Slow Firefox, Sign In Attempts/successes, Foreign Ip In Gmail History

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by bleepbleepcomp, Jan 9, 2018.

  1. bleepbleepcomp

    bleepbleepcomp Private E-2

    • Noticed firefox getting slow in mid-December; tends to be about an hour after using it that I have to reboot as videos can lag, tabbing slows down, etc.
    • Attempted login and successful ones beginning on December 20 on fairly benign accounts that I don't use much (ubisoft, EA, no saved account information on either)
    • Random Spotify account created with my email on December 29th (didn't require verification); I logged into it, changed password, then deleted account but wonder if this was a phishing attempt somehow to get me to type password
    • Ebay account accessed today (with no saved accounts) which set off flags; password changed
    • Checked Gmail history out of curiosity because at this point the access was getting ridiculous; discovered an IP associated with Microsoft so not sure if app or spoofed; password changed
     

    Attached Files:

    bleepbleepcomp, Jan 9, 2018
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please remove everything found in ADWCleaner and Hitman. Then rerun RogueKiller and remove these items:

    ¤¤¤ Tasks : 3 ¤¤¤
    [Hj.Shortcut] \{1BC10A2C-685C-4A2A-BDEE-7D341122CBBB} -- "c:\program files (x86)\mozilla firefox\firefox.exe" (http://ui.skype.com/ui/0/6.21.64.104/en/go/help.faq.installer?LastError=1603) -> Found
    [Hj.Shortcut] \{1E7F8F13-F492-42AF-9683-D99F0D5B8AC9} -- "c:\program files (x86)\mozilla firefox\firefox.exe" (http://ui.skype.com/ui/0/6.21.64.104/en/go/help.faq.installer?LastError=1603) -> Found
    [Hj.Shortcut] \{B8D4635C-C8F2-41FC-9746-1DECF5797059} -- "c:\program files (x86)\mozilla firefox\firefox.exe" (http://ui.skype.com/ui/0/6.21.0.104/en/go/help.faq.installer?source=lightinstaller&LastError=1603) -> Found

    ¤¤¤ Files : 2 ¤¤¤
    [PUP.Gen0][Folder] C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browsers -> Found
    [PUP.Gen0][Folder] C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browsers -> Found

    Reboot and rescan with ADW, Hitman and RogueKiller and attach the new logs.
     
    TimW, Jan 10, 2018
    #2
  3. bleepbleepcomp

    bleepbleepcomp Private E-2

    Thank-you for your help, Tim!
    • Completed. Took 3 attempts to reboot after HitmanPro was ran. First time I got a black screen. 2nd time I got stuck on starting windows screen. 3rd time I had the option to run Windows repair but decided to try loading normally and was successful.
    • One of the pups in RogueKiller showed an error after attempted removal but don't see it showing up now.
     

    Attached Files:

    bleepbleepcomp, Jan 10, 2018
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks good. What malware issues are you still having?
     
    TimW, Jan 10, 2018
    #4
  5. bleepbleepcomp

    bleepbleepcomp Private E-2

    Not sure it is malware, but FF still uses a lot of memory lately. Starts at about 400k KB, jumps to almost 2 million KB after an hour.
     
    bleepbleepcomp, Jan 10, 2018
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes it does. If you want, you can post in software to pursue that issue.

    Why do you have these in your trusted zone:
    O15 - Trusted Zone: http://asia.msi.com.tw
    O15 - Trusted Zone: http://global.msi.com.tw
    O15 - Trusted Zone: www.vizzed.com

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Re-enable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8 or 10, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 or 10 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. After doing the above, you should work thru the below link:
     
    TimW, Jan 10, 2018
    #6
  7. bleepbleepcomp

    bleepbleepcomp Private E-2

    Not sure about those trusted zone links, but they seem fairly benign? I'll try software.
     
    bleepbleepcomp, Jan 13, 2018
    #7
  8. bleepbleepcomp

    bleepbleepcomp Private E-2

    For what it's worth, I removed those from IE trusted zone (didn't see them in FF) and the MSI ones just returned.
     
    bleepbleepcomp, Jan 13, 2018
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, Win8 or 10, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

    After clicking Fix, exit HJT.

    ReRun HJT and show me the new log.
     
    TimW, Jan 13, 2018
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Not sure I would worry about it.....just tried to contact that site and it won't connect.
     
    TimW, Jan 13, 2018
    #10
  11. bleepbleepcomp

    bleepbleepcomp Private E-2

    Ran and fixed; checked IE and both msi links mentioned are gone, but the regular msi.com still persists. I didn't see it in HJT either, but wouldn't it just be Micro-Star International (MoBo is MSI)? Could something hide in those URLs?

    Otherwise, I noticed earlier that a file was showing under Network when I swear I'd moved it to My Documents. On top of that, I noticed remote assistance was checked which really makes me wonder.
     

    Attached Files:

    bleepbleepcomp, Jan 13, 2018
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It's a gaming site. Your HJT log is good. Continue on in your other thread. :)
     
    TimW, Jan 13, 2018
    #12
  13. bleepbleepcomp

    bleepbleepcomp Private E-2

    Will do, thank-you very much for your help!
     
    bleepbleepcomp, Jan 13, 2018
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No problem. :)
     
    TimW, Jan 13, 2018
    #14

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds