Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

windows security shield malware


  • Please log in to reply
3 replies to this topic

#1 lambertusjan

lambertusjan

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:53 AM

Posted 11 March 2012 - 05:10 PM

my daughters pc was infected with the security shield malware, a vicious piece of bleep.
So i ran thru the whole procedure with rkill and malwarebytes, however the full scan didnt detect any suspicious object.
when restarting the pc again in normal mode the virus was active again.

I may have only one route left, a complete windows reinstall (not my favourite).

anybody?

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:53 PM

Posted 11 March 2012 - 07:42 PM

Hello plese run this. Did you run them in safe mode?

Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Users, Partitions and Memory size.
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.



Please download TDSSKiller.zip and and extract it.
  • Run TDSSKiller.exe.
  • Click Start scan.
  • When it is finished the utility outputs a list of detected objects with description.
    The utility automatically selects an action (Cure or Delete) for malicious objects.
    The utility prompts the user to select an action to apply to suspicious objects (Skip, by default). Let the options as it is and click Continue
  • Let reboot if needed and tell me if the tool needed a reboot.
  • Click on Report and post the contents of the text file that will open.

    Note: By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder. The Log has a name like: TDSSKiller.Version_Date_Time_log.txt.



If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to these[/color] instructions. [color=green]In some cases it may be necessary to redownload TDSSKiller and randomly rename it before downloading and saving to the computer.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 lambertusjan

lambertusjan
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:53 AM

Posted 12 March 2012 - 04:28 AM

@boopme. Thanks for the help. Interestingly it resolved without me understanding how exactly, for what is worth here the procedure i followed.

I did all the stuff in safe mode (with networking) running rkill and MBAM and so on. MBAM didnt see any suspect object during the scan, and as a consequence didnt remove anything. Starting up in normal mode made de virus reappear again. Interestingly the network centre didnt show any proxy setting in the LAN section. So perhaps Security Shield malware has become a bit cleverer. Btw do we know the Russian criminal group who are behind this?

Resolution:
I then went back to safe mode and downloaded Microsoft Security Essentials; installed it with no problem. I could run the program ok, and even do scans. When I tried to activate the 'realtime' function, MSE told me that was not possible in safe mode.

So I went to bed totally prepared to do a system restore this morning.

However, when i started the PC, at first the virus appeared with the usual fake warnings, but immediately thereafter MSE started and reported having found a malicious piece of software. I could then activate the removal function in MSE and the problem was gone.

I guess that the attempt to activate MSE in safe mode, did actually set a flag somewhere which became active when the PC started normal.

Thanks to this Bleeping, i wouldnt otherwise have realised that safe mode with networking temporarily circumvented the intruder.

I have no idea if there is any correlation between rkill, MBAM and MSE in this case, i only know it worked. So in similar cases perhaps worth a try.

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:53 PM

Posted 12 March 2012 - 12:00 PM

Hello,Sounds good .. Please run the Mini box so I can see if it entered the hosts file.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users