MBAM detects (PUP.Optional.Bandoo)

[Dam_Hackers]

Hi all,

First post!

 

Whilst browsing the PESedit site, a link took me to uploaded.net where i was able to download some update.  This site launched a nmber of other browser windows and one of these was the Ilivid page - i saw the link to iLivid and thought i would give it a try, started the downlaod but cancelled it. 

 

The file sits on my PC as AAGymlnn.exe.PART and was never renamed by FireFox to remove the .PART extension, although Virus total identifies that the ilivid install is 1,628,904 bytes, i had also downlaoded 1,628,904 bytes but by virtue of the file still being .PART i assume i cancelled it before it was renamed.

I never ran the file and other then my hard drive starting to thrash around after 30 minutes or so i have no symptom - no home page redirects.

 

The only reference to (PUP.Optional.Bandoo) is from the above file, log as follows:

 

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
 
Database version: v2013.10.19.03
 
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16721
Graham :: UBER2 [limited]
 
19/10/2013 18:44:42
mbam-log-2013-10-19 (18-44-42).txt
 
Scan type: Full scan (C:\|D:\|E:\|F:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 499520
Time elapsed: 32 minute(s), 12 second(s)
 
Memory Processes Detected: 0
(No malicious items detected)
 
Memory Modules Detected: 0
(No malicious items detected)
 
Registry Keys Detected: 0
(No malicious items detected)
 
Registry Values Detected: 0
(No malicious items detected)
 
Registry Data Items Detected: 0
(No malicious items detected)
 
Folders Detected: 0
(No malicious items detected)
 
Files Detected: 3
C:\Users\Work\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3YFCAY4K\mDesktopSetup1.6b4OC.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\Work\Downloads\mDesktopSetup1.6b4OC.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
E:\My Documents\Temp\AAGymlnn.exe.part (PUP.Optional.Bandoo) -> Quarantined and deleted successfully.
 
(end)

 

 

Ran ADWCleaner - log as follows

# AdwCleaner v3.009 - Report created 20/10/2013 at 10:57:39
# Updated 19/10/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Graham - UBER2
# Running from : F:\AdwCleaner.exe
# Option : Scan
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Found : HKCU\Software\AppDataLow\Software\smartbar
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\OCS
Key Found : [x64] HKCU\Software\Conduit
Key Found : [x64] HKCU\Software\OCS
Key Found : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Found : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Found : HKLM\Software\Conduit
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v10.0.9200.16720
 
 
-\\ Mozilla Firefox v24.0 (en-GB)
 
[ File : C:\Users\Graham\AppData\Roaming\Mozilla\Firefox\Profiles\xw5isgl8.default\prefs.js ]
 
 
[ File : C:\Users\Work\AppData\Roaming\Mozilla\Firefox\Profiles\qwyzerd8.default\prefs.js ]
 
 
*************************
 
AdwCleaner[R0].txt - [1650 octets] - [20/10/2013 10:57:39]
 
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1710 octets] ##########

 

 

My concerns were raised because my PC would start running very slow after about 30-60 minutes of use (i only had to have the pc switched on and not actually doing anything) and only a reboot would fix the problem but it owuld always come back.  This happened at the start of October but MBAM came back clean, when this behavious started again Saturday, this was the first sign of something and from what i can found out about Bandoo, it will occupy the resources of the PC
 

My PC sometimes doesnt boot so maybe i just have a tired harddrive?  I would appreciate your thoughts

 

Thanks in advance

Graham

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Re-Run Adwcleaner scan again then use the clean function, post that log.....

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
  

 

Kevin....

[Dam_Hackers]

Hi Kevin,

Thanks for your assistance.

 

I have included all te logs as requested.  I had already ran ADW in clean mode sunday so have uploaded that log as well.

 

I have taken my PC off line, hence out of date Kasperksy - this is normally upto date.

 

I have noticed that these are persistant from the ADW logs

-\\ Mozilla Firefox v24.0 (en-GB)
 
[ File : C:\Users\Graham\AppData\Roaming\Mozilla\Firefox\Profiles\xw5isgl8.default\prefs.js ]
[ File : C:\Users\Work\AppData\Roaming\Mozilla\Firefox\Profiles\qwyzerd8.default\prefs.js ]
 

Thanks again

Graham

Addition.txt

AdwCleanerS0.txt

AdwCleanerS2.txt

FRST.txt

[kevinf80]

 

[ File : C:\Users\Graham\AppData\Roaming\Mozilla\Firefox\Profiles\xw5isgl8.default\prefs.js ]

[ File : C:\Users\Work\AppData\Roaming\Mozilla\Firefox\Profiles\qwyzerd8.default\prefs.js ]

Those are the working profiles in Firefox, no issue. No obvious malware in FRST logs

 

Re-run Malwarebytes, check for updates and then run a FULL scan, select and delete all found entries.

