Malware Hiding on me?

Neverhavemoney · Nov 10, 2008

Hey everyone,
I have this annoying windows firewall box that pops up about every 15 minutes or so and i am starting to get really annoyed. The attached picture shows everything. I had Avast! when it stared and that didnt catch anything in real-time if my full system scan. I also downloaded spybot and that didnot come up with anything in my full system scan. Now i have downloaded comodo and there is nothing that has come up so far. How should i go about this?
Any help is welcome
Thanks
Ben
Also how do i stop comodo from haveing a popup box everytime i run something(it feels like every time i click the mouse for a program i have to approve about 5 other things with comodo before i can actually get to the program or task i am doing.)

Barman58 · Nov 10, 2008

Evening Ben,

try downloading this and running a full scan, may take a while but have found that it's very good, found 11 nasties on a machine for me earlier after a full scan with spybot and avast showed it clear :eek:

Malwarebytes.org

As for comodo, bear with it, as long as you have the "remember" box ticked it will soon settle down and it is the best free firewall around.

SIW2 · Nov 10, 2008

Hi Ben,

Looks like a fake pop - up to convince you to click the link and pay for a program to remove it. ( I know you realise that - it's in case anyone else is reading this link )

Yes I agree with agree with Nigel - try Malwarebytes - you can also download a nice little free app. from them called Rogue Remover.

Comodo probably wouldn't find anything - you may have selected clean pc mode , when it assumes everything onboard is clean ( if I recall correctly, this may be the default ).

If you want to return to using the windows firewall when the malware is cleared - you could take a look at at the free Vista Firewall control. It provides some outbound protection and actually sped up my startup times.

Vista Firewall Control : Sphinx Software

Avast is good, but no single app. can be expected to catch everything. You might want to keep using Avast, and just scan every so often with malwarebytes manually - you can do this with the free version.

Hope it helps

SIW2

Neverhavemoney · Nov 11, 2008

Guys im screwed. I ran malware bites, spybot, and comodo virus scan,
Comodo-nothing
Spybot- a few cookies
malware bites- found the rouge trojan
I deleted it and it said i did it sucessfully.
I thought i was all set
I went to this websites homepage then the windows firewall (image from my first post) poped up again.
I think im screwed i dont know what to do
please help!

Barman58 · Nov 11, 2008

Hi ben,

what was the actual trojan that was found by Malwarebytes?

if you can post back with the name of the thing will try and find specific removal instructions

ok I must learn to read

the name is in your post.

will check and post back

Neverhavemoney · Nov 11, 2008

Here is the log from malwarebites
the picture is small but if u hold down cntl and use ur scroller on ur mouse and roll it up you can zoom in(u porb already know this hahaha)

barman58 said:
Hi ben,

what was the actual trojan that was found by Malwarebytes?

if you can post back with the name of the thing will try and find specific removal instructions

ok I must learn to read the name is in your post.

will check and post back

Barman58 · Nov 11, 2008

Hi ben,

Have found this explanation and removal instruction for the malware you appear to have.

Remove Personal Defender 2009, removal instructions

have a look at the description and see if that looks like the things your seeing.

Have not had experience of removing this so would like any other members with actual experience with this to comment before you actually Try to remove it.

as far as I can see this does not actually damage things directly so is better we are sure before starting.

Neverhavemoney · Nov 11, 2008

barman,
i think you need to repost and put the picture as an attachment.
thanks,
ben

makubex · Nov 11, 2008

Try running scan using SuperAnti Spyware !!! :D

stormy13 · Nov 11, 2008

Also run all your scans in safe mode (with networking, just in case you need toi go online for anything).

mastoark · Nov 11, 2008

Hello my first post here. :D New x64 user. I had a problem like you and I ran a avast scan at bootup, it seems to do a better job with allready installed spyware/malware when you run it at bootup, before the cpu boots up it will check the entire drive. Hope this helps also... If that dont help go to Wilders security forum maybe someone there can help also.......

NormCameron · Nov 11, 2008

Hi guys, I've had a bit of experience with this beastie in it's previous life as AntiVirus 2008. You'd probably have some info on that one. Nigel? It's been discussed on this forum in a number of posts. It is very hard to get rid of.

Neverhavemoney · Nov 11, 2008

makubex- i dont liike that program one bit it crashed. and this is not just one simple spyware hack this is serious and i am very upset with myself that i let this happen. I know a virus, spyware, ect.. is not always stoppable but i have been hearing so much about it that i should have known. I feel so stupid

stormy13- That is not a smart idea at all, when you boot in safe mode, your main drivers run. No programs. If you have network as an option then your computer is sitting there, fully connected to the internet with no blocking. It will make your computer very very vonerable and that one virus, spyware, ect.... could connect to others and just filter in untouched. Then you will be worse off then when you started. If anything i should boot in safe mode, and if i need anything i will just restart and boot normally.

mastorak- Welcome to Vista Forums! I dont find any difference from a boot scan to a normal full comp scan after a full start-up. But welcome and any more suggestions are welcome.

In the mean time, i have installed Comodo w/ internet security and antivirus. The only crapy part is that this little $h!t of a trojan runs in the backround and comodo doesnt pick up the request to the computer to allow the trojan to exicute the pop-up (which is soooooooooo @#$%#$%@#^!@#$% annoying!!!!!!!!!!!!). That is a downer !!!

But i will be running a full system+hardrive scan tonight consiting of:
Malware Bites
Spybot S&D
Comodo Anti-Virus

I have also downloaded RogueRemover free from the site barman told me to visit. I ran it 3 times and it never picked up a thing.

I will be sure to keep you all informed
Thanks a ton,
Ben

Barman58 · Nov 12, 2008

Hi Ben,

I have spoken to others on this matter, (public thank you Norm :geek:

), now and think I have a plan of action.

I believe from the details in the malwarebytes log that you have an infection from the rogue program Personal Defender 2009

This is a new variation of an old rogue program and as such may well have got past normally working protection measures. so don't feel guilty about it it could happen to anyone

What backups do you have of your personal items? documents, music, photos, emails.etc. as this may end up requiring a re-install of Vista.

When you have the backups you need ...

Follow these instructions exactly ...

Personal Defender 2009 manual removal:

Kill processes:
pdefendr.exe ikbmqvex.exe

Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "asus32"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Personal Defender 2009"

Unregister DLLs:
sccmsk.dll SDBHO.dll

Delete files:
c:\\Program Files\\Personal Defender 2009\\dbbase.div c:\\Program Files\\Personal Defender 2009\\pdefendr.exe UserProfile%\\Desktop\\sccmsk.dll UserProfile%\\Local Settings\\Temp\\ikbmqvex.exe UserProfile%\\My Documents\\PersonalDefender2009\\SDBHO.dll UserProfile%\\My Documents\\PersonalDefender2009\\sdcfg.dat

Delete directories:
c:\Program Files\Personal Defender 2009
c:\Documents and Settings\Bleeping\Start Menu\Programs\Personal Defender 2009

these instructions are available Here in full (including full detailed instruction for performing the individual tasks but have included them here for completeness ...

Remove Personal Defender 2009, removal instructions

There is a download available to do this removal at the site but if you feel confident enough would advise you follow the instructions manually

If when you start the removal you cannot find the folders or files mentioned ... stop and post back and will have to revise actions - this is a very bad infection and may not be removable without an re-install.

Neverhavemoney · Nov 12, 2008

Nigel
I am currently at school then have basketball but i will be trying that as soon as i get home. I dont have a vista CD. I ordered my computer online from dell.com and they did not send me a CD. I called them one day and they said that because of the PC restore to default feature that is installed i would not need a CD i told them that is not true at all but they refused to send me one. What should i do if i do have to do a clean install?
Also what are .dll and how do i edit them. and also what is BSOD?
Thanks a lot,
Ben

barman58 said:
Hi Ben,

I have spoken to others on this matter, (public thank you Norm ), now and think I have a plan of action.

I believe from the details in the malwarebytes log that you have an infection from the rogue program Personal Defender 2009

This is a new variation of an old rogue program and as such may well have got past normally working protection measures. so don't feel guilty about it it could happen to anyone

What backups do you have of your personal items? documents, music, photos, emails.etc. as this may end up requiring a re-install of Vista.

When you have the backups you need ...

Follow these instructions exactly ...

Personal Defender 2009 manual removal:

Kill processes:
pdefendr.exe ikbmqvex.exe

Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "asus32"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Personal Defender 2009"

Unregister DLLs:
sccmsk.dll SDBHO.dll

Delete files:
c:\\Program Files\\Personal Defender 2009\\dbbase.div c:\\Program Files\\Personal Defender 2009\\pdefendr.exe UserProfile%\\Desktop\\sccmsk.dll UserProfile%\\Local Settings\\Temp\\ikbmqvex.exe UserProfile%\\My Documents\\PersonalDefender2009\\SDBHO.dll UserProfile%\\My Documents\\PersonalDefender2009\\sdcfg.dat

Delete directories:
c:\Program Files\Personal Defender 2009
c:\Documents and Settings\Bleeping\Start Menu\Programs\Personal Defender 2009

these instructions are available Here in full (including full detailed instruction for performing the individual tasks but have included them here for completeness ...

Remove Personal Defender 2009, removal instructions

There is a download available to do this removal at the site but if you feel confident enough would advise you follow the instructions manually

If when you start the removal you cannot find the folders or files mentioned ... stop and post back and will have to revise actions - this is a very bad infection and may not be removable without an re-install.

Barman58 · Nov 12, 2008

Hi Ben,

When you get back take a bit of time to read the full instructions from the link in the previous post.

Remove Personal Defender 2009, removal instructions

.dll s are Dynamic Link Libraries - they are special program files which other programs can use to perform certain tasks.
The point of them is that if you need to for, instance, print a file you could write every program to include the instructions to enable printing. A .DLL file allows you to have one program to Print which can be used by all others and therefore make programming easier.

As for your re-install, which I hope won't me required, depending on your computer supplier you should have a restore utility which will enable this. With the dell restore you should also be able to create disks for restore.

will see if I can find some instructions for you.

As for the BSOD it's the Blue Screen of Death the blue screen that sometimes appears if windows has a major error.

Barman58 · Nov 12, 2008

Hi Ben,

it's me again :D:

D

Have had a look on-line and the documentation for what I think is your Dell Model is available Here ...

You may want to download and save to disk anything that you didn't have supplied or can no longer find ...

Documentation

The instructions for restore start on page 100 in the PDF version of the user manual.

have a read through and make sure you are confident that you understand what you need to do if you have to do a restore.

The manual does mention an operating system disk which should be available to you so don't know why they didn't supply one with the system :confused:

Neverhavemoney · Nov 12, 2008

Nigel,
All of the things you told me to delete are deleted and the popup is still there
anything else?
ben

Barman58 · Nov 12, 2008

hi ben
Have you rebooted?

SIW2 · Nov 12, 2008

Hi,
You could try opening Windows Defender, click Tools, and check under Startup and Currently running programs - if you see something that might be the nasty, look in the right hand pane for a path and file name.

SIW2

Malware Hiding on me?

Attachments

My Computer

My Computers

My Computers

My Computer

My Computers

Attachments

My Computer

My Computers

My Computer

New Member

My Computer

Member

My Computer

New Member

My Computer

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers

My Computer

My Computers

My Computers