Help - All Java Apps affected - IRC Virus?

codecoaster · Nov 19, 2008

I have been trying to correct this problem for 3 days now and am now at my wits end!
I am a java developer and I have been developing a game for over 3 years. I went to an IRC developers chat channel and asked for someone to help test my game. 2 peop[le offered to help. I am convinced the problems started at this point. Further details if required.
When I next ran my game from the java webstart link online, an unfamiliar applet started. I later followed this link to a forum where a script was posted, about starting private channels alongside the public ones on the afternet IRC server. This came up in the Java console. I can send link to forum if required.
When my game started the screen was covered in horrible squares and I am sure they are not random. I dont think they have anything to do with my game, and the members who supposedly were helping with the game were discussing an applet that uses XOR bit shifting. I'm not sure what is relevant so forgive the extra details.
I tried to run JSmooth to make an executable for the game but the squares showed up in JSmooth.
It happens in netbeans IDE too.
When I run malware zappers the squares disappear, but this seems to be happening less now.
Virus checkers (AVG and Panda), and all spyware removers have found nothing that I can see.
I have removed all runtime environments, even a few I didnt know I had. I installed the new SDK from Sun. (1.6.10). I have emptied the Java cache and the one in windows/sun....
Now I have broken netbeans so I have that to fix too.
Please help as I am in despair over this!
I have tried everything to get a solution, I have posted a link on the Java Forums:
http://forums.sun.com/thread.jspa?threadID=5348796
sent an email to the webmaster where the IRC channel is. (He doesnt think problem is connected to the channel)
Asked eveywhere but nothing. I even tried to pay for an online expert but nobody has replied.
It is a really difficult problem so I will understand if you cant help.

codecoaster · Nov 20, 2008

I went through all the steps in the Vista Cleaning procedure.
Nothing was found until Combo Fix and Mgtools.
A dialog box appeared with Microsoft Windows as the title and a message to say that: SteelWerX WhoAmI application has stopped working.
I will try running other java applications and see if they are also affected.
I uninstalled netbeans and the java versions yet again and reinstalled them. One of the netbeans packages was corrupted so I deleted it.

Please, Please, Please Help, I could try rebuilding the whole program from scratch but Im not sure if theres code been inserted in an image or a file or where it might be.

My Game is still showing great big ugly squares

codecoaster · Nov 20, 2008

Here is the malware bytes log though it didnt detect anything as I ran it a couple of days ago, sorry. I could send old version if needed.
I am also going to try to attach a pic of the problem if it is not too big.
Ive been at this for 12hours today and Im getting tired so forgive me any mistakes,

codecoaster · Nov 21, 2008

Ive noticed that if I start the Task Manager the blocks go away.
If I start task manager first. then run my java game the blocks disappear.
I turned off some processes and the blocks went away but when I rebooted the processes and the horrid blocks came back.
I will try to identify the processes.
Can someone help with this please?
Its driving me bonkers!

chaslang · Nov 23, 2008

Welcome to major Geeks!

We may not be able to help you with this. Problems like this are similar to when web page designers get their HTML files infected. If a virus scanner does not find and remove the problem (and frequently they do not have a way to detect malicious code like this) then we will not be able to locate your problem. Based on your logs you are clean except for one item I saw which we will get to in a moment. First I would like to see your first SUPERAntiSpyware log from Nov 17th. Please attach the below file:
Code:
"C:\Users\Rosie\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\"
supera~1.log  17 Nov 2008  4948 "SUPERAntiSpyware Scan Log - 11-17-2008 - 20-34-04.log"
Now in your ComboFix log I saw the below
Code:
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91307016-7521-11dd-84b7-001b24e58b32}]
\shell\Auto\command - Cn911.exe
\shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Cn911.exe
This cn911.exe file is considered dangerous and often comes via an infected USB drive being inserted. You need to check for this file on all hard disks and any USB drives you use and delete it. I'm not sure that it has anything to do with your problem though. Also do the below.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91307016-7521-11dd-84b7-001b24e58b32}]
Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now reboot and see if there is any change. If not, try running the below.

Now go here and download SysClean:
http://www.trendmicro.com/download/dcs.asp

You will need to download two additional files, one for viruses and the other for spyware. Instructions for which ones to download are found here:
http://www.trendmicro.com/ftp/products/tsc/readme.txt
After running SysClean, attach the log from it.

codecoaster · Nov 24, 2008

When I searched for cn911.exe it searched for over 15mins then message "Windows Explorer has stopped working and needs to restart"
I couldnt get the fixme reg file to run, so I started regedit and imported the file. There was no message though. I looked at the location in the registry and there was no mountpoints entry.
The blocks are still showing up though.
I downloaded the sysclean utility as per instructions. When the spyware utility started the rootkit version failed.
I am attaching the logs you asked for.
I will try running sysclean again while online.
Thank you for your time

chaslang · Nov 24, 2008

As expected, there was nothing detected. If you run your code on another PC does the samething happen?

You would be better off trying to work thru this in the Software Forum and having someone familar with Java programming look at your code (if the offending modules can be identified).

codecoaster · Nov 25, 2008

Hi Chaslang,
When I run exactly the same code copied from this pc on another pc, it runs normally. Only this pc seems to be affected. I will try on the software forum
Thank you for your time

chaslang · Nov 26, 2008

You're welcome.

We could check to see if there are any rootkit infections just to be safe but I don't expect to find any. Are you sure that your application used to run/test the code on the problem PC has not been corrupted?

If you want to check for rootkits, run the below and attach the log from GMER.

Running GMER to detect rootkits

codecoaster · Nov 27, 2008

I couldn't get the GMER program to run, Windows kept closing it when it got to a line 'shadowcopy1' or something like that. The display was a bit scrambled and I couldnt see the show all checkbox. I tried to run it in safe mode too.
I noticed that pushing ctl-alt-del and then pushing cancel made the blocks disappear and not come back again when running an instance of the game. I did a search and arrived at a discussion for the Spore game where a lot of people with the same video card as me were experiencing slow downs. When they pushed ctl-alt-del the problems went away. It was recommended to update the graphic driver. So I did that.
Secunia suggested that I patch zone alarm so I uninstalled and installed the new version. This reset it so nothing was getting through.
I found a hosts file in my Java cache and a file you had mentioned to someone else in another posting.
I have run the game three times since then and there are no blocks showing up!
I am sure that there was more going on here than just a graphics driver problem as the behaviour of the blocks was very spritelike and were not what you expect to happen when the screen is repainted.
I have enabled dep on the driver just to be sure it wont happen again!
There is a possibility that the problem is just hiding, but I am really hoping that it is solved!
My pc has never been so free of spyware and I trally am grateful for your time!
With so much malicious software out there, it is great to have a site like this, where peple can come to for real help!
I wish you and all at Major Geeks all the best and thanks again!

chaslang · Nov 28, 2008

You're welcome.

I'm happy to hear you have things worked out.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Help - All Java Apps affected - IRC Virus?

codecoaster Private E-2

codecoaster Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

SUPERAntiSpyware Scan Log - 11-20-2008 - 18-13-23.log

codecoaster Private E-2

Attached Files:

mbam-log-2008-11-20 (19-15-42).txt

dunbad.gif

example.gif

codecoaster Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

codecoaster Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 11-17-2008 - 20-34-04.log

REPORT.LOG

sysclean.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

codecoaster Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

codecoaster Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member