BleepingComputer.com: Malware Nastiness

Sorry for the huge post, it ended up much longer than I thought it would...

Nightmare Backstory

Starting a couple weeks ago, I started getting the bad google organic search results that redirected through doubleclick.net when using Mozilla Firefox (and maybe MSIE, can't remember). Opera et al do not have the problem. Flushing my DNS, hosts file and running MBAM seemed to fix the problem, at least for a while, but the same thing would sometimes recur. MBAM and the like generally took care of the problem. I'm not sure if the rest of the nastiness stemmed from the search result redirects or what, but it's been pretty ugly. It's been a long drawn out process, so the order of stuff might be a little out of whack, but I think it's mostly right.

I started getting the fake MS Security Essentials alert thing going on. I knew immediately that it wasn't real since I don't use MSSE for my AV software, so I didn't follow any of the "scan online" business or install any new AV software, etc. (but I did click the "apply actions" and "close" buttons). I'm getting the fake alert so I figure, run MBAM and get rid of it, so I run MBAM and it finds something like 9 bad things between executables and registry entries during the scan. I tell MBAM to clean the bad things and it tries, but it hangs up (probably because the bad stuff is still running) so I end up doing a hard restart.

I think it was at this point that Win XP stopped booting (last thing loaded is giveio.sys; it would have been mup.sys, but speedfan added on giveio.sys). I go into recovery console, run CHKDSK (which finds and repairs errors), system still wont boot into safe or normal mode, but "last good config" boots but is very slow and eventually starts the fake Security Essentials alerts again.


Current Situation

So after going through this whole process that involves a barrage of rkill, MBAM, avast, Spybot S&D, avast and AdAware, CHKDSK, /flushdns, cleaning host files, tdsskiller, etc., all scans seem to be coming up clean and the system appears to be booting into Windows XP ok, but...

After XP boots, it's VERY slow and explorer seems to be unresponsive for 5-10 minutes. After that period, the PC seems to be functioning fine. During this ordeal, I found a thread of someone who had this problem, but now I can't find it. What could be causing this? The scanners seem to think my system is clean. I'm not getting the MSSE alert anymore. Firefox just now did the doubleclick.net redirect thing again though (I've temporarily stopped using FF for now).

What are good next steps? I plan on running the most up to date versions of each of MBAM, S&D, AdAware and Avast! several times each. Should I just do that and hope for the best, or is there something else I should do. I want to get some of my work done and run these scans now, while the PC seems to be working OK, so I haven't restarted again after the latest scans to see if it's still slow.

What is your advice for action to take in either case (still-slow or back-to-normal after reboot)? I want to get some advice now before I go restarting in case something goes south before/during/after the reboot.


Edit to add:

FF doesn't seem to be redirecting me to doubleclick.net at the moment, but search results seem to take a LONG time to come up after clicking on them (if they come up at all). I'm still wary of using google on FF though, since I don't have the little happy certificate icon that says it's genuine plus search suggestions don't pop up when I type a query (which I've notice seems to happen when the redirect thing is going).

This post has been edited by masfonos: 20 October 2010 - 09:30 PM

I ran MBAM and AdAware again last night and they removed a couple more things (mostly cookies, a couple trojans). Also ran Avast and I got the dreaded explorer.exe and winlogon.exe infection by Win32:Bamital-AF. I ran HitManPro 3.5.7.116 (which I gather replaces both of those files with clean ones). Both files show clean now from Avast and AdAware.

At this point, the computer seems to boot normally, go through the windows start up screen normally, then it shows my wallpaper, desktop icons and taskbar, but the taskbar is unresponsive. Clicking icons, folders, etc. on the desktop behaves normally, I can run programs from desktop folders, etc. but when I mouse-over the taskbar teh cursor turns to a hourglass. The clock stops at the time the taskbar appears. After 30 or so minutes, the windows start-up sound plays, the clock shows the correct time, the taskbar, start menu, etc. become responsive and the computer appears to behave normally.

I'm going to continue to run successive scans with various security software for a while to see if that clears it up.

Ideas?

Hello, let's see what ESET shows,
Please perform a scan with Eset Online Antiivirus Scanner.
This scan requires Internet Explorer to work. Vista/Windows 7 users need to run Internet Explorer as Administrator.
To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.

• Click the green button.
  
• Read the End User License Agreement and check the box:
  
• Check .
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Check
  
• Check Remove found threats and Scan potentially unwanted applications. (If given the option, choose "Quarantine" instead of delete.)
  
• Click the Start button.
  
• ESET will then download updates for itself, install itself, and begin scanning your computer.
  
• If offered the option to get information or buy software at any point, just close the window.
  
• The scan will take a while so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.
  
• When the scan completes, push
  
• Push , and save the file to your desktop as ESETScan.txt.
  
• Push the button, then Finish.
  
• Copy and paste the contents of ESETScan.txt in your next reply.

Note: A log.txt file will also be created and automatically saved in the C:\Program Files\EsetOnlineScanner\ folder.
If you did not save the ESETScan log, click > Run..., then type or copy and paste everything in the code box below into the Open dialogue box:

C:\Program Files\ESET\EsetOnlineScanner\log.txt

• Click Ok and the scan results will open in Notepad.
  
• Copy and paste the contents of log.txt in your next reply.

-- Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

NOTE: In some instances if no malware is found there will be no log produced.

ESET log. Will restart in a few minutes and see what happens. Will be back with a report.

Quote

Hello, Exploit:JS/Pdfka, Adobe Reader and Acrobat versions 8.1.2 and earlier are affected by the vulnerabilities exploited by this malware.
This means you should update these two applications. From control Panel add/Remove,(tick the small box that says show updates.
highlght each and there should be a choice for updating.




What version of JAVA is running?
Go into Control Panel>Add Remove Programs. Be sure the 'Show Updates' box is checked. Go down the list and tell me what Java applications are installed and their version. (Highlight the program to see this).

boopme, on 21 October 2010 - 08:23 PM, said:

I did have 9.1.0 but I just did the update to 9.4.0.

Quote

Had Java 6 update 11, just updated to Java 6 update 22.


Long boot time persists.

Hello, be sure to remove older versions in control panel. The new Java installer will now remove older versions but the older ones didn't,,just check. If there remove and reboot.

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal/regular mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


How is it doing now?

Old versions were already gone from Add/Remove dialog.

AdAware was running earlier and it finished up. Results:
and it wanted rebooted to "completely remove the threats." After reboot, the machine looked like it was going to be normal, but then the start button/taskbar/etc. became unresponsive for roughly 30 minutes (although, as before, desktop icons are still usable including folder navigation, program execution, etc.).

MBAM reports a clean bill of health:

Quote

Firefox is still being bad. Google search results being redirected (to 66.230.188.67)

Next steps? Run AAW, Avast! or something else again? I seem to recall using the gorred tool in the past when this problem was manifesting; thoughts on that?

Yes, I think we may get it all with these 2 now

Please read and follow all these instructions.

• Please download GooredFix and save it to your Desktop.
  
• Double-click GooredFix.exe to run it.
  
• A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called Goored.txt).

Please run the tool here How to remove Google Redirects

When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

Quote

TDSSKiller showed clean.

I'll try restarting now and report back on the resulting behavior.

Restarted and it's the same story. Taskbar/start button/clock is stuck, desktop icons, folder navigation, application execution are all still functional. I don't really understand that; I thought that both the taskbar and the folder navigation were explorer.exe. Why would one work but not the other?

It's between 30-40 minutes before it becomes responsive every time. After that, it acts perfectly normal.

Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files

NOTE for Vista users..The command needs to be run from an elevated Command Prompt.
Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the XP CD when asked.

OK, will try that after this current scan completes. Will it cause additional headaches that the disc is the original SP1 and I'm now at SP3? Will it hose everything up if it finds missing/bad files and replaces them with old ones?

It should only repair what it can and I believe tell if ut cannot.