Solved Suspicious TCP/UDP connections on Currports

[Slartybart]

Ok, let's take Spybot completely out of the equation - you uninstalled it, now restore the hosts file to default
Follow this and run the MS fixit: How can I reset the Hosts file back to the default?

I didn't think your PC was named that now you know what the name is for certain.

Way back in post 4, there were 10 malwares found. I still would like to run ESET scanner and AdwCleaner after the MS fixit for the hosts file. You said you have adwcleaner, but I'd prefer it if you download a new version. There are updates and I do not know if any of the 10 malware on your system might have compromised AdwCleanr (probably not, but a fresh download - you'l know for sure)

re: delete posts, good thinking, that might be the reason. It's not important that it be deleted.

I'll write two new posts on ESET (lengthy, but thorough) and Adwcleaner, run them in that order, post the results.

So start with the MS fixit and I'l start the next two posts

Bill
-

 

[Slartybart]

Please run the ESET Online Scanner...

Since it is implemented as an ActiveX control, it is best run on Internet Explorer.
Right click the IE shortcut and select: Run as Administrator

Next, in IE, download >ESET Free Online Scanner :: Complete Malware Detection :: ESET

On the ESET website, click on: Run ESET Online Scanner
Click: Start

When asked, allow the add-on to be installed.
Again, click: Start

On the next prompt, Computer Scan Settings, do not check: Remove found threats

Next, click on: Advanced Settings
Make sure the following options are checked:
>Scan for potentially unwanted applications
>Scan for potentially unsafe applications
>Enable Anti-Stealth Technology

By Current Scan Targets, Operating memory, Local drives, press: Change
In Selection of scan targets, Local drives, select the drives in question.
Click: OK

Click: Start
Follow the prompts.

When the scan completes, if threats are found, in the Scan Results prompt, click on: List of threats found
Click on: Export to text file
Save to the Desktop and name it: ESET Scan Results
Click on: Back
Click on: Finish, and close the program.

If anything is found, please provide the ESET Scan Results in your reply to determine what further action is necessary.

 

[Slartybart]

Download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

 

[Slartybart]

Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).

Copy and paste the contents of that logfile in your next reply (logfile is also saved in C:\AdwCleaner)

 

[oddblob]

now restore the hosts file to default
Follow this and run the MS fixit: How can I reset the Hosts file back to the default?

-

Hi, before I do that, I'm just a bit curious about it... if some applications are trying to go to this dodgy domain, and it appears that Hosts is looping it back to 127.0.0.1. Why would I want to stop that? Surely putting Hosts at default will allow this connection?

 

[Slartybart]

Good question.

You are correct, resetting hosts would allow the connection.

Why would you want to do that? Spybot S&D used the hosts file to compensate for a weak AV policy. You have Avast! which should prevent the malware in the first place, so the entries created in the hosts file by Spybot are unecessary and might cause legitimate connections to fail.

edit: Win7 firewall does the other half of the job.

Having a std hosts file is "best practices" for operating any machine. Putting entries in the hosts file is a workaround to try if and when there is a connection issue, it's called a loop back TEST.


Your machine, your choice - but I strongly recommend that you reset hosts to default.

I just ran currports on my machine and see what might be confusing us. It displays all possible connections. The interesting thing is that on the first execution, I saw some unknowns and other curiosities. When I ran it a second time, those curiosities were not displayed in the window. Conclusion: use std windows apps to display network information. I think currports is just confusing the issue, you might be chasing a red herring.

If currports caused you to chase a red herring that's ok. Your machine is a little cleaner (previous AV apps removed) and if the last two scans report nothing found then you're fairly certain there is no malware on your machine. You can never be 100% certain, but you have a good AV app and the scans so far report nothing found. Make sure regular scans are scheduled (quick daily, full weekly is how I have my machine set up with Avast), and both the program and virus definitions are up to date.

Did you run ESET and AdwCleaner?

 

[Slartybart]

Thought of a few more things to clean up your system.

Seeing what Spybot did to your hosts file made me think that Spybot might have changed Windows firewall too. I don't know that for certain, but as a precaution, I would Restore Windows firewall to default values. This might cause you to re-answer prompts about allowing traffic for known applications, but there aren't that many exceptions.

Control Panel\All Control Panel Items\Windows Firewall
Seelct Restore Defaults in the left hand pane

The other thing I would recommend is the Revo uninstall app. This is a great utiltiy that cleans up uninstalled applications that don't employ "best pratices" when they are uninstalled.

Download Revo Uninstaller Freeware - Free and Full Download - Uninstall software, remove programs, solve uninstall problems
Revo Uninstaller Pro - How To

After you run ESET and AdwCleaner and they come up clean, I don't think I can add anything more.

I'll keep an eye on this thread if you need help with what I've suggested or have questions.

Bill
-

 

[oddblob]

Seeing what Spybot did to your hosts file made me think that Spybot might have changed Windows firewall too. I don't know that for certain, but as a precaution, I would Restore Windows firewall to default values. This might cause you to re-answer prompts about allowing traffic for known applications, but there aren't that many exceptions.

-

Okay, I ran ESET and it found two threats, OpenCandy and Somoto, from a quick google search they look like the sort of crap which comes with some downloads (Although, I'm usually very cautious with what I accept..) Also, Adwcleaner flagged a folder and it deleted it, but that folder comes up with every scan I do on it! It's an empty folder and I just deleted it myself now.

Also, since I've restored Hosts, the Remote Host Name on Currports is now my P.C name! I guess Spybot s&d screwed something up there... I also guess it was a red herring, but thanks for that help!

What should I do about the file found by ESET, they're both there still, and I don't remember downloading the .exe which is in my Downloads... also, regarding this recurring folder, /System32/Tasks/NCH Software should I be suspicious about this..?

Looking at this: https://en.wikipedia.org/wiki/NCH_Software I don't recognize any software from that list...

I also reset my Firewall settings View attachment new.zip The .zip is the logs from ESET and ADWCleaner.

Edit: Just to add: my P.C is actually running noticeably faster now, usually when I shut it down, it would hang on some screen saying something like closing programs, when I just shut it down, it didn't do that for the first time in ages! Thanks!

Edit 2: I found out epm.exe is a partitioning tool I have, would you recommend uninstalling this?

 

[Slartybart]

Open Candy is in a lot of installers, you don't get the option to untick it. Some call it sneakerware.
Somoto, I'll look up just to err on the side of caution.

What is the name of the dolfer AdwCleaner found?

Cool - currpports is reporting correctly.

re: files found by ESET, still in downloads, don't recall downloading... what is the exe name?

if you don't need it, delete it/them

re: NCH - sounds familiar, let me readup

I'll take a look and let you know if there's any more that needs to be done.

Always glad to help, always glad to hear good news.

 

[oddblob]

Open Candy is in a lot of installers, you don't get the option to untick it. Some call it sneakerware.

What is the name of the dolfer AdwCleaner found?

Ah, that could be why, it was in EaseUS Partition Manager, needed to do something with some SD cards a few months ago, I'll uninstall that using Revo then!

C:\Windows\System32\Tasks\NCH Software Was this mysterious folder which keeps cropping up...

 

[Slartybart]

Sophos is a reputable vendor and they specifically mention somoto.

Try http://www.sophos.com/en-us/products/free-tools/virus-removal-tool/download-now.aspx

I might run through a few other "standard scanners". I just want to be sure you're sysyem is in good shape. Maybe one or two more.

Post anything Sophos reports. I think it's ok to remove anything that shows up, you don't want to rerun the scans (some cases yes, but I'll let you know if you need to scan, then clean)

Assume, I mean clean for the rest of this exercise.

 

[oddblob]

Sophos is a reputable vendor and they specifically mention somoto.

Try Download Free Virus and Malware Removal Tool | Sophos

I might run through a few other "standard scanners". I just want to be sure you're sysyem is in good shape. Maybe one or two more.

Post anything Sophos reports. I think it's ok to remove anything that shows up, you don't want to rerun the scans (some cases yes, but I'll let you know if you need to scan, then clean)

Assume, I mean clean for the rest of this exercise.

Awesome, I'm running the Sophos tool now, although regarding ESET and what it found, I noticed it doesn't remove these? Should I do this myself and just delete the file/folders it flagged?

 

[Slartybart]

Haven't read the log, but that's probably the conclusion I'll reach.

Wait unitl Sophos finishes - it might offer up the opportunity to remove them. If it does, let it.

 

[Slartybart]

Restart your system



Then, please download Junkware Removal Tool to your desktop.

• Right click, run as administrator: JRT.exe
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

:ar: Based on the results of Sophos and JRT, there's one more - a cleanup really.

Bill
-

 

[oddblob]

Sophos is a reputable vendor and they specifically mention somoto.

Try Download Free Virus and Malware Removal Tool | Sophos

Post anything Sophos reports. I think it's ok to remove anything that shows up, you don't want to rerun the scans (some cases yes, but I'll let you know if you need to scan, then clean)

Assume, I mean clean for the rest of this exercise.

Still running Sophos scanner, it's been on item:
PHYSICAL:0080:0000:0000:0001
for ages now I've googled this, but all I got was some mbam forum which didn't help really... the number of threats is still 0 which is good! I don't suppose you know what PHYSICAL:0080:0000:0000:0001 means? :S

 

[Slartybart]

It's deep scanning - it will run for a while.
If Sophos found something down there, it will take a while to fix it, quite a while.

Do NOT interrupt the scan. It might be hours..

We'll see if we need to run something else. I hope not.

This wasn't much help, but you can read it: Free Virus Removal Tool | Sophos Antivirus and Malware Removal Tool

 

[oddblob]

It's deep scanning - it will run for a while.
If Sophos found something down there, it will take a while to fix it, quite a while.

Do NOT interrupt the scan. It might be hours..

We'll see if we need to run something else. I hope not.

This wasn't much help, but you can read it: Free Virus Removal Tool | Sophos Antivirus and Malware Removal Tool

I'll leave it overnight then and see any results in the morning, just out of interest as I've never heard of PHYSICAL:0080:0000:0000:0001, what actually is this?

 

[Slartybart]

It's deep in the disk sectors... too much for me to understand.

 

[oddblob]

It's deep in the disk sectors... too much for me to understand.

Helo, just woken up and it's still on the same item! PHYSICAl:0080:000:0000:0001
Starting to think it's stuck... :S

 

[Slartybart]

It's possible that it found something and is fighting with it... it's also possible that it's just stuck.

Launch Task Manager and look at Processes, show process from all users, sort by CPU descending, and post a screen shot. I don't know the process name(s) for Sophos, I can figure that out from the Task Mgr shot.

The Sophos doc wasn't in that much detail, let me look again to see if there are any warnings about stopping it. It's never a good idea to kill a disk operation, but it is necessary some times. I'll let you know what I find.