Unidentified malware

Discussion in 'Malware Help (A Specialist Will Reply)' started by HastyLumbago, Jul 30, 2007.

  1. HastyLumbago

    HastyLumbago Private E-2

    I work in an office cleaning the computers of the natives. Usually, this consists of running a few scan-and-scrub programs, and maybe booting into safe mode and/or running msconfig to disable, locate, and delete stubborn services.

    Recently, one desktop made this a fair bit harder.

    I'm getting the following symptoms:

    * two differant alert windows, which direct to two differant websites (www*onlinesecurity*com and www*onlinestability*com)

    * the message that one or more changes to startup items/services (happens on either one) could not be completed due to access restrictions, and that I should have to sign on as an admin. Needless to say, I am logged on as an admin.

    * a flashing red triangular icon in the system tray which repeatedly tells me I'm virus/worm infected, and which does nothing else.

    This desktop was running Macafee, it's now running alwil Avast!, with the most recent update being Friday afternoon.

    Tell me what you need in addition to all of that, and I will be happy to provide it. I want this thing off of my workbench!

    **EDIT** . replaced with * in URLs to avoid accidental infection due to link-following. Sorry about that.
     
    HastyLumbago, Jul 30, 2007
    #1
  2. HastyLumbago

    HastyLumbago Private E-2

    Incidentally, because I figure someone will want it eventually, Here's a one of those HiJackThis! Logs.

    Also, I've run Spybot, which found a metric crapton of stuff, Adaware, which has found only one thing above and beyond the standard MRU lists and cookies, and Avast, which found trojan after trojan, as well as at least one UXP(? I don't remember the file extension, actually, but when I googled it, it turned out to be some sort of self-extracting archive) which it felt the need to append an exclamation point to during boot scan.
     

    Attached Files:

    HastyLumbago, Jul 30, 2007
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Majorgeeks!

    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.​
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
      • CounterSpy
      • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
      • Bitdefender - from step 6
      • Panda Scan - from step 6
      • runkeys.txt - the log from GetRunKey.bat
      • newfiles.txt - the log from ShowNew.bat
      • HijackThis --the last scan to run after renaming it!
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
     
    TimW, Jul 30, 2007
    #3
  4. HastyLumbago

    HastyLumbago Private E-2

    As our office has stict policies against connecting potentially infected computers to the network, I cannot comply with this part of the request.

    Should I continue with the rest of the request, omitting the online scans, or seek help elsewhere?
     
    HastyLumbago, Jul 30, 2007
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes...do all that you can and attach the logs.:)
     
    TimW, Jul 30, 2007
    #5
  6. HastyLumbago

    HastyLumbago Private E-2

    OK, here are the offline logs.
     

    Attached Files:

    Last edited: Jul 30, 2007
    HastyLumbago, Jul 30, 2007
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please use add/remove programs to uninstall:
    Viewpoint Manager (Remove Only)"
    Viewpoint Media Player"
    Viewpoint Toolbar
    SearchAssist
    MarketResearch
    J2SE Runtime Environment 5.0 Update 6
    Sunbelt Counterspy
    Re-bbot and install:
    Java Runtime 6

    Now run CCleaner and remove all the temp files!

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking fix, exit HJT.

    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    NOW:
    I'm going to post two sets of instructions below. Each will be enclosed in separate Quote boxes. Make sure to complete the first one 100% before moving on to the second one.

    A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

    The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

    Now reboot into normal mode and attach this new rapport.txt log here.
    Now attach new logs from:

    * GetRunKey
    * ShowNew
    * HJT

    How are things working now?
     
    Last edited by a moderator: Aug 7, 2007
    TimW, Jul 30, 2007
    #7
  8. HastyLumbago

    HastyLumbago Private E-2


    Well, as per my boss's orders, I've removed the HD and have it slaved to another machine, and we're doing scans there. But as soon as that scan is over, I'll reattach it and follow your instructions, and then I'll let you know how it goes. Thanks muchly!
     
    HastyLumbago, Jul 30, 2007
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Hum...slaving a drive that may be compromised....not what we would suggest.:)
     
    TimW, Jul 30, 2007
    #9
  10. HastyLumbago

    HastyLumbago Private E-2

    Runs counter to what I would assume to be safe practice as well, especially since the bench computer is hooked up to our server. He assures me that it's fine, and that has bourne up under six months of practice, so, yeah.
     
    HastyLumbago, Jul 30, 2007
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Keep me informed as to your progress.:)
     
    TimW, Jul 31, 2007
    #11
  12. HastyLumbago

    HastyLumbago Private E-2

    Here are the first three logs. the two rapport logs, which I have numbered, come next. Seems to be completely operational, with all circuits functioning perfectly.
     

    Attached Files:

    HastyLumbago, Jul 31, 2007
    #12
  13. HastyLumbago

    HastyLumbago Private E-2

    These are the two smitfraud logs.
     

    Attached Files:

    HastyLumbago, Jul 31, 2007
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please reset msconfig to normal startup!
    Delete these folders:
    C:\Program Files\Common Files\PrivacyProtector Free
    C:\Documents and Settings\james\Local Settings\Application Data\Viewpoint
    If this is showing in your add/remove list, uninstall it!
    MarketResearch

    See the below list of files! They are from GetRunKey and the show in your log from ShowNew. In the READ ME we specifically requested that you finish running GetRunKey and close the popup notepad window with the runkeys.txt log in it before running ShowNew. Please remember to do this and do not run both scans at the same time either.
    Delete all of them.

    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Check the 'Input script manually' box.
    * Click on the magnifying glass icon.
    * Copy everything in the Quote box below, and paste it in the box that opens:

    * Now click the 'Done' button.
    * Click on the traffic light icon and OK the prompt.
    * You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt
    Attach new logs for:
    Avenger
    ShowNew
    GetRUn
     
    TimW, Aug 1, 2007
    #14

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds