VIRUS WARNING - ADOBE READER "Error" - DO NOT CLICK "OK"

quoia

My PC got nailed by a trojan/virus whatever yesterday (Tues lunchtime).

Searching the net for details and fixes revealed the same or a very similar intrusion appears to be affecting a lot of people recently and some MSEers have reported exactly the same in this very forum.

It didn't trash any data but was rather alarming at the time.
It PRETENDS TO BE an ANTI VIRUS program that is finding all sorts of trojans & viruses & worms all over the place when in fact they don't exist.

The "AntiVirus" pop-up report etc. is in fact the VIRUS itself and it keeps trying to get you to PURCHASE the program that is "finding all these infections".

Once "installed and active" this VIRUS WILL STOP YOU OPENING and/or RUNNING ANYTHING AND EVERYTHING.
Constantly reports that whatever you are trying to do is "INFECTED"

This was by far the best I found on the net that helped
http://deletemalware.blogspot.com/2010/01/how-to-remove-antivirus-soft-fake.html

and this specific reply from Admin (renaming a file in safe mode - mine was "tpmhsftav.exe" in a folder called USUMBO) at least got me back into my PC -
http://deletemalware.blogspot.com/2010/01/how-to-remove-antivirus-soft-fake.html?showComment=1265571242755#c7239415925490093491
and I eventually decided to roll-back my PC to a restore-point on Sunday before the "infestation" occurred.

It appears that this virus has still penetrated and infected PCs considered to be very secure with up-to-date virus scanners checkers and robust firewalls etc.
And I'd have considered mine well protected.

Anyway - and the real point of this post.
Until a little while ago I couldn't remember anything out of the ordinary about yesterday - my PC was OK - THEN IT WASN'T !

Afterwards, when I'd searched the web for the KAKA virus (KAKA appeared in a PATH when I right-clicked & displayed properties on a virus pop-up) I found a fair bit on what I'd call the KAKA 2009 variant (bit less problematic), it appeared that an ADOBE Window maybe had been involved and had appeared before all the problems started.

Since my virus appeared to be KAKA 2010 I never put too much thought into it until THIS AFTERNOON (Wed) - IT HAPPENED AGAIN !!

WELL VERY NEARLY (not quite as bad) anyway - I just managed to intervene and control the situation to some degree.

An ADOBE WINDOW popped up - and I remebered seeing exactly the same one yesterday

Adobe Reader

<i> A3D data parsing error has occurred
..................................................................[OK]

Yesterday I just clicked on the OK button without even thinking about it.
My problems I'm now absolutely sure started a short while afterwards.

Today I DID NOT CLICK THE OK BUTTON !!!!

I opened up TASK MANAGER instead.
I found a process I'd never seen before and it had the the highest and newest PID - also the IMAGE NAME "tied in" with the Adobe window message
It was called A3DUTILITY.EXE

I checked on the web and there were reports of it's involvement in exactly the sort of virus problems I had yesterday
So I selected A3DUTILITY.EXE and hit END PROCESS

I thought (mistakenly) that that might be the end of it.
Nothing happened for a few minutes but then it started again.
Odd things happening, not working etc. FORTUNATELY my TASK MANAGER was OPEN (yesterday couldn't start it so could'nt kill any processes)
There it was AV.EXE

Killed it but my PC just wasn't 100% - after a while it reappeared & I killed it again, & again, & again etc. etc.

So I'm now back up and functioning having gone back to the SYSTEM RESTORE point on Sunday 15th for the SECOND TIME !!!

I'm still rather concerned where this is coming from and how it is getting in.(and how to stop it happening again)
Today when it happened (relatively soon after my 1st restore to Sunday), apart from visiting MSE I had done nothing else that I can remember, not even opened an email.
Definitely not been to any dodgy website - it's almost as though it's just infiltrated my PC because I'm connected to the net.

ANYWAY - just hope this helps somebody either avoid the problem or get out of it if it's already struck!

aliEnRIK

Using system restore wont remove the problem (In fact its probably recreating it)

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Post the COMPLETE log here AFTER youve deleted everything it finds

reboot
Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

quoia

Thanks for the advice etc. RIK

I'm using another PC just for the moment since something is definitely not right with the original.
I tried as you suggested.

MALWAREBYTES found nothing wrong

HiJackthis produced

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\CSHelper.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\3\3Connect\AutoUpdateSrv.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\MDMA\mdma10028\mdma.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - s - (no file)
O2 - BHO: (no name) - SlimBho2.dll' - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Orbiscom - {D81AB57B-7327-4347-B7C7-9EF7CA87CE09} - C:\WINDOWS\system32\SlimBho2.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [CahootWebcard] C:\Program Files\cahoot webcard\CahootWebcard.exe /dontopenmycards
O4 - HKLM\..\Run: [O2Start] C:\Program Files\O2CM-CE\O2 Connection Manager\tscui.exe /s
O4 - HKLM\..\Run: [XoftSpySE] "C:\Program Files\XoftSpySE6\XoftSpySE.exe" -NM -hidesplash
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [NokiaMusic FastStart] "C:\Program Files\Nokia\Nokia Music\NokiaMusic.exe" /command:faststart
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Update Agent.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{37C11E0D-E96C-4B7A-84CB-485CB8FF2C17}: NameServer = 141.1.1.1 195.27.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\WINDOWS\system32\CSHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: XoftSpyService - ParetoLogic Inc. - C:\Program Files\Common Files\XoftSpySE\6\xoftspyservice.exe

My current problem is that the PC is running really really SLOW.

It can take 10 or 15 minutes just to open up a window (eg IE or Notepad etc.) and it's almost impossible to do anything.

What I have found out is that is that one of my SVCHOST.EXE (User name SYSTEM) processes is taking up to 95% of the CPU usage most of the time (and rarely drops below 50% at the very best).

I have seen that this can be associated with a virus/trojan/spyware etc. whatever attack and I eventually managed (took over an hour to run) to get a TASKLIST /SVC run to see what was happening and any clues to the problem.

The SVCHOST in question was running

AudioSrv
BITS
CryptSvc
Dhcp
dmserver
ERSvc
EventSystem
FastUserSwitchingCompatibility
helpsvc
lanmanserver
lanmanworkstation
Netman
Nla
RasMan
Schedule
seclogon
SENS
SharedAccess
ShellHWDetection
srservice
TapiSrv
Themes
TrkWks
W32Time
winmgnt
wscsvc
wuauserv
WZCSVC

sadly I've not had too much time today to pursue this further but I'm guessing something isn't kosher

Any thoughts ?

aliEnRIK

TICK and FIX these ~
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - s - (no file)
O2 - BHO: (no name) - SlimBho2.dll' - (no file)
O4 - HKLM\..\Run: [XoftSpySE] "C:\Program Files\XoftSpySE6\XoftSpySE.exe" -NM -hidesplash
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

The XoftSpySE6 is the main problem you have that I can see so far


You have a couple of items that concern me ~
Slimbho2.dll - Orbiscom Online Secure Payments, http://www.orbiscom.com/products/ocard.h tml
O4 - HKLM\..\Run: [CahootWebcard] C:\Program Files\cahoot webcard\CahootWebcard.exe /dontopenmycards

Are you sure theyre legit?



Please open malwarebytes and goto LOGS and please tell me the DATABASE VERSION the MALWAREBYTES VERSION and which operating system you have


then ~
Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be)
If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download

gingernm

Rik/Quoia,

The orbiscom and cahoot entries are ok. Take it you bank (or have) with Cahoot and used the 1 use visa payment option in the past (orbiscom)

I work in Ops for Santander owners of Cahoot and these are ligit processes.

Ginger.

aliEnRIK

gingernm wrote: »

Rik/Quoia,

The orbiscom and cahoot entries are ok. Take it you bank (or have) with Cahoot and used the 1 use visa payment option in the past (orbiscom)

I work in Ops for Santander owners of Cahoot and these are ligit processes.

Ginger.

Cheers gingernm

kduffy101

just switched on pc,ADOBE update box appears,so i STUPIDLY update then i come here to find the first post is about this update,
im running super antispyware at the moment,then im going to run malwarebytes to see if ive got the virus.i will post my log soon,hopefully my pc will be ok,
any comments would be great.
many thanks.

quietishone

kduffy101 wrote: »

just switched on pc,ADOBE update box appears,so i STUPIDLY update then i come here to find the first post is about this update,
im running super antispyware at the moment,then im going to run malwarebytes to see if ive got the virus.i will post my log soon,hopefully my pc will be ok,
any comments would be great.
many thanks.

Adobe did offer a security update to version 9.31 this Tuesday so you probably have the legitimate upgrade. the OP clicked 'OK'on a box marked Adobe error not update. checking is a good precaution though (and anyone who uses Adobe reader and has disabled automatic updates should update it manually).

kduffy101

heres the log....
Malwarebytes' Anti-Malware 1.44
Database version: 3754
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
19/02/2010 08:01:45
mbam-log-2010-02-19 (08-01-45).txt
Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 212678
Time elapsed: 1 hour(s), 17 minute(s), 21 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
seems ok so fingers crossed.
thanks to all...

Browntoa

theres also a Real Adobe shockwave or flashplayer update that has popped up today , if you are concerned then go to the adobe site and do the updates direct in the short term

Browntoa

kduffy , you need to start your own thread as it will get confusing for Quoia