BleepingComputer.com: invisible malware in plain sight

Greetings BC experts,

Anyone heard of this "seekservice.exe", seekservice127.exe, .dll, .jar and uninstall.exe?

I'm running a pc w/windows xp sp3.

I downloaded some free video conversion software which turned out to be a bait and switch.
I uninstalled it using Add/Remove. After the uninstall, a message popped up reading that the software had been removed, but some files were left that I must manually remove (are you kidding me?).

Turns out the software in question, created and left behind several folders and files for me to tend to:
c:\documentsandsettings\AllUsers\ApplicationData\SeekService\seekservice127.exe
c:\ProgramFiles\SeekService\uninstall.exe, seekservice.exe, seekservice.dll
c:\ProgramFiles\SeekService\SeekService_deleted_\seekservice.exe, seekservice.dll

In addition, I found files in my Firefox directory: seekservice.jar and seekservice127.xml
c:\ProgramFiles\MozillaFireFox\extensions\{86009AEF-9162-4EBC-B698-FF7D7B6B049}\chrome
c:\ProgramFiles\MozillaFireFox\searchplugins

I can see in the task manager that seekservice is running both .exe and ''127.exe
I'm rather apprehensive removing this unknown malware via the convenient "uninstall.exe"
so "kindly" left behind in c:\ProgramFiles\SeekService\uninstall.exe, as referred to in the directory
described above.


It appears to be invisible to Avg free (8.5), Malwarebytes, Root Repeal, and SuperAntiSW.

So far I haven't found much info Googeling this malware.
Is is a simple rightclick delete?
How I should proceed in safely removing it?

Thank you in advance

This post has been edited by alittlehelp: 22 September 2009 - 12:06 PM

Hello and welcome.
First use the END TASK button in TAsk Manager to stop them.

Next stop them at Start up/

Download Autoruns, search for the related entry and then delete it.

Create a new folder on your hard drive called AutoRuns (C:\AutoRuns) and extract (unzip) the file there. (click here if you're not sure how to do this.)
Open the folder and double-click on autoruns.exe to launch it.
Please be patient as it scans and populates the entries.
When done scanning, it will say Ready at the bottom.
Scroll through the list and look for a startup entry related to the file(s) in the error message.
Right-click on the entry and choose delete.
Reboot your computer and see if the startup error returns.



Next run MBAM (MalwareBytes):

NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop.

Please download Malwarebytes Anti-Malware and save it to your desktop.

alternate download link

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Hi, and thanks for the help.

AutoRun's a nifty little tool. Located and deleted the seekservice running process from start up.
It did not re-appear in the task manager after reboot.

As requested, below is the subsequent mbam log. (quick scan as requested):


Malwarebytes' Anti-Malware 1.41
Database version: 2847
Windows 5.1.2600 Service Pack 3

9/23/2009 1:19:29 AM
mbam-log-2009-09-23 (01-19-29).txt

Scan type: Quick Scan
Objects scanned: 92548
Time elapsed: 3 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


I see that MBAM, came back clean. Although, the files(.exe, .dll), and folders containing
SeekService still remain in my root directory.

Hi inside MBAM is another cool tool....FILE ASSASSIN...you can use it to delete those other files.
OK, let's use MBAM's FileAssassin feature.

Open MBAM again.

Click the More Tools tab and then the Run Tool button
Now browse to the file(s) we want to remove using the drop down box next to Look in: at the top.
Locate the file(s), click Open.
You will be prompted with a message warning: This file will be permanently deleted. Are you sure you want to continue?. Click Yes.
If removal did not require a reboot, you will receive a message indicating the file was deleted successfully, however, I recommend you reboot anyway.

Quote

Hi Boopme,

Yet another outstanding little tool in the pen knife of my AV arsenal - I never knew about.
Mbam/fileassasin is awesome. I will have to remember to use it again (if needed) with much discretion.

I ran a couple of final scans after removal/reboot of the offending 8 seekservice files.
Rootrepeal reported back with an error requiring a ckdsk reboot.
Ran ATF, MBAM, SAS and Rootrepeal. All reported clean. Task manager looks good too

So far so good!

Thanks!

Good job!!
Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
  
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

• Then use Disk Cleanup to remove all but the most recently created Restore Point.
  
• Go to Start > Run and type: Cleanmgr
  
• Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  
• Click the "More Options" tab, then click the "Clean up" button under System Restore.
  
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  
• Click Yes, then click Ok.
  
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
  
• Disk Cleanup will remove the files and close automatically.

Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Hi,

Done.

Your advice on all the proceedures were a tremendous education to me.
There were so many tools at my disposal I never knew about - or (like most),
too busy to make the time to learn about.
This was my first experience using/creating Restore Points. I've always been nervous about
what might happen to my previous work if I went back too far. Burned through a lot of CD-Rs in the
past couple of years.

Working with visual media - had I known about restore points in the past, I could have avoided many
sleepless nights having to recreate days of lost works due to system instability or viral compromise.

Another nice one Boop!

Thanks!

Boopme that was such a sick post man I have the same problem and you spelled it greatly. Thanks heaps.