Win Def Offline - no access to results, no log created

Thanks, Jacee

Ran the batch file. Mozilla seems OK. Should I accept version 42 I'm being offered?

IE is still under the control of the malware, I think.

Before I follow your instructions, I'd like to make sure the malware isn't messing in our business.

The page with the article keeps trying to redirect, but Firefox doesn't allow it. The Java page doesn't match your description. Is this what you saw?


Here are the settings I see in Firefox now for plug-ins. There's nothing in Extensions, Appearance or Services.


I wonder if the SSV architecture is 32-bit because the OS of the VM the malware installed in my C: partition is XP. It's controlled from a remote server, so they might need the Java stuff. I certainly don't want any Browser Helper Objects.

Should I uninstall Java 6 Update 65, reboot and reinstall it? That's the only Java thing in Add/Remove Programs.

Do you recommend having JRE anyway?

Thanks, UG

Oh, boy, did I mess that up! And hit "submit" without checking it over well.

Mis-typed Java "6" - should be "8". Installed 11/3.
Attachment 375474

As the article you linked to said, these Java SSV Browser Helper Objects are automatically included with the Java updates so network administrators in domains using old Java applications can easily change all domain computers' Java settings with one click. I just remove them (don't always remember to immediately.)

The SSV BHOs were removable in Firefox, but not IE, where the option is greyed out. I think this is malware behavior.
Attachment 375475

Here are 4 blog posts at InfoSec describing mechanisms this malware uses for stealth and persistence. I've seen symptoms of each. I don't feel competent to follow their procedures, though.

Part 1 File Associations Hijacking and BITS Backdoor
Part 2 Program.exe and Service Failure Recovery Startups
Part 3 Service Triggers based on ETW and Attach a debugger with ImageFileExecutionOptions
Part 4 Winlogon Events and Scheduled Tasks

So...

I bought this PC refurbished. It had only the 100MB "System Reserved" Partition and W7 Pro on the rest of the HDD. I never set up a virtual machine or drive on it. I never added another OS to dual boot.

My local tech said that Time Warner Cable's redirect (when you mistype a URL and it takes you to their website) leaves open a backdoor vulnerability that was exploited by the malware I have now. It locked me out of my modem with a new password, reconfigured it to allow hundreds of remote users to connect, messed with IP addresses and DHCP.

The first symptom was a glitchy mouse - I actually threw away a perfectly good USB optical mouse. PS/2 drivers had been substituted within the USB serial bus controllers somehow. I physically removed the serial adapter and uninstalled it, but it's still listed in device manager as active and working fine!

Long story shorter (but not much, I'm afraid), I DBANed the HDD since a W7Pro disc came with the PC. Then I booted without any disc or USB device. The PC booted to "X:/v::", Windows XP Pro on a hidden, virtual HDD (not just a hidden partition within C:)!

This XP installation is SYSTEM, Trusted Installer, etc. It wouldn't let me do anything to it without being an Authenticated User, the Group that's allowed remote access to take every document, piece of media, and visited webpage on my PC.

I reinstalled clean from my W7Pro disc to get online to research the problem. The virtual drive was obviously still in control. I couldn't override it with the hidden admin account turned on through lusrmgr.msc command.

Later I tried booting from a 2000 Pro disc to get low-level format. The malware simply installed its cached altered version of my W7 Pro! The DVD drive whirred - I think they were copying it. Certainly 2000 didn't become available. Same with Vista Business and XP Pro. Tried Ubuntu - it appeared to begin installation, but some fake "fatal error" forced a reboot.

Every boot, whether a cable is connected to the modem or not, is PXE through HP (was Intel, but they changed it when I tried HP Support) Boot Agent. I'm locked out of BIOS setup (the HP procedure to clear CMOS and passwords doesn't work). Of course there are lots more symptoms I won't go into here.

This why I keep asking (in several other posts/threads) if there's another way to wipe the whole HDD while this VM is hiding on it.

I realize this is intensive and time-consuming, Jacee. I can't tell you how much I appreciate the attention you've been able to give this. Hope I've cleared up the confusion.

Thanks much, UG

UH-oh!!! Look at the "do" in the URL for the page I'm on...
https://www.sevenforums.com/newreply.php?do=newreply&noquote=1&p=3172809
It shows up in hijacked page URLs I get sent to. I'm showing as logged in on this page, but it sent me to the login page when I pressed "Submit Reply".

I bought it through Newegg, refurbished by Joy Systems. The old HP sticker is Windows 7 so it came with that, and Joy had to change the license # "For Authentication Only."

Sub Virt is probably what's controlling my PC, Jacee.

U.Mich and Microsoft Research published a paper about it in 2006. (web.eecs.umich.edu/virtual/papers/king06.pdf) Here's a simple description


Does Microsoft have any solutions yet? If I could break the VM's armor that keeps disk wipers from removing it, that should do the trick, huh? Know of anything?

Thanks again! UG