The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.
I think my computer is infected by an email spam troyan/virus
Vic
Registered User regular
Registered User regular
Firstly I hope this is a suitable subforum to post this question. I have tried posting this in a virus support forum, but recieved no answer. If you have any recommended forums to take this question to I would be grateful for a link.
Friends have informed me that since january the first, my hotmail adress has been sending out emails every few days with two files I can only assume contain viruses of some sort attached. I have used the scan function of several antivirus programs including Avira, Avast and Microsoft Security Essentials but found no suspicious files. My operative system is Windows 7 64 bit, and thus I can not use the bootscan function of Avast. I can remember no particular activity that might have lead to my computer being infected.
It seems that the virus sends out spam mails to all of my contacts, either on MSN Messenger or in Hotmail. Several of the emails bounce or are reported as being delayed every time they are sent out. The emails read as follows:
I have tried in vain to google the body of the text, and it seems the file names are very commonly used.
Apart from the emails being sent, I am not sure I have noticed any particular effects of the virus. I have had slowdowns of my computer, but I am not sure if this could simply have been from my own computer activity. Any advice on how to deal with this problem would be greatly appreciated!
Thanks in advance
Friends have informed me that since january the first, my hotmail adress has been sending out emails every few days with two files I can only assume contain viruses of some sort attached. I have used the scan function of several antivirus programs including Avira, Avast and Microsoft Security Essentials but found no suspicious files. My operative system is Windows 7 64 bit, and thus I can not use the bootscan function of Avast. I can remember no particular activity that might have lead to my computer being infected.
It seems that the virus sends out spam mails to all of my contacts, either on MSN Messenger or in Hotmail. Several of the emails bounce or are reported as being delayed every time they are sent out. The emails read as follows:
With two files attached, one called "ATT00001" and the other "Re.mht"Subject: Re
Body: Dear,
How are you?
I received a shopping website's invitation and I have become their member,
they have a lot of cheapest products and best perfect services.
I have bought their products, all of the products are orginal and new.
Products they sale TV, laptop, desktop, phones, digital SLRs,
Camcorders and so on.If you have any questions ,
you will get the best service by their online servers.
I am very pleased to share with you.
Now I share the web to you: offersele.com
I am sure you will get much surprise.
Yours，
I have tried in vain to google the body of the text, and it seems the file names are very commonly used.
Apart from the emails being sent, I am not sure I have noticed any particular effects of the virus. I have had slowdowns of my computer, but I am not sure if this could simply have been from my own computer activity. Any advice on how to deal with this problem would be greatly appreciated!
Thanks in advance
Vic on
0
Posts
Then run Trendmicro's Housecall.
Do these in safe mode.
1.) You've got an infection - and after all the stuff you've thrown at it, and the lack of symptoms you describe, I'm going to guess you've got a rootkit that's evading detection. Not exactly a super-likely scenario, but possible. I'd recommend finding and using a rootkit scanner. There are many available. There are some on the software list in this thread.
2.) Someone has compromised your email account. This means they're logging into your account remotely, and they're not really doing anything on your computer - Still, they got your password somehow, so keep that in mind. Change the password on the account immediately to something secure. If the mails stop, that's probably what was going on.
3.) There's a chance that someone is just spoofing your email address. The fact that your contacts are being emailed directly makes this unlikely, but every so often spammers will just pick a domain or an address and use it to fake their 'From' field. There's no way to prevent this when it happens.
Actually, moderators on the official MalwareBytes forum recently indicated that MBAM isn't really designed to run in safemode, and that it should only be used in situations where the normal scans fail. Your results may vary, but it's been a recent surprise, at least to me. The conventional wisdom is that safemode scanning is superior, after all.
If that's the case, i'd suggest running it both ways then.
I have had malware in the past that was not detected by MBAM in a normal boot, but in safe mode MBAM found 70+ compromised files.
Very yes.
As I forgot to mention: If you do manage to turn up an infection (particularly a rootkit), full reformat is the safest option.
Database version: 3537
Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385
2010-01-11 01:27:48
mbam-log-2010-01-11 (01-27-48).txt
Scan type: Full Scan (C:\|E:\|)
Objects scanned: 408868
Time elapsed: 44 minute(s), 5 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysinfo (Trojan.Downloader) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\Vic\AppData\Local\Temp\370032316Wsy.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
I will of course keep vigilant and I am still considering a NFO, but could you estimate how safe I can feel?
Last but not least, most of these sort of infections like to hide duplicates in other temp files, some of which may or may not be found by these individual pieces of scanning software. CCleaner will run in a few minutes and clean out any and all temp files, and you may want to run it's registry function as well.
Let us know how things turn out!
First, take my recommendations with a grain of salt. I realize I tend to be touchier about these subjects than most people, so YMMV when it comes to what I'm about to say:
The 'Registry Data Item Infected' item (Hijack.DisplayProperties) is pretty much a false-positive that the MBAM developers refuse to remove. You'll see that item on a fresh install of Windows 7.
The other two items are worrisome. It's very hard to make a judgement, but the fact that MBAM found a randomly named infected dll in your temp folder, and other A/V solutions did not, may indicate that you were in fact infected by something very nasty like a rootkit. MBAM may not have removed it all. These things get tricky sometimes, hiding multiple versions of different nasties on your system so that if one gets caught, the others will restore it. There's also the fact that these threats are being classified as 'Trojan.Downloader', which means that the bugs opened your computer up wide for all its friends.
If anything is lingering, then they keylogger that stole your password the first time might've watched you change it just now.
My recommendation is to back up all of your important files (preferably NON-exe, dll, or otherwise executable), reformat your drive, and perform a fresh install of Windows. When you're ready to restore your backed-up files, first scan the media with a good A/V solution and also MBAM. Torque Monkey's recommendation of Microsoft Security Essentials is a fantastic one. Once you've protected your reformatted system, this will let you remain pretty confident that you got the bug out.
Is it over the top? Maybe. But as it stands, if you contracted some kind of trojan, you effectively cannot trust your system any longer from inside your system.
If you simply can't suffer a reinstall, then grab a LiveCD with an up-to-date A/V suite, and scan after booting from the optical drive. At least then, rootkits can't hide very well.
I have installed Microsoft Security Essentials. I am installing the programs you recommended as I type, but Sunbelt's counterspy mentions active protection. I was under the impression that having several active virus protection programs would lead to security issues, will this program work together with MSE?
HijackThis if you do plan on attempting to save this installation will be critical, and it completely slipped my mind. I would run that and post a log for us to review.
edit: That is correct. However, it's not Anti-Virus software, it just does active monitoring of registry modifications/known malicious installations and will alert you. No harm in this one, but good thinking none the less!
I ran these programs, also in safemode, and got no hits using Sunbelt's Counterspy. Going to run HijackThis.
Edit: