Microsoft Zeus Virus Detected Critical Alert

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Topspeed, Dec 11, 2016.

  1. Topspeed

    Topspeed Private E-2

    Hello,

    This computer’s hard drive was likely remotely accessed and compromised due to an official looking and professional sounding Microsoft Critical Alert warning against closing the web page or shutting down the computer. No payment was made; however, the remote access software used was <snip>. Some of the multi-tasking processes noted, commands used and possible files affected were (and not in accuracy or precise order):
    • Run Citrix Online Starter
    • Remote fixing
    • Run: devmgmt.msc
    • C:\WINDOWS\System 32\CMD – DIR /S
    • Citrixonlinelauncher.exe-074A6C2C.pf and C:\WINDOWS\Prefetch
    • Diagnostic identification and notification of an error code for IP address infection by conflicker worm but conficker was referenced via wikipedia.
    • Network identified as not protected and permission was requested to connect the call to a network expert (via Citrix)
    Issues Found Post Zeus Virus Adware:


    #1: Both msiexec.exe and MSIEXEC.EXE-2F8A8CAE.pf were found in Windows XP Task Manager (and/or Explorer Search).
    • While Malwarebytes 2.2.1.1043 didn't detect any malware or adware, 200-plus malware/adware were detected by Superantispyware.
    • Although neither application was running after installing and running Free Supersantispyware scan, MSIEXEC.EXE-2F8A8CAE.pf was still there in C:\WINDOWS\prefetch. I just did an Explorer Search and neither file was found.
    • After the scan, Superantispyware was uninstalled.
    #2: Because of the Zeus Virus Microsoft Critical Alert Adware on 12/5, I also discovered an IP address 61.135.132.59 (Beijing, China) was encoded in the web exclusions of my Malwarebytes scan v 2.2.1.1043 with the Add/Remove functions disabled (grayed out). It’s possible that Malwarebytes scan wasn’t working for a long time and well before 12/5 due to the encoded web exclusion.

    These breaches may or may not be related to the Microsoft Zeus Critical Alert pop-up. I have since uninstalled Malwarebytes 2.2.1.1043, ran the mbam-clean utility and rebooted the computer and then I installed the newly release Malwarebytes 3.0.4. Malwarebytes did not detect any malware or virus. However, I can't really trust the new Malwarebytes either because there are settings and operating glitches where Malwarebytes was stuck in updating files and cannot be terminated in Windows Task Manager or in anyway during the second scan. I had to uninstall, run mbam-clean, reboot, redownload, uninstall, reinstall and run the scan. I haven't run the scan a second time yet to see if the scan will update w/o getting stuck. In any case, I believe there were PUPs found in a few of the 5 ReadMeFirst scans logs.

    My Questions Are:

    1. Can you tell based on the remote software technology and the commands used, can the scammer actually have a copy of the hard drive or removable thumb drive? How long do the scammers have access to the computer information through a remote access software? Does the hard drive information disappear as soon as the remote support session ends or can they have it indefinitely? And can they have remote control of the computer indefinitely?

    2. I know my Windows XP need to be replaced urgently, but I haven’t had the time to do any in-depth reading or research on the pros and cons of buying a Mac vs Windows. Do you have an opinion?

    3. Would you kindly review the five attached required ReadMeFirst logs and guide me in removing all malware and adware on this computer?


    Thank you
     

    Attached Files:

    Last edited by a moderator: Dec 12, 2016
    Topspeed, Dec 11, 2016
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Base on what you posted, it does not look like it. The only real questionable area is what you did related to the below that you mentioned:
    Network identified as not protected and permission was requested to connect the call to a network expert (via Citrix)

    Based on your logs, I see no signs of remaining remote access software. But I suggest disabling Windows Remote Desktop Access or at least setting/changing any passwords for it if you use it.

    This is you single greatest security issue. Windows XP really should not be used any more. I prefer Windows over highly over priced MACs where you have to go thru Apple for everything.

    There are only a few minor additional cleaning steps to take.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
    O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
    O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)


    After clicking Fix, exit HJT.


    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of the code box
    • Make sure that you scroll all the way to the bottom of the code box to get the whole fix!
    Code:
    :Processes
explorer.exe

 
:Files
C:\Documents and Settings\Owner\Local Settings\temp\*.*


:Reg
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A589A670-2717-4756-A0E8-07ED0F6919A3}]
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, Win7, 8 or 10, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7, Win8 or Win10, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXT log
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Dec 18, 2016
    #2
  3. Topspeed

    Topspeed Private E-2

    Hi Chaslang, thanks for the written instructions. I will do my best in completing it.

    Q1: I do not have the executable analyse.exe under G:\MGtools as instructed or anywhere on the hard drive. I did a Windows Explorer Search for the executable on the entire C:\ drive and it yielded "Search is complete... no results to display". Therefore, which executable should I use to run HijackThis-MGtools if there is no analyse.exe?

