Another "help assistant" sufferer

Discussion in 'Malware Help (A Specialist Will Reply)' started by clevenger, Mar 24, 2010.

  1. clevenger

    clevenger Private E-2

    I think I just got hit with the help assistant virus....

    Symptoms are:

    under documents and settings, there is a folder called "help assistant" that all the files on my desktop seem to be getting copied to.

    This happens even after using msconfig to set the system to a safe mode bootup.

    Using f8 during startup gives a very odd "select boot device" screen I've never seen before (it's a blue and white box with many device names in it, definately not the usual MS safe mode boot screen)

    Setup:

    Windows xp sp3 (athlon xp) with Mcaffee running...last scan was saturday, all the latest MS patches installed as of friday.

    How I got it:

    It appeared to hit as a result of an ad on a site I visited this morning using firefox. I got a dialog which said something about a 3d update which I killed and then killed firefox, right after that the system started acting strange and doing constant disk accessing on the boot drive, didn't discover the Help assistant till later. I had not downloaded/installed anything today, I'm sure this is a new infection because it's hitting the disk very hard and the noise was immediately noticable.

    Actions taken so far:
    *I ran a Mcaffee critical system scan, detected nothing.
    *set the system into safe mode using msconfig
    *deleted some of the files in HelpAssistant because the HD was almost completely full by this time.
    *disabled the HelpAssistant account, but it came back on reboot
    *disconnected 2 big secondary drives I use for file storage, just in case

    Questions:

    After looking at other posts about removing HelpAssistant, wondering if I should try FIXMBR before continuing with the usual virus removal procedure in the majorgeeks readme? It's hard to run any tools now because the virus is filling the disk up so quickly.

    There are several folders on the desktop that contain several gigs of pictures. Would it make recovery any easier if these were copied off to a thumb drive and deleted from the desktop, or does this virus just find something else to copy?

    Any idea what this virus actually does? Does it infect/delete other disks/files, steal information or just do this copying thing on the boot disk to grief people?

    Thanks in advance for the help!
     
    clevenger, Mar 24, 2010
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please read ALL of this message including the notes before doing anything.

    Pleases follow the instructions in the below link:

    READ & RUN ME FIRST. Malware Removal Guide


    and attach the requested logs when you finish these instructions.

    • **** If something does not run, write down the info to explain to us later but keep on going. ****
    • Do not assume that because one step does not work that they all will not. MGtools will frequently run even when all other tools will not.


    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:


    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware and Malwarebytes ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this aother user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    TimW, Mar 24, 2010
    #2
  3. clevenger

    clevenger Private E-2

    Ok, went through the entire readme process but had some problems.

    First off, I had my ethernet disconnected from earlier when the virus hit. I had downloaded superantyspyware, mallwarebytes and the updates for both those programs to a thumb drive from another computer. I installed installed and ran both of these as described in the readme.

    Combofix.exe also ran ok, when it wanted to install the recovery console was the first time I put the network back on line. This also ran fine.

    Went ahead and tried to run RootRepeal, My antivirus and firewall (mcaffee) were still disabled from before I ran combofix.exe RootRepeal started and sat on the "initializing" screen, but never got to the screen with the "files/scan" buttons as described in the instructions. I let it sit for 20 minutes but it never got to the point where I could start a scan.

    At this point I killed RootRepeal and restarted the computer (net still connected) this was the first time during the process that the hard drive started banging away when nothing else was running. Nothing appeared to be getting copied though, disk space was still ok but the system was running real slow again.

    Disabled mcaffee and firewall and tried running RootRepeal again, same behavior, just sits on "initializing" let it go for 5 minutes this time, never got "files/scan" so I killed it.

    Then ran MGtools, after running for awhile i got an error dialog box that said:
    c:\windows\system32\cmd.exe
    NTVDM has encountered a system error c0h

    Nothing in the readme about this, so I clicked ignore.

    A bit later I got the same error again quickly followed by this one:

    An unexpected error has occurred at procedure: modRegistry_iniGetString(sFile=system.ini,sSection=boot,svalue=shell)

    error #5 invalid procedure call or argument

    Windows version: Windows NT 5.01.2006
    MSIE version 8.0.6001.18702
    HijackThis version: 2.0.2

    By the time MGTools finished running my disk space was again being eaten up, about 2 gb had been used and 1gb was left (falling fast)

    At this point I thought the safest thing to do was pull the net connection so the virus couldn't send anything out, grab the logs and report in here.

    Also, not sure if it's because I disconnected my two non-boot drives or if it's due to the virus, but my windows is saying I need to re-authorize it in the next 2 days. I haven't done this yet because I wanted to stick to your instructions as closely as possible.

    So what's next? looks like the disk space eating virus is still in there.
     

    Attached Files:

    clevenger, Mar 25, 2010
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let's start you off with this:

    Please download HelpAsst_mebroot_fix.exe and save it to your desktop.
    Close out all other open programs and windows.
    Double click the file to run it and follow any prompts.
    If the tool detects an mbr infection, please allow it to run mbr -f and shutdown your computer.
    Upon restarting, please wait about 5 minutes, click Start>Run and type the following bolded command, then hit Enter.

    helpasst -mbrt

    Make sure you leave a space between helpasst and -mbrt !
    When it completes, a log will open.
    Please post the contents of that log.


    *In the event the tool does not detect an mbr infection and completes, click Start>Run and type the following bolded command, then hit Enter.

    mbr -f

    Now, please do the Start>Run>mbr -f command a second time.
    Now shut down the computer (do not restart, but shut it down), wait a few minutes then start it back up.
    Give it about 5 minutes, then click Start>Run and type the following bolded command, then hit Enter.

    helpasst -mbrt

    Make sure you leave a space between helpasst and -mbrt !
    When it completes, a log will open.
    Please post the contents of that log.

    **Important note to Dell users - fixing the mbr may prevent access the the Dell Restore Utility, which allows you to press a key on startup and revert your computer to a factory delivered state. There are a couple of known fixes for said condition, though the methods are somewhat advanced. If you are unwilling to take such a risk, you should not allow the tool to execute mbr -f nor execute the command manually, and you will either need to restore your computer to a factory state or allow your computer to remain having an infected mbr (the latter not recommended).

    Now let's use ComboFix to remove a bunch of malware files.

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

File::
C:\WINDOWS\Temp\$$$dq3e      
C:\WINDOWS\Temp\$67we.$     
C:\WINDOWS\Temp\mmw4
C:\WINDOWS\Temp\CR_3A.tmp

Folder::
c:\documents and settings\HelpAssistant
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    * HelpAssistant log.
    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Mar 25, 2010
    #4
  5. clevenger

    clevenger Private E-2

    Suggestion, warn people that helpasst_mebroot_fix takes a while before any prompts appear. For me it sat about 10 minutes on the "please wait" screen before anything happened.

    helpasst_mebroot_fix found the MBR infection, did a fix and restarted the machine.

    After the restart and 5 minute wait reconnected the network so combofix would be able to update itself, shut down the mcafee antivirus and firewalls then ran the combofix script.

    Combofix updated and restarted itself, ran through all it's stages, did the file deletions and then it restarted the computer.

    Ran mgtools\getlogs.bat and got the same "hijack this" error dialog I reported in the previous post

    Re-enabled mcaffe virus/firewall. So far so good, help assistant account still disabled, no unusual disk accesses, free space staying stable at 6.34gb where it was before the virus hit.

    Two things:
    1. Either the virus or me taking my two bulk storage drives offline made windows require "activation" (just 2 days left) is it ok to do this now or might it interfere with any work we have left to do ?
    2. I notice there is a "guest" and an ASPNET account that are enabled, should they be there and active?

    Thanks!
     

    Attached Files:

    clevenger, Mar 26, 2010
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean. As to why your are being prompted to re-register your windows version, I cant say. That is not something that I have seen being triggered by malware. As to the two user account, they are not a problem, though I would suggest you disable the Guest account.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    TimW, Mar 26, 2010
    #6
  7. clevenger

    clevenger Private E-2

    I mentioned that I disconnected my two 1tb data storage drives from the machine just after the virus hit to protect them. Should I take any special precautions when I hook them back up? ie: could the virus have jumped to them or is it unlikely? Neither of these drives is bootable.

