Malware opening epoclick.com and blocks cleaning software

[MalwareNic]

Hello!

The first strange thing I noticed was yesterday, when shutting down windows, it said there was a process running called "m", and asking me to force shutdown or cancel of this process.

Second was today I noticed new windows in Firefox started popping up with an URL like this: http://www.epoclick.com/?ad=1287481223 with different numbers in the end:

I was having Adblock Plus installed, so all I got was a blank window.

Then I tried to download MWBAM but the website didn't seem to work, and I noticed my DNS was changed to something unusual, which was causing this and other malware-scanners to be blocked.

By using HijackThis disguised as analyse.exe notified me of some DNS-changes in the registry which I deleted.

I could download MWBAM and Spybot, but they couldn't run, but by renaming the exe-files, I could run them.

Spybot found some registry changes that disabled Windows Security Center, I fixed those. MWBAM didn't seem to find anything at all. Both of them was updated after I made the DNS-block go away.

I've run a complete check with AVAST, which found 2 infected files, which I forgot to note the names of.

After this I still couldn't run any of the above EXE-files, so I feel like there's still something creeping in my system.

I've attached my logs for MWBAM and HijackThis.

I appreciate any help removing this!

---------------------------

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4882

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

2010-10-19 18:22:04

mbam-log-2010-10-19 (18-22-04).txt

Scan type: Quick scan

Objects scanned: 132456

Time elapsed: 1 minute(s), 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:16:08, on 2010-10-19

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Analog Devices\Core\smax4pnp.exe

C:\Program\Analog Devices\SoundMAX\Smax4.exe

C:\Program\ALWILS~1\Avast5\avastUI.exe

C:\Program\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\cmd.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\TrueCrypt\TrueCrypt.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\Acronis\Schedule2\schedul2.exe

C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\Cisco Systems\VPN Client\cvpnd.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Delade filer\Acronis\Fomatik\TrueImageTryStartService.exe

C:\Program\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Program\Malwarebytes Anti-Malware\Kopia av mbam.exe

C:\WINDOWS\system32\cmd.exe

C:\WINDOWS\system32\mmc.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\notepad.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L

[Maniac]

Hello MalwareNic! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Follow my instructions step by step if there is a problem somewhere, stop and tell me.
  
• Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install or uninstall any software or hardware, while work on.
  
• Keep me informed about any changes.
  

Download DDS and save it to your desktop from here or here or here.

Double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
     
  2. Attach.txt
     

  [*]Save both reports to your desktop. Post them back to your topic.

[MalwareNic]

Thank you for taking time to help me!

One strange thing I noticed today is that some pages in Firefox don't load or load very slowly, and in the statusbar it says "Waiting for www.google-analytics.com".

DDS.txt:

---------

DDS (Ver_10-10-10.03) - NTFSx86

Run by Administrat

Attach.zip

[Maniac]

Step 1

Please, uninstall the following applications:

1. Adobe Reader 9.1 Lite
   

You can read, how to do this here:

• Windows XP
  
• Windows Vista
  
• Windows 7
  

Step 2

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

• Double-click on JavaRa.exe to start the program.
  
• From the drop-down menu, choose English and click on Select.
  
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  
• A logfile will pop up. Please save it to a convenient location and post it back when you reply
  Then look for the following Java folders and if found delete them.
  C:\Program Files\Java
  C:\Program Files\Common Files\Java
  C:\Windows\Sun
  C:\Documents and Settings\All Users\Application Data\Java
  C:\Documents and Settings\All Users\Application Data\Sun\Java
  C:\Documents and Settings\username\Application Data\Java
  C:\Documents and Settings\username\Application Data\Sun\Java
  

Step 3

Going over your logs I noticed that you have

[MalwareNic]

Thank you, here are the logs. Not the attach.txt from DDS, is that ok?

------------------------------------

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Thu Oct 21 08:23:25 2010

Found and removed: Software\Classes\JavaPlugin.160_16

Found and removed: SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}

------------------------------------

Finished reporting.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4897

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

2010-10-21 08:30:34

mbam-log-2010-10-21 (08-30-34).txt

Scan type: Quick scan

Objects scanned: 132112

Time elapsed: 3 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_10-10-10.03) - NTFSx86

Run by Administrat

[MalwareNic]

I noticed something today. I previously was having problems that some pages hang at the "Waiting for www.google-analytics.com" in the status bar. I solved this by blocking that site in Adblock Plus.

I suspect there is a deeper cause that prevents Google Analytics from loading, but it works for me. And it makes basically all sites much faster!

Looking forward to your next response Borislav!

[Maniac]

That's good!

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Open Tools -> Options -> Main tab
     
   • Set to Always ask me where to Save the files.
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[MalwareNic]

Hmm, i downloaded and ran Combo-Fix.exe. All I got first was a blank dialog box with the title FEL (error in swedish) and an OK-button. I clicked it and the computer restarted.

After the restart, there was a blue window (like a dos box) with a text about that it's creating a system restore point, and after that it said that it recommends that I allow it to install Microsoft System Recovery. I answered Yes to the EULA, and after a little while there was a dialog box something like this "ComboFix has detected that a rootkit is running on your computer and needs to restart", and I clicked OK.

After that it has been a blank screen and no apparent action for at least 10 minutes. I'm gonna wait for a little while and then restart it manually.

If you have any tips at this point, please let me know!

[MalwareNic]

I rebooted after that hang, and after that it ran just fine and restarted by itself a few times.

At one time it said, "take a note of this", not sure why:

C:\windows\system32\drivers\etc\snapman.sys

Here's the log:

--------------------------------------------------------------------------------------------------------------------------

ComboFix 10-10-22.05 - Administrat

[Maniac]

Please download Rootkit Unhooker and save it to your desktop.

• Double-click RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan
  
• Check Drivers, Stealth Code, Files, and Code Hooks
  
• Uncheck the rest, then click OK
  
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  
• Wait till the scanner has finished then go File > Save Report
  
• Save the report somewhere you can find it, typically your desktop. Click Close
  
• Copy the entire contents of the report and paste it in your next reply.
  

Note - You may get this warning it is ok, just ignore it."Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

[MalwareNic]

Thanks again, here it is!

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #2

==============================================

>Drivers

==============================================

0xB954A000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 4399104 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver)

0xACF62000 C:\WINDOWS\system32\drivers\RtHDMI.sys 3526656 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)

0xBF1EC000 C:\WINDOWS\System32\ati3duag.dll 2990080 bytes (ATI Technologies Inc. , ati3duag.dll)

0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2150400 bytes (Microsoft Corporation, NT:s kernel och system)

0x804D7000 PnpManager 2150400 bytes

0x804D7000 RAW 2150400 bytes

0x804D7000 WMIxWDM 2150400 bytes

0xBF4C6000 C:\WINDOWS\System32\ativvaxx.dll 2125824 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver)

0xBF800000 Win32k 1855488 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Win32-drivrutin f

[Maniac]

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
  
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• Click the Report button and copy/paste the contents of it into your next reply
  

Note:It will also create a log in the C:\ directory.

[MalwareNic]

2010/10/24 13:42:33.0859 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59

2010/10/24 13:42:33.0859 ================================================================================

2010/10/24 13:42:33.0859 SystemInfo:

2010/10/24 13:42:33.0859

2010/10/24 13:42:33.0859 OS Version: 5.1.2600 ServicePack: 3.0

2010/10/24 13:42:33.0859 Product type: Workstation

2010/10/24 13:42:33.0859 ComputerName: COMPUTER

2010/10/24 13:42:33.0859 UserName: Administrat

[Maniac]

Interesting...

1. Download mbr.exe to your Desktop.
   
2. Doubleclick mbr.exe and follow prompts.
   
3. When mbr.exe is ready, it will create a log.
   
4. Copy and paste contents of that file to your next reply.
   

[MalwareNic]

It's really amazing how many different malware-removal tools there are. Let's keep going!

This one said this:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

[Maniac]

I know, sorry about that, but I want to be sure. The situation is not the same as several years ago. Now we need very specific tools to solve a problem.

Please manually update your Avast and perform a full scan. Let me know how are things now.

[MalwareNic]

Hi and thanks again. I ran the Avast full scan, and it found one threat:

Win32:Alureon-FZ in a file in C:\System Volume Information\_restore...[jibberish].\RP1\A0001027.sys (i don't know how to copy/paste from Avast or where the log is).

Is it clean now, or is there anything else? The epoclick stuff is long gone, and it seems like opening forums and webpages with google analytics now is fast.

Thanks a lot for your persistent help, but let me know if there's anything else I can do!

[Maniac]

Yes, there are some steps, but last steps.

Step 1

1. Go to Start => Run... and copy & paste next command in the field:
   

   ComboFix /uninstall

   
   

2. Then hit Enter button.
   

This procedure will do the following:

• Uninstall ComboFix
  
• Delete its related folders and files
  
• Reset your clock settings
  
• Hide file extensions
  
• Hide the system/hidden files
  
• Resets System Restore again
  

P.S.: Make sure there's a space between ComboFix and /uninstall

Step 2

Please manually delete DDS, Rootkit Unhooker, TDSSKiller, mbr and JavaRa.

Step 3

Please uninstall HijackThis 2.0.2 .

Step 4

Please download and install the latest version of Adobe Reader from:

www.adobe.com

About Java:

www.java.com/en

Step 5

Some malware preventions:

http://forums.malwarebytes.org/index.php?showtopic=9365

http://www.bleepingcomputer.com/tutorials/tutorial174.html

Safe surfing!

[MalwareNic]

Thank you Borislav, I am very thankful for your help! Everything is working supergood now!

I've made a small donation to you, even if I'm not sure this compensates you for the time you took to help me.

The donation might seem anonymous or me using an alternate e-mail, but I'm sure it will be useful anyhow.

Have a great day and thanks again!

To anyone reading this, donate to these guys if you get some help, they are awesome..

[Maniac]

Thank you so much, Nick!

Will keep in touch on Facebook.

I wish you a nice day!

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.