malicious website blocked 95.215.1.57 and fffSee.com

[beester]

Started seeing Malwarebytes reporting Malicious Website Blocked late in the afternoon 9/18.  Been going steady since.

How can I find and remove the malware?

 

Thanks, Jeff

[LiquidTension]

Hello beester, welcome to Malwarebytes' Malware Removal forum!

My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.

If you would allow me to call you by your first name I would prefer that.

General P2P/Piracy Notice:

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

======================================================

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation & providing the best set of instructions for you.
• Please backup important documents before proceeding with my instructions.
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.
• Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
• Ensure you are following this topic. Click at the top of the page.

======================================================

STEP 1

Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
• Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
• Right-Click FRST.exe / FRST64.exe and select Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

STEP 2

TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach the file in your next reply.

======================================================

STEP 3

Logs

In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• TDSSKiller log (attached)

[beester]

Seems I would need to run a few scans based on what other folks have been told.

 

Attached are the log files from Malwarebytes scan, FRST scan, tdsskiller scan.

 

Thanks, Jeff

malewarebyesscan.log

FRST.txt

Addition.txt

tdsskiller_boot.log

[LiquidTension]

Unfortunately, your computer is infected with a rootkit. As such, I must issue the following warning. Please let me know how you wish to proceed.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor, that allows attackers to remotely control your computer, download/execute files and steal critical system, financial and personal information.

Please disconnect your computer from the internet immediately. If your computer was used for online banking, has credit card information or other sensitive data,using a non-infected computer/device you should immediately change all account information (including those used for banking, email, eBay, paypal, online forums, etc). Consider these accounts already compromised.

Banking and credit card institutions should be notified of the possible security breach immediately. Please read the following for more information: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Whilst the identified infection(s) can be removed, there is no way to guarantee that your computer will be trustworthy again. This is due to the nature of the infection, which allows the attacker complete control over the computer. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat the hard drive and reinstall the Operating System. Please read the following articles for more information.

• When should I re-format? How should I reinstall?
• Help: I Got Hacked. Now What Do I Do?
• Where to draw the line? When to recommend a format and reinstall?

Please let me know how you wish to proceed, and if you have any questions.

[beester]

Adam,

 

Obviously I am disappointed to hear this is a backdoor.. The machine always has MS Security Essentials running and Malwarebytes Anti-Malware.

So this must be something new that such programs cannot detect? 

 

Anyway, I would like to continue to try to remove this for now.   Reformat will likely not be far off though.

 

Thanks, Jeff

[LiquidTension]

Hello Jeff, 

 

Poweliks is relatively new. What makes Poweliks so unique and sophisticated is that once the dropper is on the system, no further files are required in order for the infection to be active. The dropper will make the necessary modifications to the registry, and the infection utilizes legitimate files/programmes such as dllhost.exe and Powershell. Once the dropper has completed its tasks, the file is deleted. This makes it difficult for anti-virus companies to acquire, analyse and write signatures for Poweliks droppers. 

 

Furthermore, once the payload (modifications to the registry/Powershell installed if not already) has been dropped by the dropper, anti-virus software is ineffective in dealing with the infection. Anti-virus software do not typically monitor the registry, so an infection that resides entirely within the registry will evade detection. 

 

STEP 1
 ComboFix

• Note: Please read through these instructions before running ComboFix. 
• Please download ComboFix and save the file to your Desktop. << Important!
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click ComboFix.exe and select  Run as administrator to run the programme.
• Follow the prompts. 
   
• Allow ComboFix to complete it's removal routine (please refer to Important Notes:).
• Upon completion, a log (ComboFix.txt) will be created in the root directory (C:\). Copy the contents of the log and paste in your next reply.
• Re-enable your anti-virus software.
   

Important Notes:

• Do NOT mouse click ComboFix's window whilst it is running. This may cause the programme to stall.
• Do NOT use your computer whilst ComboFix is running.
• Your Desktop/taskbar may disappear whilst ComboFix is running; this is normal.
   
• If you get the message Illegal operation attempted on registry key that has been marked for deletion please reboot your computer.
• ComboFix will disconnect your machine from the Internet as soon as it starts.
• Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
• If you are unable to access the Internet after running ComboFix, please reboot your computer. 

 

STEP 2
 Farbar Recovery Scan Tool (FRST) Scan

• Right-Click FRST64.exe and select  Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of the logs and paste in your next reply. 

 

======================================================

STEP 3
 Logs
In your next reply please include the following logs. 

• ComboFix.txt
• FRST.txt 
• Addition.txt

[beester]

Adam,

 

The machine is now useless after running ComboFix.  No networking, FRST64 will not run.  Many things just hang forever and shutdown is always a force shutdown.

 

It looks like a full restore (couple month old image) is in order once/if I can salvage a few things since then. 

 

Thanks a bunch for your help.  (LiquidTension anything related to Liquid Tension Experiment?)

 

Jeff

[LiquidTension]

Jeff, 

 

Lets not get ahead of ourselves. Malware removal can be unpredictable, and unfortunately, unexpected issues can arise. But that's not to say we need to give up; there are (almost) always alternatives - unless you think a full restore is indeed the only option? 

 

 

If you would like to continue, please try booting into Safe Mode, and running an FRST scan there. 

 

 Boot into Safe Mode

• Restart your PC.
• As soon as the BIOS is loaded, begin repeatedly tapping the F8 key until the Advanced Options menu appears.  
• Using the arrow keys, select Safe Mode. 
• Press the Enter key.
   
• Run FRST. Place a checkmark next to Addition.txt. Click Scan. Include both logs in your next reply. 

 

I'd also like you to check for a ComboFix log (located at C:\)

[beester]

Adam,

 

Attached are the logs.  I am not so sure about moving forward.  I have an image from about 10 weeks ago and I was able to copy stuff I know I updated since I took the image.

 

Jeff

Addition.txt

ComboFixLog.txt

FRST.txt

[LiquidTension]

Hi Jeff, 

 

Ultimately, the decision is yours. We can troubleshoot the issues present now, or proceed with reimaging. 

If you would like to troubleshoot, please describe in detail the exact issues you are currently experiencing with your machine. 

 

-------

 

What would you like to do? 

[beester]

Hi Adam,

 

I am going to work with the backup image.  It is not too far off and I am assuming is clean of the malware.

 

Thanks for your help!

 

Jeff

[LiquidTension]

OK. If the image is 10 weeks old, and you were free of issues at that time, you should be safe to assume it is clean. Best of luck.

I will mark this topic for closure.

Adam.

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.