Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Latest Malware Bytes release has found 29 infections so far


  • Please log in to reply
4 replies to this topic

#1 Victor43

Victor43

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:06:57 PM

Posted 15 February 2011 - 08:00 PM

Hello all.

I'm running Windows XP SP3 with no AntiVirus and 3rd party Firewalls. Unfortunately I did not install any Antivirus or firewall except for the Windows XP built in firewall. Now I'm getting redirects and the odd popups when using Firefox and End programs on XP shutdown. I'm seeing 161.exe and ViewerViewer.exe, HandlerLink.exe fp4AwecFrontPage.exe WindowsWindows6.0.00.2900.5512.exe conhost.exe and csrss.exe running from the Windows Temp folder. The End Program window comes up for several of these programs where never before.

I'm running MalwareBytes latest release and its running a full scan and so far its found 28 infections. Can someone walk me through cleaning my system ?

Thanks in advance

Victor

Edit: Moved topic from XP to the more appropriate forum. ~ Animal

BC AdBot (Login to Remove)

 


#2 Victor43

Victor43
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:06:57 PM

Posted 16 February 2011 - 09:23 AM

Here is the result of the MAlwareBytes scan log.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5769

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

2/16/2011 9:21:53 AM
mbam-log-2011-02-16 (09-21-53).txt

Scan type: Full scan (C:\|)
Objects scanned: 173257
Time elapsed: 45 minute(s), 8 second(s)

Memory Processes Infected: 7
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 11
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 29

Memory Processes Infected:
c:\documents and settings\AUSER\application data\dwm.exe (Trojan.Downloader) -> 1664 -> Unloaded process successfully.
c:\documents and settings\AUSER\application data\microsoft\conhost.exe (Trojan.Downloader) -> 1936 -> Unloaded process successfully.
c:\program files\Adobe\Reader 8.0\Reader\plug_ins\multimedia\MPP\flashadobe.exe (Trojan.FakeAlert) -> 1428 -> Unloaded process successfully.
c:\program files\common files\System\windowswindows6.00.2900.5512.exe (Trojan.FakeAlert) -> 3080 -> Unloaded process successfully.
c:\program files\Adobe\Reader 8.0\Reader\handlerlink.exe (Trojan.FakeAlert) -> 3272 -> Unloaded process successfully.
c:\program files\Adobe\Reader 8.0\Reader\spplugins\managerdialog.exe (Trojan.FakeAlert) -> 3460 -> Unloaded process successfully.
c:\program files\common files\microsoft shared\web server extensions\40\bin\fp4awecfrontpage.exe (Trojan.FakeAlert) -> 3668 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\YahooAUServiceSharedAccess (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\ANTIVIRUS SYSTEM 2011 (Rogue.AntivirusSystem2011) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\AntiVirus System 2011 (Rogue.AntivirusSystem2011) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Downloader) -> Value: conhost -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QuickTimeAdobe (Trojan.FakeAlert) -> Value: QuickTimeAdobe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\SoftWarepgeqtot (Trojan.FakeAlert) -> Value: SoftWarepgeqtot -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\AdobeAdobe8.0.0.0 (Trojan.FakeAlert) -> Value: AdobeAdobe8.0.0.0 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\WAB32resWAB32 (Trojan.FakeAlert) -> Value: WAB32resWAB32 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\LinkViewer (Trojan.FakeAlert) -> Value: LinkViewer -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\pgeqtotSoftWare (Trojan.FakeAlert) -> Value: pgeqtotSoftWare -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\FrontPageMicrosoft (Trojan.FakeAlert) -> Value: FrontPageMicrosoft -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Value: load -> Delete on reboot.
HKEY_CURRENT_USER\Software\AntiVirus System 2011\BackgroundScan (Rogue.AntivirusSystem2011) -> Value: BackgroundScan -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Value: Shell -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Backdoor.Bot) -> Bad: (C:\DOCUME~1\AUSER\LOCALS~1\Temp\csrss.exe) Good: () -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\AUSER\application data\dwm.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\AUSER\application data\microsoft\conhost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Documents and Settings\AUSER\Local Settings\Temp\csrss.exe (Backdoor.Bot) -> Delete on reboot.
c:\program files\Adobe\Reader 8.0\Reader\plug_ins\multimedia\MPP\flashadobe.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\common files\System\windowswindows6.00.2900.5512.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\Adobe\Reader 8.0\Reader\handlerlink.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\Adobe\Reader 8.0\Reader\spplugins\managerdialog.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\common files\microsoft shared\web server extensions\40\bin\fp4awecfrontpage.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\actmoviev.exe (Trojan.Downloader) -> Delete on reboot.
c:\documents and settings\AUSER\local settings\Temp\2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\AUSER\local settings\Temp\3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\AUSER\local settings\temporary internet files\Content.IE5\E6I9FL4L\pics[1].scr (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\AUSER\local settings\temporary internet files\Content.IE5\RYZO7O0Q\pics[1].scr (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\program files\Adobe\Reader 8.0\Reader\plug_ins\imageviewer\en_US\viewerviewer_7.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\program files\internet explorer\conhost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\program files\windows nt\dwm.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\RECYCLER\s-1-5-21-57989841-484763869-1957994488-1003\Dc1.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\RECYCLER\s-1-5-21-57989841-484763869-1957994488-1003\Dc3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\RECYCLER\s-1-5-21-57989841-484763869-1957994488-1003\Dc5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{93f72491-6509-46b6-8ec1-c6ac1de1a7a3}\RP74\A0036679.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{93f72491-6509-46b6-8ec1-c6ac1de1a7a3}\RP74\A0036681.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\system volume information\_restore{93f72491-6509-46b6-8ec1-c6ac1de1a7a3}\RP74\A0036683.exe (Rogue.SecurityShield) -> Quarantined and deleted successfully.
c:\system volume information\_restore{93f72491-6509-46b6-8ec1-c6ac1de1a7a3}\RP74\A0036691.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{93f72491-6509-46b6-8ec1-c6ac1de1a7a3}\RP74\A0036695.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{93f72491-6509-46b6-8ec1-c6ac1de1a7a3}\RP74\A0036678.dll (Rogue.FakeHDD) -> Quarantined and deleted successfully.
c:\system volume information\_restore{93f72491-6509-46b6-8ec1-c6ac1de1a7a3}\RP74\A0036696.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\csrss.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\svchost.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
c:\documents and settings\AUSER\application data\microsoft\internet explorer\quick launch\antivirus system 2011.lnk (Rogue.AntivirusSystem2011) -> Quarantined and deleted successfully.

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,612 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:57 PM

Posted 16 February 2011 - 09:40 AM

Please download the TDSS Rootkit Removing Tool (TDSSKiller.zip) and save it to your Desktop. <-Important!!!
Be sure to print out and follow all instructions for performing a scan or refer to these instructions with screenshots.

  • Extract (unzip) the file to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the Desktop. Vista/Windows 7 users refer to these instructions if you're unsure how to unzip a file.
  • If you don't have an extracting program, you can download TDSSKiller.exe and use that instead.
  • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • When the program opens, click the Start Scan button.

    Posted Image
  • Do not use the computer during the scan
  • If the scan completes with nothing found, click Close to exit.
  • Any objects found, will show in the Scan results - Select action for found objects and offer three options.
  • If an infected file is detected, the default action will be Cure...do not change it.

    Posted Image
  • Click Continue > Reboot now to finish the cleaning process.<- Important!!

    Posted Image
  • If 'Suspicious' objects are detected, you will be given the option to Skip or Quarantine. Skip will be the default selection. Leave it as such for now.
  • A log file named TDSSKiller_version_date_time_log.txt will be created and saved to the root directory (usually Local Disk C:).
  • Copy and paste the contents of that file in your next reply.
-- If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these instructions. In some cases it may be necessary to redownload TDSSKiller and randomly rename it before downloading and saving to the computer.

-- For any files detected as 'Suspicious' (except those identified as Forged to be cured after reboot) get a second opinion by submitting to Jotti's virusscan or VirusTotal. In the "File to upload & scan" box, browse to the location of the suspicious file and submit (upload) it for scanning/analysis.


Rescan again with Malwarebytes Anti-Malware (Quick Scan) in normal mode and check all items found for removal. Don't forgot to check for database definition updates through the program's interface (preferable method) before scanning and to reboot afterwards. Failure to reboot normally will prevent Malwarebytes' from removing all the malware. When done, click the Logs tab and copy/paste the contents of the new report in your next reply.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 Victor43

Victor43
  • Topic Starter

  • Members
  • 57 posts
  • OFFLINE
  •  
  • Local time:06:57 PM

Posted 16 February 2011 - 05:32 PM

Thanks alot for the reply and help. I ran into issues with my computer with the BSOD showing itself on reboots. Then my firefox and ie stopped working no websites. So instead of spending too much time further I decided to reload Windows XP. All is working now with AntiVirus protection. Hopefully I'll be more careful next time.

Apperciate the help. You can go ahead and close this thread.

Victor

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,612 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:57 PM

Posted 16 February 2011 - 09:03 PM

Sorry to hear about having to reformat/reinstall but sometimes that is the best solution.

:thumbup2: Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all security updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. When necessary, Microsoft releases security updates on the second Tuesday of each month and publishes Security update bulletins to announce and describe the update. If you're not sure how to install updates, please refer to Updating your computer. Microsoft also recommends Internet 6 and 7 users to upgrade their browsers due to security vulnerabilities which can be exploited by hackers.

Avoid gaming sites, porn sites, pirated software (warez), cracking tools, and keygens. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. In some instances an infection may cause so much damage to your system that recovery is not possible and the only option is to wipe your drive, reformat and reinstall the OS.

Avoid peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, Kontiki, BitTorrent, BitComet, uTorrent, BitLord, BearShare). They too are a security risk which can make your computer susceptible to malware infections. File sharing networks are thoroughly infected and infested with malware according to Senior Virus Analyst, Norman ASA. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs install themselves and spread infections, read How Malware Spreads - How did I get infected.

Keeping Autorun enabled on flash drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. One in every eight malware attacks occurs via a USB device. Many security experts recommend you disable Autorun as a method of prevention. Microsoft recommends doing the same.

...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file...For more information about this issue, including download links for this non-security update, see Microsoft Knowledge Base Article 967715

Microsoft Security Advisory (967940): Update for Windows Autorun
Microsoft Article ID: 971029: Update to the AutoPlay functionality in Windows

Note: If using Windows 7, be aware that in order to help prevent malware from spreading, the Windows 7 engineering team made important changes and improvements to AutoPlay so that it will no longer support the AutoRun functionality for non-optical removable media.

Always update vulnerable software like Adobe Reader and Java Runtime Environment (JRE) with the latest security patches. Older versions of these programs have vulnerabilities that malicious sites can use to exploit and infect your system.
Change all passwords: Anytime you encounter a malware infection on your computer, especially if that computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised and change passwords as a precaution in case an attacker was able to steal your information when the computer was infected. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.

Security Resources from Microsoft:Other Security Resources:Browser Security Resources:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users