Mistery Infiltration And Bdts 2010 Corruption

G'Day Folks,

Have this issue with "URL's in browsers redirected and BD with Proxy issue not updating" Using BDTS 2010 which was all working until this strange behavior started.

I take great care with UR"s and general browsing, going to places I need to and no other. I use either Firefox 3.6 or IE8 depending on what I am doing.

12 days ago I noticed an issue with Firefox when loading a Hyper-link from the MS Outlook 2007 which popped up an error regarding that it could not load the link, however opened it anyway, so I just closed the error message and continued. Note that this load error did nor occur if I had IE8 as the default Browser.

I investigated this and completely un-installed Firefox, cleaned it out and reloaded a fresh installation and slow,y put back the Add-ons, all seemed to go well and then after not coming up with any issues for 3 days, the same problem came back.

Then 3 days ago when I performed a Google search using either IE8 or Firefox, and clicking on any item in the search result, it took me to other than the designated site of the item and continued to do so while clicking the back one page button until finally after 2 or 3 attempts it went to the correct site.

Obviously I performed a virus scan with BDTS which showed no infected files.

Re-booted

Not giving up I performed a Ad-Aware scan, showing only Cookies.

Re-Booted

Then performing a Spybot S&D, it showed 1. Trojan.FakeAlert, and Rootkit.TDSS which it removed.

Re--booted

The performed a Malwarebytes scan, when all ###### broke loose with multiple entries of Trojan.FakeAlert, and Rootkit.TDSS and Trojan.Downloader and Malware.Packer.Gen - which it then got rid of and I removed any item in quarantine.

Re-Booted

Then used Spyware Terminator - no issues detected

Re-Booted

Then used SUPERAntiSpyware which detected 1 Trojan.Dropper/Win-NV in C:\WINDOWS\MSA.EXE and removed it for me.

Re-Booted

NB: Only the BDTS 2010 is running as a resident program, no other Scanners have any part of their resident programs running and are used to scan for parasite issues only when needed or for checking.

Now since the 11th Feb - 3days ago, the updater on BDTS2010 stopped working, and all the other program and utility updater's also stopped performing their updating, either automatic or manually attempting to do so.

Windows and Microsoft Updater want to load IP 77.14.205.100 and then fail. Google suggesting in pop-up that the link may be broken. Typing in the URL brings up the same error.

To say I may have gotten hijacked is an understatement.

So Folks, who is the expert in finding the cause of the problem and a fix for the issues.

What procedure do we follow and what do you want me to do ?

Regards

pcbugfixer

Find more posts tagged with

Comments

alexcrist

Hello pcbugfixer,

Please read this article: http://kb.bitdefender.com/KB490

Generate the logs as described there, upload them on a file sharing server of your choice (like www.sendspace.com) and send me a PM with the download link.

Cris.

pcbugfixer

G'DAy Chris,

The BDSI.zip goes to the "http://www.bitdefender.com/site/Main/contactEmail" page and does not download the zip file, do you have another link for it ?

I got the GMER.zip, no problem.

Regards

pcbugfixer

alexcrist

Thank you for pointing that out. I will announce that broken link.

In the meantime, this is the link: http://www.bitdefender.com/files/KnowledgeBase/file/BDSI.zip

Cris.

pcbugfixer

G'Day Chris,

Need answers to my PM's please

GMR has been scanning for 45+ minutes so far - what is essential to you ?

pcbugfixer

alexcrist

I replied to your messages. I'm looking forward for your logs.

pcbugfixer

G'Day Chris,

Thanks for the replies to my PM's.

However I seem to have a Security Policy issue in that I cannot release any files until we can ratify the content as not to be in breach of our Security Policy.

The gmer.log took 2:45 hours to compete and for what it contains it seems to have taken a long time to generate so little information.

Now to the "bd_sys_log.xml" or the situation with the "bd_sys_log.xml.zip" files.

1. The "bd_sys_log.xml" when trying to open it with IE8 comes up with this error

"The XML page cannot be displayed

Cannot view XML input using XSL style sheet. Please correct the error and then click the Refresh button, or try again later.

--------------------------------------------------------------------------------

System error: -2146697211. "

Obviously we have other means to look at the content, so we are sending you the files (location download link) for download in a PM.

Files have been uploaded and PM sent.

pcbugfixer

alexcrist

The gmer.log took 2:45 hours to compete and for what it contains it seems to have taken a long time to generate so little information.

gmer is an extremely powerful rootkit detector. Rootkit scanning take a long time, especially if you run it on large partitions. The larger the partition is, the longer it will take to fully scan it.

1. The "bd_sys_log.xml" when trying to open it with IE8 comes up with this error

You get that error because the log is meant to be viewed with a XSL interpreter (private). You can view the log as plaintext (in any text/XML editor), but you cannot view it in a browser or automatic XML parser/interpreter.

