PUP.Optional.Spigot.A/OpenCandy quarantined, but machine keeps freezing

[roffer]

Hi -

 

My Windows 7 machine became infected. Malwarebytes seemed to clear the issue by removing PUP.Optional.Spigot.A and PUP.Optional.OpenCandy, however my machine continues to hang and it seems related to the Chrome browser. I have attached the requested logs and appreciate your help!

FRST.txt

Addition.txt

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 

Fix with AdwCleaner
 
Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please include the contents of that file in your reply.

[roffer]

Hi -

 

Thanks for the reply...

 

I ran the tool (admittedly before you requested and JRT, I will wait however for your next instructions) and it looks like it cleaned out some stuff, but the computer is still exhibiting strange behavior (it freezes when Malwarebytes tries to run a scan).

AdwCleanerS0.txt

JRT.txt

[TwinHeadedEagle]

Let's try to reinstall it:
 
 
Uninstall outdated Malwarebytes' Anti-Malware
 
Please download MBAM-clean and save it to your desktop.

• Right-click on mbam-clean.exe icon and select Run as Administrator to start the tool.
• It will ask you to reboot the machine - please do so.

After that follow my next instructions to download & install the newset MBAM version.
 
 
 
Scan with Malwarebytes' Anti-Malware
 
Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam and select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• Click the Scan tab, choose Threat Scan is checked and click Scan Now.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

[roffer]

TwinHeadedEagle -

 

I downloaded the MBAM-clean utility and launched it as 'administrator'. The file seemed to run but before it completed I got a very strange error message, it said something like the MBAM-clean file is corrupted and won't work. Then the MBAM-clean program asked me to reboot the machine. I did and CHKDSK was forced to run and it fixed a bunch of sectors and recovered one file that had MBAM in the name.

 

Anyway, I downloaded and installed MBAM, but it looks like the version is the same as before. Then I ran the scan as requested and the same thing happened. MBAM got stock on the sector scan and completed 409 scanned objects. At that point the machine became non responsive for over 10 minutes. I then had to hard reboot it. Obviously I was not able to get a log generated. It seems like there maybe a rootkit involved and it clearly has some strategies on how to deal with MBAM installs/scans. Anyway, hopefully you have a plan B as this machine seems to be badly infected. Thanks for all your help!

[TwinHeadedEagle]

I would like to see fresh FRST reports. This could be hardware problem that stops MalwareBytes.
 
 
 
Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[roffer]

Updated scans are attached.

 

I would be surprised if it was hardware since I am using SSDs in a RAID 1 config and it only seems to be a problem when Malwarebytes runs. It even prevents me from launching certain items once the scan starts, like it is a rootkit targeted at Malwarebytes. BTW, why did you think the Malwarebytes version was old, seems like it was the same version before/after the removal/install? Could that also be due to a rootkit?

FRST.txt

Addition.txt

[TwinHeadedEagle]

Okay, let's make more scans:
 
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.
 
 
 
 

Scan with TDSSKiller
 
Please download TDSSKiller by Kaspersky and save it to your desktop.

• Right-click on
• icon and select Run as Administrator to start the tool.

• Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
• Your machine may appear very slow and unusable after that - it's normal.
• TDSSKiller will run automaticaly. Click on Change parameters and click OK.
• Click the Start Scan button and wait patiently.
• If anything will be found follow this guidelines:A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    If Cure is not available, please choose Skip instead.
  • Do not choose Delete unless instructed!

 

 

 

Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).
• Include that log in your next reply.
  If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
  If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

fixlist.txt

[roffer]

I ran all the scans and have attached the logs. TDSSKiller did not find anything but I attached the log anyway. It seems like ComboFix and FarBar found something, do you think that did the trick?! Should we try MBAM again? Any signs of a rootkit?

ComboFix.txt

TDSSKiller.3.0.0.40_12.09.2014_09.20.39_log.txt

Fixlog.txt

[TwinHeadedEagle]

Yes, try it please. No sign of malware on your system, just some temporary files.

[roffer]

Regretfully it exhibits the same behavior on the physical sector scan. I tried it three different times, I even disabled my Symantec AV completely and tried launching with only Microsoft services running, all other items disabled, same results. Any ideas?! At least I am not getting the 'corrupt file' message again for MBAM or chkdsk running after the reboot.

[roffer]

My desktop just blinked off and all the programs that were running disappeared. Then the desktop came back up as if nothing happened. Maybe it is a hardware issue, but then why just the applications? Why didn't everything crash?! Seems like odd behavior. Any insights/suggestions would be greatly appreciated!

 

If it helps, someone asked me to check on Ice Movies as he heard that there is a plugin for XBMC and you can download free movies legally. I told him that could not be legal and that I would check it out. Stupidly, I went to this URL and clicked on one of the links, that is what started the strange behavior, don't know if that helps analyze what is happening to my machine: http://www.icefilms.info/movies/popular/1

[TwinHeadedEagle]

My desktop just blinked off and all the programs that were running disappeared. Then the desktop came back up as if nothing happened. Maybe it is a hardware issue, but then why just the applications? Why didn't everything crash?! Seems like odd behavior. Any insights/suggestions would be greatly appreciated!

 

This is often hardware problem, but let's scan your system one more time:

 

 

Scan with Farbar Recovery Scan Tool

 

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.

  (XP users click run after receipt of Windows Security Warning - Open File).

• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[roffer]

Hi -

 

Sorry for the delay, I missed your posting somehow in my inbox. I have attached the Farbar reports, please let me know if it looks all clear. In the meantime I have stopped scanning with Malwarebytes as it seems to not get along with my system. I did have a incident yesterday where the Flash plugin crashed and managed to bring down my whole system. Hard to know if it is hardware, malware or software related. Not sure what to do next...

Addition.txt

FRST.txt

[TwinHeadedEagle]

Your PC looks clean to me. Let's perform some clean-up and tell me how is the situation now.
 
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!