infected by Omiga Plus

[vinzent]

Hello,

 

I was just infected by Omiga Plus. It came with the latest DAEMON Tools Lite installer, and, unless I missed something, it didn't warn me at all about installing a search/toolbar feature.

 

I may have done something wrong : prior to coming here, I ran the Omiga Plus uninstaller from the Windows Add/Remove Program Menu.

It submitted a captcha and many pop-ups asking for confirmation (one per browser extension), then it completed. But I still have the omiga-plus.com start page, and not sure about what was compromised on my system.

 

I haven't done anything else to remove it.

 

Here is my Farbar log : FRST.txt, Addition.txt (see attachment)

 

By the way,

Do you think some of my personal data may be compromised now or in the future following this attack?

Is it recommended to scan for rootkits (TDSSKiller...)?

 

Thank you for your help!!!

 

FRST.txt

Addition.txt

[kevinf80]

Hello and

 

P2P/Piracy Warning:

 

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

 

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Download Malwarebytes Anti-Malware to your desktop.

• 
  

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish.
On the Dashboard, click the 'Update Now >>' link
After the update completes, click the 'Scan Now >>' button.
Or, on the Dashboard, click the Scan Now >> button.
If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

 

• 
  

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click 'Copy to Clipboard'
Paste the contents of the clipboard into your reply.

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Let me see those logs, also give an update on any remaining issues or concerns....

 

Kevin

 

 

 

 

fixlist.txt

[vinzent]

Done.

 

I'm afraid I still have 2 tabs opening on isearch.omiga-plus.com everytime I launch Google Chrome.

 

I ran Adw twice to see if there was any improvement - you'll see that the Registry entries have been cleaned, but Chrome still infected.

JRT seems to detect nothing?

 

Waiting for your comments before continuing.

 

By the way, I'm still puzzled that they cared to put a fake "uninstall" feature, what's the point?

Fixlog.txt

MBAM.txt

AdwCleanerS0.txt

AdwCleanerS1.txt

JRT.txt

[vinzent]

Update: I ran MBAM a second time.

 

Google Chrome still infected.

MBAM pass2.txt

[vinzent]

Another issue: Internet Explorer is slower to start than usual.

[kevinf80]

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save the zip file to your Desktop.

Double click zip file and extract to your  Desktop:

 

 

 

 

you will now have 3 versions of the tool on the Desktop:

 

 

 

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/

 

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:

 

 

 

 

Copy and paste the following script from the code box and paste into the field.

 

 

standardsearch;autoruns;autoclean;FFdefaults;CHRdefaults;emptyalltemp;installedprogs;

 

 

Select the "Run Script" tab. The following window will open:

 

 

 

 

 

 

Please be patient and do not use the PC when the scan is in progress.

 

When complete you maybe asked to re-boot your PC, if so please do

 

 

Post the produced log in your next reply, also let me know if Chrome still has issues....

 

Kevin

[vinzent]

Done!

 

Please note the following

1. No more Omiga Plus tabs showing up in Chrome upon startup

 

2. (zoek-results.log) Ridiculously long "Files Recently Created / Modified" log: I reinstalled Windows last week (then I made the good decision to install fresh software and ended up with Omiga Plus...)

 

3. (bug.jpg) I got an error message from HijackThis, which apparently failed

zoek-results.log

[vinzent]

I'm out of luck - two reboots later, I just reopened Chrome and the Omiga Plus start page is back again (2 tabs).

 

Please note than in the meantime I did not install or uninstall anything, did not perform any time of browser reset.

It's just back. 

[vinzent]

There's one thing I did actually prior the Omage Plus start page came back - I logged back into Chrome.

Do you think it could be somehow attached to my Google profile?

 

Additional info: I have another machine, a laptop. I logged into Chrome yesterday and found out the "Quick Start" chrome extension had carried over to my laptop. I immediately disabled and uninstalled it from Chrome. I have seen no other sign of infection on my laptop (and I don't believe it could infect the whole system from the Chrome extension since it didn't have admin rights... right?)

[vinzent]

Update: restarted Chrome on my 2nd computer (laptop) and it now displays the 2 Omiga Plus tabs (same URL, same uid parameter)

[kevinf80]

Chrome is notorious for the type of issue you describe, I also suggest the same instructions are done on the laptop! ..... Do the following:

 

Go here: https://support.google.com/chromebook/answer/1281195?hl=en scroll to and follow the instruction to Stop Sync, scroll to and follow the instructions to Delete Synced information from your account.

 

Next,

 

Go here: https://support.google.com/chrome/answer/95319?hl=en-GB Follow the instructions to Uninstall Chrome, also use this option "Also delete your browsing data" from the instructions...

 

Next,

 

Navigate to this folder: C:\Program Files (X86)\Google Delete the full folder named Google.  Reboot the PC....

 

Next,

 

Reinstall Chrome from here: http://www.google.com/intl/en_uk/chrome/browser/

 

Next,

 

Install AdBlock plus for Chrome from here: https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb

 

Next,

 

Install FlashBlock for Chrome from here: https://chrome.google.com/webstore/detail/flashblock/gofhjkjmkpinhpoiabjplobcaignabnl?hl=en

 

Next,

 

Install CryptoGuard by Hitman Pro (Free) from here: http://www.surfright.nl/en/alert/cryptoguard  That will protect all browsers....

 

Next,

 

Run another scan with Malwarebytes, post the log.....

 

Let me see MB log, also give an update on Chrome issues...

 

Kevin

[vinzent]

Thanks a lot! I'll be doing that within the next couples of hours.

 

In the meantime, could you tell help me with the following questions:

- Do you think all my passwords are compromised due to Google Chrome's sync feature? (I just read they are non-encrypted!!!)

- Once the cleaning is complete, will I ever be able to use sync again (I like it for bookmarks)?

[kevinf80]

I was not aware that Chrome did not encrypt passwords, the version of Chrome I have certainly can.... When you have Chrome re-installed do the following:

 

Open Google Chrome and sign in, Select the Menu (stack of plates) top right corner, scroll to and select "Settings"

 

From the Settings window select "Advanced Sync Settings"

 

From within the Sync settings window you have full control over what you sync and how you use encryption options....

 

Regarding passwords, all passwords should be changed on a regular basis, maybe every week and immediately if your system has been compromised with any type of infection, malware or browser hijacker.

 

Let me know how you progress and what other help you need..

 

Thanks,

 

Kevin

[vinzent]

Thanks. I'll follow your advice and will keep you posted.

 

Here is the article http://siliconangle.com/blog/2013/08/07/google-chrome-hacked-how-your-passwords-can-be-exposed/

Although Google states that passwords are encrypted, they would be in clear in Chrome's cache. That makes sense, otherwise how would Chrome be able to convey the passwords accross different Chrome instances, on different machines?

[kevinf80]

Very interesting read. I personally never use sync on Google Chrome, I see issues such as you have and many others on a regular basis at malware forums I frequent. I do export bookmarks for a back up anytime I add any new ones, thats about it for Chrome.....

[vinzent]

Finally, Omiga Plus isn't showing anymore in Chrome.

 

Here is the MB log:

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 27/06/2014

Scan Time: 21:02:25

Logfile: 

Administrator: Yes

 

Version: 2.00.2.1012

Malware Database: v2014.06.27.08

Rootkit Database: v2014.06.23.02

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Chris

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 271573

Time Elapsed: 6 min, 41 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[vinzent]

By the way I just doubled-checked: I confirm that my passwords are stored in clear in Chrome!

 

I also found this great article: http://www.darkreading.com/attacks-and-breaches/google-chrome-tabs-let-malware-sneak-into-businesses/d/d-id/1104632? 

Can't believe Chrome still has this breach 2 and a half years after this was highlighted. 

 

All of this won't have been for nothing: now I know I cannot trust Chrome with my passwords, and shouldn't activate Google sync for extensions...

[kevinf80]

Another interesting read. I have Chrome on my system but never use it personally. What is the current status of your system, do you have any remaining issues or concerns? if none run the following to clean up:

 

Download "Delfix by Xplode" and save it to your desktop.

 

"Delfix link mirror"

 

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

 

Make Sure the following items are checked:

 

• 
  

    Activate UAC
    Remove disinfection tools
    Create registry backup
    Purge System Restore
    Reset system settings

 

Now click on "Run" and wait patiently until the tool has completed.

 

The tool will create a log when it has completed. We don't need you to post this.

 

Part of the routine will be to create a registry back up with ERUNT,  the back up will be created here:

 

C:\Windows\ERUNT

 

When all is known to be well with your system you can delete that back up folder if you consider it as not needed...

 

Let me know your progress...

 

Thanks,

 

Kevin...

[vinzent]

Done. It worked! Thanks a lot for your help

[kevinf80]

It was a pleasure to work with you, take care and surf safe...

 

Kevin....

[vinzent]

Hello again,

We're one week later after my Omiga Plus infection.

Everything's perfectly fine, except for the fact that MB has found a malicious registry key...

 

My previous scan was clean on June 27.

Could this be a left-over, that couldn't be detected at the time, but can be now, following the latest update?

 

Here is the log:

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 04/07/2014

Scan Time: 21:50:42

Logfile: 

Administrator: Yes

 

Version: 2.00.2.1012

Malware Database: v2014.07.04.09

Rootkit Database: v2014.07.03.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Chris

 

Scan Type: Custom Scan

Result: Completed

Objects Scanned: 336847

Time Elapsed: 3 min, 6 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 1

PUP.Optional.WindowsProtectManger.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsProtectManger, Quarantined, [58ca4c4f99e2bf7791a0e8cb4eb412ee], 

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 0

(No malicious items detected)

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end) 

[kevinf80]

Yes is inert remnant leftover, if you recall we kill and remove with FRST early in your thread.....

 

 

WindowsProtectManger => Service stopped successfully.
WindowsProtectManger => Service deleted successfully.
C:\ProgramData\WindowsProtectManger => Moved successfully.

 

You are still good to go my friend....

 

Kevin...

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!