Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

PC infected with Malware & Rogue internet traffic


  • This topic is locked This topic is locked
41 replies to this topic

#1 Happy83

Happy83

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 04 April 2014 - 11:36 AM

Broni has been assisting me in trying to clean up the PC which I've named GROTTO_2.

 

Under his guidance, I've been trying many things, but the PC is still infected.

 

The trouble probably has multiple origins:

On a previous XP PC, "GROTTO":

1.  Early in 2013 I'd omitted to do regular virus scans with AVG IS 2013 and when I did,

    AVG IS 2013 reported a trojan, which had been on the PC for an unknown period.

2. On 2013-08-03 I was very dumb: I allowed myself to be scammed to the tune of ZAR 3600, by a "snake charmer" ,

who spoke to me for 99 minutes on our landline telephone and I

allowed installation of  software of Ammyy Admin for remote "assistance".

By the next day I'd realised that it had been a scam and refused to speak to them again, when they phoned repeatedly.

 

Since then I've been going from one old  XP PC to the next,

each time  removing the HDD and installing it in an external USB case.

Of these I now have three 3.5" HDDs and  one custom 2.5" external USB drive.

 

My wife's PC "Bettie_XP2" is also so badly "locked down" by malware, that I cannot even get it started in safe mode.

 

Now I'm working on XP PC "GROTTO_2"

GROTTO_2 has been donated to me, and I do not have the installation disks.

 

My wife and I both intend buying new laptops - but we dare not transfer anything from GROTTO_2, before the problems have been cleared up.

 

I would be most thankful to be helped out of this morass - which is mainly of my own creation.

 

(I have to leave off now - to resume when I've read the rest of Broni's instructions.)

 

 

 

 

 

 

Attached Files



BC AdBot (Login to Remove)

 


#2 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 07 April 2014 - 08:15 AM

My apologies, I only now zipped attach.txt, which I've attached.

Attached Files



#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:39 PM

Posted 09 April 2014 - 11:40 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/529940 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 10 April 2014 - 08:06 AM

Attached File  Attach.txt   17.33KB   2 downloadsAttached File  dds.zip   5.2KB   3 downloadsPlease note, my original topic, where BRONI assisted me extensively, was:

PC creates FALSE internet traffic AND false FLASH Player update

the final entry of which you can find at:

 

http://www.bleepingcomputer.com/forums/t/528730/pc-creates-false-internet-traffic-and-false-flash-player-update/page-2#entry3330839

 

I do not know how to use the LINK button.

 

Sadly,

  1. The false / rogue internet traffic is continuing, and I suspect the malware still exists.
  2. IE8 still gives me a skew grin (in connection with missing Flash Player) when I want to view videos in Youtube,
    although Firefox does play Youtube videos without any problem.
    I suspect that the problem in IE8 may have been caused by myself:
    Long ago, (shortly after I'd been scammed)  I erased some items in the registry, 
    of which one may have something to do with IE8 being able to run with add-ons, etc.
  3. Since being scammed, I've tried to disable everything which refers to remote.
  4. The DDS logs which I want to attach, include information on:

    The only internal HDD of this PC GROTTO_2
    500GB_USB
    2.5" External HDD
    N3_SATA 3.5" External HDD partitioned:
        Local disk
        Installers
        G_Videos
        O_HUGE

 



#5 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 11 April 2014 - 09:48 AM

I DO NOT have the original installation disks for the PC "GROTTO_2",

it was donated to me by a firm which had upgraded - and they do not have the disks any more.



#6 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 14 April 2014 - 05:58 AM

The rogue / false internet traffic persists, caused by some unknown malware:

Starting as soon as the router is active (without any connection between router and ADSL line).

 

TRUSTEER RAPPORT in its Weekly Activity Report, gave 30 instances where

IP ADDRESS 207.69.188.186 Does not match Trusteer Rapport.

 

The report for APR 14 2014 07H33 was the time the PC was first booted, with NO connection to the internet.

 

207.69.188.186  belongs /is rns2.Earthlink.net, a sub-domain of Earthlink.net



#7 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,314 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:09:39 PM

Posted 17 April 2014 - 01:22 PM

Hello, my name is Elise and I'll assist you with this issue.

 

First and for all, XP is no longer supported by Microsoft. This means practically no more vulnerabilities that would allow your computer to be infected will be patched. Before continuing, are you sure you want to continue to use XP, even knowing that by doing so you make yourself vulnerable online? There are free alternatives to Windows, see for example here.


regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#8 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 20 April 2014 - 12:00 PM

Elise,

thank you - I'll have to work through quite a lot to convert to LINUX.

This PC will not support W7 or W8.

 

Regards,

Happy83



#9 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,314 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:09:39 PM

Posted 20 April 2014 - 03:19 PM

Have you reset (not rebooted, but reset to factory defaults) your router so far?

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#10 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 21 April 2014 - 04:43 AM

Thanks El;ise,

the router was reset (by button) and then programmed again.

The false/rogue internet traffic persists.

 

I've downloaded UBUNTU:             ubuntu-14.04-desktop-i386.iso

downloaded the free ISO burner:  FreeISOBurner.exe

burning  two dvds at SLOWEST speed: UBUNTU-ISO  and UBUNTU-ISOI-2

set the boot order:                   CD/DVD first

 

read the DIRE warning about ONLY TRYING UBUNTU,

till all necessary data has been safely, separately backed-up.

 

Then : TRY UBUNTU.

 

Questions:

Does this version of UBUNTU include an equivalent of MS ACCESS?

 

If yes, does it require programming in SQL

and can it import MS ACCESS databases?

 

(I'm using MS ACCESS for the database of my wife's pupils and their payments)

 

Can LibreOffice be installed on UBUNTU?

 

Signing off for now.

 

Regards,

Happy83



#11 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 21 April 2014 - 06:06 AM

I initended trying UBUNTU, but when the DVD ran,

I didn't get an option to TRY,

only a black screen with long error message:

 

Busybox v1.21.1 (Ubunto 1:1.21.0-1ubuntu1) built-in shell (ash)

Enter 'help' for a list of built-in commands.

 

(initramfs) Unable to findmedium containing a live file system

help

Built-in commands:

------------------------

   . : [ alias break cd chdir command continue ....................

....................

 

I had to switch-off the mains, to get the dvd out of the drive, at the next start-up.

 



#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,314 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:09:39 PM

Posted 21 April 2014 - 07:11 AM

Hmm, that sounds like your hardware is too old for that as well.
 
To be sure lets do a rootkit scan.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
  • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • If TDSSKiller does not run, try renaming it.
  • To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  • Click the Start Scan button.
  • Do not use the computer during the scan
  • If the scan completes with nothing found, click Close to exit.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  • A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  • Copy and paste the contents of that file in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 21 April 2014 - 12:04 PM

Some information:

I've successfully tried

UBUNTU-10.04.1-desktop-i386.iso

which I've had on CD since 2010-09-20

(Apart from the version downloaded today, this is the "youngest" version I have available.)

 

In the trial, Firefox merrily wanted to get itself updated - which I then cancelled.

On selecting "Youtube Sujari" ,

 I was told that the Flashplayer is out of date and must be updated.

 

I downloaded TDSSKiller, ran it twice,

first time with the default settings and

then  after reboot with all options checked.

 

Two files have been quarantined.

Viz: both unsigned files, InCDPass and InCDRec

 

Rogue / false internet traffic still persists, as reported by the graph of BANDWIDTH METER PRO.

 

I've attached the zipped log files.

 

Regards, and thanks for the very speedy responses.

 

(I'm unsure as to whether I should've ticked "Add to post" or not.)

 

Happy83Attached File  TDSSKiller.3.0.0.31_21.04.2014_18.23.51_log.zip   87.44KB   0 downloadsAttached File  TDSSKiller.3.0.0.31_21.04.2014_18.11.56_log.zip   29.88KB   0 downloads


Edited by Happy83, 21 April 2014 - 12:07 PM.


#14 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,314 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:09:39 PM

Posted 21 April 2014 - 12:17 PM

Download TCPView from http://live.sysinternals.com/tcpview.exe

Once the file is downloaded, double-click on it to execute the program.

When the program starts, click on the Options menu option and uncheck Resolve addresses.

Then click on the File menu option and select Save as....

A window will open asking where you would like to save the log file. Save it to your desktop as tcpview.txt

Please post its contents in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#15 Happy83

Happy83
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:39 PM

Posted 21 April 2014 - 02:12 PM

Ran TCPView as instructed.

File TCPVIEW.txt is attached

Attached File  TCPView.txt   3.82KB   2 downloads

 

Regards,

and amazed at the speed of your replies.

 

Happy83.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users