Malwarebytes problem

[AdamZ]

I downloaded Malwarebytes because I was having a problem with Browser Hijackers, Trovi, Taplika and another. I ran the scan which found a bunch of threats including a Trojan horse. Malwarebytes quarantined the threats and I thought great that was that. WRONG!

Now I can't access the Internet on that computer. It has a good wifi connection and have tried on different networks but no joy. I have rebooted the router, deleted and reconnected to the network, and deleted Malwarebytes and rebooted all with no change. I still can't connect to the Internet. I've emailed support but don't expect to hear back for a few days. Anyone have any ideas?

 

[Lawreston]

I was having a problem with my online backup supplier; couldn't get into the backup to make any adjustments. The vendor told me they were having problems relative to Malwarebytes. They were working on the situation and that I should wait a few days. Nothing changed and I was advised to DELETE Malwarebytes as a trial. I did the delete; haven't had a backup problem since.

HR

 

[Cpt_Kirk]

Why would you quarantine the issue when you have the option to remove it?

 

[AdamZ]

Why would you quarantine the issue when you have the option to remove it?

Ted, it gave me a one click option to " remove" and it said something about quarantine. I clicked my one option.

 

[schmookeeg]

My go-to when my PC has been to digital thailand has been Combofix lately.

 

[txflyer]

Check your LAN controller DNS settings.

One of the Trojans may have changed it, and when you quarantined it, it crapped out.

 

[Mason]

When this happens to me, I go back to last week's ACRONIS backup. I then have to get any updates from the past week and reload my daily document backups.

 

[RJM62]

Check your LAN controller DNS settings.

One of the Trojans may have changed it, and when you quarantined it, it crapped out.

That, and also check to see if there's an empty proxy configuration (or any proxy, for that matter). Sometimes malware that gets deleted was forming part of the path to the Internet, for lack of an easier way to explain it. When the malware is deleted, you lose your connection.

Or just call me when you're in front of the computer, if you like. These things are usually easy to fix.

Rich

 

[BigBadLou]

Rich is onto something, the proxy might have been hijacked and is now broken.

FWIW, if I find a virus, malware or something "ungood" on a computer, I automatically reghost the system partition from a clean backup. Though I have not had to do that in a long time since I don't visit porn sites and blocked Fecesbook so that wife cannot pull a virus from there again.
Prevention beats intervention.

 

[AdamZ]

FWIW I think the hijack occurred from a few areas primarily from something on FB. My cursor went over a link but I did not click on it, then all of a sudden whoosh I was hijacked.

 

[txflyer]

You can try a system restore point to go back to when the computer was working if you use restore points.

 

[JimNtexas]

I've never understood why someone would fool with things like malwarebytes. If you have "a problem with Browser Hijackers, Trovi, Taplika and another" then there is one and only one way to fix the problem.

Reinstall Windows, and do like the Mac guys do and run from a non-admin account for the 95% of the time that you don't need admin privilege.

Always keep your Windows Updates current.

Use Microsoft Security Essentials.

Learn what 'system restore' is.

If you browser pops up a dialog box that babbles about security, or the FBI, or something KILL your browser with task manager (this goes for Macs also)! NEVER click any button on an unexpected dialog box emitted by a browser.

Do these things and your life will be happier.

 

[txflyer]

I've never understood why someone would fool with things like malwarebytes. If you have "a problem with Browser Hijackers, Trovi, Taplika and another" then there is one and only one way to fix the problem.

Reinstall Windows, and do like the Mac guys do and run from a non-admin account for the 95% of the time that you don't need admin privilege.

Always keep your Windows Updates current.

Use Microsoft Security Essentials.

Learn what 'system restore' is.

If you browser pops up a dialog box that babbles about security, or the FBI, or something KILL your browser with task manager (this goes for Macs also)! NEVER click any button on an unexpected dialog box emitted by a browser.

Do these things and your life will be happier.

Unnescessary unless the system is totally hosed and you can't login or boot up.

Do you know what a pain it is to re-install windows? It takes a better part of three days after you re-install all the updates and re-start 50 times.

Malwarebytes is THE spyware program that many IT techs turn to when no other spyware program will get the job done. The problem isn't malwarebytes, it's something else that MWB found and nuked.

 

[RJM62]

Unnescessary unless the system is totally hosed and you can't login or boot up.

Truly, and even then I've fixed a few. You can do wonders to resurrect Windows with ERD or a live Linux distro. More often than not the problems that prevent booting are malware, registry issues, or corrupted files, all of which usually can be fixed in a bootable environment.

In my entire career, I'm pretty sure that I've reinstalled Windows because I had to fewer than a dozen times. I've done it other times because it was the easiest and/or cheapest way to fix a problem on a machine that had nothing important on it, anyway; but fewer than a dozen times because I couldn't fix whatever the problem was that was ailing Windows.

Rich

 

[txflyer]

Truly, and even then I've fixed a few. You can do wonders to resurrect Windows with ERD or a live Linux distro. More often than not the problems that prevent booting are malware, registry issues, or corrupted files, all of which usually can be fixed in a bootable environment.

In my entire career, I'm pretty sure that I've reinstalled Windows because I had to fewer than a dozen times. I've done it other times because it was the easiest and/or cheapest way to fix a problem on a machine that had nothing important on it, anyway; but fewer than a dozen times because I couldn't fix whatever the problem was that was ailing Windows.

Rich

An old simple understanding of DOS and the old commands like C:\chkdsk ran under an administrator prompt will fix 90% of windows problems. Of coarse, you need to be able to boot in.

Otherwise, you need Linux or Ubuntu or some other OS.

Re-installing windows is like getting divorced and re-married. I only do it as a very last resort. I'm surprised that thousands of talk board help suggestions will quickly say "just re-install windows." ... it's a major PITA... and you lose EVERYTHING.

 

[AdamZ]

First off a HUGE Thanks to Rich, for walking me though this on the phone. It does seem the malware somehow inserted itself into my browsers conduit to the internet and when Malwarebytes nuked the malware it also took out that section of the conduit which the malware installed, sort of like cutting a section of pipe out. It is insidious stuff.

The only fix we could come up with was to to a system restore to earlier in the month but even after that I had to uninstall and reinstall chrome. Thanks again Rich for all your assistance!!!

 

[txflyer]

First off a HUGE Thanks to Rich, for walking me though this on the phone. It does seem the malware somehow inserted itself into my browsers conduit to the internet and when Malwarebytes nuked the malware it also took out that section of the conduit which the malware installed, sort of like cutting a section of pipe out. It is insidious stuff.

The only fix we could come up with was to to a system restore to earlier in the month but even after that I had to uninstall and reinstall chrome. Thanks again Rich for all your assistance!!!

You were getting a DNS re-direct I'll betcha....

I've had good luck running Google's free open DNS setting 8.8.8.8 and 8.8.4.4.

I don't care if they log what I'm looking at, every DNS server does...

 

[RJM62]

First off a HUGE Thanks to Rich, for walking me though this on the phone. It does seem the malware somehow inserted itself into my browsers conduit to the internet and when Malwarebytes nuked the malware it also took out that section of the conduit which the malware installed, sort of like cutting a section of pipe out. It is insidious stuff.

The only fix we could come up with was to to a system restore to earlier in the month but even after that I had to uninstall and reinstall chrome. Thanks again Rich for all your assistance!!!

My pleasure, Adam.

Rich

 

[RJM62]

You were getting a DNS re-direct I'll betcha....

I've had good luck running Google's free open DNS setting 8.8.8.8 and 8.8.4.4.

I don't care if they log what I'm looking at, every DNS server does...

No, the machine had Internet and good DNS. It was just the Web browsers that couldn't connect. Whatever installed itself had done so as a Web proxy.

Once we figured that out, System Restore was the easiest and fastest way to fix it.

Rich

 

[AdamZ]

Next step is getting a decent fire wall

 

[RJM62]

My favorite Windows security products at the moment are still the ESET line. That could change, of course: It seems like security vendors all have their golden age. I've used most of them, and they were all good at some point. Then they go downhill.

But I've been using ESET for more than four years. That's a record for me. It's stopped me dead in my tracks more than once when I was about to visit sites that had been compromised. I remain impressed.

Rich

 

[jesse]

I've never understood why someone would fool with things like malwarebytes. If you have "a problem with Browser Hijackers, Trovi, Taplika and another" then there is one and only one way to fix the problem.

Reinstall Windows, and do like the Mac guys do and run from a non-admin account for the 95% of the time that you don't need admin privilege.

Always keep your Windows Updates current.

Use Microsoft Security Essentials.

Learn what 'system restore' is.

If you browser pops up a dialog box that babbles about security, or the FBI, or something KILL your browser with task manager (this goes for Macs also)! NEVER click any button on an unexpected dialog box emitted by a browser.

Do these things and your life will be happier.

Agree.

Malware can certainly be removed, but you really have no idea what the hell might have taken place on your system and what could be left after it's removed.

If you're security conscious and your data really matters you nuke it and start over regardless of how skilled you are at removing the crap.

Typically the thought process is this....You're machine was vulnerable, software was installed that modified the system with administrator credentials, you know the box is hacked. You can always "think" you removed something but the reality is it's pretty damn impossible to know for sure. Too big of a liability if the data is something you can get sued over.

It's impossible to know what it did without major forensics efforts and even then you don't know for sure. It could have modified any piece of the system, any library, or any piece of any software installed.

