Solved Obfuscator.xz detected w/ MSE

[In Need Of Help]

I see there's currently a thread with the same issue, and have also checked a few others, but from what I understand it's best to start a new thread. When I got my laptop back from my little brother, I ran a full scan using MSE and it detected Obfuscator.xz. After some research, I realized this happened because he downloaded and installed NBA2K13.

I was able to quarantine and remove it, but it showed up once again on a second scan. This time, it was unable to quarantine. I uninstalled and removed the NBA 2K13 iso and ran a full scan on MSE a third time, and it didn't show up this time.

I'm still extremely nervous about what this has done, considering it's been on my system for at least a month. I've used this laptop to log into my bank, log into the website I work for, and all of my other online accounts. I realize that I'm going to have to change all my passwords, but I want to make sure the system is completely clean before I do, so I know the new passwords are safe.

I would greatly appreciate any assistance you can offer, in helping me out with this situation. Let me know what my next step should be, and I'll be sure to follow through with your suggestions. Thanks in advance, for your time and help.

 

[Golden]

Hi,

The best thing you can do is change your online account passwords (on a known clean computer - NOT the current one) as you have already suggested.

In addition, perform some scans using a variety of different tools such as:

ESET On-line Scanner

and also this:

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Finally, if you still have any doubts, many will suggest that you format everything and then perform a clean installation - its the only way to be 100% confident that anything malicious has been removed. Some think its overkill, but its up to you.

Regards,
Golden

 

[cottonball]

In Need Of Help,

After running the scans, please provide the reports for each.
Looking at their reports will provide information on what was found, and determine if any further action is necessary. This is better than taking things for granted, or, operating in the blind.

WDO:
The log files are stored in a MPLog-MM/DD/YYYY-HH/MM/SS.txt file in the folder below:
C:\Windows\Windows Defender Offline\Support

ESET:
To run the ESET Online Scanner:
ESET Online Scanner
Run it from Drive C:\, presuming it has Windows 7.

First, temporarily disable your Anti-Virus (MSE).
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - BleepingComputer.com
Taking this action allows for ESET to run a little faster.

If possible, use Internet Explorer for this scan.

Right-click on the IE icon in the Start Menu and select: Run as Administrator

Accept the Terms of Use, then click on: Start
When prompted, allow the Add-On/Active X to install.

Under Scan Settings, make sure that the option Remove found threats is not checked, and the option Scan Archives is checked.

Click on Advanced Settings and select the following:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Now, click on: Start
The virus signature database begins to download. (This make take some time.)

Next, the Online Scan begins automatically.
Please do not touch the Mouse or keyboard during the scan, otherwise it may stall.

When the scan completes, click: List Threats
Please copy and provide the information presented in your reply. (If no malware is found, a list is not presented.)
Click the Back button, and then click the Finish button.


Notes:
1. Quarantined files are stored in the folder: \Local settings\Application data\ESET\ESET NOD32 Antivirus\Quarantine
2. Make sure you re-enable your Anti-Virus when done.

 

[In Need Of Help]

WDO found nothing. This is what ESET found.

C:\Program Files (x86)\CustoPackTools\utils\ask\AskInstallChecker.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files (x86)\CustoPackTools\utils\ask\askToolbarInstaller.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\ProgramData\Ask\APN-Stub\MYC-ST\APNIC.dll a variant of Win32/Bundled.Toolbar.Ask application
C:\Users\All Users\Ask\APN-Stub\MYC-ST\APNIC.dll a variant of Win32/Bundled.Toolbar.Ask application

 

[jimbo45]

Hi there
With ANY of this sort of stuff -- WIPE (Re-format) the disc and restore CLEAN version of your OS.

How can you possibly trust ANY A/V removal tool --especially when it's run on already a compromised system. - I just don't understand people's logic here -- they get an infection which does unknown things to their computer and then trust some other program which by nature of the beast can never be guaranteed to be 100% successful to run ON AN INFECTED SYSTEM and then "Hope" their computer is OK.

Also DO NOT USE ANY ONLINE SCANNERS IF THE MACHINE IS INFECTED.I just hope your Bank account isn't being emptied in some far off country. If you have an infected machine KEEP OFF THE NET until its fixed --you just don't know what the Hack is doing -- just because a program says it's virus xxxxx that doesn't mean to say it actually is xxxx. Using the internet on an infected machine is the best way to pass confidential stuff all over the internet.

From now on in (if you aren't already doing it) Take DAILY backups of your OS and archive user data regularly.

Would you if you possibly thought one wheel of your car might come off actually DRIVE it to the repair shop. -- That's the computer equivalent of using any program ON AN INFECTED MACHINE.


Cheers
jimbo

 

[In Need Of Help]

@jimbo45 Not everyone is as knowledgeable about this stuff as you, this is my first time experiencing something like this. Unfortunately, this is the only computer available to me at the moment, so I had no choice but to use it to research how serious it was, and to find out what to do. I'm aware that this is serious, and all of my stuff is at risk until I rectify it, and am just trying to figure out the best route to take to solve the problem, and ensure that it doesn't happen again.

@cottonball I have finished running WDO and it found nothing.

This is what ESET found.

C:\Program Files (x86)\CustoPackTools\utils\ask\AskInstallChecker.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files (x86)\CustoPackTools\utils\ask\askToolbarInstaller.exe a variant of Win32/Bundled.Toolbar.Ask application
C:\ProgramData\Ask\APN-Stub\MYC-ST\APNIC.dll a variant of Win32/Bundled.Toolbar.Ask application
C:\Users\All Users\Ask\APN-Stub\MYC-ST\APNIC.dll a variant of Win32/Bundled.Toolbar.Ask application

Is jimbo right, when saying that the only way to be sure that this problem is solved is to do a clean install? If so, how do I go about doing that? Pardon my ignorance, but I've never done a clean install before. They did not send a disk with the laptop when I purchased it, so what would be my next step? Thanks again for anyone helping me out with this, it is very much appreciated.

 

[Golden]

Is jimbo right, when saying that the only way to be sure that this problem is solved is to do a clean install?

A clean install is an option if you can't wait any longer for cotton to reply, but its not necessarily the only way to solve the problem.

This explains how to do it, and how to create installation media (DVD or USB):

http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

However, if you aren't in a rush, wait for cottons next reply - she is a trained malware removal specialist, so I'm quite sure she knows what he is talking about.

Regards,
Golden

 

[In Need Of Help]

Is jimbo right, when saying that the only way to be sure that this problem is solved is to do a clean install?

A clean install is an option if you can't wait any longer for cotton to reply, but its not necessarily the only way to solve the problem.

This explains how to do it, and how to create installation media (DVD or USB):

http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

However, if you aren't in a rush, wait for cottons next reply - she is a trained malware removal specialist, so I'm quite sure she knows what he is talking about.

Regards,
Golden

That's what I figured, I appreciate the response.

Update: Thanks for the link as well, I do plan on doing a clean install once the process is finished. I'd just like to hopefully be able to safely get everything off of this computer and onto an external HD, if possible, before I do. I work from this computer, so there's a lot of stuff I would hate to lose.

 

[In Need Of Help]

I can say that the computer already seems to be running much smoother. There had been a lag whenever I try to load a page, it'd take like 2-3 seconds before it would start to load. And when I'd start a post in wordpress or something, it was doing this thing where the cursor would be in the text box on loading, then suddenly leave the box for a second or two, and return. It's no longer doing either of those things.

Also, the fan seemed to run when doing nearly anything... opening a new tab, constantly when in google reader or on facebook. It's as quiet as when I first got the laptop all of a sudden, and the fan hasn't started once.

I don't know for sure if these things are directly related, but it sure seems to have had a positive effect. Figured I would let you guys know, in case it helps in any way.

 

[cottonball]

Have you already done a clean install?

The entries that ESET is showing are not "big ticket" items.

You can easily get rid of them doing the following:

Please download AdwCleaner:
http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner
Save to the desktop.


Close all open programs.


To run the program, right-click AdwCleaner.exe and select: Run as Administrator

Click on Search and confirm the prompt.

After it finishes, a text file report opens.


Please post the content of the AdwCleaner report to your reply.
(A copy of the log is also saved at C:\AdwCleaner[S1].txt)




This report is the result of the search. Once we look at it, then we perform a Delete.

 

[In Need Of Help]

I have not done a clean install yet. It would be a big process, so if I can avoid it safely, that would be great.

Downloading and running AdwCleaner now, and will post the report when it's completed.

 

[cottonball]

Also, please download RogueKiller:
Tlcharger RogueKiller (Site Officiel)


When you get to the website, go to where it says:
(Download link) Lien de téléchargement
Select the version that applies to your system: x64
Click the dark-blue button that applies.

Save to the Desktop.


Close all windows and browsers
Right-click RogueKiller and select: Run as Administrator

Press: SCAN


When done, a report opens on the Desktop: RKreport.txt


Please provide the RKreport.txt (Mode: Scan) in your reply.
(Please do not delete anything! Thanks!)

 

[In Need Of Help]

Here's the report from AdwCleaner. Will download and run RogueKiller now.

# AdwCleaner v2.115 - Logfile created 03/24/2013 at 08:57:26
# Updated 17/03/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : home - HOME-PC
# Boot Mode : Normal
# Running from : C:\Users\home\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\ProgramData\Ask
Folder Found : C:\ProgramData\Partner
Folder Found : C:\Users\home\AppData\LocalLow\boost_interprocess
Folder Found : C:\Users\home\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Found : HKCU\Software\1ClickDownload
Key Found : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Found : HKLM\Software\Iminent
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16521

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (en-US)

File : C:\Users\home\AppData\Roaming\Mozilla\Firefox\Profiles\0oxj7xbm.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v25.0.1364.172

File : C:\Users\home\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1693 octets] - [24/03/2013 08:57:26]

########## EOF - C:\AdwCleaner[R1].txt - [1753 octets] ##########

 

[In Need Of Help]

Here's the RKreport.

 

[cottonball]

Please run AdwCleaner once again, and this time use the Delete option.

On RogueKiller, do you engage in any activity with: wireless-rtr.stanford.edu?
Might be doing couses on-line?

Last, for your peace of mind, please run ESET once again, just like in Post #3.
It should take less time now.

When you do so, Under Scan Settings, make sure that the option Remove found threats is checked, and the option Scan Archives is checked.

When the scan completes, click: List Threats

Please copy and provide the information presented in your reply. (If no malware is found, a list is not presented.)

Need to go out and get some lunch, will be back around 2:00PM Central Time (USA).

Are you near St. Louis? If so, I am also.

 

[In Need Of Help]

Never engaged in any activity with wireless-rtr.stanford.edu that I am aware of. That has me worried.

I'll do everything else as instructed and post the results. Thanks again.

 

[In Need Of Help]

Here's the report from AdwCleaner. Will run ESET now and get back with results.

# AdwCleaner v2.115 - Logfile created 03/24/2013 at 10:14:55
# Updated 17/03/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : home - HOME-PC
# Boot Mode : Normal
# Running from : C:\Users\home\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\Users\home\AppData\LocalLow\boost_interprocess
Folder Deleted : C:\Users\home\AppData\Roaming\OpenCandy

***** [Registry] *****

Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Key Deleted : HKLM\Software\Iminent
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

***** [Internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16521

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (en-US)

File : C:\Users\home\AppData\Roaming\Mozilla\Firefox\Profiles\0oxj7xbm.default\prefs.js

C:\Users\home\AppData\Roaming\Mozilla\Firefox\Profiles\0oxj7xbm.default\user.js ... Deleted !

[OK] File is clean.

-\\ Google Chrome v25.0.1364.172

File : C:\Users\home\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1822 octets] - [24/03/2013 08:57:26]
AdwCleaner[R2].txt - [1882 octets] - [24/03/2013 10:14:39]
AdwCleaner[S1].txt - [1934 octets] - [24/03/2013 10:14:55]

########## EOF - C:\AdwCleaner[S1].txt - [1994 octets] ##########

 

[cottonball]

Let's press on with RogueKiller and get rid of those entries that concern you.

•Please quit all programs
•Right-click the RogueKiller file and select: Run as Administrator
•Wait until the Prescan finishes
•Press: Scan
•Once again at the RogueKiller console, click the DNS tab.
•Make sure the entries there are checked, if there is an option to do so.
•Then, press the [DNSFix] button.

Last, an RKreport (Mode: DNSFix) is created on the Desktop.

Please post the report in your reply.

 

[cottonball]

Also download farbar's MiniToolBox:
Downloading MiniToolBox
Save to your Dsktop and double-click to run it.

Check the following boxes:

• Flush DNS
• Report IE Proxy Settings
• Report FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries

Click: Go
Please post the Result.txt (appears on the Desktop) in your reply.

 

[In Need Of Help]

ESET finally finished, it took over 4 1/2 hours, and I just realized I forgot to turn off MSE this time. It found the two Ask toolbars again, and I'm pretty sure it deleted them, but accidentally closed it before checking the threat list. Been up all night with this issue, and I'm getting too tired to function. I'll run it again and check to make sure it was done correctly.

Ran RogueKiller again, nothing showed up under the DNS tab. I ran DNSFix, here's the log.

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : Download RogueKiller (Official website)
Blog : tigzy-RK

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : home [Admin rights]
Mode : DNSFix -- Date : 03/24/2013 15:15:21
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{803A29DC-5697-4DB2-91F0-3D8C88F25CB5} : NameServer (172.26.38.1 172.26.38.2) -> REPLACED ()
[DNS] HKLM\[...]\ControlSet002\Services\Tcpip\Interfaces\{803A29DC-5697-4DB2-91F0-3D8C88F25CB5} : NameServer (172.26.38.1 172.26.38.2) -> REPLACED ()

¤¤¤ Driver : [NOT LOADED] ¤¤¤

Finished : << RKreport[2]_DN_03242013_02d1515.txt >>
RKreport[1]_S_03242013_02d0904.txt ; RKreport[2]_DN_03242013_02d1515.txt



Going to install and run the MiniToolBox now, and will post the results.