John L. Galt Posted January 12, 2011 ID:372928 Share Posted January 12, 2011 Howdy, all,LTNS OK, so my Dad gets on the net on his laptop and surfs around looking at legitimate websites - He's the directory of a Master's Program at a nearby university, so he was browsing various colleges in India this morning at 8:40 AM EST (roughly 12 hours ago).All of a sudden he comes to me that his computer is saying that the HD cannot be found and he doesn't know what to do. I had classes this morning and am only now able to take a look.He has some program that acts almost identically to Antivirus XXXX except that instead of showing infections it shows hardware errors. As soon as I saw it popping up I was suspicious, but when I am ni the middle of the OS running a scan and it tells me that my MBR is corrupted I knew it was a fake - Can't exactly boot into my OS if it was corrupted.The program that runs has the usual random letters and symbols when running in Task manager, but the title bar shows Good Memory - I searched here and online for for it but cannot find any reference to it.Anyone heard of this puppy at all? Is this some sort of new 0-day clone of AV XXXX that's taking a different twist and presenting hardware issues that simply are not present?FWIW:Dell Inspiron 600mWindows XP SP3Previously had Symantec Antivirus corporate edition (from the University) but I cannot find any trace of it on there now - looks like it was remvoed, as LiveUpdate is still installedInitial MBAM Flash scan found 39 infected objects, removed and rebooted, but it is still running. I then manually deleted all files in the temp dir, scanned for an removed a few files located in areas that simply were not meant to be there (and coincidentally had a modified time of just before this started occurring) and now ran a full HD scan, finding only 4 more items, all in the registry for adware - all while this app is running in the system tray telling me every 10 seconds that something is wrong with my HD or low memory or whatever....I have the logs that I can post up from MBAM, and I am now booted into SafeMode, where it seems the sucker cannot load, but since I am finding no info on it, not sure where to go now.... Link to post Share on other sites More sharing options...
John L. Galt Posted January 12, 2011 Author ID:372961 Share Posted January 12, 2011 I should add that 1) I've found the offending files, and 2) I'm trying to get them uploaded for analysis - sorry about the confusion. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 12, 2011 Staff ID:372973 Share Posted January 12, 2011 Please submit them to our malware submission forums. They have to be zipped to be uploaded.Thanks! Link to post Share on other sites More sharing options...
John L. Galt Posted January 12, 2011 Author ID:372976 Share Posted January 12, 2011 Someone beat me to it - http://forums.malwarebytes.org/index.php?showtopic=72487Mine are not .ZIPped yet but I'm submitting mine as we speak. Mine will be .ZIPped. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 12, 2011 Staff ID:372987 Share Posted January 12, 2011 Those will be added within 30 mins.. Let me know when yours are up. Link to post Share on other sites More sharing options...
John L. Galt Posted January 12, 2011 Author ID:372988 Share Posted January 12, 2011 PM sent. Link to post Share on other sites More sharing options...
Staff shadowwar Posted January 12, 2011 Staff ID:373004 Share Posted January 12, 2011 Added to database! Thanks again! Link to post Share on other sites More sharing options...
John L. Galt Posted January 12, 2011 Author ID:373010 Share Posted January 12, 2011 There may be more - MBAM is still blocking outgoing IP access left and right, even though the program itself is no longer there - may be some snarky other files I missed. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now