Hotmail is compromised but cleanup shows nothing

Sorry for the long email. I am not sure what information is important and what isn't.

My hotmail account has been compromised.

Key dates: March 22 (approximate date)
Clicked on an email from a friend and downloaded an attack from what looked like a heath products website (I was just looking and deleted it immediately as it was not a personal email from my friend, and I was unaware of the attack).

I had seen this email before while using my Mac but not looked inside the email, just deleted it. I'd been receiving this same email message for months. This time, I was using my pc (Presario Compaq using Windows XP) and clicked on the message to finally find out what it was about. Big mistake.

An email was sent out to all my contacts containing the same link that I had clicked on. I was unaware of this until my friends contacted me later asking about the "strange email" I'd sent them.

Following a comprehensive cleanup (details below):

April 22
The same email was sent out from my pc while I was at work. The computer was not even turned on, but it was hooked up to the modem and the modem was on.

I've done a comprehensive cleanup again, after updating all scanners, this time in Safe Mode and with the computer not connected to the internet (details below).

Details:

My emails were attacked about March 22. The virus (or trojan or whatever, I am techno-illiterate) managed to turn off the mail checker of AVG before it sent itself to my entire contacts list without my knowledge. I ran a comprehensive cleanup program using that recommended by MajorGeeks. com. A month later, the virus replicated and sent itself out to my entire contact list again (April 22 exactly), so I did the same cleanup program but this time in Safe Mode.

After the first attack, I ran the following cleanup programs in "complete" (not "quick") mode:

AVG - after, I uninstalled it to install a different anti-virus program, to avoid conflicts and catch what AVG might have missed.
Panda (same procedure)
Avast (same procedure, but I reinstalled it later to continue using for an anti-virus protection program)
CCleaner
Windows Defender (tried, it was compromised after the 2nd attack)
Spyware Blaster
Spybot Search and Control
SuperAntiSpyware
MalwareBytes AntiMalware
Baku (it was compromised, and through it, Windows Defender, I don't understand the connection)
OneTouch
Glary Utilities
A variety of Registry Cleaners, and Disk Cleaners and Defragmenters

After the second attack, I:
Updated all scanning programs
Disconnected my computer from the internet
In Safe Mode, ran all the above programs except AVG and Panda (which had found nothing wrong the first time, including tracking cookies, which they always find, so I suspected the virus deactivates their crucial components during scans)

In addition, I have:
Deleted all sent emails
Deleted all received emails except for crucial received emails from trusted senders, friends and family members (ex. about work)
Deleted "History" in all email accounts
Deleted all caches, as far as I know
Printed and then deleted my entire contact list from all email addresses
Created a Bookmarks document in My Documents, in anticipation of losing or deleting them

The idea of deleting all this information was that if the attack runs again, on May 22 as appears to be the pattern, it won't have email addresses to go to. The only email addresses I have kept at this point are from important personal messages sent by co-workers, supervisors, the universities I work for, and family. I am concerned that the virus/trojan or whatever might use these old, kept messages to attack what few addresses are available. Do I need to delete them too?

In the course of deleting received and sent emails in either my Gmail or Yahoo, I accessed the activity log and discovered that a large number of emails had been sent on March 22. All links included a series of capitalized letters, about 6 or 7, beginning with M. Sorry, I can't locate that information at the moment. I copied just the letters (not the entire link) and googled it. I received a warning that malicious attack software uses this link to access cookies for personal and financial information. This is possible in MSN and is a problem for both MSN and Adobe Reader. Sorry, I was doing this late at night and my memory is foggy on the details, but I believe this is at the heart of the problem. The information was very technical and I had difficulty trying to read it.

After completing the cleanup operation according to the MajorGeeks recommendation, I attempted to wipe the pc system and re-load the os from disk. I tried to replace my present Windows OS with the original manufacturer's OS on disk, which came with my computer, but the program told me I couldn't do that as I am now using a newer version. I would have to delete my current version and then download again from disk. I was aware that I would have to download the entire OS and then update to Pack 3 and a wide variety of other updates a variety of programs, such as Adobe Reader and the Office X3, but this is the first time I've received this message. The entire process, if I figure out how to do it again, will take the better part of a day, especially to update the old version to new standards. So I haven't done that yet, but I intend to.

I found out today, after all that cleanup, that my hotmail account is still compromised. I could not send or receive emails through hotmail while in Windows Live. I usually access hotmail from Firefox.

Details:

I received this notice from Google Safe Browsing:
http://safebrowsing.clients.google....://www.qwerks.com/download/8811/EFRCSetup.exe

I had downloaded something from qwerks . com, which included possible contamination from filekicker.net, hosted on filekicker.com, hosted on the network AS8182 (DIGITALRIVER). To be honest, I do not understand this message and so might have overlooked crucial information. I hope you can find it in the "safebrowsing.clients.google.com/safebrowing /diagnostic ... link above.

I am not sure if it is these links and programs which have compromised my hotmail account. Apparently, I accessed this website around March 17, and so the date suggests that it is possible.

I was clearing all overlooked emails (sent and received) in Windows Live. I usually access hotmail through Firefox rather than Windows Live or IE. I had just downloaded a file checker program (May 1 2010) to use with Windows Messenger via Windows Messenger "Others" link, and it was this file sharing checker program which located qwerks.

An earlier warning (March 17), which I had somehow overlooked but was linked to via the Google warning described above, suggested that qwerks was downloaded when I downloaded the following program: Eusing Free Registry Cleaner. I find that hard to believe, as I downloaded if from MajorGeeks or one of the linked mirrors, the source of all my cleanup and maintenance programs. Aside from this possibility, I have no idea where the qwerks link could have come from. In fact, I didn't know it was in my computer anywhere.

It seems my system is thoroughly compromised. I can't use a newly downloaded PhishGuard program because I can't get the license, for example. I downloaded a few new email checker programs last night and none seem to work.

My pc is 64-bit, so I was unable to run 2 of the cleanup programs recommended in MajorGeeks ReadMe cleanup program.

I have attached the following log:
MGlogs.zip
mbam-log (from Malwarebytes AntiMalware)

I hope to deal with this by May 21, in anticipation of the next attack. I plan to have my HP Compaq Presario computer with Windows XP not connected to the internet and the modem shut down for about 3 days - May 21, 22 and 23. I don't know if this is necessary, and would appreciate any info. If I need to use my computer, I'll use my MacBookPro, and it will be hooked up only as long as I am using it.

What can I do?

I appreciate all the help you can offer.

Thanks!

philosophicalcat

 

First, I rechecked and you are correct. It is a 64-bit system. I was confused because "64" appeared next to Athelon.

I am in the process of doing the cleanup as recommended in the "Read Me First" post, followed by all 4 scans. Since several days have passed, and I`ve deleted a lot of files, I thought it would be best to send the most up-to-date information. I will include the 2 logs you asked for in addition to the newly run other 2 logs.

Secondly, in your general guide:
1. As you say, #1 doesn`t look like an attractive option.
2 & 3. I have already deleted a massive number of emails, both sent and received, as well as all the emails which were sent on the days of the attack. I`ve cleared the trash bin and deleted the histories on not only my hotmail account but also my accounts in Gmail and Yahoo. I`ve deleted the cache in hotmail and intend to do the same in Gmail and Yahoo. I hope this covers your first recommendation. I`ve kept some emails (both sent and received) as they are important for work or personal reasons, but I intend to follow your advice in regards to these remaining emails. None of them were involved in the attack, as far as I know, but I want to be thorough.
I think the folders that contain the infected files are the inbox folder, the sent folders, and definitely my address book. I`ve printed and deleted all addresses. I still need to delete the `recently emailed` and `favorites` which pop up when I click the send "to" button, but that won`t take long. I`m guessing that you mean I need to create a new folder for Inbox, transfer any emails still in the Inbox to the new Inbox, and delete the old Inbox. I`m not sure how to make sure all new emails will go to my new Inbox folder, and I`m a bit nervous about that.
I will follow the same procedure for every folder I have for saved emails.
I`m not sure what the procedure is for using the Mailbox Cleanup Option - is there a tab I click on somewhere?
I`m guessing the link you gave me will show me how to compact the Outlook database. I`ll do that after the scans run and I can send the logs to you.

I am running the 4 scans now, after a lengthy cleanup operation. I hope to be able to send you the logs in a few hours.

After that, I`ll try to follow recommendations 2 & 3 while I`m waiting for your feedback.

Thank you very much! I hope to save my present hotmail account as it`s my main pc address and all my work and personal contacts use it. You might make this possible!

pc

 

An update:

First, I have to correct a typo from my previous post. You are correct, it is NOT a 64-bit system. Sorry about that.

Again, I ran the cleanup procedure according to the Read Me First thread (which has been updated). I wasn't able to do this exactly as written, so here are the details:

1. Updated all malware and scanning programs
2. Updated Java
3. Ran CCleaner
4. Checked for malware in Add/Delete Programs
5. Ran SuperAntiSpyware
6. Tried to run Malwarebytes Anti-Malware (unsuccessful)
7. Ran ComboFix
8. Ran RootRepeal
9. Ran MGtools

I ran CCleaner and SuperAntiSpyware in Safe Mode with the pc unplugged from the internet. I ran into problems with Malwarebytes, which was almost certainly due to sloppy configuration on my part since the last scan. I gave up on that scan, and finished the rest of the scans in regular mode and hooked up to the internet. I rebooted between all procedures and scans.

I have attached logs for ComboFix, RootRepeal, and MGtools, and Super Anti Spyware. I hope you can still use my Malwarebytes log in my first post. Also, I just noticed that the Root Repeal says the files were hidden, so I might run that again, if it turns out that Windows reset itself. If I do, I'll attach the new log in a separate post. Sorry about the confusion. I really do need your help, because I'm not good at this!

Thank you very much for helping!

View attachment ComboFix.txt

View attachment RRlog.txt

View attachment MGlogs.zip

View attachment SUPERAntiSpyware Scan Log - 05-04-2010 - 08-00-06.log

 

Just an update on my attempts to follow your directions. This will be continued later. I live in Japan, so I`m guessing you`re sleeping for now and won`t check this thread for a few hours yet.

The quick version: It looks like I`ve finally managed to delete Malwarebytes. I couldn`t do that before, and an attempt to download a new version ontop of the old one, which I misconfigured after it`s first scan, failed to be usable. So this was definite progress. I haven`t managed to delete Avirus, Baku (which seems to be housing Avirus) or Panda (Cloud) yet.

1.My Avirus seems to be nested in Baku. Having trouble doing anything with Baku.
2.I am using XP. I went to Add or Remove Programs. I tried to locate and remove Baku, Avira, Malwarebytes and Panda. Unsucesssfully. Details:
3.Baku: Got an error message. “A network error occurred while attempting to read from the file:C:/WINDOWS/Installer/Baku.msi (The Japanese keyboard on my MacBookPro doesn`t have the backslash symbols, which is a problem; I am using the forward slash to communicate this). I clicked Ok. The message appeared “Fatal error during installation.” I clicked OK.
4.Uninstalled Malwarebytes. Clicked Ok.
5.Avira and Panda did not appear on the Add or Remove Programs list.

Next, I ran RegCleaner 4.3 by Jouni Vuorio.
I`ve sometimes been able to remove programs here that the Add/Remove program couldn`t locate, remove, or remove completely.

