Phantom Audio, Ad-Clicker worm, need some info/help! please!

simP · Jul 12, 2010

Well, I'm currently at work and do not have access to my home/infected PC atm.

So i'm not able to run the tools and print out the logs, I originally posted this on MalWareBytes, but I received no response, so if someone can give me some general information or if you may know what the culprit is, I'll be glad to go through all of the steps, as soon as I get home, but I'm little worried because this seems to be a nasty problem, I worked on it for about 7 hours last night with no avail.

Well, I'm at work currently and don't have access to my PC, so I wasn't able to do all of the steps in the sticky yet.

Basically, I'm just inquiring about some basic advice, before I go home and go threw all the steps and upload my logs.

Maybe, someone can offer me some general advice before I get home and do this the correct way.

Well, last night, I visited FPSBanana.com which has been hijacked and currently has a virus.

There's a hidden iFrame which takes you to this http://xxx.tossads567.com/f/index.php site, which gives you the virus/worm whatever.

I visited the site on google chrome, with adblock, and I was running McAfee, I also tested this on a virtual machine with the same setup, but MSE(microsoft security essentials) instead of McAfee, both got the bug.
As a side note, is MSE any good? people have said it's great, and according to an article i read in PC magazine, it was ranked as one of the best free av. But with my experience, i've found that it sucks?
anyway back to the topic,

it run's an iexplore.exe process. which uses anywhere 30,000-150,000k memory.

It sometimes will popup ad's in internet explorer, which I have never used once on this machine.

It loads random commercials, for like Sham-WoW and shampoo, and orangejuice and a washing machine.

It makes clicking noises, like when you click links in internet explorer, which makes me guess, this is an Ad-Clicking worm to make someone money with google ads or something.

And, randomly usually 1-5 mins after the process starts back up, after I kill it in task manager, it will turn down my 'Wave' volume, in my master volume control for windows. I assume, so I don't hear all these crazy ads and commercials.

I've scanned with McAfee, MSE, MalwareBytes, and SuperAntiSpyware, nothing has found an infection, scanned in safe mode, and regular mode.

usually, your guys tool, mwb anti-malware, does the trick and removes anything from my pcs, vm's, and friends computers that I work on.

This time, it cannot find the culprit,
has anyone had any experience with this, and can give me some help?

Or am I boned, until I get home and run through all the steps. Sorry, not trying to be impatient, just kinda worried and I cant find any reliable information about this situation on google. Found others having the same problem, but nobody with a solution.

I'm running Windows XP home, 32bit, SP3, legit, genuine.
on both the virtual machine and my main machine.

Thanks in advance for any help or information.

also: I ran a scan on fpsbanana with novirusthanks.org/com whichever, and it picked up the iframe, and http://xxx.tossads567.com/f/index.php that link, but said it was clean, when I scanned both URL's, obviously thats a lie.
And I'm positive for a fact, that this is where I received the nasty bug.

But, I left my PC on in safe mode, because I was letting McAfee run a "Full Scan" with the hope it might find something, and because this takes forever, I just left it running while I went to work.

Should I call my girlfriend and have her turn my PC off, or will it not be a big deal until i get home.
Click to expand...

simP · Jul 12, 2010

I'm sorry that I'm an idiot, I noticed there's lots of similar threads to mine, I apologize for not being more aware.

Although, if there's anything in particular related to my problem that's not been mentioned in the other threads, please let me know.

I will update this as soon as I'm home from work in about 2 hours, with all the correct steps done. Hopefully someone can help me out, I worked on this from 9:30pm to 4:30am last night, and went too bed with bloody fingertips and tears in my eye.

simP · Jul 12, 2010

In the sticky, to continue the READ AND RUN ME FIRST steps, there's no links for any of the windows installations, it says click the blue underlined links, but uh... I don't see any... so, i ran Ccleaner disabled my daemon tools, now i'm kinda stuck....?

what else do I do? cause I still cant get rid of this thing, and it's becoming very annoying.

and just so we know i'm not completely retarded:

http://i30.tinypic.com/2exqy4w.png

no links...

chaslang · Jul 13, 2010

Welcome to Major Geeks

simP said: ↑

In the sticky, to continue the READ AND RUN ME FIRST steps, there's no links for any of the windows installations, it says click the blue underlined links, but uh... I don't see any
Click to expand...

Either disable the addons like AdBlocker or similar in FireFox ( or Chrome or whatever you are using ) or add forums.majorgeeks.com to your safe list. Otherwise use a better and safer browser like Internet Explorer.

Log in or Sign up

Phantom Audio, Ad-Clicker worm, need some info/help! please!

simP Private E-2

simP Private E-2

simP Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member