    One interesting thing, I did some reading of docs this morning, just stuff on the HD, no browser use. Mcafee auto-installed an update while I was doing it. Later I shut the machine down and got a data execution exception from explorer. When explorer restarted itself, mcaffe alarmed on combofix saying it had a trojan and quarantined it. Probably a false alarm, but thought you might want to know about it when you are helping other people since prior to this morning's update mcafee had no complaints about combofix.

    I will re-authorize my windows tonight, then perform your final steps. If anything weird happens I'll let you know.

    Thank you very much for your help! Everything seems to run much better now!
     
    clevenger, Mar 26, 2010
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If there are no exe files on the externals, you should be fine. But the first thing I would do is to scan each drive with both SAS and MBAM after you install them.

    McAfee may have alerted to a file in the COmbo quarantine folders ...hard to say, but not a problem.

    Let me know if everything is running well.

    And you are welcome. :)
     
    TimW, Mar 26, 2010
    #8
  9. clevenger

    clevenger Private E-2

    Everything looks fine, windows authorized with no problems.

    In case someone needs the info the trojan reported in combofix by the latest mcaffee was
    Artemis!F9944212C5B3

    It also reported a potentially unwanted program in mgtools.

    I ignored both of these and did the uninstall as directed.

    I assume it is also ok to delete the HelpAsst_backup folder now too?

    Thanks again
     
    clevenger, Mar 26, 2010
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, you can remove that folder. And you are most welcome. Safe surfing. :)
     
    TimW, Mar 27, 2010
    #10
  11. clevenger

    clevenger Private E-2

    It looks like I may still have a problem.

    When this infection started I pulled my 500gb and 1.5tb storage drives off line.

    I reconnected the 500gb without incident (did a SAS scan, clean)

    Today I reconnected the 1.5tb and Norton alerted that Boot.Mebroot was detected on drive 0x81. It claimed the problem was fully removed, but on reboot I get the same alert and "successful removal" message again. Tried reboot one more time, same alert and successful removal message.

    I SAS scanned the system drive and the 1.5tb drive, no spyware detected.

    Disconnected the 1.5tb drive and rebooted, no alerts from norton.

    I have barely used the machine since we finished cleaning it so I doubt this is a re-infection. Probably the virus got onto the 1.5tb drive during the original infection before I disconnected it. The 1.5tb drive is not bootable and has no OS on it, it's pure storage.

    What steps should I take to clean off this drive?
     
    clevenger, Apr 9, 2010
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to give me the full path to the file. Then we can use either Combo or Avenger to remove it.
     
    TimW, Apr 10, 2010
    #12
  13. clevenger

    clevenger Private E-2

    Norton did not give a path and did not say a it found an infected file. It just says that it detected and "fully removed" a Boot.Mebroot on drive 0x81 (the 1.5tb storage drive on "L:"), this message repeats on every boot.

    Neither SAS or Norton detected any problem files (haven't tried MBAM yet), so it sounds like Norton is detecting something in the MBR that it can block but can't remove.

    If I reran HelpAsst_mebroot_fix.exe with this drive connected up would it clean the MBR? This drive wasn't hooked up when we were cleaning up the machine before.
     
    clevenger, Apr 10, 2010
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Unless your external is capable of booting your computer, it has no MBR. The only thing that comes to mind is it may have an autorun file that Norton is thinking is bad. You could try installing:
    AutoEater.

    See it that makes a difference.

    And yes, the drive should have been attached when you ran the scans.
     
    TimW, Apr 11, 2010
    #14
  15. clevenger

    clevenger Private E-2

    Was gone for awhile (tax time) but am still trying to figure this out.

    Norton still reports Boot.Mebroot on drive 0x81 and "fully removed" after every restart whenever this second (data storage) drive is connected. There is no autorun.inf file on this disk.

    Drive 0x80 is the boot drive, no problems reported on it.

    The drive is an INTERNAL (not usb) connected to a SATA controller.

    I've rerun SAS, MBAM and HelpAsst_mebroot_fix they detect no problems

    When I disconnect this drive, the problem goes away.

    The only thing I can figure is that this second drive has an MBR that got bad code copied to it during the original infection, but since it's not the boot disk maybe none of the "cleaner" programs know how to fix it.

    That norton warning on every boot is making me paranoid, but other than this there is no suspicious behavior.

