Unknown Malware Disabling A/v?

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > HijackThis Logs and Malware Removal

Forum Guidelines

Read this topic before posting a log.

DO NOT post a ComboFix log unless requested to.

Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

2 Pages

1 2 >

Unknown Malware Disabling A/v?, A/V found something but I don't know what

Options

Blender View Member Profile	Aug 7 2008, 12:44 PM Post #2
I will eat your Malware Group: HJT Team Coach Posts: 2,237 Joined: 14-November 04 From: Ontario Member No.: 5,056	Hi and welcome, Sorry for the delay. We have been backlogged. If you still need help please do the following: Enable system to show hidden files. How to: http://www.bleepingcomputer.com/tutorials/tutorial62.html don't forget to hide files/folders when we are finished cleaning. Locate & delete: (if present) C:\Documents and Settings\jayme\Application Data\Sun\Java\Deployment\cache\6.0\33\54407b61-639f766b G:\DOWNLOAD\Utilities\SmitfraudFix.exe <-- this is not malware but the tool is updated too often to keep it around. I'd like to rule out false positive on those files on N drive. Scan these 3: N:\ACCSoft\AC.exe N:\ACCSoft\DBEdit.exe N:\ACCSoft\SiteSetup.exe At this site & post results: http://www.virustotal.com/en/indexf.html Next: Please be logged into the "Lynn" account then... Click start> run> type: "%userprofile%\desktop\dss.exe" /config Hit OK> hit "scan" & post results of both logs here. ---------------------------- My additional questions: With the possible exception of "Judi" are they all local accounts or do the users have to log onto the machine from elsewhere? The "Judi" account looks like she would log into the machine from elsewhere. Correct? Reason I ask is because those kind of logins are dealt with a bit different in terms of cleanup than local logins. The N drive -- Is it Data storage only? What was on that drive before? I just find it odd that seems to be the only one affected with "Email-Worm.Win32.Magistr.b.corrupted" which is a damaged varient of: http://www.trendmicro.com/vinfo/virusencyc...2EB&VSect=T Thanks -------------------- I'll have an order of massive trojan attack please with a side order of rootkit and virus dip. Pre-course order of fresh spyware salad please with a side order of polymorphic dressing. And to drink...a nice tall glass of adware! For dessert; can I have a bowl of the freshest worms you have please?. Never Give Up! If you are happy with the service I provided, please consider making a donation to help me continue the fight against Malware

LynnBR View Member Profile	Aug 7 2008, 05:18 PM Post #3
Member Group: Members Posts: 16 Joined: 22-July 08 Member No.: 224,414	Blender, Thanks for getting to me. Will be about an hour before I can run DSS on system again but have started on other activities and can answer your questions now. Deleted smitfraudfix. Ran 3 files on N drive through VirusTotal. N is a mapped drive to accounting software on our server. I may be dense but couldn't figure out how to save the scan results other than copy/paste, so did that into a txt document which I have attached. There was an awful lot of text in the report, didn't want to fill up this space with all that, so attached instead. Hope that is not a problem. Can repost inline if you'd like. Judi was a local account. No users should be logging into this machine from elsewhere. This is receptionist computer; when other employees need to cover phones/front desk they log in and work from here. Thanks, Lynn Attached File(s) ACCscans.txt ( 35.5k ) Number of downloads: 5 -------------------- Lynn Plan as if you will live forever but live as if you might die tomorrow

Blender View Member Profile	Aug 8 2008, 12:46 PM Post #5
I will eat your Malware Group: HJT Team Coach Posts: 2,237 Joined: 14-November 04 From: Ontario Member No.: 5,056	Hi, Thanks for the logs. Attaching the txt file of virustotal results is fine. Those 3 files you can delete from the N drive. Sorry about the dss scan -- I forgot to have you "check all" at the config window. However -- since you have several accounts on the machine I would like to have a look at those too in case something strange is being started from a different user account. See, when you have several user accounts -- each user has their own desktop, settings and so on. So it is much like having 17 different computers to check. We'll use a different program for checking... If anything is found in this log we can use an admin level account to fix everyone rather than having to log into each account seperately. Since we have been working from the "Lynn" account -- I would preferr to keep working from there if possible. This will save confusion if we have to fix anything. download OTScanIT.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIT on your desktop. Note: You must be logged on to the system with an account that has Administrator privileges to run this program. Close ALL OTHER PROGRAMS. Open the OTScanIT folder and double-click on OTScanIT.exe to start the program At the top checkmark "Scan all users" In the Drivers section click on Non-Microsoft. In the rootkit section click on yes Under Additional Scans click the checkboxes in front of the following items to select them: Reg - BotCheck File - Additional Folder Scans Do not change any other settings. Now click the Run Scan button on the toolbar. Let it run unhindered until it finishes. When the scan is complete Notepad will open with the report file loaded in it. Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it. You can close this log file. Please zip up & attach the file "OTScanIT.txt" in your next reply as it will be way too long to copy/paste log here. I ask for it zipped because we are limited in how much attachment space we have so zipping large logs will save space. Don't forget to re-enable antivirus. While waiting for me to get back -- I highly advise uninstalling older versions of Java. Old Java versions are exploitable. Go to add/remove programs and uninstall All versions of Java and J2RE except Java™ 6 Update 7 Reboot when done. Keep in mind when installing new Java versions the installer does not remove the old. Having old versions can allow malicious sites to "call up" old Java installs to carry out their exploits. I also advise uninstalling Acrobat Reader 8 & installing the new version. Your version is exploitable. New version here: http://www.adobe.com/products/acrobat/readstep2.html UNcheck google toolbar before installing Reader if you don't want it. As with Java -- Adobe installer does not check for & uninstall old versions either. Thanks ps. If no reply back from me in say 24 hours --- please shoot me a PM. -------------------- I'll have an order of massive trojan attack please with a side order of rootkit and virus dip. Pre-course order of fresh spyware salad please with a side order of polymorphic dressing. And to drink...a nice tall glass of adware! For dessert; can I have a bowl of the freshest worms you have please?. Never Give Up! If you are happy with the service I provided, please consider making a donation to help me continue the fight against Malware

LynnBR View Member Profile	Aug 8 2008, 02:16 PM Post #6
Member Group: Members Posts: 16 Joined: 22-July 08 Member No.: 224,414	Here's the log. I'll work on the Java and Adobe items. It's also Friday afternoon, I have to leave early, and since I hope to avoid the office this weekend, I won't bug you unless it's well over 48 hours before I hear back from you. As for the 3 files on N drive, I need to see what they are. Can't just go deleting files from the accounting software now, can we? Thanks again! Lynn Attached File(s) OTScanIt.zip ( 28.17k ) Number of downloads: 6 -------------------- Lynn Plan as if you will live forever but live as if you might die tomorrow

Blender View Member Profile	Aug 9 2008, 05:46 PM Post #7
I will eat your Malware Group: HJT Team Coach Posts: 2,237 Joined: 14-November 04 From: Ontario Member No.: 5,056	Hi, Thanks for the log. I am looking at it now & will reply back shortly with recommendations. As for those 3 files on the N drive -- if they were in fact legit part of your accounting software -- I highly suggest replacing them with backups. What is the date created/modified compared to other files in that directory? I hate to see that thing get executed... I don't think it can execute properly as the scanners from VT seem to indicate a damaged virus but -- This virus can do alot of damage. http://www.trendmicro.com/vinfo/virusencyc...2EB&VSect=T You may also want to upload copies to your AV company & have them check it out. Possible the virus portion can be removed and leave file itself intact if you don't have backups. Your AV may have an option to upload suspicious files? Anyhoo -- be back shortly. -------------------- I'll have an order of massive trojan attack please with a side order of rootkit and virus dip. Pre-course order of fresh spyware salad please with a side order of polymorphic dressing. And to drink...a nice tall glass of adware! For dessert; can I have a bowl of the freshest worms you have please?. Never Give Up! If you are happy with the service I provided, please consider making a donation to help me continue the fight against Malware

Blender