Malwarebytes hasn't removed fake.alert trojan

[Interactive]

To the kind helper of my plight.

 

I have just taken charge of an old computer WindowsXP with service pack2 from my parents which included expired Norton Security Security software. I applied a service pack 3 upgrade and attempted to install some of my software from my existing computer including mathematica before I installed new security software. I downloaded a keygen download for mathematica as my version of mathematica would not run on the new computer with the existing keys, which was stupid I know. I had scanned the keygen download with the online virus checker Housecall and it said the download was fine.

 

On running the keygen, the expired Norton Security system said a malware script or something had been blocked. I stopped attempting to install the keygen. I still have the zipfile with the keygen setup.exe.

 

On the following day I noticed that my CPU, memory and virtual memory were been gobbled by a Rundll process which was also instigating vast amounts of network activity. On examining this process in ProcessExplorer from sysinternals I established that the rogue process doing this was “rundll” running “msvcrt.dll”, and this “rundll” process in turn was created by “ippromonq.dll” from the system32 directory. I also found some other files which suggested that I had a virus and I installed the malwarebytes program and on scanning it detected the “Fake.alert Trojan”.

 

Malwarebytes cleaned up my system and removed such things as “tsi video” I think from the “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” registry key and also identified “dwm.exe” (?) from my temp folder as a problem, which interestingly also had a copy of MSVCRT.dll.

 

I thought everything was fine but alas, on startup the ippromonq “rundll” process is still there and periodically will create the “msvrt.dll” process which gobbles all of the CPU. It seems to be linked to the Background Intelligent Transfer Service (BITS)

 

I examined the ippromonq.dll and attempted to delete it. Alas it has hidden file and system attributes and these attributes cannot be changed even when starting in safe mode as it gives “access is denied”. I tried a piece of software “moveonboot” which claims to be able to modify locked and inaccessible files but it also failed to modify the file. I have yet to try and boot up off my old WindowsXP installation CD and delete the file from there. The “ippromonq” file has no author, no information and its creation date is shortly after the date of the download of the mathematic keygen. So it looks incredibly suspicious. The rundll process of the ippromonq.dll is created by a “svchost.exe –k netsvcs” process which seems to be responsible for a vast number of things including windows updates.

 

So in process explorer the process tree looks like

 

svchost.exe –k netsvcs

            wupdate.exe ………..

            rundll.exe ippromonq.dll  ( which is invoked by  C:\WINDOWS\system32\rundll32.exe  "C:\WINDOWS\system32\ippromonq.dll",BKCIXYSBSBA)

                        rundll32.exe msvcrt.dll,_sleep

 

ProcessExplore shows the autostart location for these processes as “NT\CurrentVersion\Winlogon\VmApplet” which has the value “rundll32 shell32,Control_RunDLL "sysdm.cpl"”

 

 

I can delete the ippromonq.dll process.

 

Please help. As I said I *think* I have the virus software in a zip file. I have no torrent or p2p software installed. I include the two scans that were requested in the help post and the zip file of the crack and a screen grab of processplorer properties of the dubious ippromonq.dll process.

 

Thank you in advance.

 

Mark

 

FRST.txt

Addition.txt

Mathematica.6.0.1.keygen.exe.zip

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll try to help your with your issue.
 
     
    
Before we start please read and note the following:

• We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 

---

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please upload it to your reply.

---

Scan with ComboFix

This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!

Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.
If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

fixlist.txt

[Interactive]

Thank you very much for answering my post.

 

But arrrrrggggghhhhhhhhhh!!

 

I have a problem already.

 

I copied FRST and fixlist.txt to my desktop as indicated in the pictures and right-clicked the frst.exe and got the following dialogue.

 

There is only one administrator on this machine and it is called User, so I ran using the "User" account that I use all the time on this machine and I did not select the "other account" option in the dialogue, as when I did I couldn't log on to it. I checked in the system tools->User accounts that the "user" account is an administrator.

 

I clicked run and the program returned with the error "can't open script file"

 

Oh dear!

 

Mark

[Interactive]

Where are my attached pictures?

[TwinHeadedEagle]

Can you just run FRST by double clicking?

[Interactive]

I could and I did run successfully! Phew!

 

One thing I have noticed is that the malwarebytes forum doesn't seem to send me emails when it should. I had terrible trouble getting it to send me a validation email, and I didn't get one for your last reply. I can't see that it could spam detection at my ISP as I have received emails, but I will check again.

