Security Suite Virus?

I've had Bitdefender for around a month now, but last night while browsing the web I got slammed by a fake virus scanner. There's an unfamiliar icon mounted in my system tray called "Security Suite" when I hover over it. A UI pops up every 5 minutes or so and it pretends to scan my system, then randomly webpages will open up trying to get me to buy this bogus antivirus software. When I try to open web browsers (I use firefox) my browsers get hijacked and blocked saying "This website has been blocked due to malicous software - click here to fix." Every time I try running a command, example being Task Manager, it just flickers and an error window pops up trying to redirect me to the same site.

I ran the deep scan option in bitdefender right away, but found nothing. The most recent update was on 8/23/10. I also tried restarting the computer in Safe Mode with Networking, but even then my browsers are disabled and I can't connect to the bitdefender servers.

I'm running out of ideas here.. any help?

Find more posts tagged with

Comments

Cristi Raducu

Hello Loks,

Please post a quick scan report here,the infected file/s can be easily identified in that log.

http://quickscan.bitdefender.com/en/virusscan/

Loks

Thank you for the quick reply! I'll try running the scan later on at home though, but I'm not sure I'll be able to... even though my computer is connected to the internet the virus keeps me from being able to use Internet explorer or Firefox (The pages pop up blank with an error message that tries to redirect me to the bogus AV website). The internet is pretty much unaccessable at this point. I've tried opening MSconfig and disabling all the start up applications but to no avail. Any ideas?

Cristi Raducu

You must check the following 3 settings to make the Internet work properly:

1. Most of the times the virus will hijack your DNS server so you need to go to:

Start ->Run (or Ctrl+R) and type: ncpa.cpl to open the network connections.

Right click on your LAN connection and go to -> Properties ->double click TCP/IP v4 -> in here check that your DNS is on automatic.

If the DNS is on manual make sure those IP's are from your ISP.

2. The virus tries to hijack the browser by entering an invalid proxy server.

To check this you need to go in Control Panel -Internet Options ->Connections tab->LAN Settings and in here disable Use a proxy server option.

3. The virus will hijack the hosts file.

In the Run box type: C:\Windows\System32\Drivers\etc and OK

Locate the hosts file,open it with Notepad (right click -open with) and post here the content to see if you need to make any changes.

Loks

My internet browsers were set to a proxy server, so I disabled it and was able to use the web browser again. After performing the quick scan you suggested, no threats were found. Here's the log:

QuickScan Beta 32-bit v0.9.9.23

-------------------------------

Scan date: Mon Aug 23 14:32:58 2010

Machine ID: CCE1A9BD

No infection found.

-------------------

Processes

---------

<verified> Firefox 4836 C:\Program Files (x86)\Mozilla Firefox\firefox.exe

<verified> Microsoft Search Client Server 4908 C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SCServer\SCServer.exe

<verified> Radmin 3208 C:\Windows\SysWOW64\rserver30\FamItrfc.Exe

Network activity

----------------

Process firefox.exe (4836) connected on port 80 (HTTP) --> 66.102.7.104

Process firefox.exe (4836) connected on port 80 (HTTP) --> 24.143.207.130

Process firefox.exe (4836) connected on port 80 (HTTP) --> 96.6.60.20

Process firefox.exe (4836) connected on port 80 (HTTP) --> 74.125.19.113

Process firefox.exe (4836) connected on port 80 (HTTP) --> 66.235.142.20

Process firefox.exe (4836) connected on port 80 (HTTP) --> 96.6.53.115

Autoruns and critical files

---------------------------

<verified> Microsoft® Windows® Operating System c:\windows\system32\browseui.dll

<verified> Microsoft® Windows® Operating System C:\Windows\system32\userinit.exe

<verified> Windows® Internet Explorer c:\windows\syswow64\webcheck.dll

Browser plugins

---------------

<unsigned> Silverlight Plug-In c:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll

<verified> AcroIEHelper Library c:\program files (x86)\common files\adobe\acrobat\activex\acroiehelper.dll

<verified> BitDefender QuickScan C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\r2kyuwll.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

<verified> BitDefender QuickScan C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\r2kyuwll.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

<verified> Google Toolbar for Internet Explorer c:\program files (x86)\google\google toolbar\googletoolbar_32.dll

<verified> Google Update C:\Program Files (x86)\Google\Update\1.2.183.13\npGoogleOneClick8.dll

<verified> GoogleToolbarNotifier c:\program files (x86)\google\googletoolbarnotifier\5.5.5126.1836\swg.dll

<verified> Java Platform SE 6 U20 c:\program files (x86)\java\jre6\bin\jp2ssv.dll

<verified> Microsoft Search Enhancement Pack c:\program files (x86)\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll

<verified> Microsoft® Windows Live ID c:\program files (x86)\common files\microsoft shared\windows live\windowslivelogin.dll

<verified> Microsoft® Windows® Operating System C:\Windows\System32\mswsock.dll

<verified> Microsoft® Windows® Operating System C:\Windows\system32\napinsp.dll

<verified> Microsoft® Windows® Operating System C:\Windows\system32\NLAapi.dll

<verified> Microsoft® Windows® Operating System C:\Windows\system32\pnrpnsp.dll

<verified> Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll

<verified> Mozilla Default Plug-in C:\Program Files (x86)\Mozilla Firefox\plugins\npnul32.dll

<verified> MSN® Toolbar c:\program files (x86)\msn toolbar\platform\4.0.0401.0\npwinext.dll

<verified> NPSWF32.dll C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

<verified> Windows Presentation Foundation c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll

<verified> Windows® Internet Explorer c:\windows\syswow64\ieframe.dll

Missing files

-------------

File not found: "c:\program files\bitdefender\bitdefender 2010\antispam32\ietoolbar.dll"

referenced in: HKCR\CLSID\{381FFDE8-2394-4f90-B10D-FC6124A40F8C}\InprocServer32\(default)

Scan

----

<unsigned> MD5: ff686c4620b646773c8181f1c7c5101c C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

<unsigned> MD5: 2cb7c019a1ab8ea3d281c9606d097331 c:\Program Files (x86)\Microsoft Silverlight\4.0.50524.0\npctrl.dll

<unsigned> MD5: 10bed437023f93dd1ad8efa80e71280f C:\Program Files (x86)\Mozilla Firefox\freebl3.dll

<unsigned> MD5: dce543b6b3ff516bd65c1030e4b933ff C:\Program Files (x86)\Mozilla Firefox\nssdbm3.dll

<unsigned> MD5: 222afed911cbf5f9a454adee53d31b30 C:\Program Files (x86)\Mozilla Firefox\softokn3.dll

<unsigned> MD5: a88262e674d8589b3187a5d8ff75337b C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_53\plugin_base.m32

<unsigned> MD5: 2243e07d3e9e04dc5be9a6f69aa5946c C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_53\plugin_extra.m32

<unsigned> MD5: 51ece9775171f98d01eba048ebfe4fbd C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_53\plugin_fragments.m32

<unsigned> MD5: c9ed8e79c5adfe0f3bd7680a32b84153 C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_53\plugin_net.m32

<unsigned> MD5: 33feb3706f9ff8eaab0feeb431ca86dc C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_53\plugin_nt.m32

<unsigned> MD5: 95048b324c3a82a3b5398948e968b29b C:\Program Files\BitDefender\BitDefender 2010\Active Virus Control\midas64-v2_53\plugin_registry.m32

<unsigned> MD5: c23cd74a7bbd0708955207c8fde39867 C:\Program Files\BitDefender\BitDefender 2010\Antispam32\bdaphcl.dll

<unsigned> MD5: d80f660c30c18c6fb044129e54a237ee C:\Program Files\BitDefender\BitDefender 2010\Antispam32\bdguictl.dll

<unsigned> MD5: 61d3f01351ebce4dc2434f868f330b1c C:\Program Files\BitDefender\BitDefender 2010\Antispam32\bdutils.dll

<unsigned> MD5: 097b35761cf861edc6bb6750b98977b3 C:\Program Files\BitDefender\BitDefender 2010\Antispam32\ENU\bdaphcl.ui

<unsigned> MD5: 04567f20e5828bcf951bcae4644047a4 C:\Program Files\BitDefender\BitDefender 2010\Antispam32\ENU\bdguictl.ui

<unsigned> MD5: 0e7f16a170cc1faa0830ebde09c9ac77 C:\Program Files\BitDefender\BitDefender 2010\Antispam32\npcomm.dll

<unsigned> MD5: 1658f2cdece6b74be1d1ba0b1717c47d C:\Program Files\BitDefender\BitDefender 2010\Antispam32\productinfo.dll

<unsigned> MD5: 16f9a2dfbe5c1185d7e5280e3d9682ed C:\Program Files\BitDefender\BitDefender 2010\Antispam32\txmlutil.dll

<unsigned> MD5: 8dd193953b7924df74ca3df585a05267 C:\Program Files\BitDefender\BitDefender 2010\Antispam32\txmlx.dll

<unsigned> MD5: 95282c70e03d10b20f218213a0c09453 C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff2.dll

<unsigned> MD5: 3ea4af010605bcbb9df43eae3aa275fe C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff3.6.dll

<unsigned> MD5: fd9893a764b7337f7bd78e674bee6583 C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\components\bdaphff3.dll

<unsigned> MD5: cc0f90969c8c951217b53eb6a4487328 C:\Program Files\Common Files\BitDefender\BitDefender Threat Scanner\scan.dll

<unsigned> MD5: 4d06d9a26227ac485305133916888df1 C:\Program Files\GATEWAY\Gateway Recovery Management\Service\ETService.exe

<unsigned> MD5: a094effbb91ba2002f815340eda30890 C:\Windows\SysWOW64\rserver30\wsock32.dll

No file uploaded.

Scan finished - communication took 2 sec

Total traffic - 0.01 MB sent, 0.12 KB recvd

Scanned 228 files and modules - 16 seconds

==============================================================================

Host file:

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

# For example:

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

::1 localhost

-----------------------------------------------------------------------------------------------------

The only way I was able to access any of these options was using MSconfig and disabling all start up applications... when they're still on my computer is useless.

Loks

Even with the internet freed up, bitdefender able to update, the scans don't pick up any infected files. It's obviously a start up program that has something to do with it, so I went down the list of start up applications to see if which ones seemed to not belong. Anywho, I found an .EXE file that was created around the time that my computer started acting up, located in a folder in my application data. I tried google'ing it first to make sure it wasn't a critical windows program.. google search turned up nothing for it. I deleted it, and after allowed my start up apps to start again the fake viruscanner UI went away along with the system lock ups.

I still don't think this has solved the issue, though. Now when I try to use google (in firefox or IE) the page looks fake, and if I try to search something it gives me an error saying google can't complete the task (looks like another bogus page). The only way for me to bypass it is to get the firefox home version of google so that I can complete searches. Any ideas?

Cristi Raducu

The log doesn't show anything suspicious,most likely because the log was created on a 64 bit system.

Please send me by PM a BDSI and a GMER log as described in this article:

http://www.bitdefender.com/KB490-en--The-s...s-infected.html

If you encounter problems attaching the logs by PM,you can upload them on a server such as www.sendspace.com and send in only the download links.

The hosts file you posted is clean.

Loks

After searching the internet for possible leads on more information, I came across this:

http://deletemalware.blogspot.com/2010/08/...te-malware.html

This site gives in depth information about what kind of malware this is, what registry keys are effected, and how to go about removing it. The only problem now is that it suggests using alternate malware programs such as rkill and spyware doctor. Is it safe to use this programs while I have bitdefender installed or is that a potential problem?