Threat sucured message ictkjkmd.top connection aborted

system · 2017-11-07T17:29:40.000Z

I’ve been getting this “Threat secured” message over the last couple of days:
Threat name: URL:Mal

URL: http://ctkjkmd.top/techred/?br=chrome&lang=engnew24&n=%2B1-888-694-2167

process: C:\Users\Craig\AppData\Local\vsdgbtk\wirlhpx.exe

Detected by: Web Shield

Status: Connection aborted

I’ve done several searches for the URL listed and the .exe mentioned, but can’t find any info. I’ve tried to delete the folder and exe mentioned but only get a message saying I don’t have permissions even when I am an administrator on the system. OS is Windows 7 Pro with all updates installed. Any help would be appreciated. Thanks!

Pondus · 2017-11-07T17:59:27.000Z

URL:Mal mean Blacklisted URL or IP

URL is down http://downforeveryoneorjustme.com/ctkjkmd.top

Since it seems to contain what looks like a phone number at the end, my guess it is related to Fake Alert and call xxxxx number to get support

C:\Users\Craig\AppData\Local\vsdgbtk\wirlhpx.exe

upload and scan the file wirlhpx.exe here >> www.virustotal.com Post link to scan result here

You may have some malware that need to be removed.
If you want help, follow instructions here >> https://forum.avast.com/index.php?topic=194892.0

system · 2017-11-07T18:54:39.000Z

When I tried to upload the file to www.virustotal.com, I get an access denied message. I’ve scanned the drive and the specific folder already with both Malwarebytes and Avast and neither reports any problems. So it seems like the problem has to do with using my web browser. I’ll probably try doing a system restore from a couple of days ago and see whether that gets rid of the folder.

Pondus · 2017-11-07T18:58:17.000Z

Follow step 2 in the instructions i gave link to
attach the two diagnostic logs from FRST and a expert will have a look

system · 2017-11-07T21:01:45.000Z

I’m in the process of running a Malwarebytes scan with the root kits option enables as suggested; however, I got another Avast message saying that wirlhpx.exe had been quarantined. It may be that the problem is solved. Is it reasonable to assume the threat is neutralized? I’ve also noticed that I am unable to run system restore, even from a newly created system repair disc. When I tried to I got a message saying that there were no restore points. Ay Yi Yi.

Pondus · 2017-11-07T21:05:59.000Z

Is it reasonable to assume the threat is neutralized?

Read my post above again

system · 2017-11-07T21:10:35.000Z

OK, I’m running FRST64.exe. I’ll post the logs as soon as it is done.

system · 2017-11-07T21:14:12.000Z

Logs are attached.

SassDrake · 2017-11-07T21:42:05.000Z

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\Run: [ Maintance] => "C:\Program Files\\net1.exe" windowsStartup
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: E - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {34a40282-5427-11e6-9ffe-f82fa8e6e870} - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {a4cabf1d-55b8-11e6-b568-f82fa8e6e870} - I:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-4113727973-3948558827-3579228898-1001\...\MountPoints2: {a69de2c5-50d5-11e6-8efe-806e6f6e6963} - Q:\LenovoQDrive.exe
cmd: type "C:\Users\Craig\Documents\sub_drvs.bat"
GroupPolicy: Restriction <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
VirusTotal: C:\Program Files\net1.exe;C:\Users\Craig\AppData\Local\vsdgbtk\wirlhpx.exe;C:\Windows\system32\Drivers\sbsvzcfi.sys
C:\Program Files\net1.exe
C:\Users\Craig\AppData\Roaming\et
C:\Users\Craig\AppData\Local\PCBooster
C:\Windows\system32\atozxdh
C:\Windows\SysWOW64\atozxdh
C:\Users\Craig\AppData\Local\pwdxlbk
C:\Users\Craig\AppData\Local\vsdgbtk
C:\Windows\system32\Drivers\sbsvzcfi.sys

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

system · 2017-11-07T21:59:06.000Z

Done! Fixlog.txt attached.

SassDrake · 2017-11-07T22:27:12.000Z

What is system status now?

system · 2017-11-07T22:34:20.000Z

I haven’t seen the original message for awhile. System Restore will still not launch either from the Windows menu, Run command or from command prompt.

SassDrake · 2017-11-07T22:37:14.000Z

Do you get any error message?

system · 2017-11-07T22:43:06.000Z

No, nothing happens at all. I even tried creating a new restore point earlier. It said it created successfully, but still no dice.

bob3160 · 2017-11-07T22:53:03.000Z

You may want to look at the following:
https://forum.avast.com/index.php?topic=164936.msg1284599#msg1284599

system · 2017-11-07T23:06:48.000Z

I downloaded and installed and it shows the restore point I created before. I assume that there should be others. Is it possible that the malware deleted them? Can you tell whether the original problem has been removed?

bob3160 · 2017-11-07T23:09:19.000Z

cglasser post:16:

I downloaded and installed and it shows the restore point I created before. I assume that there should be others. Is it possible that the malware deleted them? Can you tell whether the original problem has been removed?

It is quite possible but Sass Drake would be the expert to confirm that.

system · 2017-11-07T23:12:03.000Z

OK, I’ll assume so for now. Thanks very much for all of your help!

bob3160 · 2017-11-07T23:21:31.000Z

You’re welcome.

SassDrake · 2017-11-07T23:40:33.000Z

Malware you had should not be reason why System Restore Apllication won’t open. Follow these instructions and tell us results.
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

Announcements