 

Now when I restarted I NO longer have the errant rundll.exe with the ippromonq.dll process! Hooray!!!

 

And I no longer have the ippromonq.dll file in system32!!!!! Hooray!

 

How wonderful!!!! Hooray, hooray!!!!!

 

Is it worth me doing the second instruction regarding the download and scan using ComboFix?

 

Please enlighten me as to what was going on with regard to that DLL and how you managed to delete it? And where was it embedded in my startup sequence from winlogon?

 

Did you have to edit the fixlist file for my situation specially?

 

One thing perhaps to notice is that the malwherbytes service was very active when I switched on as I applied the fixlist.txt FRST scan, I don't suppose it had somehow managed to clean the system?

 

I am very happy. I am going to enjoy today ! I have spent days being very distressed by this virus.

Fixlog.txt

[Interactive]

Ok, I now see that you designed fixlist.txt such that FRST.exe would specifically target the ippropmonq.dll and delete it.

 

Was deleting the dll all that was required to fix the infection? Or is the infection still possibly there as I have yet to run ComboFix?

[TwinHeadedEagle]

Very good. I suppose that infection is gone, but I would like you to run ComboFix anyway. This tool has some excellent routines, so please run it.

[Interactive]

I have run combofix

 

It tried and failed to download the restore recovery console, and I allowed it to proceed.

 

During the scan It said it had a problem with stage 5, I think, it may have been stage 6, and it apologised for any lost work and asked me to click ok to continue. Everything proceeded normally afterwards.

 

I have provided the log file in an attachment.

 

I would be very interested to know how ippromonq.dll was started at winlogon. Was a rootkit installed? Was there a registry entry? Was the problem the presence of ippromonq.dll which would have been fixed merely by deleting it?

 

Thank you very much indeed for your invaluable assistance which has saved me from further enormous distress. I will be providing you with a beer

 

Mark

ComboFix.txt

[Interactive]

And I am still not getting emails when you reply. I did when you first replied but none since and I am still following the topic.

[TwinHeadedEagle]

Very good. PC seems clean.

Any other concerns or questions for me?

[Interactive]

Just the questions I asked above about how ippromonq.dll was able to run

[TwinHeadedEagle]

Malware created a Scheduled Task, that should ensure malware is started after every system boot.

[Interactive]

I see. Thank you very much.

 

And presumably I was incapable of deleting ippromonq.dll because the scheduled task was claiming it at startup. I am surprised if this is the case that the ippromonq.dll was claimed when starting in safe mode. I assume that scheduled tasks don't operate in safe mode.

 

Mark

[TwinHeadedEagle]

Glad I could help. We will delete all used tools and I'll give you some tips to harden your security and learn how to protect yourself

Recommended reading:

MUST READ - security tips:

• Computer Security - a short guide to staying safer online.

• Simple and easy ways to keep your computer safe and secure on the Internet

• How Malware Spreads - How did I get infected

MUST READ - general maintenance:

• What to do if your Computer is running slowly?

The Importance of Software Updating:

In order to stay protected it is very important that you regularly update all of your software. Cybercriminals depend on the apathy of users around software updates to keep their malicious endeavor running.

Operating systems, such as Windows, and applications, such as Adobe Reader or JAVA, are used by tens of millions of computers and devices around the world, making them a huge target for cybercriminals. Downloading updates and installing them can sometimes be tedious, but the advantages you get from the updates are certainly worth it.

• How to configure and use Automatic Updates in Windows
• How to update Java
• How to update Adobe Reader

Recommended additional software:

CCleaner - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

Adblock - to surf the web without annoying ads!

Post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run.
• The program will run for a few seconds and display a notepad report. You do not need to attach it.

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix

Tool deletes old system restore points and create a fresh system restore point after cleaning.

My help is free for everybody.

If you're happy with the help provided and/or wish to show your appreciation for the assistance you received, then you can consider a donation:

Thank you!

Stay safe,

TwinHeadedEagle

[Interactive]

Thank you for that.

 

I see that ippromonq.dll is not mentioned anywhere on the internet.

 

Do scheduled tasks operate in safe mode?

[TwinHeadedEagle]

It is probably randomly generated name. I am not sure if it works in Safe Mode, probably yes.

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!