Microsoft Security Essentials- A Warning

[gringoal]

I apologize in advance for the length of this thread but I want to give an accurate and detailed account of my experience as it may help with some other problems I've seen in these forums.

2 weeks ago I started to get a Windows security warning "Your Internet settings do not allow you open these files". It didn't make sense as the files were sometimes Windows system 32 files and nothing to do with the internet. Resetting Windows Security levels made no difference.

Next Microsoft Security Essentials started reporting that it could not update it's Virus definitions. after trying several fix's I uninstalled and re-downloaded and tried to re-install but got an error. At this point I opened a ticket with MSE tech support.

I tried to install other antivirus software and also purchased Malwarebytes but the above Windows Security warning prevented me installing or enabling, leaving me totally unprotected.

MSE asked me to try various fix's and even took remote control of my computer
but nothing worked.

I contacted Malwarebytes who were fanastic, even though it was not really a malware issue. They suggested an ESET scan which found two serious Trojans and walked me through removing the Viruses. Unfortunately It did not fix the Windows security warning issue.

I know from the files that the Trojans were attached to that they had entered my system while Microsoft Security Essentials was operational with the correct settings to prevent infection.

Finally Malwarebytes suggested that I might have a corrupted User Account, this suggestion is also mentioned elsewhere on these forums. It proved to be correct, the new user account allowed me to install all of the software which was then available for use in the old user account. I did not delete the old account as the new account did not transfer all of my settings or shortcuts correctly.

So I had solved all my problems by the time MSE tech support finally phoned again to say that all I had to do was "Sit back and relax and in a couple of hours we will make your computer run like new" I was very skeptical but I gave him control.

I could see he was having problems setting up a new user account and
7 hours later I had a computer that had no Documents & Settings folder in ‘C’, had lost all its Firefox bookmarks and passwords, couldn't change the Firefox download destination, all Outlook emails, account settings and contacts were gone, I couldn't create or copy anything to Libraries, I couldn't change the desktop background or set up a screen saver and no desktop settings were retained after log off.


At no time did he set a restore point or create any backups and he deleted the old User Account before testing the New one.
He then told me he was only qualified to deal with MSE problems and the ticket was closed, for all other Windows 7 problems I must seek help elsewhere !



My complaint emails to MSE tech support have been totally ignored



So if you're using MSE be warned, It lets in Trojans which disables the protection, if you want a totally screwed up system just ask their tech support.


I am still not sure whether the original problems were caused by the trojans or the corrupted account or maybe both. I am now working on re-imaging my system back to happier times.

 

[yowanvista]

Thats the problem with MSE, it only provides basic protection and fails to block some malware, but version 2.0 seems promising. Thats why I use KIS2011 now

 

[whs]

I had a similar experience with MSE. Fortunately I do heavy imaging and got myself easily out of the bind. I am now using NIS 2011 hoping that it will better protect me - the earlier NIS editions worked quite well for me.

 

[Jacee]

Do you know what the Trojan was that MSE missed? It's possible that the Trojan was able to disable MSE. Backdoor/password stealing Trojans are quite nasty that way.

 

[mickey megabyte]

any idea what you were doing to get infected in the first place?

it may help others avoid your problems in the future...

no a/v is 100% perfect, and it's sad to hear this story, but i'm pretty sure that you'll find similar stories of people using kis or nis or whatever also getting infected.

mse tech support didn't sound too helpful.

 

[gringoal]

Trojans

The Results of my ESET scan are attached

 

[Golden]

Thanks for posting about your experience, albeit it not a very pleasant one for you.

Those folks at Malwarebytes are pretty good, I agree. Out of interest, had tyou managed to install MBAM, do you know whether it would have detected these Trojans?

Great news on getting your issue sorted

 

[gringoal]

No I dont think MBAM would pick up a trojan. I don't believe that's what it's designed to do. It was MBAM themselves that suggested using ESET to find the trojans.

I only tried to install it because I was desperate for any protection I could get

 

[gringoal]

Another one that MSE missed

I forgot about this one

 

[whs]

Thanks for posting about your experience, albeit it not a very pleasant one for you.

Those folks at Malwarebytes are pretty good, I agree. Out of interest, had tyou managed to install MBAM, do you know whether it would have detected these Trojans?

Great news on getting your issue sorted

Mine was detected by SAS - Malwarebytes did not.

 

[DBone]

This is the only forum that I frequent, that MSE is recommended so often. MSE produces poor results in test after test, but it is revered on this site, and I just don't get it? I'm sure I'll be hammered for this post!

I use Comodo 5.0 and couldn't be happier. Thanks for sharing your experience.

 

[pparks1]

This is the only forum that I frequent, that MSE is recommended so often. MSE produces poor results in test after test, but it is revered on this site, and I just don't get it? I'm sure I'll be hammered for this post!

I think that many of us here on this forum are generally speaking low risk and safe PC users. We don't use pirated software, we don't search for torrents and we generally speaking steer far away from trouble. For these reasons, for many of us, the protection provided by MSE is suitable enough. I'm sure that a few of the paid apps would do a better job...but I sincerely doubt that I would get my $60 worth out of something like ESET or NIS.

On my box, I use a combination of super spyware blaster, MSE and Malware Bytes. I also use Firefox as my daily browser. I'll be honest, I honestly don't recall the last nasty thing that showed up on my PC. These tools update and search regularly and they always come back with a big fat 0.

What are these test sites that show such poor results with MSE? I'd like to see them...something to me seems a bit fishy their as the product does seem to perform well and most things I have read have been pretty darn positive about this product.

 

[Jacee]

hmm... possibly a new variation of TDSS Rootkit : a variant of Win32/Kryptik.HQY trojan C_Windows\System32\ernel32.dll
Ernel32.dll is Trojan/Backdoor

These are the most dangerous, and most widespread, type of Trojan.

Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.

If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.

Banking and credit card institutions should be notified of the possible security breech.
More info can be found below:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
How to report ID theft, fraud, drive-by installs, hijacking and malware? Security | DSLReports.com, ISP Information
When should I re-format? How should I reinstall?
When should I re-format? How should I reinstall? Security | DSLReports.com, ISP Information
If you choose to format and reinstall see this link for instructions:
Windows: reformat and reinstall - Cyberwalker.com
Though the Trojans have been identified there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS.
We can in no way, guarantee it to be trustworthy again.

If you decide to reformat, you should still download the protection on the newly formatted PC, or else you will have a high chance of reinfection.

Who/what forum helped you to use OTL?

 

[Jacee]

In short ... this is a nasty Rootkit that most all, if any, Anti-virus program can detect.
It takes special tools by 'dedicated developers' to detect it.

Don't blame MSE alone

 

[mickey megabyte]

In short ... this is a nasty Rootkit that most all, if any, Anti-virus program can detect.
It takes special tools by 'dedicated developers' to detect it.

Don't blame MSE alone

i think you mean "can't detect", Jacee?

 

[jimbo45]

Hi all
NONE of you have answered the REAL question here --what were you doing on the machine BEFORE you got infected -- without that info all this speculation is pointless.

Some of us have run computers for DONKEYS YEARS without any AV at all (although not a good idea these days) and NEVER been infected whilst others who have installed all sorts of AV and malware detection programs get infected within 30 mins of first logging on to the Internet.

In order to defend against an attack you need to have some idea as to where it came from in the first place.

In any case it sounds like using foxit reader or something you've got is messing around with pdf files.

I usually use a Virtual Machine to connect to the internet and only migrate stuff to a REAL machine after testing.

If the Virtual Machine gets infected I just trash it and start a new copy of the clean VM.

IMO if you have enough resources this is one of the safest ways to do it.

cheers
jimbo

 

[Orbital Shark]

In truth you'll never stop malware no matter what AV/AM software you use. Some will ALWAYS find a way in. I remember using Norton IS 2008 which was a very good av but still, it let all sorts in. I would visit known bug sites and they would just have a field day. Jimbo's right, it's all about how sensible you're browsing is and knowing what sites are classed as safe and unsafe.


OS

 

[marsmimar]

I had a similar experience with MSE. Fortunately I do heavy imaging and got myself easily out of the bind. I am now using NIS 2011 hoping that it will better protect me - the earlier NIS editions worked quite well for me.

I think what WHS said bears repeating. Once a computer is set up the way a user wants, create a full system image. Doesn't matter if you use the Windows 7 imaging tool, Macrium free, Paragon, Acronis, or something else. The OP invested many hours trying to resolve this issue and without a reformat/reinstall, there's no way to be 100% sure the machine is without malware.

 

[gringoal]

Thanks for the advice and info Jacee. If you believe that these trojans can't be detected by most AV programs. The fact that both of these trojans were identified by ESET must say good things about their AV

OTL? Do you mean OTM (Old Timer Move it). That was another of the many detection and deletion programs that Malwarbytes asked me to try.

For others who asked about what I was doing when I got infected, I was downloading a pirated PDF ebook from a dodgy site. Here is the full OTM log

c:\windows\syswow64\drivers\hlfcm.sys
c:\windows\syswow64\drivers\xsgdw.sys
c:\windows\syswow64\drivers\rmmo.sys
c:\users\owner\my ebooks\stieg larsson - the girl with the dragon tattoo - 2005\foxit reader 3.2.1 - pdf document viewer (high-quality)\foxitreader321_en_setup.exe
c:\windows\system32\spool\prtprocs\x64\qg55a.dll
C:\Documents and Settings\Owner\My eBooks\Stieg Larsson - The Girl with the Dragon Tattoo - 2005\Foxit Reader 3.2.1 - PDF document viewer (High-Quality)\FoxitReader321_en_Setup.exe

 

[Tews]

For others who asked about what I was doing when I got infected, I was downloading a pirated PDF ebook from a dodgy site. Here is the full OTM log

....