Of course..typically...it was a pretty known thing that only did X..but you never know. There is no automatically detecting this stuff, or automatically coming up with a removal routine, there's only detecting what was a known piece of malware and then writing a way to remove it. It can easily be a variant that did something else as well or be the original that was poorly studied by the guy that wrote the removal code. Also possible *OTHER* pieces of malware got on the system via the same path that aren't even known and therefore won't ever be detected until it gets to be mainstream enough.

Most likely you're fine. But most likely is the only guarantee you can get.

 

[bflynn]

My memory of these is that there is usually
A) one or more programs installed. If you merely remove them, they come back
B) one or more rogue programs being run through srvhost,exe or windll32.exe.
C) some kind of bootstrap/root kit virus that is actually not on your c drive.

It's very rare to have a virus embedded in a system dll file anymore.

Check your running processes for anything that looks suspicious. If you verify a bad process here, search and destroy in the registry...but be sure.

Check the registry for anything starting when you log in.

Where else are they hiding thins? It's been a while since I've dealt with anything serious.

 

[catmandu]

Sort of on topic: What is it that steals folk's contacts and then sends a generic "check this out: <link>" message with their display name but a false return? It would be nice to let them know something more specific when I get these rather than "Your email has been compromised."

 

[Heftiger]

Agree.



Malware can certainly be removed, but you really have no idea what the hell might have taken place on your system and what could be left after it's removed.



If you're security conscious and your data really matters you nuke it and start over regardless of how skilled you are at removing the crap.



Typically the thought process is this....You're machine was vulnerable, software was installed that modified the system with administrator credentials, you know the box is hacked. You can always "think" you removed something but the reality is it's pretty damn impossible to know for sure. Too big of a liability if the data is something you can get sued over.



It's impossible to know what it did without major forensics efforts and even then you don't know for sure. It could have modified any piece of the system, any library, or any piece of any software installed.



Of course..typically...it was a pretty known thing that only did X..but you never know. There is no automatically detecting this stuff, or automatically coming up with a removal routine, there's only detecting what was a known piece of malware and then writing a way to remove it. It can easily be a variant that did something else as well or be the original that was poorly studied by the guy that wrote the removal code. Also possible *OTHER* pieces of malware got on the system via the same path that aren't even known and therefore won't ever be detected until it gets to be mainstream enough.



Most likely you're fine. But most likely is the only guarantee you can get.

File integrity checking does exactly this. However you have to have already been doing the integrity checks before the compromise to have a baseline for what changed.


Sent from my iPhone using Tapatalk

 

[jesse]

File integrity checking does exactly this. However you have to have already been doing the integrity checks before the compromise to have a baseline for what changed.


Sent from my iPhone using Tapatalk

Right which nobody on a typical desktop is doing nor is it a practical solution for anyone that's not an expert as they'll have no clue what they're looking at as there will be constant change. You also have to carefully arcitect things to make it very difficult for anybody to dick with your file integrity database or the integrity system itself. The devil is in the details.

File integrity has its place but unless you know what you're doing you're likely to just ignore it all.

 

[RJM62]

Sort of on topic: What is it that steals folk's contacts and then sends a generic "check this out: <link>" message with their display name but a false return? It would be nice to let them know something more specific when I get these rather than "Your email has been compromised."

The specific malware type could be anything. Trojans, worms, true viruses, scripts embedded in chain letters... I'd guess that most are Trojans, but that would just be a guess. I'm not as current on bleeding-edge malware as I used to be, back when most of my days began by reviewing what nasty stuff had come out since I'd gone to bed the night before.

Rich

 

[denverpilot]

That, and also check to see if there's an empty proxy configuration (or any proxy, for that matter). Sometimes malware that gets deleted was forming part of the path to the Internet, for lack of an easier way to explain it. When the malware is deleted, you lose your connection.

Or just call me when you're in front of the computer, if you like. These things are usually easy to fix.

Rich

Ungggggh. I spent a couple hours getting rid of one of those on a work PC about a month ago. So much for the expensive protection software. That little bastard made changes in the registry to hijack DNS too.

Manifested itself by breaking the UPS shipping application which is not really an application, it's just a crappy wrapped around a browser window that you can't change the settings on. Even cleaning up the main browser didn't stop this little pain in the ass.

I'd have flattered the machines and just reloaded it if it did anything important. It's just a shipping label box. I found all sorts of crap where the two people who use it were browsing to various arts and crafts sites for cross-stitching and a bunch of malware infested freeware for getting "Free cross-stitch patterns! Just install our evil crap, grandma, so we can grab all your bank account info."

There was also a crap ton of sports applications for sports news on it. Because you know, typing in espn.com is hard. LOL.

Someone had given the ladies who usually use this machine the local admin password for the machine to avoid having to go type it for them for certain software updates or figuring out a smarter way to handle said updates.

If I'd have known that and how long clearing out one of these damn things takes, I'd have made him go clean it up.

And this kids, is why we can't have nice things. Ha. Signed, Grumpy Bastard Sysadmin.

 

[gkainz]

BOFH ...