New Virus/malware found

Eddy · 2017-10-03T19:31:46.000Z

https://forum.avast.com/index.php?topic=209388.msg1423858#msg1423858

You sure was!

system · 2017-10-03T20:29:09.000Z

“If you wish help, here are some tools and logs that will speed up the process of getting you clean.”

If you are referring to the above line taken from that thread you posted, there is nothing there asking me to provide logs. and the 1st step in those instructions say to run MalwareBytes…which I have already stated it won’t run, neither will other virus/malware type software now. To me, it looks like whatever got into my system removed the use of those programs.

Since I am using the free version of Avast, apparently I have no avenue other than the forums to inform someone of a (possibly) new virus/malware. But, I have downloaded and run the program Farbar Recovery Scan Tool. If you tell me which part of the 2 files (FTST.txt and Addition.txt) you need, I will paste them here. I do not feel comfortable uploading a file with the info it contains to a public post.

Pondus · 2017-10-03T20:36:52.000Z

FRST logs are computer diagnostic logs, and both logs are needed. And don’t paste, attach logs

I have no avenue other than the forums to inform someone of a (possibly) new virus/malware.

Do you have a sample? It can be sendt to avast lab. See instructions >> https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

You can also check suspicious files at: www.virustotal.com / www.jotti.org / www.metadefender.com

So, I looked online for more info and found a program named [b]Reason Core Security[/b] that said it could get rid of the virus/malware. I

:P http://uk.pcmag.com/software/89944/review/reason-core-security

system · 2017-10-03T21:24:09.000Z

Pondus post:6:

FRST logs are computer diagnostic logs, and both logs are needed. And don’t paste, attach logs

I have no avenue other than the forums to inform someone of a (possibly) new virus/malware.
Do you have a sample? It can be sendt to avast lab. See instructions >> https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438
You can also check suspicious files at: www.virustotal.com / www.jotti.org / www.metadefender.com

I am trying to check the file via the sites you posted. Another oddity with this file that makes me believe it is a virus/malware is the fact that using Windows Commander (file manager) with hidden files turned on I cannot see the file in the directory. But when I navigate to it via windows explorer I can. I cannnot see it when checking (so far) virustotal.com. However, I was able to copy it to another directory (I know, probably not a good idea) and check it from there. Unfortunately, all three sites say the file is clean

So, I looked online for more info and found a program named [b]Reason Core Security[/b] that said it could get rid of the virus/malware. I
:P http://uk.pcmag.com/software/89944/review/reason-core-security

Pondus · 2017-10-03T21:32:55.000Z

Malware expert is notified.

system · 2017-10-03T21:38:38.000Z

Pondus post:8:

Malware expert is notified.

Not sure what you are saying? File is suspicious? After rebooting, the file is there in the running processes and trying to end the process gets a unable to terminate the process. Operation could not be completed, access is denied.

Pondus · 2017-10-03T21:42:33.000Z

kingkoz1313 post:9:

Pondus post:8:

Malware expert is notified.

Not sure what you are saying? File is suspicious? After rebooting, the file is there in the running processes and trying to end the process gets a unable to terminate the process. Operation could not be completed, access is denied.

Malware expert will check the FRST logs you attached when he is online

You may post link to VirusTotal scan result here

system · 2017-10-03T21:53:43.000Z

Pondus post:10:

kingkoz1313 post:9:

Pondus post:8:

Malware expert is notified.

Not sure what you are saying? File is suspicious? After rebooting, the file is there in the running processes and trying to end the process gets a unable to terminate the process. Operation could not be completed, access is denied.

Malware expert will check the FRST logs you attached when he is online

You may post link to VirusTotal scan result here

There were no results all three URLs you posted reported zero of whatever scans they did. All said the file was clean. BUT, the only way I could test the file was copy it to another directory so I guess to be technical, I didn’t check the actual (possibly) infected file. There is also a directory C:\program files\mbcdhze being created after each reboot (I can delete the directory b4 reboot) and it is empty. I am assuming it has to do with the file c:\windows\system32\sneiukpsvc.exe.

Pondus · 2017-10-03T22:29:22.000Z

There were no results all three URLs you posted reported zero of whatever scans they did. All said the file was clean.

There are additional file info given when you scan it, like file type, who made it, digitally signed, seen before, ......... And lots more

SassDrake · 2017-10-04T00:55:11.000Z

Did you install BOINC?

system · 2017-10-05T03:04:10.000Z

Sass Drake post:13:

Did you install BOINC?

I installed BOINC back in 1999 and have been running it fine since. I have not updated it for a few months either.

SassDrake · 2017-10-05T09:50:29.000Z

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

BootExecute: autocheck autochk * bddel.exe
FF user.js: detected! => C:\Users\KingKoz\AppData\Roaming\Mozilla\Firefox\Profiles\eeiipjvw.default-1489569338083\user.js [2017-03-18]
VirusTotal: C:\Windows\system32\sneiukpsvc.exe

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

system · 2017-10-05T15:25:58.000Z

here is the fixlog.txt you requested

SassDrake · 2017-10-06T17:01:13.000Z

File seems to be clean according to VirusTotal result but follow Pondus isntruction for uploading suspicious files to Avast.
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

system · 2017-10-06T18:38:40.000Z

Sass Drake post:17:

File seems to be clean according to VirusTotal result but follow Pondus isntruction for uploading suspicious files to Avast.
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

Thanks for the help. I have more info for you. I booted into safe mode and was then able to delete the sneiukpsvc.exe file as well as the c:\program files\mbcdhze directory. That directory appears after rebooting and is empty. Looking at the same directory a few minutes later it was full of dll’s and other files as well as a LOCALE directory. Inside that directory are 2 language file dirs…us-en and zh-cn. I am not positive but I think zh-cn is a chinese language file. Seems odd that ONLY those 2 language files are there. Makes me think this is originally from China. Unfortunately, after rebooting from safe mode, the sneiukpsvc.exe and the mbcdhze have returned. My system seems fine after reboot but as time goes by I notice it slowing down. There are moments of total freeze, nothing crashes, everything freezes for a short time then back to normal. I have also noticed that programs that were running after reboot (i.e. checked my email with Thunderbird, firing up AVG PC Tuneup) will not start up. The task for that program is in the task manager but clicking on it gives a window saying the operation could not be completed. access denied. Since I am administrator (and the only one that uses this pc) it looks like this issue has changed my access as well. The only way I can start a program at that point is to reboot my system.

Anyway, I will follow the instructions to upload the suspect file as soon as I can. thanks again

system · 2017-10-06T18:49:57.000Z

Sass Drake post:17:

File seems to be clean according to VirusTotal result but follow Pondus isntruction for uploading suspicious files to Avast.
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

Need more help. I went to the thread you posted, found the submit a file section, click the BROWSE button, but when I surf to the location of the file, it is not listed. If I surf to the same directory going through my Computer/Program files the file is listed there. I have my system set to see hidden files. So how do I upload the alleged infected file? I also use Windows Commander (file manager application) and have that set to see hidden files but it also does not see this file. Can I drag & drop the file to your upload page? I can copy the suspect file to another firectory and upload that but I would think that is probably not a good idea. Please advise.

system · 2017-10-06T18:58:59.000Z

Sass Drake post:17:

File seems to be clean according to VirusTotal result but follow Pondus isntruction for uploading suspicious files to Avast.
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

Tried to upload infect file but had issues. See previous post. I did upload the file but it was the copied file so hopefully that will be ok. If not, I will need halp.

SassDrake · 2017-10-06T22:53:08.000Z

Scan your PC with this:

http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe

and attach C:\TDSSKiller_*.txt to your post.

system · 2017-10-07T15:03:16.000Z

Sass Drake post:21:

Scan your PC with this:

http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe

and attach C:\TDSSKiller_*.txt to your post.

I have downloaded the tdsskiller you suggested and all that happens when I click it is I get the run dialog. I click yes and nothing happens. I have search the directory the file ran from as well as looked for a c:\tdsskiller.txt you requested and cannot find it.

SassDrake · 2017-10-07T20:04:25.000Z

Try running TDSSKiller in Safe Mode.

Announcements