Solved Mor.exe has stopped working?

[gbu]

The last couple of days ive had a window pop-up that says 'mor.exe has stopped working'
Iv'e noticed this comes up when i visit a site that uses java as the java icon appears in the toolbar at the same time as the window pops up.
The detailed info that is shown is:-
Fault Module Name: mor.exe

Fault Module Version: 0.0.0.0
Fault Module Timestamp: 721c31e7
Exception Code: c0000005
Exception Offset: 0003910b
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 2057
Additional Information 1: 0a9e
Additional Information 2: 0a9e372d3b4ad19135b953a78882e789
Additional Information 3: 0a9e
Additional Information 4: 0a9e372d3b4ad19135b953a78882e789

Read our privacy statement online:
Windows 7 Privacy Statement - Microsoft Windows

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt

i click on Close Program and the java icon goes away.

 

[Golden]

Hi,

There appears to be quite a few hits for this file as being associated with a malware infection. Java is often used as a vehicle for malware delivery, so I think its best to scan your system for malware.

Please perform an online scan using this link, and then post the results back here:

http://www.eset.eu/eset-online-scanner

This way we can rule this out.

Regards,
Golden

 

[gbu]

Thanks for the reply, heres what the scan found:-

C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\4fd90665-49176361 Java/Exploit.Blacole trojan
C:\Users\James\AppData\Roaming\sdra64.exe Win32/Spy.Zbot.WM trojan
C:\Windows\System32\aigovox.dll a variant of Win32/Urlbot.NAO trojan
C:\Windows\System32\movuxavi.exe a variant of Win32/Urlbot.NAT trojan
C:\Windows\System32\MPK\MpkNetInstall.exe probably a variant of Win32/Agent.EUDBPIN trojan
C:\Windows\SysWOW64\aigovox.dll a variant of Win32/Urlbot.NAO trojan
C:\Windows\SysWOW64\movuxavi.exe a variant of Win32/Urlbot.NAT trojan
C:\Windows\SysWOW64\MPK\MpkNetInstall.exe probably a variant of Win32/Agent.EUDBPIN trojan

My own AV Microsoft Security Essentials picked up these before this scan was run.:-

Exploit:Java/CVE-2011-3544.AV
file:C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\5675a445-743090a4->Men.class

Exploit:Java/CVE-2011-3544.AU
file:C:\Users\James\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\3ba307a2-5361461b->Loo.class

 

[Golden]

Hi,

Yes - thats a good demonstration on the vulnerabilities of Java, especially if its not updated.

Some of these trojans appear to be backdoor trojans, meaning your system could be significanly compromised. I prefer to get a professional malware removalist opinion ion this, so I will ask Jacee and/or Corinne to make a recommendation.

They will either:
1. Guide you through a removal process, or
2. Recommend a format + clean install

If the infection is that severe, only a clean install can guarantee complete removal.

In the meantime, backup all your user data to an external drive, and also more importantly, on a different clean computer change all your passwords on your email, bank accounts etc. etc.

Regards,
Golden

 

[Jacee]

.. doubled possted message, ignore

 

[Jacee]

sdra64.exe Win32/Spy.Zbot.WM trojan
sdra64.exe | ThreatExpert statistics

Warning! Backdoor Trojans

These are the most dangerous, and most widespread, type of Trojan.
Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.
If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.

They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.

Banking and credit card institutions should be notified of the possible security breech.
More info can be found below:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
How to report ID theft, fraud, drive-by installs, hijacking and malware? Security | DSLReports.com, ISP Information

Please ask for more help here: Virus, Spyware & Malware Removal - What the Tech

 

[Golden]

Thanks Jacee.

 

[gbu]

Thanks for the help Jacee and Golden

Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.

After reading this part it got me thinking as to a recent problem i had with my router that kept cutting out, i phoned tech support for BeUnlimited and they guided me through a process to allow them to set up remote access to my pc in order to update the firmware and reset some of my settings.
Could this be something the scan is picking up on?

 

[Golden]

Hi,

I think it is unlikely that this could have caused the problem, but you should consider it possible. Did you turn OFF the remote connection option after they were finished?

I would very strongly urge you to follow Jacee's advice she posted.

Come back and let us know how you get on after visiting the site she recommended.

Regards,
Golden

 

[gbu]

Thanks for the reply and will join that forum and post there shortly.

I just looked and i had the top box checked so it was allowing remote connections, and the bottom one was checked like yours is i have now unticked the top one.

 

[Jacee]

I've just gone through all of your logs ( I watched the topic)...
One thing that's very important for you to do, if you haven't done it yet, is to update your Java! Older versions have vulnerabilities that malware can use to infect your system.

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 7.
  Java SE Downloads
• Scroll down to where it says "Java Runtime Environment (JRE) 7u2 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-7u2-windows-i586-p.exe to install the newest version.

 

[gbu]

Many thanks for putting me onto that site they was very helpful like yourselves here at sevenforums.

From the Java link you supplied i cant see "7u2" there is a "7u3" however.
Or am i looking at the wrong thing?

Is downloading it from there different to the java.com site?
Verify Java Version
When i go there it says:-
You have the recommended Java installed (Version 6 Update 31).

 

[Golden]

Thats fine gbu - 7u3 is the latest update. Check to see that this is the version you have installed.

Regards,
Golden

 

[gbu]

I updated to 7u3 but when i went back to check on the java site it said it wasnt the latest update and Version 6 Update 31 is the latest?

 

[Golden]

Mmm. OK. Lets do it from scratch. Follow this link to remove all previous versions of java, and then downlaod and install the latest:

Download Java for Windows

Post back here if you need more help.

Regards,
Golden

 

[gbu]

The link you just posted is the one i have now and alls fine and says i have the latest version what i was querying is the download from the link in post #11.
When i updated from there i was told it wasnt the latest.

 

[Golden]

Hi,

If Java says you have the latest, then its all good.

As a double-check follow this tutorial to make sure everything is closed off:

http://www.sevenforums.com/tutorials/181981-secunia-online-software-inspector.html

Regards,
Golden

 

[Jacee]

Current update for Java (Java Runtime Environment -JRE) ..

Java SE 7u3

This release includes security fixes. Learn more

"What Java Do I Need?" You must have a copy of the JRE (Java Runtime Environment) on your system to run Java applications and applets. To develop Java applications and applets, you need the JDK (Java Development Kit), which includes the JRE.

 

[Corrine]

Hi, gbu.

For the time being, you're fine with JRE6u31. From Java SE 7:

Why is Java SE 7 not yet available on java.com?


Java SE 7 is the latest release for Java that contains many new features, enhancements and bug fixes to improve efficiency to develop and run Java programs.

Why is Java SE 7 not yet available on java.com?

The new release of Java is first made available to the developers to ensure no major problems are found before we make it available on the java.com website for end users to download the latest version. If you are interested in trying Java SE 7 it can be downloaded from Oracle.com

Should you with to update to Java 7u3, you'll be ahead of the game. However, it is likely you will need to uninstall the previous version (Java 6u31) as reports are that the update to version 7 doesn't appear to remove the older version.

 

[gbu]

Ah thanks for the clarification i wasnt sure if it was installing the wrong version

Rep to everyone that has helped me and many thanks again