System Check - Hopefully sorted, just need a follow-up

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Mahzes, Jan 20, 2012.

  1. Mahzes

    Mahzes Private E-2

    Hey,

    So, my work laptop managed to get infected with the infernal Security Check malware yesterday.

    To cut a long story short, I've followed the general Malware Removal/ Cleaning procedure so hopefully everything will be fine, but I just thought I'd post the logs here anyway. If anyone has the time to check over them and give me the all-clear (or further instruction if there's any lingering remnants, I'd appreciate it.

    I didn't run RootRepeal since my work laptop is on 64-bit Windows. It was apparently infected yesterday morning, although I was out of the office at the time- reportedly a colleague simply started up the laptop to check their e-mail and the Security Check malware appeared on startup.

    It didn't seem too intrusive, and I thought I'd got rid of it for a while (Microsoft Security Essentials, Malwarebytes)- indeed it didn't appear for a while, but I did notice yesterday afternoon that I was getting hijacked when Googling, usually to something like AtoZ search, I think?

    Microsoft Security Essentials detected (and apparently cleaned) two threats when I started up the laptop this morning, and for a while it was fine, but once I got back online and started searching on Google (for brand info and product images), Security Check seemed to bounce back at full force.

    Ive certainly not done anything questionable with the laptop, although part of what I do involves image searches. I do a bit of personal browsing on by breaks, but little more than facebook and twitter, and certainly nothing I don't also do at home and know to be generally safe.

    So yes, in short, as I said above- I've run the complete set of scans and attached logs- if anyone could find the time to let me know whether I'm in the clear or need to do a bit more to get rid of this, I'd appreciate it. :)

    Thanks very much!
     

    Attached Files:

    Mahzes, Jan 20, 2012
    #1
  2. Mahzes

    Mahzes Private E-2

    Re: System Check

    Just checked, I'm still getting radonly hijacked to Easy A-Z search. Something must still be lingering, at the very least.
     
    Mahzes, Jan 20, 2012
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member


    Goto the below link and follow the instructions for running TDSSKiller from Kaspersky
    • Be sure to attach your log from TDSSKiller
    Now please also download MBRCheck to your desktop.

    See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )
    ​
     
    chaslang, Jan 20, 2012
    #3
  4. Mahzes

    Mahzes Private E-2

    Thanks very much- obviously can't do this over the weekend, but will try it once I get back to work on Monday and let you know.

    Thanks again!
     
    Mahzes, Jan 20, 2012
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Just post your results when you can.
     
    chaslang, Jan 21, 2012
    #5
  6. Mahzes

    Mahzes Private E-2

    Okay, slightly worrying that TDSSkiller didn't seem to work- I tried changing the name as suggested, and it did attempt to run; It asked if I wanted to run it and I clicked yes, but then nothing seemed to happen. Any ideas why and what else I can do?

    In the meantime, I've run MBRCheck and attached the log. Any further advice would be greatly appreciated!
     

    Attached Files:

    Mahzes, Jan 23, 2012
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try shutting down all other protection software first. Also try safe boot mode.

    I'm not seeing any malware in logs thus far. Are you having any malware symptoms?
     
    chaslang, Jan 23, 2012
    #7
  8. Mahzes

    Mahzes Private E-2

    Okay, things took a rather bizarre and somewhat worrying turn yesterday;

    Shortly after I made my last post, I noticed tha alternative/ fix to TDSS, 'fixTDSS'. Since I couldn't get TDSSkiller to run, I thought I'd try that.

    In any case, that ran okay, gave the result "***infected MBR detected", successfully repaired them and then required a restart. Upon restarting, Microsoft Security Essentials suddenly alerted me that a threat had been detected;

    Trojan:DOS/Alureon.E

    When I tried to clean/ repair the issue via Security Essentials, it then told me;

    "Security Essentials Couldn’t apply the action you selected;

    Error Code: 0x80501001"

    It then asked me to restart in order to try and remove them. Upon restarting, Windows can't even boot up any more; it says that Windows failed to start up normally and gave me the options of going through startup repair. I've done this, the process completes, and then it basically says that it couldnt' repair them and shuts itself down, and the process basically repeats.

    We've tried restoring to factory settings, which was apparently successful but we're still getting this same error.

    In any case, Dell are sending in a technician now at this stage, since it's a work laptop we can't really afford to lose any more time to this right now. Still, I thought I'd post this here because I'm somewhat baffled myself; this seemed like a fairly textbook case of malware, and the few times I've had troubles with malware in the past, the advice you guys have given has always worked to a T. You said in your last post that you couldn't see any malware in logs so far, and sure enough, aside from the redirects there were no other symptoms. Yet suddenly when I try to fix the redirects it all goes to hell? Do you have any idea what could have caused it?

    Whilst I was away over the weekend, I think someone else at work might have come in to try and sort it out; is there any chance they might have done something that in turn has clashed violently with my attempts to remove the redirect yesterday and caused this? I find it hard to believe that the malware alone could have done this, especially when there weren't any more symptoms other than redirects yesterday until I tried to fix the redirects.
     
    Mahzes, Jan 24, 2012
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Ah hah! With this in mind, I double checked logs and now the below infected partition comes to light.
    Code:
    Get Partition Info From WMI in K-bytes                          
==============================================================  
Bootable  Name                   Size          Type                     
FALSE     Disk #0, Partition #0  104857600     Unknown                  
FALSE     Disk #0, Partition #1  15728640000   Installable File System  
FALSE     Disk #0, Partition #2  304237338624  Installable File System  
[B][COLOR=red]TRUE      Disk #0, Partition #3  1040384       Unknown[/COLOR][/B]
    Correct!!! It cannot fix this and neither can any other scanning tool. Many steps must be used. Attempting to use other procedures and MSE to fix this could result in the problems you are having which is why we don't use it to fix these infections.

    Was not a good idea since this cannot fix the problem either because the partitions are changed.

    Yes! The infected TDL partition that we can now see.

    Potentially yes. I don't really know for sure what they did.

    Yes it is the malware. I can still possibly give you a fix that may work ( i will post what the fix would be in my next message ); however the reimage that you already did has changed the initital conditions so some of what I post may not be 100% as far as stating disk/ partition sizes. Also the reimage, has wiped your data from the PC.
     
    chaslang, Jan 24, 2012
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Below is a set of instructions for making a G-Parted boot disk and using it to remove the infected partition and to make the proper partition on the PC active. As long as the reimage did not windup corrupting the hard disk, the below may work.


    Instructions ( obviously you need to use another PC to make the disk ):
    Now boot off of the newly created GParted CD.

    http://img717.imageshack.us/img717/6546/gpartedsplash01107.th.png
    You should be here...
    Press ENTER
    http://img819.imageshack.us/img819/7286/gpartedkeymaps.th.png
    By default, do not touch keymap is highlighted. Leave this setting alone and just press ENTER.
    http://img404.imageshack.us/img404/9840/gpartedlanguage.th.png
    Choose your language and press ENTER. English is default [33]
    http://img140.imageshack.us/img140/7958/gpartedgui.th.png
    Once again, at this prompt, press ENTER
    You will now be taken to the main GUI screen below
    http://img32.imageshack.us/img32/1122/gpartedo.th.png
    According to your logs, the partition that you want to delete is 1,016.00 KB or about .992 MiB ( .992 MB)
    Click the trash can icon to delete and then click Apply.
    You should now be here confirming your actions:
    http://img233.imageshack.us/img233/1533/gpartedsteps.th.png
    Now you should be here:
    http://img696.imageshack.us/img696/8471/gpartedsuccessclose.th.png
    Is boot next to your OS drive? According to your logs, your OS drive is the 283.34 GBsized partition.
    http://img194.imageshack.us/img194/7753/gpartedboot.th.png
    If boot is not next to your OS drive under Flags, right-mouse click the OS drive while in Gparted and select Manage Flags
    In the menu that pops up, place a checkmark in boot like the picture below:
    http://img196.imageshack.us/img196/3483/gpartedmanageflagsboot.th.png
    Now press the Close button to save these changes.
    Now double-click the http://img822.imageshack.us/img822/641/gpartedexit.png button.
    You should receive a small pop up like this:
    http://img88.imageshack.us/img88/8986/gpartedexitreboot.png
    Choose reboot and then press OK.


