Avast WEBforum
Other => Viruses and worms => Topic started by: Jim Flagarty on March 14, 2013, 02:02:19 AM
-
This morning, Avast notified me that I needed to update a few of my programs, Utorrent being one of them. After I went through with the updating, I opened Utorrent and didn't like their new layout. So I did a Google search "previous Utorrent version" and found a website called "oldapps(.)com". Avast Webreputation Alert said it had a good rating, so I went to the site, downloaded "uTorrent-3.2.2_build_285705" and went through with the installation. During which, I was given the option to download their toolbar, which I denied by unchecking the appropriate box.
All went well, that is until the installation completed. Moments later, my Firefox browser closed and restarted with the Utorrent toolbar installed, and a random pop-up window appeared. Avast didn't notify me of any problems, so I ran Spybot Search & Destroy and it found "Win32.Downloader.gen".
Unfortunately, it couldn't immediately remove the virus, saying I needed to run Spybot again after a reboot. After the reboot and scan, it appeared to remove the virus, but when I ran a third scan, an hour later, the virus once again showed up in the scan results. This time, I was unable to remove it. I then ran an Avast Full system scan, but it didn't find any problems. Although, I did scan the infected file "uTorrent-3.2.2_build_285705" on https://www.virustotal.com/en-gb/ and it found the virus I mentioned. As of now, I don't know what to do and would appreciate any help I can get.
Thanks for taking the time to read my post.
-
Update avast, MBAM, Spybot, and download and install and update SuperAntiSpyware and run your computer in safe mode. Hope this time it will work? Report back if it finds anything?
-
http://www.spywareremovaltoolkit.com/all-detail/Win32.Downloader-gen.Trj.html#
download and update and scan
and if you may, in this forum I see a lot of win32.downloader.gen, or win32.malware.gen or win32....opt for win8 it will not be infected by these viruses
-
Windows 8 is not listed under the infected system, but just to be on the safe side it's best to remove it.
-
yes that's the point staticguy it is not listed under the infected system, and from my experience win8 users do not complain about any sort of win32....malwares
-
Oh okay fair enough. Based on your experience you do wat u know it's best :)
-
Spybot - Search & Destroy 2.0
http://www.pcmag.com/article2/0,2817,2412372,00.asp
Quote
" In testing, it proved almost 100 percent ineffective
-
Thanks for replying, everyone.
I've done a number of safe-mode scans, avast and MBAM weren't able to detect anything. I then downloaded, updated and did a full scan with SuperAntiSpyware and it while it removed 78 adware cookies, it didn't even find the Win32 thing. From there, I scanned yet again using Spybot, and it detected the virus, removed it, but it came back when I restarted my laptop.
One thing I didn't mention before is that since yesterday, every time I turn on my laptop a window will pop-up for about 30 seconds, warning me of "compatibility issues" that I'm positive is fake. I'll upload a screencap.
After trying all your advice, I'm out of ideas.
-
http://www.spywareremovaltoolkit.com/all-detail/Win32.Downloader-gen.Trj.html#
download and update and scan
and if you may, in this forum I see a lot of win32.downloader.gen, or win32.malware.gen or win32....opt for win8 it will not be infected by these viruses
Sorry, I forgot to try the link you provided. I'm downloading it right now, will do a scan in a moment.
-
Hi lets have a look .. As you may have noticed a lot of these automatic removal tools do not see it . I would not use a tool from the web that advertises they can clean it, as you may get more toolbars or be asked to pay for the removal
Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your Desktop
Secondary link (http://www.itxassociates.com/OT-Tools/OTL.exe)
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
(https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif)
- Select All Users
- Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Attach both logs
-
Hey, I hope these help.