    Regarding what specific actions were taken during "Network identified as not protected and permission was requested to connect the call to a network expert (via Citrix)".

    My impression and a review of my scattered written notes on the probable sequence of event is that there are two distinct phases of the technical support involving two different people. The first part, the more technical and lengthier of the two, appears to involve downloading Citrix Online Launcher to \Local Settings\Application Data\Citrix as well as \Plugins in establishing remote access connection as well as allow virtual written communication through Notepad. After running commands for devmgmt.msc and C:\windows\system32\cmd.exe -DIR /s and programs running through DOS, the first tech diagnosed and referenced the worm infection on my IP address. And because it was determined that my network was not protected, he asked for my permission to transfer the call to a network expert.

    I talked to the Network Security Tech probably for less than 5-10 minutes because the nature of the call was more of a sales than a technical support call. He first assured me the IP address infection and network problems would not require me to go out and buy a new computer. He explained that local ISPs do not provide IP network security. As soon as he said he will install a fee-based software on my computer, I objected and asked if he would allow software to be installed on his computer without vetting the security service provider or the security software if the role was reversed. The network security expert started talking fast and over me a bit on matters unrelated to my computer security problem or how his security software and service would be the technical resolution. And because the support call was taking on the focus of a sales call, I ended the call by asking for the price of the service/software, his direct line so we could get connected again after I do some research on the security software (Advanced Level Security) and the company providing the service (TechZcare, Virginia) he is offering. As far as I know (and not a techie), no commands or changes were made or programs were downloaded to the computer during this shorter second part of support phase because just before we ended the phone conversation with a possible call back on my part, the network tech click on the malware/Microsoft Critical Alert screen to show me how my computer screen remained locked and unresponsive.​

    Waiting for your instructions on the missing MGtools analyse.exe before proceeding.
     
    Topspeed, Dec 20, 2016
    #3
  4. Topspeed

    Topspeed Private E-2

    Chaslang, I ultimately did find analyse.exe in the MGtools directory after a closer look of the files.

    You listed a total of 3 lines to be fixed in HijackThis. I found an extra line of O2-BHO: (no name) – { } – (no file) line in HijackThis System Scan, so a total of 4 lines were fixed in my case. I hope it was okay to do so.

    Attached are the 3 the scanned log files:
    • OTM MovedFiles 12212016.log
    • JRT 12212016.txt
    • MGlogs 12212016.zip
    Super grateful for your expertise. Please let me know what this all means. I will report back how the computer is running sometime tomorrow. First, I need to get some sleep.
     

    Attached Files:

    Topspeed, Dec 21, 2016
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It is on drive C not drive G. Your first set of logs showed this! So the complete path is C:\MGtools\analyse.exe If the C:\MGtools folder is gone then some how it may have been deleted. It was there when you posted your first logs. If the C:\MGtools folder is still present but you just do not have analyse.exe then just skip the analyse.exe instructions and continue with the rest.
     
    chaslang, Dec 25, 2016
    #5
  6. Topspeed

    Topspeed Private E-2

    Happy Holidays, Chaslang,

    Yes, I already found and executed analyse.exe. Please review the attached 3 scanned logs in the previous response and let me know what you see and if my computer is clean.

    My computer seems to be working as before, but I am still reviewing and working on installing security software. Thanks.
     
    Topspeed, Dec 25, 2016
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Those logs are clean, but there is one more scan that I want to run just as an additional check.

    Please download the latest version of FRST the below link.

    Farbar Recovery Scan Tool and save it to your Desktop.
    • See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
     
    chaslang, Dec 26, 2016
    #7
  8. Topspeed

    Topspeed Private E-2

    Good to know the 3 logs are clean.

    NOTE: No AV program is currently installed. Only Malwarebytes Free 3.0.5 is installed. Avastclear.exe was run last week in preparation for conflict-free fresh AV install later. Could you please help with removing any remaining registry, drivers and services associated with Avast, Symantec, Trendmicro, or Ad-Aware by Lovasoft with the help of FRST.txt and Addition.txt?

    Do I need to worry about Accounts ASPNET and Guest - Limited Enabled and Guest HelpAssist - Limited-Disabled listed on Addition.txt as being remote access accounts? Please advise.


    Attached are FRST.txt and Addition.txt from running Farbar Scan Tool yesterday on 12-26-16.
     

    Attached Files:

    Topspeed, Dec 27, 2016
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    They are not problems.


    Download the attached fixlist.txt file found at the bottom of this message and save fixlist.txt on your Desktop. Make sure you save it as a txt file.

    • You should now have both fixlist.txt and FRST64.exe on your Desktop.
    • Run FRST64.exe by right clicking on it and selecting Run As Adminstrator
    • Click the Fix button just once and wait.
    • Your computer should reboot after the fix runs.
    • The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)

    Then attach the below log:
    • Fixlog.txt
    Are you having anymore problems?
     

    Attached Files:

    chaslang, Dec 27, 2016
    #9
  10. Topspeed

    Topspeed Private E-2

    Am I suppose to get an attachment fixlist.txt from you?
    Just want to confirm FRST64.exe is the same FRST.exe (Farbar Recovery Scan Tool) I ran yesterday?
     
    Topspeed, Dec 27, 2016
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Sorry I forgot to attach it. It is attached now to my previous message. And yes it is the same frst.exe that you previously ran.
     
    chaslang, Dec 28, 2016
    #11
  12. Topspeed

    Topspeed Private E-2

    I’m not sure if the Farbar Fix completed or not. I ran FRST.exe and clicked on Fix as instructed. In the middle of Farbar Fix, the standard Windows Error Reporting dialogue box came up asking to send error report to Microsoft. I clicked on “Don’t Send” and a Fixlog.txt was generated nevertheless. My computer also didn’t not reboot automatically. I rebooted the computer manually just in case.


    Do I need to rerun Farbar Fix again or differently?

    Can I and should I install and run an AV program now?


    See attached Fixlog.txt
     

    Attached Files:

    Topspeed, Dec 28, 2016
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The fix did not run. I suggest trying to run it again in safe boot mode.

    Your PC does not have enough memory to install and run an antivirus program. Your PC would be extremely slow if not already slow. I can see the below from your logs.
    Code:
    Total Physical Memory 1,024.00 MB
Available Physical Memory 128.65 MB
    If you still plan to keep using Windows XP even though this is not a good idea then you really should upgrade to 3 GB of memory. You have 1/3 of that now.

    In fact the small/inadequate amount of memory could be the reason for the crash while running FRST which is why I suggested running in safe boot mode.
     
    chaslang, Dec 29, 2016
    #13
  14. Topspeed

    Topspeed Private E-2

    Success! After numerous failed attempts at running Farbar Fix in Safe Mode, the fix is completed and the computer reboots automatically. Double-clicking instead of right clicking on FRST.exe in Safe Mode seems to be the trick in running the fixlist.

    3 Outstanding Problems:


    Windows could not boot in Safe Mode Windows XP Home Edition on the first attempt. The first error message when booting into Safe Mode-Windows XP Home Edition: "Windows could not start because the following file is missing or corrupt. Please reinstall a copy of <windows root>\system32\hal.dll" How do I reinstall hal.dll and restore Windows XP Home Edition Safe Mode functionality?

    On the second attempt in booting into Safe Mode but via Windows <default>, I logged in as Administrator, but FRST.exe and Fixlist.exe were not on the desktop and there was no Internet connection. I could neither configure the desktop display nor establish internet access. Windows would not keep the display resolution I set so I can reconfigure the browser home page or get Internet connection. How can the Administrator account in Safe Mode be totally lacking in basic reconfiguration capability let alone administrative rights? Does this mean I should have logged in the Owner instead of the Administrator User Account? If so, should I and how do I make Owner the Administrator Account and should I then delete the Administrator Account?

    Booting up the computer in Safe Mode on the third try to run Farbar Fix was via the Windows Recovery Console option. A system error message was generated: “INF file txt setup.sif is corrupt or missing. Status 14. Setup cannot continue. Press any key to exit. What is the proper fix for this problem?

    Please review the attached fixlog.txt What do you think? Is my computer clean now? What should I do next?

    Thanks for all you do.
     

    Attached Files:

    Topspeed, Dec 29, 2016
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This is not an issue for the Malware Forum but you can try running the below using SFC to see if it can restore the file. It may ask for your Windows XP CD. Otherwise I suggest posting in the Software Forum.

    Click Start, Run, and enter sfc /scannow and click OK. There is a space after the sfc. This runs System File Checker which looks for missing or corrupted system files and attempts to replace/repair them from files on your hard disk or from the CD if necessary. So it will ask for the Windows CD if it needs it.

    The files were never put on the Administrator's Desktop. They were put on the Owner's Desktop. So yes you needed to login as the Owner. If you wanted to have an Internet connection you would have to log into safe boot mode with networking but you did not need internet for this fix. And resolution is set down to a lower mode in safe boot mode. This is normal and it is the only choice.

    Yes again! You need to login to Owner to see the files. Since already have gotten the FRST fix to run, you do not need to repeat the fix. You cannot delete the Administrator user account. It is a required built-in windows account that always exists as part of Window. The Owner account is a member of the admin group. That means it has most priviledges that the Administrator has but not all!
    Again this is not an issue for the Malware Forum. You could discuss in the Software Forum. It was not necessary to use the Recovery Console for the fix. We just needed safe boot mode.

    There really wasn't any malware on your computer. Just a little junkware and also some left overs form old antivirus programs you ask me to help you remove.
     
    chaslang, Dec 30, 2016
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds