Infected Windows Update?

[Voi]

Hello!

Back in February my mother's computer caught one of those antivirus impersonating viruses. She took it to a shop, but a month or so after that another one popped up. This time she could still access the internet (possibly because the repair guy left the proxy box unchecked in internet explorer) so she ignored it. After a while it simply stopped popping up messages. Her antivirus doesn't show any history of deleting/quarantining a virus. I ran Malwarebytes and three infections came up: two in temp files which have since been deleted and update.exe. The file is currently quarantined which prevents Windows from updating. I think it's a Windows file so I don't want to delete it, especially since I am unsure if she made backup DVDs.

Note: The Malwarebytes log is NOT the most recent. That one shows up as clean because update.exe is quarantined. The one below is the original that caught the three viruses. If it helps, I can post the most recent as well.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6586

Windows 6.0.6001 Service Pack 1

Internet Explorer 8.0.6001.19048

5/15/2011 9:11:52 PM

mbam-log-2011-05-15 (21-11-52).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 341268

Time elapsed: 1 hour(s), 19 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Users\Owner\update.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\Owner\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\6Q3EBSW2\payload.exe[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\Users\Owner\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\9KVC5T9U\sefoopqs[1].exe (Trojan.Agent) -> Quarantined and deleted successfully.

.

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 8.0.6001.19048 BrowserJavaVersion: 1.6.0_24

Run by Owner at 13:49:33 on 2011-05-23

Microsoft

Attach.zip

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[Voi]

Okay, the logs are below. I had a brief problem after running Combofix. Every time I attempted to open a file or program I would receive "illegal operation attempt on a registry key marked for deletion" but a restart fixed that.

Something's come up, and I will be out of town and unable to reply from tomorrow until the 30th.

My post is too long, so I have to do it in two parts.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6654

Windows 6.0.6001 Service Pack 1

Internet Explorer 8.0.6001.19048

5/26/2011 10:04:41 PM

mbam-log-2011-05-26 (22-04-41).txt

Scan type: Quick scan

Objects scanned: 167501

Time elapsed: 7 minute(s), 25 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

.

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 8.0.6001.19048 BrowserJavaVersion: 1.6.0_24

Run by Owner at 23:05:50 on 2011-05-26

Microsoft

[Voi]

Well, the Combofix log is way too long to post, so I've attached it. Unfortunately I can't find an edit button to amend it to my previous post, sorry.

ComboFix.txt

[screen317]

Hi,

I see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". I suggest you remove the program now. Navigate to Start --> Control Panel --> Add or Remove Programs and uninstall the following programs if present.

• 
  
• Viewpoint
  
• Viewpoint Manager
  
• Viewpoint Media Player
  
• Viewpoint Toolbar
  

Let me know if you decided to uninstall it.

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[Voi]

Hello!

I uninstalled Viewpoint. I am still unsure if the update.exe that was quarantined was a Windows file. I assumed so since afterwards I couldn't use Windows Update, but I am not very familiar with Vista. I ran both scans (logs below) but was still unable to update. I spent a few hours scouring the internet and came across Microsoft Fixit. I was leery about using it because I'd never heard of it before so I created a restore point and registry back up before running. Whatever it did fixed my update problem (maybe it replaced that update.exe file or something?). I've begun to make sure all of the programs are up to date and finally got to install SP2.

Thank you for the time you've given to help me fix this problem! I've posted the log below. The ESET log is tiny. I've restarted since running it, would that have wiped the log file?

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

Results of screen317's Security Check version 0.99.12

Windows Vista Service Pack 1 (UAC is enabled)

Out of date service pack!!

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET Online Scanner v3

McAfee Security Scan Plus

Microsoft Security Essentials

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Eusing Free Registry Cleaner

Java 6 Update 24

Java 6 Update 5

Out of date Java installed!

Adobe Flash Player 10.3.181.14

Adobe Reader 8.2.6

Out of date Adobe Reader installed!

Mozilla Firefox (x86 en-US..)

````````````````````````````````

Process Check:

objlist.exe by Laurent

Windows Defender MSMpEng.exe

Microsoft Security Essentials msseces.exe

``````````End of Log````````````

Thank you!

[screen317]

No it was not a Windows file.

Look where it was located:

c:\Users\Owner\update.exe

Windows files are in C:\windows or C:\windows\system32 usually.

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

Java

[Voi]

Okay, I've updated those files.

Windows Update opens and runs fine now, whether I click it from the start menu or if it does shut-down updates.

If there is anything else I need to (un)install I need to know before June 8th. I'll be going out of state and will not have access to this computer.

Thank you!

[screen317]

Hi,

Great!

I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!