-
Let me know if this works
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
(https://dl.dropbox.com/u/73555776/OTL_Fix.GIF)
:OTL
SRV - [2013/03/06 09:36:52 | 000,093,984 | ---- | M] (Conduit) [Auto | Running] -- C:\Program Files\SearchProtect\bin\CltMngSvc.exe -- (CltMngSvc)
IE - HKLM\..\URLSearchHook: {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-79315306-941780379-3646258439-1000\..\URLSearchHook: {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentControl_v6 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3289075&CUI=UN10905751483721047&UM=2&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "uTorrentControl_v6 Customized Web Search"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3289075&SearchSource=2&CUI=UN10905751483721047&UM=2&q="
[2013/03/13 12:49:12 | 000,001,013 | ---- | M] () -- C:\Users\Ryan\AppData\Roaming\Mozilla\Firefox\Profiles\xt9ip9ut.default\searchplugins\conduit.xml
O2 - BHO: (uTorrentControl_v6 Toolbar) - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentControl_v6 Toolbar) - {96f454ea-9d38-474f-b504-56193e00c1a5} - C:\Program Files\uTorrentControl_v6\prxtbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [SearchProtectAll] C:\Program Files\SearchProtect\bin\cltmng.exe (Conduit)
O4 - HKU\S-1-5-21-79315306-941780379-3646258439-1000..\Run: [SearchProtect] C:\Users\Ryan\AppData\Roaming\SearchProtect\bin\cltmng.exe (Conduit)
[2013/03/14 17:40:58 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Roaming\SearchProtect
[2013/03/13 12:49:44 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2013/03/13 12:49:12 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Local\CRE
[2013/03/13 12:49:01 | 000,000,000 | ---D | C] -- C:\Program Files\SearchProtect
[2013/03/13 12:48:21 | 000,000,000 | ---D | C] -- C:\Users\Ryan\AppData\Local\Conduit
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
Alrighty, here is the log from the quick scan. When the computer rebooted after the "run fix" scan, the "compatibility issues" pop-up appeared again, so I think I still have the virus.
Oh, I can't believe I didn't think to do this earlier, but I just went to Control Panel and in the list of programs, I see that I have something called "Search Protect by conduit" that was installed yesterday. Should I try to uninstall it?
-
The popup is a genuine windows one, just place a tick in the box "do not show this again"
Yes uninstall search protect, but you will probably get a popup saying it can't be uninstalled (it has already gone)
Go yes to remove from the uninstall list
How is the computer otherwise ?
-
It's gone!
Sure enough, the conduit thing was already removed, all I had to do was delete it from the list.
And I'll take your word that the compatibility pop-up is genuine, I just found it weird how it only showed up after getting the virus, 2 days ago. I clicked "don't show this again" so that should be the end of that.
One more thing, I'm sure this isn't a big deal but since I ran the OTL fix/reboot, 2 desktop.ini files are on my desktop. From what I read, they're nothing to worry about but I thought I'd mention it.
But yeah, thanks so much for your help! This is the first virus I ever got so I'm glad it wasn't a bad one. I got careless and downloaded a program from a random site, I'll make sure to never do that again.
Have a nice day :)
-
The text files will go back to the hidden status once I clean up
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View Tab.
- Under the Hidden files and folders heading select Do not show hidden files and folders.
- Click Yes to confirm.
- Click OK.
Clear Restore Points
Go Start > All Programmes > Accessories > System tools
Right click Disc Cleanup and select run as administrator
Select More Options tab
Press Sytem Restore and Shadow Copies Cleanup button
(https://dl.dropbox.com/u/73555776/disc%20clean.JPG)
: Keep Java Updated :
WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article (http://www.forbes.com/sites/eliseackerman/2013/01/11/us-department-of-homeland-security-calls-on-computer-users-to-disable-java/) and this article (http://www.nbcnews.com/technology/technolog/us-warns-java-software-security-concerns-escalate-1B7938755).
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser (http://www.geekstogo.com/2600/how-to-disable-java-in-your-web-browser/) and How to unplug Java from the browser (http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/))
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
(http://img233.imageshack.us/img233/7729/mbamicontw5.gif) Malwarebytes (http://www.malwarebytes.org/mbam-download.php).
Update and run weekly to keep your system clean
Download and install FileHippo update checker (http://www.filehippo.com/updatechecker/) and run it monthly it will show you which programmes on your system need updating and give a download link
If you use on-line banking then as an added layer of protection install Trusteer Rapport (http://www.trusteer.com/Products/Trusteer-Rapport-for-Online-Banking)
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit - Microsoft Windows Update (http://windowsupdate.microsoft.com)
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)Keep safe :wave:
-
Hello. It would appear that I am experiencing the same problem here. I am unable to remove this malware by any other means, and I think it is interfering with the internet connection. If I follow the same instructions, will you be able to help me as you helped this gentleman? Hope to hear back soon. Thank you.
-
Hi what is your problem ?
Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your Desktop
Secondary link (http://www.itxassociates.com/OT-Tools/OTL.exe)
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
(https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif)
- Select All Users
- Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Post both logs
-
Here are the logs Essexboy, appreciate the help. As far as the problems with my computer, there have been some issues around the house with the internet, and me being able to stay connected, as well as others.
-
Hmm not a great deal apparent there, so the main problem is connectivity issues correct ?
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
(https://dl.dropbox.com/u/73555776/OTL_Fix.GIF)
:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva391.sys -- (XDva391)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva356.sys -- (XDva356)
DRV - File not found [Kernel | Boot | Stopped] -- System32\drivers\msro.sys -- (pnujm)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O4 - HKLM..\RunOnce: [SpUninstallCleanUp] REG delete HKEY_CURRENT_USER\Software\SearchProtect /f File not found
O4 - HKU\S-1-5-21-1220945662-1801674531-839522115-1004..\RunOnce: [SpUninstallDeleteDir] rmdir /s /q "C:\Documents and Settings\Chaos\Application Data\SearchProtect" File not found
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN
Please download MiniToolBox (http://download.bleepingcomputer.com/farbar/MiniToolBox.exe), save it to your desktop and run it.
(https://dl.dropbox.com/u/73555776/minitoolbox.JPG)
Checkmark the following checkboxes:
- Flush DNS
- Report IE Proxy Settings
- Reset IE Proxy Settings
- Report FF Proxy Settings
- Reset FF Proxy Settings
- List content of Hosts
- List IP configuration
- List Winsock Entries
- List last 10 Event Viewer log
- List Installed Programs
- List Devices
- List Users, Partitions and Memory size.
- List Minidump Files
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.
Note: When using "Reset FF Proxy Settings" option Firefox should be closed.
-
Alright, here are the new logs.
-
Hmm the net data looks OK
Could you explain in a bit more detail what the problem is
-
Well, after running MBAM before, I found the directory for where the worm was located and removed the program it was in. Conduit I believe. But over the past week after I discovered it, the internet connection for myself and others in the household have been has been vitriolic to say the least. Lagging connection, slow download speeds, high latency/ping in online games, high amounts of connection time outs, and occasions of the connection completely vanishing for moments at a time before showing back up. I'm not sure if the worm is a root to this, as seeing I've considered it being a fault in the provider, and all of the other systems have updated their security.
-
Have you tried a router reset at all to see if that helps ?
On this system I will flush the dns and reset the tcpip to see if that helps any
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
(https://dl.dropbox.com/u/73555776/OTL_Fix.GIF)
:OTL
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3268494&CUI=UN57558940321591735
FF - prefs.js..keyword.URL: "http://mystart.incredibar.com/mb175/?loc=IB_DS&a=6Oz1fENOj4&&i=26&search="
FF - prefs.js..extensions.enabledAddons: %7B97E22097-9A2F-45b1-8DAF-36AD648C7EF4%7D:15.0.4
:Files
ipconfig /flushdns /c
ipconfig /release /c
ipconfig /renew /c
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
Well so far the connection issues seem to have leveled out. Still a little buggy here and there but no where near like it was. Here is the next log.
-
I can still see no malware, it may be worth resetting dns on the other systems to see if that helps
The commands to use are the following :
ipconfig /flushdns
ipconfig /release
ipconfig /renew
-
Alright, will do. Thanks a lot Essexboy, I appreciate the help immensely.
-
So, what actually fixed it? I have this virus (Windows 7).
-
So, what actually fixed it? I see several suggestions here.
-
@Waco could you start your own thread and we will work there
-
Gang,
In the same boat. attached are the OTL and Extras files.
Any help would be appreciated.
Daemeon
-
Daemeon13 I have created a topic for you here
http://forum.avast.com/index.php?topic=120542.new#new