this one, since that is the max, I will have another post.

Just to note, Avast has stopped going crazy with blocking those connections and the PC does seem to be running smoother, or I have just adapted to it’s slowness. It looked like Rogue Killer picked up on some items though. Let me know where to go next.

Thanks,
Sam

system · 2014-04-21T22:49:44.000Z

Rogue Killer log.

Thanks,
Sam

system · 2014-04-22T04:45:08.000Z

Hi,
I have submitted my fix to an Expert here and will post here after his approval. Thank you for your patience.

system · 2014-04-22T13:00:00.000Z

Hi samlemx,

We have one more big fish to fry.

[*]Step #5 Fix with RogueKiller
[*]Re-run RogueKiller. If you do not have it on your Desktop download it from the suitable link below.
Download link for 32 bit system
Download link for 64 bit system

[*]Let the pre-scan finish. After that click on Scan and wait for the scan to finish;
[*]Click on Delete;
[*]Now again click on Scan and wait for the scan to finish;
[*]Click on Report and a log file will open;
[*]Attach the report in your next reply.

[*]Step #6 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –

Start
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
C:\Windows\system32\fkzzesn.pqa
C:\Windows\system32\eclydv.own
C:\Windows\System32\ulwhr.cso
C:\Windows\System32\dxhceav.baq
C:\Users\Compouter\AppData\Local\Google\Desktop\Install
End

[*]Click on File > Save as…
[list][*]Inside the File Name box type fixlist.txt
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Re-run FRST.exe and click Fix;
[*]Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.[]After the completion, a log will be produced;
[]Attach the log in your next reply.[/list]

[*]Required Log(s):
[]RogueKiller Report;
[]FRST Fix Log

Regards,
Valinorum

system · 2014-04-22T21:01:57.000Z

Hi Valinorum,
I have attached the reports you requested. It looks like Rogue Killer cleaned up it’s findings. Avast has been quiet too. I know an absence of symptoms doesn’t mean it is in the clear, but it is certainly behaving better. Thank you again for your help. I have to ask, does it annoy you that this PC’s name is “compouter”? It sure bugged me when I first started working on this. ;D

Thanks,
Sam

system · 2014-04-22T21:23:00.000Z

How is your system running? I have seen weird usernames.

system · 2014-04-22T21:31:14.000Z

Compared to how it was when I started with it, it is running much smoother. I tried to create a folder 2 days ago to try and keep my logs organized and that took a couple of minutes after I right clicked just for the menu to come up. Now it takes a few seconds. I can also open and minimize IE without it being sluggish too. The last thing I want to do is give it a restart, since I left it on last night so I didn’t lose that Rogue Killer website that came up about what it found. I kind of stole the computer for stuff I needed to do before restarting though

system · 2014-04-22T21:36:40.000Z

Hi,
We are almost done. I have submitted my fix for you to an expert for his approval and will post it here afterwards. Thank you for your patience.

system · 2014-04-23T14:36:25.000Z

Hi samlemx,

[*]Step #7 Scan with Malwarebytes’ Anti-Malware
[*]Download Malwarebytes’ Anti-Malware from the suitable link below –
[list][]Download Link #1
[]Download Link #2
[]Download Link #3
[*]Double-click mbam-setup.exe to install the application.
[*]Before clicking Finish perform the following actions –
[*]Un-check the box beside Enable free trial of Malwarebytes Anti-Malware Premium.
[*]Check the box beside Launch Malwarebytes Anti-Malware
[*]Once the program has loaded, The MBAM dashboard will appear with an alert to update - click the green button Update Now;
[*]Click on Setting–
[*]Navigate to the tab Detection and Protection and check all the boxes under Detection Options
[*]From the Dashboard click on Scan Now;
[*]If threats are detected click on Apply actions. If the program asks to reboot your PC, let it do so;
[*]On completion of the scan click on View Detailed Log after that click on Export Button, select Text File and save the log to your Desktop;
[]Attach the log in your next reply.[/list]

[*]Step #8 ESET Online Scanner
Disable your security programs which includes but not limited to anti-virus, anti-malware, anti-spyware et cetera. Peruse this for additional information.
[*]Go here from Internet Explorer and click on Run ESET Online Scanner.
[list][*]Note: If you use any browser other than Internet Explorer, you will have to download and install esetsmartinstaller_enu.exe when prompt to run the scan.
[*]Accept their terms and condition and proceed.
[*]Install Add-On/Active X if prompted.
[*]From the Computer Scan Setting –
[*]Uncheck the box beside Remove Found Threats;
[*]Check the box beside Scan archives
[*]Click on Advanced Setting and check the following boxes–
[*]Scan for potentially unwanted applications
[*]Scan for potentially unsafe applications
[*]Enable Anti-Stealth Technology
[*]Click on Start and wait for the virus signature database to update.
[*]The online scan will begin automatically and can take several hours.
[*]Note: Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.
[*]After the Scan finishes –
[*]If no threats were found:
[list][*]Put a checkmark in Uninstall application on close.
[*]Close the program and report that nothing was found
[*]If threats were found:
[*]Navigate to the log file located at C:\Program Files\ESET\ESET Online Scanner\log.txt (32-bit) or C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt (64-bit).
[*]Attach the log file in your next reply.[/list][/list]
Note: Enable your security programs afterwards.

[*]Required Log(s):
[]MBAM Log;
[]ESET Scan Log

Regards,
Valinorum

system · 2014-04-24T10:08:14.000Z

Hi Valinorum,
That last scanner took quite awhile, 6 hours, and it found some more items. Doing this before work this time so I have to be quick ;D Here are my logs. As always, thanks much!

Thanks,
Sam

system · 2014-04-24T14:50:53.000Z

Can you re-attach the ESET log? The log you have attached does not contain any data.

system · 2014-04-24T23:15:19.000Z

uh oh! That was the log that was in my C Drive. Luckily, I kept that window open and it allows me to export the items it found, so try this one. Sorry about that.

Thanks,
Sam

Announcements