Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Repeated attacks "Hard drive failure" malware/virus


  • Please log in to reply
8 replies to this topic

#1 pinksnowsunshine

pinksnowsunshine

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:00 AM

Posted 16 June 2011 - 09:26 PM

Hello,

I keep getting attacks from a virus that claims that hard drive is failing. When it happens, all my desktop icons disappear and my laptop keeps restarting. I have tried Malware Bytes, Super Anti Spyware, Hitman Pro. Each time, the anti malware program seems to get rid of the malware, and I then use "unhide" to restore my icons. This works for about a day but after a while the malware ALWAYS comes back, randomly! sometimes my laptop will just be on, I'd be listening to music and not even surfing on the internet, and the malware will suddenly appear.

Moreover, sometimes, random audio adverts will start playing on my laptop. These last about 1-2 min.

A third problem - My browsers have become incredibly slow, and I have the 'redirect' problem on both firefox and IE. This means that everytime I perform a search, I have to manually select the result's url and paste it into the address bar.

These multiple problems have been going on for about 2 weeks and it's exhausting me.

Can anyone help me clean this laptop please, it's my work tool and I can't do anything without it :( I would so buy a new one if I had the money but I can't afford it at the moment.

Edited by hamluis, 17 June 2011 - 11:28 AM.
Moved from MRL to AII.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,035 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:00 AM

Posted 16 June 2011 - 10:04 PM

Hello, as you didn;t state your Operating System (OS)...Go here
http://www.bleepingcomputer.com/virus-removal/page/5/

Use the Removal Guide that matches your OS..eg Windows Vista Recovery (Uninstall Guide)
Click on the guides name to open the guide.
After reading how the malware is misleading you ...
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 pinksnowsunshine

pinksnowsunshine
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:00 AM

Posted 17 June 2011 - 05:04 AM

Thanks for your reply.
I followed all the instructions and my redirect problem is solved. Does that mean that all traces of the malware have been removed? Here's my MBAM log:


Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 6874

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

17/06/2011 10:59:30
mbam-log-2011-06-17 (10-59-30).txt

Scan type: Full scan (C:\|)
Objects scanned: 279173
Time elapsed: 1 hour(s), 27 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\user\application data\adobe\plugs\mmc27368640.txt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\user\application data\Adobe\plugs\mmc27368906.txt (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\documents and settings\user\application data\Sun\Java\deployment\cache\6.0\18\351eb552-5cb0b38e (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\user\application data\Sun\Java\deployment\cache\6.0\18\351eb552-77bb9b17 (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\user\local settings\temporary internet files\content.ie5\or3en73t\windows-update-sp4-kb66877-setup[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\user\local settings\temporary internet files\Content.IE5\OR3EN73T\windows-update-sp4-kb89609-setup[1].exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
c:\system volume information\_restore{1e75a07d-b750-44a8-abb6-0c7dedf6e7cf}\rp802\a0148453.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\user\application data\Adobe\shed\thr1.chm (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\user\application data\Adobe\plugs\mmc182.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\user\application data\Adobe\plugs\mmc36.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,035 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:00 AM

Posted 17 June 2011 - 11:01 AM

Hello,good job. We should run an online scan and be sure there is nothing left.

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Under scan settings, check Posted Image and check Remove found threats
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NOTE: In some instances if no malware is found there will be no log produced.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 pinksnowsunshine

pinksnowsunshine
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:00 AM

Posted 18 June 2011 - 02:02 AM

this is what I got:

C:\Documents and Settings\Jenny\Local Settings\Temporary Internet Files\Content.IE5\CHEB8LIJ\HistoryFrame_13.3.3227.0707[1].html Win32/Ramnit.A virus cleaned - quarantined
C:\Documents and Settings\Jenny\Local Settings\Temporary Internet Files\Content.IE5\OLIROLQN\evpadr[1].html Win32/Ramnit.A virus cleaned - quarantined
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\05A3S1M7\corp[1].gif a variant of Java/TrojanDownloader.OpenStream.NAZ trojan deleted - quarantined
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\05A3S1M7\dezh[1].gif a variant of Java/TrojanDownloader.OpenStream.NAZ trojan deleted - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\0\6685d300-20afbfae Java/Exploit.CVE-2010-4452.A trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\10\55390a0a-1bde1fdc multiple threats deleted - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\12\3cc664c-40a2555b probably a variant of Java/Exploit.CVE-2010-4452.A trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\16\31bdcfd0-58d692a1 multiple threats deleted - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\19\33c7d6d3-12b34fdd Win32/Spy.Zbot.YW trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\19\33c7d6d3-2b921872 Win32/Spy.Zbot.YW trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\19\33c7d6d3-4aaae927 Win32/Spy.Zbot.YW trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\20\3878d94-21f47c5e a variant of Java/Agent.BP trojan deleted - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\30\18698d5e-3e4b9905 a variant of Win32/Kryptik.NPP trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\34\c669a2-76a9e830 multiple threats deleted - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\54\6e45fa36-33ec350c Java/TrojanDownloader.OpenStream.NCA trojan deleted - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\61\4e4ae3d-57038d5f multiple threats deleted - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\62\60d9c47e-29fd5950 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\62\60d9c47e-2a11f3e4 a variant of Java/TrojanDownloader.OpenStream.NCE trojan cleaned by deleting - quarantined
C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\cache\6.0\9\3c21dc49-7c11c8da Java/Agent.CO trojan deleted - quarantined
C:\Documents and Settings\user\Desktop\Temp\New Folder (3)\New Folder (2)\bookmarks.html Win32/Ramnit.A virus cleaned - quarantined
C:\Documents and Settings\user\Local Settings\Temp\jar_cache1307477735530190359.tmp a variant of Java/Exploit.CVE-2010-0842.L trojan deleted - quarantined
C:\Documents and Settings\user\Local Settings\Temp\jar_cache1672198930943375585.tmp multiple threats deleted - quarantined
C:\Documents and Settings\user\Local Settings\Temp\jar_cache2085227172605081197.tmp a variant of Java/Exploit.Agent.NAL trojan deleted - quarantined
C:\Documents and Settings\user\Local Settings\Temp\jar_cache5128430576508820676.tmp multiple threats deleted - quarantined
C:\Documents and Settings\user\Local Settings\Temp\jar_cache7766542967422498710.tmp a variant of Java/Exploit.Agent.NAL trojan deleted - quarantined
C:\Documents and Settings\user\Local Settings\Temp\jar_cache9197565106541810205.tmp a variant of OSX/Exploit.Smid.D trojan deleted - quarantined
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\IBG2XLS2\shostkon2_com[1].htm HTML/Iframe.B.Gen virus deleted - quarantined
C:\Documents and Settings\user\My Documents\Archived bookmarks.html Win32/Ramnit.A virus cleaned - quarantined

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,035 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:00 AM

Posted 18 June 2011 - 10:20 AM

Unfortunately this is what I was afaid of. I'm afraid I have very bad news.

Win32/Ramnit (and related variants) is a dangerous file infector with IRCBot functionality which infects .exe, and .HTML/HTM files, and opens a back door that compromises your computer. Using this backdoor, a remote attacker can access and instruct the infected computer to download and execute more malicious files. The infected .HTML or .HTM files may be detected as The infected .HTML or .HTM files may be detected as Virus:VBS/Ramnit.A or VBS/Generic. Win32/Ramnit.A!dll is a related file infector often seen with this infection. It too has IRCBot functionality which infects .exe, .dll and .HTML/HTM files and opens a back door that compromises your computer. This component is injected into the default web browser by Worm:Win32/Ramnit.A which is dropped by a Ramnit infected executable file.

-- Note: As with most malware infections, the threat name may be different depending on the anti-virus or anti-malware program which detected it. Each security vendor uses their own naming conventions to identify various types of malware.With this particular infection the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

Why? The malware injects code in legitimate files similar to the Virut virus and in many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files often become corrupted and the system may become unstable or irreparable. The longer Ramnit.A remains on a computer, the more files it infects and corrupts so the degree of damage can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies Worm:Win32/Ramnit.A with a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.

In my opinion, Ramnit is not effectively disinfectable, so your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. Security vendors that claim to be able to remove file infectors cannot guarantee that all traces of it will be removed as they may not find all the remnants. If something goes awry during the malware removal process there is always a risk the computer may become unstable or unbootable and you could loose access to all your data.

Further, your machine has likely been compromised by the backdoor Trojan and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if your anti-virus reports that the malware appears to have been removed.

Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:

Whenever a system has been compromised by a backdoor payload, it is impossible to know if or how much the backdoor has been used to affect your system...There are only a few ways to return a compromised system to a confident security configuration. These include:
• Reimaging the system
• Restoring the entire system using a full system backup from before the backdoor infection
• Reformatting and reinstalling the system

Backdoors and What They Mean to You

This is what Jesper M. Johansson at Microsoft TechNet has to say: Help: I Got Hacked. Now What Do I Do?.

The only way to clean a compromised system is to flatten and rebuild. That’s right. If you have a system that has been completely compromised, the only thing you can do is to flatten the system (reformat the system disk) and rebuild it from scratch (reinstall Windows and your applications).


How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 pinksnowsunshine

pinksnowsunshine
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:08:00 AM

Posted 18 June 2011 - 03:42 PM

Thank you for your reply,

I am going to attempt to reformat my OS myself, but I have just one question..How can I easily backup all my files? It there any cost-friendly way of doing this?

Thanks again

#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,035 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:00 AM

Posted 18 June 2011 - 04:11 PM

Caution: If you are considering backing up data and reformatting, keep in mind, with a Virut /Eamnit infection, there is always a chance of backed up data reinfecting your system. If the data is that important to you, then you can try to salvage some of it but there is no guarantee so be forewarned that you may have to start over again afterwards if reinfected by attempting to recover your data. Only back up your important documents, personal data files, photos to a CD or DVD drive, not a flash drive or external hard drive as they may become compromised in the process. The safest practice is not to backup any executable files (*.exe), screensavers (*.scr), autorun (.ini) or script files (.php, .asp, .htm, .html, .xml ) files because they may be infected by malware. Avoid backing up compressed files (.zip, .cab, .rar) that have executables inside them as some types of malware can penetrate compressed files and infect the .exe files within them. Other types of malware may even disguise itself by hiding a file extension or adding to the existing extension as shown here (click Figure 1 to enlarge) so be sure you look closely at the full file name. If you cannot see the file extension, you may need to reconfigure Windows to show file name extensions. Then make sure you scan the backed up data with your anti-virus prior to to copying it back to your hard drive.

If your CD/DVD drive is unusable, another word of caution if you are considering backing up to an external usb hard drive as your only alternative. External drives are more susceptible to infection and can become compromised in the process of backing up data. I'm not saying you should not try using such devices but I want to make you aware of all your options and associated risks so you can make an informed decision if its worth that risk.Again, do not back up any files with the following file extensions: exe, .scr, .ini, .htm, .html, .php, .asp, .xml, .zip, .rar, .cab as they may be infected.

If you're not sure how to reformat or need help with reformatting, please review:These links include step-by-step instructions with screenshots:Vista users can refer to these instructions:Don't forget you will have to go to Microsoft Update and apply all Windows security patches after reformatting.

Note: If you're using an IBM, Sony, HP, Compaq or Dell machine, you may not have an original XP CD Disk. By policy Microsoft no longer allows OEM manufactures to include the original Windows XP CD-ROM on computers sold with Windows preinstalled. Instead, most computers manufactured and sold by OEM vendors come with a vendor-specific Recovery Disk or Recovery Partition for performing a clean "factory restore" that will reformat your hard drive, remove all data and restore the computer to the state it was in when you first purchased it. See Technology Advisory Recovery Media. If the recovery partition has become infected, you will need to contact the manufacturer, explain what happened and ask them to send full recovery disks to use instead..

If you need additional assistance with reformatting or partitioning, you can start a new topic in the Operating Systems Subforums forum.

You're welcome..

Edited by boopme, 18 June 2011 - 04:12 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#9 unlucky-Satellite

unlucky-Satellite

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:00 AM

Posted 27 June 2011 - 03:13 AM

I want to say thanks to you guys my hard drive has been giving me a failure code and my microsoft essentials never found these nor did malware bytes or spybot search and destroy and the link given above found multiple ones so far and my when i started it up last it gave me a

Smart Failure Predicted on Hard disk 4 hitachi ht554161612j95a00 ata device (s3) Volume D:

Which is weird cause my C: is the one thats supposedly failing heres the list of virus's it picked up that nothing else picked up and any reason why my defrag programs wont totally defrag my C:? ive been trying since long before this failure alerts have happened, its all System Volume Files and Hibernation type files its weird.

C:\Program Files\Search Toolbar\SearchToolbar.dll Win32/Toolbar.Zugo application cleaned by deleting - quarantined
C:\Users\William\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\21IP67VH\evfile[1].js JS/Exploit.Agent.NBU trojan cleaned by deleting - quarantined
C:\Users\William\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OAPWG1N1\index[4].htm JS/Kryptik.AG trojan cleaned by deleting - quarantined
C:\Users\William\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WU2EA8GI\yd0e[1].htm HTML/TrojanDownloader.FraudLoad.NAC trojan cleaned by deleting - quarantined
F:\Seagate Backup\WILLIAM-PC\C\Program Files\Search Toolbar\SearchToolbar.dll Win32/Toolbar.Zugo application cleaned by deleting - quarantined




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users