Strange Behaviour, Affiliate.Downloader found

[copperkid]

Hello all,

I'll try to be brief and clear: Today I was working from home with multiple windows open. One such window was a Gchat window as I was chatting with someone. I was cleaning my keyboard with a cloth prior to this, but when I sat back down at my computer, there was typing going on in the Gchat text window. At first it was a bit of gibberish, then it was backspaced, and replaced with BABAR (something I'd Googled at some point in the past). Immediately after this, a window opened up to some website that lists famous quotes (which I had probably done a search for some time ago during the school year for a college paper).

Of course, I just sat there, eyes wide. Nothing else happened. Anyway, I did an immediate scan with AVG and it found nothing. I found mention of your software, so I tried it out and lo and behold, the following report...

Malwarebytes Anti-Malware (Trial) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.08.09.01

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

Windows :: WINDOWS-PC [administrator]

Protection: Enabled

8/8/2012 10:43:44 PM

mbam-log-2012-08-08 (22-54-44).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 204573

Time elapsed: 5 minute(s), 25 second(s)

Memory Processes Detected: 1

C:\Program Files (x86)\Registry Helper\RegistryHelperService.exe (Rogue.RegistryHelper) -> 2232 -> No action taken.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 4

HKLM\SOFTWARE\Registry Helper (Rogue.RegistryHelper) -> No action taken.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RegistryHelper.exe (Rogue.RegistryHelper) -> No action taken.

HKLM\SYSTEM\CurrentControlSet\Services\Registry Helper Service (Rogue.RegistryHelper) -> No action taken.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Registry Helper (Rogue.RegistryHelper) -> No action taken.

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 2

C:\Program Files (x86)\Registry Helper (Rogue.RegistryHelper) -> No action taken.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Helper (Rogue.RegistryHelper) -> No action taken.

Files Detected: 32

C:\Users\Windows\Downloads\DownloadSetup (1).exe (Affiliate.Downloader) -> No action taken.

C:\Users\Windows\Downloads\DownloadSetup.exe (Affiliate.Downloader) -> No action taken.

C:\Users\Windows\Downloads\FastDownload.exe (Affiliate.Downloader) -> No action taken.

C:\Program Files (x86)\Registry Helper\AdvisorLetters.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\background.jpg (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\delete_invalid_entries_grey.jpg (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\ErrorFound.wav (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\header.gif (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\help.chm (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\IEHandler.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\letter.htm (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\letter1.htm (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\letter2.htm (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\letter3.htm (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\letter4.htm (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\letter5.htm (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\logo.jpg (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\print_16.gif (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\Registry Helper Screen Saver Setup.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\Registry Helper.url (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\RegistryHelper.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\RegistryHelperBundle.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\RegistryHelperService.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\RegistryHelperSetupCB.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\RegistryHelperSetupTR.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\RegistryHelperUninstaller.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\Starter.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\uninst.exe (Rogue.RegistryHelper) -> No action taken.

C:\Program Files (x86)\Registry Helper\vbrun60sp5.exe (Rogue.RegistryHelper) -> No action taken.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Helper\Registry Helper Help.lnk (Rogue.RegistryHelper) -> No action taken.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Helper\Registry Helper.lnk (Rogue.RegistryHelper) -> No action taken.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Helper\Visit our Website.lnk (Rogue.RegistryHelper) -> No action taken.

(end)

Any suggestions as to what might have happened to ellicit the strange behaviour? (Besides a ghost hitting my keys to creep me out? Gosh, it was weird.)

Thanks in advance,

Ck

[MrCharlie]

Registry Helper is a fake computer protection tool which enters the system with the help of trojan horse. Once installed, it can imitate computer scans and displays rogue security threats to trick users into purchasing illegal version of the application. So don’take action on these warning.

-----------------------------------------

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

MrC

[copperkid]

Malwarebytes Anti-Malware (Trial) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.08.09.01

Windows 7 x64 NTFS

Internet Explorer 9.0.8112.16421

Windows :: WINDOWS-PC [administrator]

Protection: Enabled

8/9/2012 11:37:16 AM

mbam-log-2012-08-09 (11-37-16).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 204785

Time elapsed: 3 minute(s), 35 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Scan says all clear now.

Does the Registry Helper cause the 'ghost typing' issue? I'd just like to know for peace of mind.

Thanks.

[MrCharlie]

Does the Registry Helper cause the 'ghost typing' issue? I'd just like to know for peace of mind.

It could, how's the computer now?? MrC

[copperkid]

It could, how's the computer now?? MrC

It seems fine. I've run the Quick Scan a few more times since the issue and it found nothing.

[MrCharlie]

Great

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!