I clicked on Uninstall Menu (Description on the top toolbar: Software in Windows` Uninstall Menu. You can uninstall them or just remove them from this list.)
Looked for Baku (pmcc), Avira and Panda.
Found Baku. Clicked on it and then Uninstall. The Baku Setup Wizard window popped up. Clicked on Next when prompted. Clicked on Remove (2 separate remove buttons). Message appeared: A network error occurred while attempting to read from the file:C/WINDOWS/Installer/Baku.msi. I clicked Ok. It returned to Baku`s Setup Wizard, which said Baku Setup Wizard ended prematurely because of an error. Clicked Finish.
Avira and Panda did not appear.

Went to Software (registered to the Registry. You should delete every program`s entries you know you`ve had, but don`t have anymore.)
Removed the Malwarebytes` Anti-Malware entry.
Could not locate Baku (pmcc), Avira or Panda.

Checked the Startup List. No Baku (pmcc), Avira or Panda.

Went to Backups. Removed Malwarebytes Anti-Malware, Pmcc: Baku, Panda Software: Setup.

Went to file types and cleaned up. Did not see any files from the above.

Went to New File. Nothing.
Went to Shell Extensions. Only one old program, unrelated to the problem. Tidied up.

Did searches for Avira, Baku, Malwarebytes Anti-Malware, Pmcc, Panda, Panda Cloud.
Got the same error message for Baku. Did not find the other software in any of the tabs.

Did a OLE etc. (Do them all) cleanup, just because I was here.

Rebooted.

The Malwarebytes icon was gone from the desktop.

Ran Ccleaner.
Checked Tools: Uninstall. Baku was still there (of course). Malwarebytes was gone.

Ran Glary Utilities. 1-Click Maintenance. Checked the Uninstall Manager. Decided to do a cleanup while I was in this program. Using File Shredder, erased an old AVG Free program. Deleted empty folders. Used Internet Explorer Assistant to restore hijacked settings. Used Windows Standard Tools, System File Checker, to restore protected files, and check disk.

The next step will be to google the individual programs to discover alternative names and company names (ex. Baku files are also under pmcc, the company name). Then, I will run the program names and company names in “Run,” print out the file locations, and attempt to delete them manually, by going to the locations, finding the files, and clicking <delete>. As I don`t really know what I`m doing, this might not work, which is why I tried the other methods above.

I will take a few hours break and then return to continue deleting the program files for baku, avira and Panda (Cloud), before running the requested programs to obtain scan logs.

 

Hi Tim,

Sorry for the delay. I had to deal with a sudden crisis from work, and I'm still under considerable time pressure. I appreciate your patience.

I followed your directions by doing the following:

1. Uninstalled MalwareBytes
2. Updated and ran CCleaner
3. Updated and ran Glary Utilities (not on your list but thought a cleanup might help)
4. Installed and ran MalwareBytes (full scan)
5. Turned off Avast real time protection (it will turn on again at reboot)
6. Checked to make sure combofix.exe was on the desktop
7. Copied & pasted the code you gave me to Notepad
8. Saved this as CFscript.txt to the desktop
9. Dragged the CFScript.txt to ComboFix.exe
10. Ran ComboFix
11. Could not locate C:/MGtools/GetLogs.bat file, but did locate the MGtools zip log
    
12. Attached ComboFix and MGtools zip-reader logs to this message

Note, I did not run MGtools again (I don't think your instructions said to run it again, so I didn't) so the log you will see is a reader-text version. I was not allowed to attach the MGtools zip log, as I had attached it to a previous post, but I could attach the zip-reader log. Hope that helps. If I need to run MGtools again, please let me know. I might run it again just to have it available.

Also, I did not try to manually locate and delete Panda, Cloud, Avirus (cloud seems to be used with both programs) as your instructions looked like they might be able to delete all traces of these programs.

I hope this information helps you to locate my problem. I will go ahead and create new hotmail folders, transfer date into them, delete the original hotmail folders, and them compact them according to your directions given below. I am not sure how to do this with the inbox folder and junk mail folder themselves, or even if I can or should. I believe the infection is residing in the junk box folder, the inbox folder, the transfer buttom (for moving files from junkbox to inbox), and definitely in the hotmail addresses (contacts) list. I have printed and deleted all contacts. If you have suggestions for clearing these parts of hotmail, I'd be happy to try them out.

I expect the virus to be activated next weekend (around May 22) and this will be a very busy week at work. If these efforts haven't removed the infection, we'll know soon.

Thanks you for your help so far, and for any future suggestions!

pc

View attachment MGlogs-ZIPReader.log

View attachment ComboFix.txt

 

Here is the MGtools log I ran today.

Also, I created new files, transfered the emails from the old files into the new ones, and deleted the old files. I haven't compacted them yet.

pc

 

Hi TimW,

I haven't compacted the new personal messages folders yet, but I will later this week.

I was unable to do anything with the inbox and junk mail boxes (or related boxes), which is where the infection passed into my system. I'm hoping, since you say the logs are clean, that it is unnecessary to do anything with the inbox and junk mail folders. Also, I can't seem to delete the "recently emailed list" (which pops up when you click on "to" while preparing to send a message). The only potential email addresses a new virus attack could go after would be in this list or the personal folders, the latter of which will be compacted in a few days.

I hope to do a thorough cleanup once more before this weekend, just the usual maintenance scans.

I will follow the rest of your directions later this week (by the 21st at the latest) and will let you know if a new attack goes out from my hotmail account on or around the 22nd.

Thank you very much for helping me! I really hope this works.

pc

 

Hi TimW,

An update and possibly further related problem:

I followed your previous instructions exactly. I began with a general cleanup, checked that the TeaTimer real-time protection was turned off, updated everything and ran all cleaners in regular mode. I then followed your instructions, including compacting IE.

I did get one response to a ticket (request for help) which I do not remember sending - I didn`t even recognize the email address it was sent to. I checked my "sent" folder but this particular request for help (resulting in a "ticket") did not appear. It is possible that the request for help was sent during the original attack or it`s followup attack, and this particular website was just slow to acknowledge the request for help. Also, a friend reported getting a "strange email" from me after the majority of the cleaning, at the beginning of May. That was before the final phase which I finished just before May 22 (the expected next attack day). So I`m not convinced that the problem is over, but I hope and think it is.

No "strange emails" were sent out on the 22nd or any time since then, as far as I know. I think the cleanup program you recommended worked. Thank you!

A new problem is developing, which I think is related to the original problem, otherwise I would start a new thread for it. It is happening when I access my hotmail account from either my Compaq Presario (with Windows as the os) or my MacBook (with the Mac OS X being Leapard). In both cases, I access hotmail via Firefox.

I have not added addresses to my address book for now, except for the booby-trap you recommended. So, when I get emails from people I know and trust, I have to move the emails from the junk folder to my inbox folder. Every time I do that, it takes longer. I recently timed it at 2 minutes, when I ended the wait by clicking on refresh. Sometimes when I click on refresh, I wind up being sent to the inbox while the emails I tried to move into the inbox remain in the junk mail folder. This only started happening during and after the attacks.

I suspect some damage to my email account happened. I think I might have moved the original infected email from the junk mail folder to the inbox, just to find out once and for all what the mysterious message was (curiosity killed the cat...). I think this somehow infected or damaged the "move" function between the junk mail folder and the inbox folder. I just noticed that a similar remarkable delay exists when I hit the "junk" button to report spam. I don`t remember if I did that when I realized the mysterious email was not a personal message from my friend but a spam email. Anyways, it is possible that the move function is also damaged between my inbox and the "junk" reporting button. None of the other folders seem to be affected by this dramatic slowdown if I move files from the junk box to a personal file.

Could this problem be related to my original battle with the virus/trojan/email from hell? Is it unrelated? And what can I do about it?

Also, is it safe to start adding addresses to my address book, or should I wait a little while to make sure the problem doesn`t re-emerge on it`s own?

Thank you very much for helping me to save my email address!

pc

 

Hi TimW,

Thanks for your help. I will follow your suggestion. You rock! :wave

pc