Author Topic: Malware constant pop up (Read 7158 times)

Peew971 · « **on:** August 16, 2012, 02:19:48 PM »

Looks like it's a common issue these days but I have zero idea what to do as it's my first time dealing with that.
Can someone help please?

Peew971 · « **Reply #1 on:** August 16, 2012, 02:25:16 PM »

Forgot to mention I did a root scan overnight which deleted a few things but the issue remains.

DavidR · « **Reply #2 on:** August 16, 2012, 03:30:24 PM »

It is best not to try and tackle these things on your own, especially deletions.

What is the full text of the avast alert ?

This is likely to need further analysis by a malware removal specialist:
Go to this topic http://forum.avast.com/index.php?topic=53253.0 for information on Logs to assist in cleaning malware. Use the information about getting and using the tools and attach the logs here, not in the LOGS topic.

Peew971 · « **Reply #3 on:** August 16, 2012, 04:03:06 PM »

I'm on it, thanks. The pop up says avast has blocked a threat. Some kind of trojan with Win32 on the name.
Edit: screen capture

Peew971 · « **Reply #4 on:** August 16, 2012, 04:21:48 PM »

Malwarebytes Log:

Quote

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.16.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
MadMonk3y :: PC [administrator]

16/08/2012 15:05:29
mbam-log-2012-08-16 (15-05-29).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 252903
Time elapsed: 11 minute(s), 34 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 3
C:\Users\MadMonk3y\AppData\Roaming\Ozhy\ihro.exe (Trojan.Winlock.P) -> Quarantined and deleted successfully.
C:\Users\MadMonk3y\AppData\Local\Temp\~!#30E2.tmp (Trojan.Winlock.P) -> Quarantined and deleted successfully.
C:\Users\MadMonk3y\AppData\Local\Temp\~!#57C7.tmp (Trojan.Winlock.P) -> Quarantined and deleted successfully.

(end)

DavidR · « **Reply #5 on:** August 16, 2012, 04:57:38 PM »

Yes that alert is an indication of the underlying hidden/undetected infection trying to get out to download more of the same from malicious sites. Once you have the other logs attached it can be taken up by a malware removal specialist.

Peew971 · « **Reply #6 on:** August 16, 2012, 05:06:53 PM »

Thanks. Logs attached for OTL.

DavidR · « **Reply #7 on:** August 16, 2012, 05:16:18 PM »

A malware removal specialist has been informed of your topic.

Peew971 · « **Reply #8 on:** August 16, 2012, 05:20:34 PM »

Thank you. Log attached for aswMBR.

magna86 · « **Reply #9 on:** August 16, 2012, 05:54:32 PM »

Monitoring

magna86 · « **Reply #10 on:** August 16, 2012, 05:56:41 PM »

Download AVZ Antiviral Toolkit from the following link:

http://support.kaspersky.com/downloads/utils/avz4.zip

Extract the archive to a folder.
Run AVZ [/color] (double click on icon);
Click on File > Custom Scripts ;
In the new window that opens, Copy/Paste everything inside the field code:

Code: [Select]



begin
ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
if not IsWOW64
then
  begin
   SearchRootkit(true, true);
   SetAVZGuardStatus(True);
  end;
DeleteFileMask('C:\Windows\Installer\{53a2525f-3e78-0a7c-238b-9c164478abfc}', '*.*', true);
DeleteFileMask('C:\Users\MadMonk3y\AppData\Local\{53a2525f-3e78-0a7c-238b-9c164478abfc}', '*.*', true);
DeleteDirectory('C:\Windows\Installer\{53a2525f-3e78-0a7c-238b-9c164478abfc}');
DeleteDirectory('C:\Users\MadMonk3y\AppData\Local\{53a2525f-3e78-0a7c-238b-9c164478abfc}');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

Click the Run and wait to execute the script.

***************************

> Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this Instruction.

How to disable avast:

Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
In the window that opens on the top right corner, click Settings.
In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.

> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.

> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.

Peew971 · « **Reply #11 on:** August 16, 2012, 07:53:07 PM »

Log attached

magna86 · « **Reply #12 on:** August 16, 2012, 08:16:40 PM »

Open notepad and copy/paste the text present inside the code box below:

Code: [Select]


Folder::
c:\program files (x86)\Conduit
c:\users\MadMonk3y\AppData\Local\Conduit
c:\users\MadMonk3y\AppData\Roaming\Ozhy
c:\users\MadMonk3y\AppData\Roaming\Myes

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)

Save this as CFScript.txt

Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )

---------------------

How is your computer running now?

Peew971 · « **Reply #13 on:** August 16, 2012, 09:35:45 PM »

Attached

magna86 · « **Reply #14 on:** August 16, 2012, 10:29:59 PM »

Ok, how is your computer running now?

Author Topic: Malware constant pop up (Read 7158 times)

Peew971

Malware constant pop up

Peew971

Re: Malware constant pop up

DavidR

Re: Malware constant pop up

Peew971

Re: Malware constant pop up

Peew971

Re: Malware constant pop up

DavidR

Re: Malware constant pop up

Peew971

Re: Malware constant pop up

DavidR

Re: Malware constant pop up

Peew971

Re: Malware constant pop up

magna86

Re: Malware constant pop up

magna86

Re: Malware constant pop up

Peew971

Re: Malware constant pop up

magna86

Re: Malware constant pop up

Peew971

Re: Malware constant pop up

magna86

Re: Malware constant pop up