The logs do not contain any private information. All info stored in these logs are only directed to BitDefender Labs and are processed as confidential. BitDefender has it's own security policies, according to which no information from such logs will be made public in any way.

I will forward the logs for analysis. As soon as I get a reply, I will get back to you.

Cris.

pcbugfixer

G'Day Chris,

Yes, we gathered that and used the correct editor for the file.

OK, we will wait, although I have another issue with the development team and have been waiting since 18th January for a fix, so I won't hold my breath.

pcbugfixer

G'Day Chris,

Quick question - How long is this going to take ?

I have 2 Workstations with BDTS 2010 issues and need this (Sys03) to work as it is the main workstation.

pcbugfixer

Cristi Raducu

Hello pcbugfixer,

Use GMER to retrieve c:\trash\rx1.exe

For this you need to go in GMER,press the >>> tab and under the Files tab.

Password protect the file and send it to me by PM.

Thank you.

pcbugfixer

G'Day Cristi Raducu,

When this came up BD stopped it and when I ran the CCleaner it deleted it.

However I will run a Recovery for the file on the HDD to see if it is posible to retrieve it.

Back Soon.

pcbugfixer

More info on rx1.exe

Lineage Trojan and rx[1].exe

Just in case I cannot retrieve it.

pcbugfixer

G'Day Cristi Raducu,

The rx1.exe file you requested is not on the HDD any more !

BTW. Attempting to manually install the Weekly.exe fails with the error message "The installer has insufficient privileges to install this file: C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\av32bit_16995\Plugins\TBD11.tmp"

Please let me know asap if this looks like being able to be fixed - Thanks

pcbugfixer

Cristi Raducu

The lab team also recommended a scan with the rescue CD.

I have sent you an email with full instructions on how to create it and scan the PC.

pcbugfixer

G'Day "Chris" and "Cristi Raducu"

Valiant effort with the BD Rescue CD, which after scanning system 3 with 17,895,253 (yes 17 million .....) files taking 19+ hours it detected old .pst infected emails (why did it not detect them previously ??) which it failed to remove as well as other key files on the other 5 HDD's which it also failed to remove. These however did not effect the operation of the C: drive and Operating system.

It did for some reason detect a corruption the the nvgts.sys file (nVidia driver) in the c:\windows\system32\drivers - folder and did remove it. This then meant that the XP did not boot because it had this driver missing and after replacing it from my driver backup folder on another drive, the system then booted correctly.

The BAD News is that all this did NOT fix the update issue for any application software.

I will un-install BDTS and attempt to re-install it to see if that fixes the problem, if not I will restore the partitioon from an older Image, however this just is a lot more work with updating etc.

BTW: I also ran the Rescue CD on System 4, same story except it did not detect any fault with the nvgts.sys driver and booted normally.

Any other Braincells ??

pcbugfixer

alexcrist

Hello,

Just a small side-question: I'm not saying that this is the case, but are you sure the problem is not outside the questioned systems? Maybe the redirect/blockage is made from within the network (maybe on the DNS server/Gateway, or from another system in the same network through ARP poisoning)?

There are methods of monitoring/redirecting traffic and network requests within a network without actually infecting the system. Other systems in the same network behave normally?

Also, could you send me a PM with the addresses/IPs to which you are being redirected? Maybe they will shed some light on this situation.

Cris.

pcbugfixer

Thanks for the suggestion Chris,

However after un-installing BDTS 2010, half my problems just went away and the browsers are no longer going elsewhere and are loading the designated URLs in the hyper-links.

Some application updater's are not working yet some have re-established themselves.

The system by now is in an unreliable state so I will test and re-install BDTS 2010 just to see what occurs and to see the affects.

Otherwise I will be re-installing an older image for the XP Partition.

pcbugfixer

Thanks Cristi,

I'm back in business, all seems to be working again

Restrictive PM does not allow me to correct the URL I sent you in my last message. Just type it in with spaces as in the PM - Thanks

pcbugfixer

Bad news.

Did I say "Valiant effort with the BD Rescue CD" well it was from the initial reaction and superficial glance to the 2 main issues that were involved, i.e. the URL and updater's problem.

They got fixed, however now I am faced with other problems where, the other Workstations cannot log-onto system 3 (this PC) and cannot find the network printer, and other applications needed to be re-loaded having only tried 7 so far of another 76 .... which in fact means that it is not worth persisting in attempting to re-establish this current setup.

Looks as though the exercise itself caused more damage by taking out (nulling) applications and the system is no longer reliable !

Back to the drawing board. - I will go back and try different images and hope that I do not have any more issues with the BD Keys.

pcbugfixer