Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

fake security scan and internet search redirect


  • This topic is locked This topic is locked
14 replies to this topic

#1 uncle_buck

uncle_buck

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:57 AM

Posted 11 September 2011 - 06:19 PM

Attached File  Attach.txt   14.54KB   1 downloads
Attached File  DDS.txt   23.76KB   4 downloads

I started getting a fake security scan that popped up on my screen and would not allow any other programs to run. There was also a new icon on my desktop for "Defender.exe". I re-booted in safe mode and ran Malwarebytes. It removed the threats and I deleted the link on my desktop, but the pop ups and icon would re-appear after a day or two. I've been running Malwarebytes whenever it reappears. I haven't seen the fake scan in a while, but now I'm getting a re-direct when clicking on the results page of an internet search.

I ran the dss and attach log files and am attaching them to this post. Any help you can provide will be GREATLY appreciated.

Edited by Orange Blossom, 11 September 2011 - 09:55 PM.
Adjusted spacing for ease of reading. ~ OB


BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 18 September 2011 - 06:20 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/418531 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 uncle_buck

uncle_buck
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:57 AM

Posted 18 September 2011 - 08:34 PM

As requested, here are updated dds and attach files.

Attached Files



#4 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 18 September 2011 - 09:29 PM

Hello and welcome. Please follow these guidelines while we work on your PC:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until Iíve given you the ďAll clear.Ē Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please note that the forum is very busy and if I don't hear from you within five days this thread will be closed.
Posted Image Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link
--------------------------------------------------------------------

Double click on ComboFix.exe & follow the prompts.
  • If you have trouble, stop and post back. Do not try to repeatedly run comboFix!
  • When finished, it will produce a report for you.
.
Please include the following in your next post:
  • ComboFix log

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#5 uncle_buck

uncle_buck
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:57 AM

Posted 18 September 2011 - 11:44 PM

Here is the ComboFix log file.

Attached Files



#6 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 19 September 2011 - 07:19 PM

uncle_buck:

Please do this next:

Posted Image Go to the Control Panel
  • In the search bar enter Show hidden
  • In the main window click on Folder Options > Show hidden files and folders
  • Change the setting under Hidden files and folders to Show hidden files, folders, or drives
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
virscan.org
Virus Total

Click on Browse, and upload the following file for analysis:
c:\windows\SysWow64\instnm.exe
c:\windows\SysWow64\user.exe


Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.

Please include the following in your next post:
  • File analysis results

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#7 uncle_buck

uncle_buck
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:57 AM

Posted 19 September 2011 - 10:03 PM

RPMcMurphy -
I appreciate your taking the time to help me with this problem. Here are the results of the 2 scans.


VirSCAN.org Scanned Report :
Scanned time : 2011/09/19 21:49:59 (CDT)
Scanner results: Scanners did not find malware!
File Name : instnm.exe
File Size : 7680 byte
File Type : PE32 executable for MS Windows (console) Intel 80386 32-bit
MD5 : 4cb37840a10bf884493597b98135cce0
SHA1 : 2647ea337b0b1db57d59a9773dfcd8042b10c536
Online report : http://r.virscan.org/32bfe09fc76b4ea7507d0ee5a8ca0664

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.3 20110920104252 2011-09-20 0.30 -
AhnLab V3 2011.09.19.00 2011.09.19 2011-09-19 2.13 -
AntiVir 8.2.6.64 7.11.14.233 2011-09-19 0.30 -
Antiy 2.0.18 20110920.12551854 2011-09-20 0.02 -
Arcavir 2011 201109061639 2011-09-06 2.44 -
Authentium 5.1.1 201109192056 2011-09-19 1.69 -
AVAST! 4.7.4 110919-1 2011-09-19 0.00 -
AVG 8.5.850 271.1.1/3907 2011-09-20 0.26 -
BitDefender 7.90123.9208791 7.39080 2011-09-20 4.45 -
ClamAV 0.97.1 13638 2011-09-19 0.01 -
Comodo 5.1 10173 2011-09-19 1.95 -
CP Secure 1.3.0.5 2011.09.12 2011-09-12 0.03 -
Dr.Web 5.0.2.3300 2011.09.20 2011-09-20 14.96 -
F-Prot 4.6.2.117 20110919 2011-09-19 1.45 -
F-Secure 7.02.73807 2011.09.19.05 2011-09-19 0.28 -
Fortinet 4.2.257 14.150 2011-09-19 0.12 -
GData 22.2077 20110920 2011-09-20 0.12 -
ViRobot 20110919 2011.09.19 2011-09-19 0.39 -
Ikarus T3.1.32.20.0 2011.09.20.79403 2011-09-20 4.95 -
JiangMin 13.0.900 2011.09.19 2011-09-19 2.40 -
Kaspersky 5.5.10 2011.09.19 2011-09-19 0.17 -
KingSoft 2009.2.5.15 2011.9.19.18 2011-09-19 1.82 -
McAfee 5400.1158 6474 2011-09-19 10.01 -
Microsoft 1.7604 2011.09.19 2011-09-19 7.15 -
NOD32 3.0.21 6475 2011-09-19 0.02 -
Norman 6.07.11 6.07.00 2011-09-17 16.02 -
Panda 9.05.01 2011.09.19 2011-09-19 2.30 -
Trend Micro 9.500-1005 8.438.14 2011-09-19 0.03 -
Quick Heal 11.00 2011.09.19 2011-09-19 1.45 -
Rising 20.0 23.76.00.03 2011-09-19 2.49 -
Sophos 3.23.2 4.69 2011-09-20 3.90 -
Sunbelt 3.9.2500.2 10526 2011-09-19 0.63 -
Symantec 1.3.0.24 20110919.007 2011-09-19 0.00 -
nProtect 20110919.01 12786772 2011-09-19 1.27 -
The Hacker 6.7.0.1 v00300 2011-09-19 0.53 -
VBA32 3.12.16.4 20110919.0730 2011-09-19 4.24 -
VirusBuster 5.3.0.4 14.0.221.0/62551662011-09-19 0.01 -


VirSCAN.org Scanned Report :
Scanned time : 2011/09/19 21:54:48 (CDT)
Scanner results: Scanners did not find malware!
File Name : user.exe
File Size : 2048 byte
File Type : PE32 executable for MS Windows (console) Intel 80386 32-bit
MD5 : 2ffebe5594387b71b57f3a0eb07ef078
SHA1 : 8eee000acd11caae031a57e0215584b82c237941
Online report : http://r.virscan.org/a5d713d9bc1057a6e821f414988d574f

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.1.0.3 20110920104252 2011-09-20 0.33 -
AhnLab V3 2011.09.19.00 2011.09.19 2011-09-19 3.43 -
AntiVir 8.2.6.64 7.11.14.233 2011-09-19 0.29 -
Antiy 2.0.18 20110920.12551854 2011-09-20 0.02 -
Arcavir 2011 201109061639 2011-09-06 2.47 -
Authentium 5.1.1 201109192056 2011-09-19 1.58 -
AVAST! 4.7.4 110919-1 2011-09-19 0.01 -
AVG 8.5.850 271.1.1/3907 2011-09-20 0.29 -
BitDefender 7.90123.9208791 7.39080 2011-09-20 5.47 -
ClamAV 0.97.1 13638 2011-09-19 0.01 -
Comodo 5.1 10173 2011-09-19 1.99 -
CP Secure 1.3.0.5 2011.09.12 2011-09-12 0.02 -
Dr.Web 5.0.2.3300 2011.09.20 2011-09-20 15.65 -
F-Prot 4.6.2.117 20110919 2011-09-19 1.03 -
F-Secure 7.02.73807 2011.09.19.05 2011-09-19 3.67 -
Fortinet 4.2.257 14.150 2011-09-19 0.13 -
GData 22.2079 20110920 2011-09-20 0.11 -
ViRobot 20110919 2011.09.19 2011-09-19 0.42 -
Ikarus T3.1.32.20.0 2011.09.20.79403 2011-09-20 4.97 -
JiangMin 13.0.900 2011.09.19 2011-09-19 1.73 -
Kaspersky 5.5.10 2011.09.19 2011-09-19 0.11 -
KingSoft 2009.2.5.15 2011.9.19.18 2011-09-19 0.95 -
McAfee 5400.1158 6474 2011-09-19 10.58 -
Microsoft 1.7604 2011.09.19 2011-09-19 4.37 -
NOD32 3.0.21 6475 2011-09-19 0.02 -
Norman 6.07.11 6.07.00 2011-09-17 20.03 -
Panda 9.05.01 2011.09.19 2011-09-19 2.11 -
Trend Micro 9.500-1005 8.438.14 2011-09-19 0.03 -
Quick Heal 11.00 2011.09.19 2011-09-19 2.21 -
Rising 20.0 23.76.00.03 2011-09-19 2.32 -
Sophos 3.23.2 4.69 2011-09-20 6.71 -
Sunbelt 3.9.2500.2 10527 2011-09-19 0.76 -
Symantec 1.3.0.24 20110919.007 2011-09-19 0.31 -
nProtect 20110919.01 12786772 2011-09-19 1.22 -
The Hacker 6.7.0.1 v00300 2011-09-19 0.52 -
VBA32 3.12.16.4 20110919.0730 2011-09-19 4.34 -
VirusBuster 5.3.0.4 14.0.221.0/62551662011-09-19 0.00 -

#8 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 19 September 2011 - 10:20 PM

uncle_buck:

Please do this next:

Posted Image Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\utilman.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\volmgr.lnk
c:\users\Owner\AppData\Local\volmgr.exe
Driver::
Beeprvhbp_w

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

Posted Image


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Posted Image You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Uncheck any entries from C:\System Volume Information or C:\Qoobox
  • Make sure that everything else is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Please include the following in your next post:
  • ComboFix log
  • MBAM log

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#9 uncle_buck

uncle_buck
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:57 AM

Posted 20 September 2011 - 07:50 AM

Here are the ComboFix and Mbam files.

Attached Files



#10 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 20 September 2011 - 04:00 PM

uncle_buck:

How is your computer running now? Please do this next:

Posted Image Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Java™ can be updated from the Java control panel Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. If it does not, let me know.

Once the install is complete...

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
    • Trace and Log Files
  • Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
Posted Image Please go to here to run an online scan with ESET.
    • Turn off the real time scanner of any existing antivirus program while performing the online scan
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Click Start
    • Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
    • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
Please include the following in your next post:
  • How is the computer running?
  • ESET log

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#11 uncle_buck

uncle_buck
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:57 AM

Posted 20 September 2011 - 09:36 PM

I updated Java and ran ESET. I'm attaching the ESET log file. The fake security scans have not popped up since running malwarebytes a few days ago. But in the past it has gone up to a week after a scan before re-appearing.
Thanks.

Attached Files

  • Attached File  ESET.txt   768bytes   2 downloads


#12 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 20 September 2011 - 09:51 PM

uncle_buck:

ESET considers your oovoo apps to be adware. If you wish to remove them, simply do so through Control Panel > Programs > Uninstall a program

This will take care of the other detections:

Posted Image Open notepad and copy/paste the text in the quotebox below into it:

@echo off
del "C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Default\ppbibhokgoacccnddkfhjblehkehdfhc\contentscript.js"
del "C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Default\ppbibhokgoacccnddkfhjblehkehdfhc\contentscript.js"
del /Q %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this: Posted Image
Right click on fix.bat, select 'Run as administrator' & allow it to run.

Now all I have left for you is another update and some very important cleanup:

Posted Image Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version. Be sure to watch for and uncheck any boxes offering to install other software.

Posted Image Uninstall ComboFix
  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
    Combofix /Uninstall
Posted Image

Posted Image Delete the following tools along with any other logs you saved from our work:
  • DDS
Posted Image Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
Posted Image Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application and MBAM current and updated. Scan with them at least weekly.
  • Please read this post for some helpful information.
Please post once more so I know you are all set and I can mark this thread resolved. Good luck and stay safe!

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#13 uncle_buck

uncle_buck
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:03:57 AM

Posted 20 September 2011 - 11:01 PM

Thank you for all of your help! I completed all of the final tasks and saved the tips link for future reference.
Have a great evening.

#14 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 21 September 2011 - 08:52 PM

You're welcome, uncle_buck. Take care.

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#15 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:57 AM

Posted 27 September 2011 - 08:49 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users