    Now you need to boot into the Windows 7 Recovery Environment using one of the below two methods.


    Method1: To enter System Recovery Options from the Advanced Boot Options:
    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next then skip down to Part 2 below.
    Method 2: To enter System Recovery Options by using Windows installation disc:
    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.
    Part2: On the System Recovery Options menu you will get the following options:[
    • Startup Repair
    • System Restore
    • Windows Complete PC Restore
    • Windows Memory Diagnostic Tool
    • Command Prompt
    Here we would select Command Prompt and then at the command prompt run the below commands ( note the space after bootrec )
    • bootrec /fixmbr
    • bootrec /fixboot
    • exit
    Once back in Windows...
    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


    Now attach the below log:
    • C:\MGlogs.zip
     
    chaslang, Jan 24, 2012
    #10
  11. Mahzes

    Mahzes Private E-2

    Just a quick update;

    As I mentioned, Dell sent an engineer over today, who decided that the best course of action would be to replace the entire hard drive and motherboard. >_> *facepalm*

    So yes, problem 'solved' I guess, by the most ridiculously extreme methods possible. *sigh* I guess that's the problem when it comes to work- you're at the mercy of a boss who (sort of understandably) doesn't have the patience nor the faith to wait around on advice from places like yourselves.

    Still, I'm pretty shocked to learn that was the malware's doing- In my (thankfully fairly limited) experience of it, it's never been able to do that extent of damage. Also glad to hear there's a fix for it (thanks for posting, even though it's not needed now- you guys rock, seriously :) ), even if does seem slightly complex! *laughs*

    As I said, I guess it's problem solved for now, anyway! Thanks again, and hopefully I won't have to come back here with more problems (work or home) any time soon! :)
     
    Mahzes, Jan 24, 2012
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    :-D Totally not needed but too late.

    Yes the majority of infections we are getting these days do things like this. There are many forms, but MBR and/or partition infections are running wild.;)
     
    chaslang, Jan 26, 2012
    #12
  13. Mahzes

    Mahzes Private E-2

    Bloody hell, looks like malware's got more, well, malicious since I last had problems with it at home. Really keeping my fingers crossed now that I don't get any! (That said, at least I have enough spare computers floating around at home that I'd be able to get on here and run the various fixes!)
     
    Mahzes, Jan 26, 2012
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes it is much worse than ever. And most commerical protection tools do nothing to block these problems. Nor are the capable of fixing them. Many steps are required which is why this forum and many others like it, are extremely busy.
     
    chaslang, Jan 26, 2012
    #14
  15. Mahzes

    Mahzes Private E-2

    Is there even anything you can do to protect yourself against these things, then? I mean, the one that hit the work laptop did so without any sort of questionable activity on anyone's part, meaning it must have just jumped down during a google image search or something (although I have acquired Malware that way at home once before, too).

    If none of the main programs can even stop it, is there any way I can go about protecting/ defending myself from getting this sort of thing either again or at home?
     
    Mahzes, Jan 27, 2012
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    There is no perfect ideal solution, but you can follow the instructions in the below

    How to Protect yourself from malware!

    One of the most important things these days is the user of the PC. Everyone needs to be more aware of what they are doing, where they are surfing, what they are downloading and installing, what they are clicking on. Read before clicking and even then be very careful.

    Even sites that people think are 100% safe ( like google ) are far from safe. They do not police eveything that is there.
     
    chaslang, Jan 28, 2012
    #16

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds