Infected while helping :(

[Orbital Shark]

While searching for a solution to a problem poster here on sevenforums I found an answer that was close to what I needed, it was on another tech forum. Only thing was as soon as I closed the page down I was informed by MSE that I was infected.

After a full system scan, and some 750,000 files checked it reported to have remove 3 severe threats.



I then thought I'd check Task Manager to see if anything untoward was running and to my surprise I was faced with several processed with an 'Installer' description. Needless to say I immediately killed all suspect processes and deleted all temporary files from both

%systemroot%\Temp
%userprofile%\Appdata\Local\Temp

I then performed a reboot and all seemed well until the processes appeared once again so I downloaded MalwareBytes and performed a Quick Scan and again, I was faced with threats.

Below Is a copy of the log...

Malwarebytes' Anti-Malware 1.50.1.1100
[URL="http://www.malwarebytes.org"]www.malwarebytes.org[/URL]
Database version: 5976
Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8080.16413
06/03/2011 21:25:24
mbam-log-2011-03-06 (21-25-24).txt
Scan type: Quick scan
Objects scanned: 189694
Time elapsed: 2 minute(s), 54 second(s)
Memory Processes Infected: 12
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 16
Memory Processes Infected:
c:\Users\Jeff\AppData\Local\Temp\WinSATa.exe (Trojan.Agent) -> 4524 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\WinSATa.exe (Trojan.Agent) -> 6004 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\atibtmonb.exe (Trojan.Agent) -> 4028 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\atibtmonb.exe (Trojan.Agent) -> 6092 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\klista.exe (Trojan.Agent) -> 2368 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\klista.exe (Trojan.Agent) -> 6068 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\forfilesb.exe (Trojan.Agent) -> 5692 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\forfilesb.exe (Trojan.Agent) -> 4444 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\odbcconfb.exe (Trojan.Agent) -> 4796 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\odbcconfb.exe (Trojan.Agent) -> 5336 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\logagenta.exe (Trojan.Agent) -> 6048 -> Unloaded process successfully.
c:\Users\Jeff\AppData\Local\Temp\logagenta.exe (Trojan.Agent) -> 5964 -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Spyware.Passwords.XGen) -> Value: conhost -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\Jeff\AppData\Local\Temp\WinSATa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\atibtmonb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\klista.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\forfilesb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\odbcconfb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\logagenta.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\microsoft\conhost.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\System32\config\systemprofile\AppData\Roaming\dwm.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\calca.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\fixmapia.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\ocsetupa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\printa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\Jeff\AppData\Local\Temp\psra.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{62c40aa6-4406-467a-a5a5-dfdf1b559b7a}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Windows\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

Quite a lost really as I'm a very careful browser.

I have one main question...

If MSE detected a threat file after closing the browser page why did it not detect that the file was attempting to be downloaded to c:\windows\system32?

From that stems another one...

Why did it then allow for other files to embed themselves into Task Manager Registry and my temp locations?

Is it not the job of AntiVirus & Internet Security to do exactly what their name intends? Especially as 1 of the severe threats was months old (see info below).

TrojanDownloader:Win32/Ponmocup.A ​

(?)​

​

Encyclopedia entry
Updated: Nov 25, 2010 | Published: Jun 04, 2010 ​

Aliases

• Swisyn.s (McAfee)
• Trojan.Win32.Swisyn.jyb (Kaspersky)
• W32.Changeup!gen (Symantec)

Alert Level (?)

Severe​

​

​

 

[Golden]

Holy Crap! Sorry about that.....the replies will be interesting. Did you manage to clean your system?

Regards,
Golden

 

[Maguscreed]

This is why I browse with firefox running the noscript plugin. It's a bit problematic but very secure if you actually know what you're doing with it.
Injections are just too easy to make...

 

[DBone]

Another MSE swing and miss. It's gotta be the most over rated AV on the planet. MBAM, HMP, SAS, NPE, Housecall are what I would start with, and hopefully all of those will work.....Good luck, and time to rethink your antivirus!

 

[Fayla]

Yes it is, the web of trust addon is also helpful.

This is why I browse with firefox running the noscript plugin. It's a bit problematic but very secure if you actually know what you're doing with it.
Injections are just too easy to make...

Wow, that's one hell of a attack there, I hope you get it all cleared out.

 

[The Howling Wolves]

I use WOT all the time when going to new places along with the favorites MBAM, SAS, and WinPatrol.
Yes it is an overkill but you don't see me asking for BSOD help.

 

[Fayla]

Prevention (for the most part) is better than a cure WOT really helps you avoid making a bad move.

I use WOT all the time when going to new places along with the favorites MBAM, SAS, and WinPatrol.
Yes it is an overkill but you don't see me asking for BSOD help.

 

[I be he]

Greetings.................... 1st, there is no such thing as "safe surfing, just use your common sense" anymore. :shock: 2nd A/V's wont protect you like they use too anymore either.:shock: 3rd, Please for the love of pete download and use Sandboxie for all your surfing needs from now on. I have never ever heard of any malware being able to get past sandboxie, so dont say you werent warned.:shock: Oh yea, its good enough to use all by itself.:shock:

 

[profdlp]

I had a friend who died after getting infected while helping someone. :shock:

(His wife killed him.)

 

[IggyAZ]

Prevention

Take the following steps to help prevent infection on your system:

• Enable a firewall on your computer.​
• Get the latest computer updates for all your installed software.​
• Use up-to-date antivirus software.​
• Use caution when opening attachments and accepting file transfers.​
• Use caution when clicking on links to Web pages.​
• Avoid downloading pirated software.​
• Protect yourself against social engineering attacks.​
• Use strong passwords.​

 

[I be he]

You forgot " Hands on 10 and 2 "

 

[A Guy]

As we reported several days ago in Search Engine Results – More Malware Surprises Than Ever!, poisoned search engine results have proven to be a gold mine for the bad guys who, naturally, continue to be unrelenting in their chase to infect web searches.

Since drive-by downloads, which don’t require user action to create an infection, are resident on many of these compromised sites, this is unhappy news for the unwary Internet user.

Source

A Guy

 

[Orbital Shark]

In answer to your questions I got it cleaned up very easily

As I run a company that deals with Cleaning/Removing Viruses & Malware, and General PC/Laptop Maintenance I'm more than well aware of the dangers of hidden infection it just bugs me that no matter what AV software you use, something will always find a way in, it's inevitable.

I'll stick with MSE as I still hold it in high regard and will put this down to another forum getting hijacked.

With 20 years dealing with this sort of crap you still never get used to it

 

[Golden]

Nice one OS.

Out of interest, was MBAM resident when you got infected, or did you only run that manually once MSE warned you that you were infected?

Regards,
Golden

 

[Orbital Shark]

I installed it as soon as the infection appeared the second time. Thought I'd managed it manually the first time until the processes appeared again in Task Manager...That was when the reinforcements were called in

 

[Golden]

OK. It would have been interesting to see if it managed to get past MBAM had it been resident.

Regards,
Golden

 

[Orbital Shark]

The problem with MBAM is that the free version has no realtime protection

 

[Golden]

The problem with MBAM is that the free version has no realtime protection

At ~$20 a pop, it might be worth it...........

 

[Orbital Shark]

True, but I can survive with the normal version as I've not found an infection yet that's beat me

 

[Golden]

I've not found an infection yet that's beat me

Nice one - it must be a relief to have the skills to overcome these things.....still, I think you made a good point. MSE should have blocked the issues instead of letting them through, and then going "Oh, look I let these through, now get rid of them".

Regards,
Golden