Jump to content

Can't find di10 .biz threat


Recommended Posts

I was doing my bussiness on my web browser (Mozilla Firefox) Suddenly i got a redirected to a malicious site. possible with fake norton pop-ups. It looks like Norton protected me from the attack but after the attack legit applications acted weird.

I know every now and then Norton log shows "application used networkresources" & "firewall rules updated" but after the attack so many application used my networkresources one by one like never before at this rate..

(sorry if the translation is not perfect) applications like

- Controle Program URI-handlers - Diskdrive cleaner- Pingsender (mozilla) - System - System settings - Runtime broker - Video.ui - Device Census

- default browse Agent - Windows explorer - search app  - background task - windows defender smart screen - SIH-client - Mouse core worker

- and more...

after each use of my networkresource "firewall rules updated"

Also there were 6  or 7 logs with "firewall rules have been created automatically" ik never seen this before.

To my very limited knowledge it looks like somebody succefully can change my firewall setting and gather/steal info about my system.

 

So i ran my thrusted Norton Scan and ADWcleaner but they could not find anything. After gathering some info this di10 threat could be detected with malwarebytes but it didn't find anything, also hitmanpro didn't find anything.

then i got again attacked by this attacker with me doing nothing. the attacker uses Mozilla so i uninstalled Mozilla and deleted every mozilla file on my pc i could find. then i cleaned my PC with CCcleaner, and got rid of trackers. and installed mozilla again, clean.

After doing so my pc gaind again a bit performance, and my application logs acting normal again.

 

I find it strange no program can find the threath, maybe i need to find it for some  insurance nobody hacked or stole some data or have acces to my pc?

 

Link to post
Share on other sites

  • Root Admin

Good day, @Yoeri

 

Let's get some logs to see if we can find out what's going on. Perhaps nothing wrong and Norton was doing it's job keeping out the bad people?

 

 

Please do the following so that we can get started and see what's going on.


The Farbar Recovery Scan Tool is a free Windows utility designed to create troubleshooting logs for your computer. These logs help our Support team to identify and resolve issues with your computer.

There are two versions of the Farbar Recovery Scan Tool available for download: 32-bit and 64-bit.
To find which operating system is installed on your computer, refer to Microsoft's article: 32-bit and 64-bit Windows: Frequently asked questions

Download and launch Farbar Recovery Scan Tool

  1. Download the Farbar Recovery Scan Tool
    Do not click on any Ads.
     
  2. Locate the file you downloaded on your computer.
    Downloaded files are often saved to the Downloads folder.
     
  3. Double-click the downloaded file to run the Farbar Recovery Scan Tool.

    DOC-1318-1.png
     
  4. Windows protected your PC notification may appear. This notification is from the Windows Defender SmartScreen Filter which prevents unfamiliar apps from running on your PC.
    Disable smart screen ONLY if it interferes with software we may have to use:  What is SmartScreen and how can it help protect me?

         a.  Click More info.

    https://support.malwarebytes.com/hc/article_attachments/360051190254/DOC-1318-2.png
         b.  Click Run anyway.

    https://support.malwarebytes.com/hc/article_attachments/360051190294/DOC-1318-3.png
  5. When the User Account Control window appears, click Yes.

    image.png

     
  6. To accept the Disclaimer of warranty, click Yes.

    image.png

     
  7. Ensure only the boxes listed below are checked

    image.png

    Registry  Services  Drivers
    Processes  Internet  One month
    Addition.txt

    image.png

     

  8. Disable any Antivirus software you have installed ONLY if it stops software we may use from working.
    Please remember to re-enable any Antivirus software when we are finished running scans

    Click Scan. The scan may take a few minutes to complete.

    image.png
     

  9. When the scan completes, Farbar Recovery Scan Tool shows two messages:

  • Scan completed. FRST.txt is saved in the same directory FRST is located.

    image.png

  • Addition.txt is saved in the same directory FRST is located.

    image.png
     

  • Click OK to close each message window

 

Please attach both of those logs on your next reply, DO NOT copy/paste the contents of the logs directly

https://content.invisioncic.com/Mmalware/monthly_2018_10/_mb_attach.jpg.dbd89b8e360d3763b3bbe33ce83d680d.jpg

 

 

Thanks

 

 

Link to post
Share on other sites

  • Root Admin

The choice is yours but most computer experts no longer recommend the use of this program:  CCleaner 
I would recommend that you uninstall it.

 

Firefox is having some issues but we'll see if the clean up below helps correct that @Yoeri

 

Your DNS Servers: 195.130.131.3 - 195.130.130.3

Please consider changing your default DNS Server settings. Please choose one provider only

DNS is what lets users connect to websites using domain names instead of IP addresses

  • Google Public DNS: IPv4   8.8.8.8 and 8.8.4.4   IPv6   2001:4860:4860::8888 and 2001:4860:4860::8844
  • Cloudflare: IPv4   1.1.1.1 and 1.0.0.1   IPv6   2606:4700:4700::1111 and 2606:4700:4700::1001
  • OpenDNS: IPv4   208.67.222.222 and 208.67.220.220  IPv6  2620:119:35::35 and 2620:119:53::53
  • DNSWATCH: IPv4   84.200.69.80 and 84.200.70.40   IPv6  2001:1608:10:25::1c04:b12f and 2001:1608:10:25::9249:d69b

The Ultimate Guide to Changing Your DNS Server
https://www.howtogeek.com/167533/the-ultimate-guide-to-changing-your-dns-server/

Here is a YouTube video on Changing DNS settings if needed

 

 

The computer does not appear to be infected at this time @Yoeri but it does have signs of either a conflict or possibly a previous infection.

There are over 1,500 invalid Scheduled Tasks. We'll remove them with this script below and do some other tests, checks, and clean up.

Please make sure you temporarily disable your Norton Antivirus 360 real-time protection while you run the fix.

 

 

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

  • Windows Temp
  • Users Temp folders
  • Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
  • Recently opened files cache
  • Flash Player cache
  • Java cache
  • Steam HTML cache
  • Explorer thumbnail and icon cache
  • BITS transfer queue (qmgr*.dat files)
  • Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

Link to post
Share on other sites

I believe you when you say there is something wrong with firefox, it needs to use up to 40% more resources to run. Also just right before turning of norton and my scan i got a Norton pop up telling me firefox is missing  security files or protection. Not sure how this is possible, However i didn't want install it between the first logs and fix. So i didn't click on the pop-up to install it.

Also i expected passwords to be deleted yet on this site my password was still saved,

 

Fixlog.txt

Link to post
Share on other sites

  • Root Admin

Thank you the log shows it was able to remove most of those invalid scheduled tasks and clean up a few other issues.

It found and corrected some corrupted Windows operating system files

Since it was sold years ago more and more bloated features keep getting added to it.

 

Why You Shouldn’t Download CCleaner for Windows Anymore
https://helpdeskgeek.com/free-tools-review/why-you-shouldnt-download-ccleaner-for-windows-anymore/

Microsoft Windows 10 is warning users not to install CCleaner
https://www.techradar.com/news/windows-10-is-warning-users-not-to-install-ccleaner

Is CCleaner Safe? Not Quite. And We Show You How to Replace It
https://www.makeuseof.com/tag/stop-using-ccleaner-windows/

 

Please disable Norton real-time protection and run the following

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

  • Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
  • The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

 

 

 

When that's done restart the computer one more time and run the Farbar program again and get me new logs

FRST.TXT
Addition.txt

 

Thanks

 

 

 

 

Link to post
Share on other sites

  • Root Admin

Please export your bookmarks from Firefox. Then go into Control Panel, Programs, Programs and Features and uninstall Firefox

Restart the computer

Then download and reinstall the latest version of Firefox

https://www.mozilla.org/en-US/firefox/new/

 

Then open Norton Antivirus, check for updates. Scan the system and let us know if you're still having any signs of an issue.

 

Link to post
Share on other sites

After the fix you have send me, It seems everything on my pc runs a bit more smooth. Specially Firefox works much better. The memory when my pc is idle seems to back to normal, like when it was new.

But i have one odity. After my full Norton scan my pc uses around 48% memory without any software or application using unusual high use of memory. and it stays there. Only a restart fixes this. This also happend after the Microsoft Safety Scanner.

Link to post
Share on other sites

  • Root Admin

You can delete the file C:\Users\AppData\Local\Temp\~nsuA.tmp

If it won't let you then let me know and we can run a script to remove it.

As far as Norton issues you may want to try doing a full uninstall and use their removal tool as well to ensure all is clean.

https://support.norton.com/sp/en/us/home/current/solutions/v60392881

Direct download for their removal tool

https://norton.com/nrnr

 

Then restart your computer and reinstall Norton 360 and see how things work now.

Let me know how that goes @Yoeri

 

 

Link to post
Share on other sites

During the reinstall, i had to remove MWB to prevent conflict. But same thing i am running now at 50% memory after the scan.

 

Also it seem in my household there was a second pc with di10 .biz threat.

 

Also weird things are shown in my norton logs: i hope this is normal after reinstalling Norton

(translation?) Static submission IPS, Static submission greenwork 32-node, Static submission FSwin.node,Static submission MSISCMTsk.exe, Static submissionn MSIAdTsk.exe.

Sending statistics: Store Desktopextension.exe, Sending of statistics; unistall.exe, sendig of statistics update, sending  of statistics: sourceinit.dat, sending of stas: squirell.exe

& multiple lines of "feedback on Norton Community Watch" (Firefox.exe) & (Device/Hardsiskvolume5/Programfiles/mozilla firefox/xul.dll)

 

 

 

 

Link to post
Share on other sites

  • Root Admin

My advice if you have a paid version of Malwarebytes is to try running without Norton for a couple weeks and just use Malwarebytes and Windows Defender

 

If you own your own router you can reset it. If you don't own it then you'd need any changes done by your ISP

Please ensure that you have the user manual for your router. Then perform a factory reset.

How To Reset Your Router
https://setuprouter.com/networking/how-to-reset-your-router/

 

Depending on one's preferences and the Router's capabilities please consider the following.

  • Disable acceptance of ICMP Pings
  • Change the Default Router password using a Strong Password
  • Use a Strong WiFi password on WPA2  using AES encryption or Enable WPA3 if it is an option.
  • Disable Remote Management
  • Create separate WiFi networks for groups of devices with similar purposes to prevent an entire network of devices from being compromised if a malicious actor is able to gain unauthorized access to one device or network. Example: Keep IoT devices on one network and mobile devices on another.
  • Change the network name (SSID).  Do not use your; Name, Postal address, or other personal information.  Make it unique or whimsical and known to your family/group.
  • Is the Router Firmware up-to-date?  Updating the firmware mitigates exploitable vulnerabilities.
  • Specifically set Firewall rules to BLOCK;   TCP and UDP ports 135 ~ 139, 445, 1234, 3389 and 5555
  • Document passwords created and store them in a safe but accessible location.

 

 

Link to post
Share on other sites

Sorry for the confusion. "Ok, we will do" was in response to the 'router' tips. I don't have a paid subscription fo Malwarebytes, yet.

The only thing i want to fix now is a memory issue. When i perform a Norton full scan the memory of my system go's around 50% and stays there even after the scan. For no reason at all.

Reinstalling Norton didn't help, But i doubt its a Norton issue since it also happens with the "Microsoft Safety Scanner". I wonder if the "fix.list" broke something?

 

Link to post
Share on other sites

I see, unfortunately i struggle with these pc problems for a few week and needed resolve this quickly now. Cause next weeks i am not availbale. So i took a risk to perform a full recovery of my system. and it seems it worked at first glance.

Quote

Let's get some logs to see if we can find out what's going on. Perhaps nothing wrong and Norton was doing it's job keeping out the bad people?

 

I guess i have the ultimate anwers i needed. Thank you for your time & expertise.

This topic may be called 'resolved'.

Link to post
Share on other sites

  • Root Admin

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you

 

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.