Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Online Armor Showing Suspect Processes


  • Please log in to reply
4 replies to this topic

#1 maximianusherculius

maximianusherculius

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Lexington, KY
  • Local time:04:28 AM

Posted 25 January 2010 - 07:53 PM

Online Armor is showing the following processes: IKUEKA.exe; mkunicode.dll; N.exe; OGVQGBUQM.exe; PCDLIB32.dll; sdthlpr.sys; YXOB.exe; advcheck165.tmp

Most of these (ones ending in .exe) are named "Rootkit detection utility, 1.70"

I have not specified to Online Armor whether to "block" or "allow" these yet. Online Armor is set to "ask" currently, with the exception of advcheck165.tmp. It is set as "allowed"

I opened Online Armor earlier today and none of these were listed. Since then, I have installed a new version of Internet Explorer and InterActual Player. I, shortly after install, removed them both because I did not end up needing them. I downloaded them only because the DVD I wanted to play had an icon I clicked that said I needed IE and InterActual Player to play the movie (The Last Samurai). I do not usually use IE anyway.

I have viewed my running processes via Spy DLL Remover and Process Explorer. I see nothing unusual going on. Please give me some piece of mind.

Edited by maximianusherculius, 25 January 2010 - 09:07 PM.

Windows XP Professional 2002 sp3 32bit (ACPI Multiprocessor PC); Google Chrome and Mozilla w/Keyscramble
Processors: Twin Dual Core E5200's @ 2.5 GHz & 2 GB of RAM;..... MOTHERBOARD: INTEL
Hard Drive: Seagate 240GB ST3250310AS;..... SECURITY: Realtime is Avira (free) and Online Armor (free)
DVD/CD Drive: ATAPI DVD A DH20A4P;..... MALWARE Scanners: MBAM, SAS
WIRELESS: Linksys Wireless-N USB Network Adapter;..... DISPLAY Adaptors: NVIDIA GeForce 7300 SE/7200 GS

BC AdBot (Login to Remove)

 


#2 maximianusherculius

maximianusherculius
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Lexington, KY
  • Local time:04:28 AM

Posted 31 January 2010 - 09:30 PM

I have resolved this. thanks
Windows XP Professional 2002 sp3 32bit (ACPI Multiprocessor PC); Google Chrome and Mozilla w/Keyscramble
Processors: Twin Dual Core E5200's @ 2.5 GHz & 2 GB of RAM;..... MOTHERBOARD: INTEL
Hard Drive: Seagate 240GB ST3250310AS;..... SECURITY: Realtime is Avira (free) and Online Armor (free)
DVD/CD Drive: ATAPI DVD A DH20A4P;..... MALWARE Scanners: MBAM, SAS
WIRELESS: Linksys Wireless-N USB Network Adapter;..... DISPLAY Adaptors: NVIDIA GeForce 7300 SE/7200 GS

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:28 AM

Posted 01 February 2010 - 12:23 PM

Why not tell us how?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 maximianusherculius

maximianusherculius
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Lexington, KY
  • Local time:04:28 AM

Posted 05 February 2010 - 12:27 PM

I'm sorry. Kind of selfish of me.

Some of them were nothing. At least one, OGVQGBUQM.exe, was obviously malware related.

I ran ComboFix (glitches in CFix were gone). Then I individually copied the FILE and DRIVER entries from Qoobox and pasted them in notepad as CFScript.txt and saved them to the desktop (two seperate CFScript.txt shortcuts, one for FILES, and one for DRIVERS). I then dragged the CFScript.txt desktop shrotcuts, one per scan, (Qoobox FILES in one, and the Qoobox DRIVERS in another) to the combofix icon, and let ComboFix do its thing.

I ran MBAM and SAS to make sure all was clear. I then Rebooted. Next, I turned off system restore and ran Mbam and SAS again. Then I created a new restore point. All is well now. :thumbsup:

Edited by maximianusherculius, 05 February 2010 - 12:59 PM.

Windows XP Professional 2002 sp3 32bit (ACPI Multiprocessor PC); Google Chrome and Mozilla w/Keyscramble
Processors: Twin Dual Core E5200's @ 2.5 GHz & 2 GB of RAM;..... MOTHERBOARD: INTEL
Hard Drive: Seagate 240GB ST3250310AS;..... SECURITY: Realtime is Avira (free) and Online Armor (free)
DVD/CD Drive: ATAPI DVD A DH20A4P;..... MALWARE Scanners: MBAM, SAS
WIRELESS: Linksys Wireless-N USB Network Adapter;..... DISPLAY Adaptors: NVIDIA GeForce 7300 SE/7200 GS

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,969 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:28 AM

Posted 05 February 2010 - 02:25 PM

I ran ComboFix (glitches in CFix were gone).

Please note the message text in blue at the top of this forum.

No one should be using ComboFix unless specifically instructed to do so by a Malware Removal Expert who can interpret the logs. Please read the pinned topic ComboFix usage, Questions, Help? - Look here.

With that said, I'm glad you were successful and the issue has been resolved.


Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all critical updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. If you're not sure how to do this, see Microsoft Update helps keep your computer current.

Avoid gaming sites, porn sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, uTorrent). They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Porn sites can lead to the Trojan.Mebroot MBR rootkit and other dangerous malware. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs and infections install themselves, read:Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. To learn more about this risk, please read:Many security experts recommend you disable Autorun asap as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...

Microsoft Security Advisory (967940): Update for Windows Autorun
How to Maximize the Malware Protection of Your Removable Drives

Other security reading resources:Browser Security resources:• Finally, if you need to replace your anti-virus, firewall or need a reliable anti-malware scanner please refer to:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users