 

Next,

 

We need to run an online AV scan to ensure there are no remnants of any infection left on your system, this scan can take several hours to complete, it is very thorough and well worth running, please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 

• Turn off the real time scanner of any existing antivirus program while performing the online scan
  
• click on the Run ESET Online Scanner button
  
• Tick the box next to YES, I accept the Terms of Use.
  Click Start
  
• When asked, allow the add/on to be installed
  Click Start
  
• Make sure that the option Remove found threats is unticked
  
• Click on Advanced Settings, ensure the options
  
• Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  Click Scan
  
• wait for the virus definitions to be downloaded
  
• Wait for the scan to finish
  

 

When the scan is complete

 

• If no threats were found
  
• put a checkmark in "Uninstall application on close"
  
• close program
  
• report to me that nothing was found
  

 

If threats were found

 

• click on "list of threats found"
  
• click on "export to text file" and save it as ESET SCAN and save to the desktop
  
• Click on back
  
• put a checkmark in "Uninstall application on close"
  
• click on finish
  

 

close program

 

copy and paste the report here

 

Thanks,

 

Kevin

[Dam_Hackers]

Hi Kevin

 

Asked my Wife to run Malware Bytes - she said she did but no log

 

Thus I ran the ESET scan first thinking MBAM had already been done.

 

Summary as follows

 

ESET found the file I have left on my pc as mentioned in my original post  - AAGymlnn.exe.PART (now let ESET delete it), otherwise all clear.

Malware found nothing

 

 

Logs attached.

 

I think im clean??

 

Thanks

Graham

ESET SCAN.txt

mbam-log-2013-10-22 (20-40-49).txt

[kevinf80]

Run this please:

 

Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop.

Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

Kevin

[Dam_Hackers]

 Results of screen317's Security Check version 0.99.74   
 Windows 7 Service Pack 1 x64 (UAC is enabled)   
 Internet Explorer 10   
``````````````Antivirus/Firewall Check:``````````````  
 Windows Security Center service is not running! This report may not be accurate!  
 Windows Firewall Enabled!   
Kaspersky Internet Security    
 Antivirus up to date!    
`````````Anti-malware/Other Utilities Check:`````````  
 Malwarebytes Anti-Malware version 1.75.0.1300   
 Java version out of Date!  
 Adobe Flash Player 11.9.900.117   
 Mozilla Firefox (24.0)  
 Mozilla Thunderbird (17.0.8)  
````````Process Check: objlist.exe by Laurent````````   
 Kaspersky Lab Kaspersky Internet Security 2012 avp.exe   
 Kaspersky Lab Kaspersky Internet Security 2012 x64 wmi64.exe  
`````````````````System Health check`````````````````  
 Total Fragmentation on Drive C:   
````````````````````End of Log``````````````````````

[kevinf80]

Security Check is showing Windows FW as active, as you are running Kaspersky security suite maybe pertinent to turn off Windows FW as Kaspersky suite has its own.

 

FRST logs show up to date version of Java, also an outdated version, uninstall the following:

 

Java 7 Update 17 (64-bit) (Version: 7.0.170)

 

Let me know how your system is responding, also if any remaining issues or concerns..

[Dam_Hackers]

Hi Kevin

Thanks for responding so quickly last night.  In terms of malware, does it look like im clean?

Will take your advice RE:above

 

Many thanks

Graham

[kevinf80]

The produced logs do not show any obvious malware issues, what is the status of your system at present.

 

Run the following, see if this makes any difference:

 

Download and install CCleaner from here:

 

 http://www.piriform.com/ccleaner/builds   Ensure to select Slim version. (No Toolbar)

 

 Then select the items you wish to clean up.

 

In the Windows Tab:

 

• 
  

    Clean all entries in the "Internet Explorer" section except Cookies if you want to keep those.
    Clean all the entries in the "Windows Explorer" section.
    Clean all entries in the "System" section.
    Clean all entries in the "Advanced" section.
    Clean any others that you choose.
    Make sure "Wipe free space" is unticked, this will dramatically increase scan time if selected.

 

 

In the Applications Tab: 

• 
  

     Clean all except cookies in the Firefox/Mozilla section if you use it.
     Clean all in the Opera section if you use it.
     Clean Sun Java in the Internet Section.
     Clean any others that you choose.    

 

4. Click the "Run Cleaner" button.

5. A pop up box will appear advising this process will permanently delete files from your system.

6. Click "OK" and it will scan and clean your system.

7. Click "exit" when done.

 

CCleaner is an excellent Utility and well worth keeping, bottom left hand corner of main interface is link "Online Help" use that link to get the full instructions for this very handy application.

[Dam_Hackers]

I will keep an eye on it,  thanks. 

I am  not sure I was infected given I never ran the installer,  but MBAM picked up the file sat there. 

Need to keep an eye on the hard drive activity as that was what alerted me initially as it was constantly accessing, slowing everything down to a crawl.   disk scans found nothing in terms of errors. 

 

Thanks again for your help.  I will look to make a donation post pay day! 

[kevinf80]

Thanks for the reply, not much to do to clean up...

 

We need to remove FRST, first it is very important to deal with its Quarantine folder using FRST itself..

OK, we continue:

Delete any fixlist.txt file previously used, continue:

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). That will confirm the removal action, delete if successful. 

Next,

 

Delete FRST.exe from your Desktop or the folder it was saved to, navigate to and delete its folder C:\FRST

 

Next,

 

Delete Security Checks, other than that you should be good to go...

 

Kevin....

fixlist.txt

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!