Jump to content

Purging System Protection

dborba

By dborba
in Resolved Malware Removal Logs

 Share

Recommended Posts

dborba

dborba

Posted
Posted

My problems began last night. I was attempting to find an program I had 5 or so years ago. Since I couldn't locate it within my backups, I turned for the web. After 30 minutes of fruitless googling, I stumbled upon it. The source was questionable, but being rather frustrated I downloaded it anyway. After a quick, warning free scan, I decided it would be okay to use it. Big mistake =\ - have never had a windows install go this bad before. (This is on a windows XP install)

Shortly after the execution of the program (which did nothing - setting off all types of alarms on my mind), I got a stand alone pop up window saying my system was under risk and requesting me to install "System Protection." The dialog had an OK & Cancel option. When I clicked the cancel, the "install" began anyway - showing a progress bar & details under it claiming it was downloading and installing system protection. I clicked cancel under the progress bar - which made the window invisible for about 2 seconds before it was restored at the same point it was before.

Shortly before the "install" is finished, spybot SD alerts me of a process that is considered a threat, so I tell it to terminate it & delete the malicious file. At this point I open the spybot main window, run an update & start googling "system protection." After the update, spybot s&d crashed & no longer would start up. At the same time, the "install" is finished & system protection claims to be scanning my system. I close it out & it warns me it found 9 problems & that I should purchase the full version to fix them - I ignore the dialog & click cancel. I open task manager & start killing all types of processes - including a number of suspicious ones like "scvhust" (not its spelled with an U instead of an O), b.exe & c.exe and a few others. This doesn't seem to help spybot s&d however.

Meanwhile, google suggested "system protection" + "virus" - which landed me on a few different oldish posts on "system protection." A few were clearly out dated, dating over a year ago & screen shots that didn't match the screens I had seen for "system protection." None the less, I looked at the files that were associated with the problem and tried to locate them on my system. The great majority of them weren't to be found, except for a "system protection" folder under %programfiles% and a start menu entry, both which I was able to delete. One of them suggested I should grab mamb, close everything out, and run it to automatically fix the problems. At that point I was able to access the mamb site, download and install the application. Upon execution, the update caused a weird error & froze the application. After that I could no longer open mamb - I'd get a system error saying the file was not accessible & that maybe I didn't have enough permission. I quickly reinstalled it, and once again it opened up - this time I tried to simply do a scan without an update - 2 seconds into the scan the program terminated, and once again I could no longer open it due to the previous error.

Getting pissed, I decided to restart the system in safemode w/ networking - figuring whatever was screwing with things would not start up & I'd be able to run spyware removal software and get rid of the thing. I tried spybot which wouldnt open. I tried mamb, got the error accessing the file, reinstalled it & once again it crashed on me during the scan. Checking the processes, nothing suspicious was visible - just the usual windows stuff. Checking the services, there were only about 10 of them, all claiming to be from microsoft. More frustrated than ever, I open firefox to try and find out more about this unexpected plague. When I tried to grab other malware removal utilities, or visit the malwarebytes forum, my browser was redirected to relatively random websites - like random youtube videos or sites for domain names for sale. Since google was working, I started using google's cached pages to access the sites indirectly. After a few queries, I started running into a few entries in this forum, and others with people whom had run into the same or similar problem.

With those posts in hand, I went to work. I tried reinstalling mamb & renaming it - which yielded the same previous results. I wasn't able to find a source on the web to download hijack this from which my browser was not blocked from - when I grabbed it through a different computer & used a pen drive - hijack this failed to run. I then tried the instructions for combofix from one of the posts - trying a few different ways, all of which ended with combofix telling me it was compromised & deleting itself.

Then I found about SDFix, following directions, I had it extracted to c:\SDFix - and ran the appropriate bat file. It closed out explorer, and began running on a command prompt as expected. I chose to proceed, and it began scanning the system. After a while, the prompt window simply closed out & the system halted. I wondered if I had missed anything it did or said, so I opened the task manager and verified it was no longer running. Since it wasn't I started explorer again. On the desktop there was a single log file - "catchme.log" with contents as follows:

file copied: C:\WINDOWS\system32\user32.dll -> C:\WINDOWS\system32\dllcache\user32.dll ( 578560 bytes )

I went back to SDFix's folder, which is now populated with a countless number of text files, a few new exes & a backup folder. This is where I am at now - it was late at night & I got pissed so I tried nothing after that. All these issues are on my laptop - conveniently it has a few different OSs on it, and I have 2 desktops at home. Currently I am using ubuntu on the infected laptop to post.

How do you guys suggest I proceed? I am not wholly opposed to reformatting except for the time consumption factor & the fact that I need the laptop for daily use - so I'd rather have a fix until I have the appropriate time to properly redo the windows install.

Hope the post isn't very confusing or overwhelming.

Thanks,

dborba

Link to post
Share on other sites
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.