    What can I do now?
     

    Attached Files:

    clevenger, Apr 17, 2010
    #15
  16. clevenger

    clevenger Private E-2

    Small update to the above. I let the system just sit awhile doing nothing after making the above post. After awhile Norton ran a background scan and alerted on Boot.Mebroot on drive 0x81 again. However this time it said it could not remove it.

    Still no suspicious activity though.
     
    clevenger, Apr 17, 2010
    #16
  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am beginning to believe this is a totally false positive on Nortons part as I am working another thread with the exact same problem. I am not familiar enough with Norton to guide you on how to tell Norton to ignore it but I am sure someone in the software forums can explain it to you.
     
    TimW, Apr 17, 2010
    #17
  18. clevenger

    clevenger Private E-2

    Could it be that the drive is infected but the virus never gets to run because it isn't the boot disk? Maybe the virus removal tool only runs against the boot drive, unless there is a way to change that from the command line?

    Please let me know if you find a solution.
     
    clevenger, Apr 19, 2010
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If this was a bootable drive, then fixmbr can be run on that drive. See the instructions for it in the Recovery Console info. If you do not specify anything after the fixmbr command, it simply defaults to the active Windows boot drive. If you want to rewrite other partition/drives then you have to specify which ones. ;) For example:

    fixmbr \Device\HardDisk0

    In the above example, the master boot record is written to the drive located at \Device\HardDisk0.

    For additional info, see: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/bootcons_fixmbr.mspx?mfr=true
     
    TimW, Apr 19, 2010
    #19
  20. clevenger

    clevenger Private E-2

    Is there a way to check if the drive is bootable, or will fixmbr not run on it if it isn't?
     
    clevenger, Apr 21, 2010
    #20
  21. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What is this drive? Is it just an external drive you bought for storage? Or is it a drive you took from another computer and have set as a slave drive?
     
    TimW, Apr 21, 2010
    #21
  22. clevenger

    clevenger Private E-2

    The drive was bought at Frys as a "retail kit", basically a bare unused drive and some SATA2 and power cables. I installed it in my machine and formatted it with segate's software.

    There was never an OS installed on it, but I've seen some formatters that put an MBR on the drive by default, even if the drive isn't bootable, so maybe that's what Norton is detecting?

    The machine has 3 drives, the boot drive, this 1.5tb seagate and a 500gb WD. The 500gb shows up clean. The 1.5tb is the one Norton complains about...It was attached to the primary controller when the main boot drive was infected so maybe they both got hit at the same time.
     
    clevenger, Apr 25, 2010
    #22
  23. clevenger

    clevenger Private E-2

    Oh...If I disconnect the 1.5tb drive's power and sata cables, the norton warnings go away. So I know it's this drive that's the problem.
     
    clevenger, Apr 25, 2010
    #23
  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Did you try doing what I posted in message #19?
     
    TimW, Apr 25, 2010
    #24
  25. clevenger

    clevenger Private E-2

    I have not done message #19 yet, I wanted to get a backup of the drive just in case I accidentally wiped it doing this. Should be done soon, then I'll try.

    By the way, when I booted the machine norton alarmed on drive 0x81, then it alarmed again on 0x81 when I plugged in the USB disk for backup.

    How do I tell what path to use for fixmbr? Norton says it's drive 0x81, would that be \Device\HardDisk1 ?
     
    clevenger, May 1, 2010
    #25
  26. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, that should be hard disc1 as your C drive is disc0.
     
    TimW, May 2, 2010
    #26
  27. clevenger

    clevenger Private E-2

    Sorry for the long delay, finally got a complete backup of the drive.

    When I run fixmbr \Device\HardDisk1 I get the message:

    ** Caution **

    This computer appears to have a non-standard or invalid master boot record.

    FIXMBR may damage your partition tables if you proceed.

    This could cause all the partitions on the current hard disk to become inaccessible

    If you are not having problems accessing your drive do not continue.

    So should I go ahead with this? I'd really rather not clobber the drive if I can avoid it.
     
    clevenger, May 17, 2010
    #27
  28. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you have completely backed up that drive, then I would just suggest you format it. That will wipe it clean and hopefully remove anything that Norton is complaining about.
     
    TimW, May 17, 2010
    #28

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds