+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Infected] Fairly sure there's SOME type of infection. (/showthread.php?tid=4558925)
Pages: Pages
1
2
Fairly sure there's SOME type of infection. - justg - Nov 27, 2014
Came home from college, and the desktop I usually used when I was home (Family Desktop) was running at a snail's pace. There are certain times it will run fine, and then others the usage is very choppy and slow.
I asked my mother about it, and learned that the three smaller girls we have (ages 7-10) had been on the computer a lot while I've been gone. I figured they probably downloaded something that infected the computer with some adware or malware.
Run CCleaner to clear out temporary system files, just in case it was just that. However, it gets stuck at 34% under System temp files. I stop the CCleaner scan and run a Malwarebytes scan, and find 2 Trojan's and quite a few file registry/key/value errors. I let malwarebytes handle that, run the CCleaner again, and the same thing happens.
Next I check under task manager and check for open processes. I notice that with only One tab in google chrome open that there are 98 processes, so I end a few. Even after ending a few, CPU Usage has stayed up near 100%, while physical memory in between 40 and 60.
If I run Malwarebytes now, it ALWAYS comes up with the same 5 errors - which is from the Sweetpacks Adware, which after multiple tries, I can not seem to get rid of. I also figured it couldn't be the Sweetpacks slowing this computer down and making CPU usage 100%. Also, on top of this, at least once a day there is a pop up that tells me Windows Powershell has stopped working.
Any help here guys?
* - Aura - Nov 27, 2014
Follow the instructions here :
https://hackforums.net/showthread.php?tid=4486298
Post the log either here or there. Give me a few to reply to it since I'm on my phone.
* - desynk - Nov 28, 2014
Sounds like it's infected with Poweliks. If you are awake right now I can remove it if you pm me your TeamViewer details, otherwise you'll have to wait for tomorrow unless someone else gets to you first.
* - ven0m - Nov 28, 2014
Have resolved the issue or require further assistance?
* - -Hyperion - Nov 28, 2014
If you are only using MWB it will not remove it. Please follow these instructions here http://malwaretips.com/blogs/remove-sweetpacks-toolbar/
* - justg - Nov 28, 2014
I will be following Aura's advice when I get back to the PC later after work.
* - Aura - Nov 28, 2014
(Nov 28, 2014 11:50 AM)justg Wrote: I will be following Aura's advice when I get back to the PC later after work.
That's fine with me. If ven0m's wants to jump in however, I strongly recommend you to follow his instructions over the instructions of anyone else here since he's way more qualified than me in that domain. For now, I'm good with that :smille:
* - justg - Nov 28, 2014
http://pastebin.com/ZaYqp8zF
That's the log.
* - Aura - Nov 28, 2014
(Nov 28, 2014 02:15 PM)justg Wrote: http://pastebin.com/ZaYqp8zF
That's the log.
Alright let's see :
- Uninstall Catalina Savings Printer;
- Uninstall Coupon Printer for Windows;
- Uninstall Java 7 Update 67 - You'll have to install the latest version from Java.com, do not Accept the Ask Toolbar;
- Uninstall Internet Explorer Toolbar 4.8 by SweetPacks;
- Uninstall QuickTime;
- Update Sandboxie;
- Update Skype - We are on v6.22;
- Uninstall Skype Click to Call;
- Update WinRAR - From RARLabs, install the 64-bits version;
The Updates can wait, go with the Uninstalls.
* - justg - Nov 28, 2014
(Nov 28, 2014 02:18 PM)Aurа Wrote: Alright let's see :
- Uninstall Catalina Savings Printer;
- Uninstall Coupon Printer for Windows;
- Uninstall Java 7 Update 67 - You'll have to install the latest version from Java.com, do not Accept the Ask Toolbar;
- Uninstall Internet Explorer Toolbar 4.8 by SweetPacks;
- Uninstall QuickTime;
- Update Sandboxie;
- Update Skype - We are on v6.22;
- Uninstall Skype Click to Call;
- Update WinRAR - From RARLabs, install the 64-bits version;
The Updates can wait, go with the Uninstalls.
Can not find the Catalina Savings Printer in "uninstall a program".
When I attempt to remove the Sweetpacks toolbar, it comes up with this:
https://gyazo.com/1a60c5f9f84e3e7baa45d93fabf91c12
Updated Skype and Java, decided to remove Sandboxie and WinRAR, will decide if I want them back at a later time.
* - Aura - Nov 28, 2014
(Nov 28, 2014 02:42 PM)justg Wrote: Can not find the Catalina Savings Printer in "uninstall a program".
When I attempt to remove the Sweetpacks toolbar, it comes up with this:
https://gyazo.com/1a60c5f9f84e3e7baa45d93fabf91c12
Updated Skype and Java, decided to remove Sandboxie and WinRAR, will decide if I want them back at a later time.
Was expecting that error from Sweetpack, since the previous deletion of it's files by Malwarebytes most likely corrupted it's installation.
Do you have CCleaner (I don't remember) ?
* - justg - Nov 28, 2014
(Nov 28, 2014 02:47 PM)Aurа Wrote: Was expecting that error from Sweetpack, since the previous deletion of it's files by Malwarebytes most likely corrupted it's installation.
Do you have CCleaner (I don't remember) ?
I do. I have ran it several times, and always comes up with file/registry errors (The same 5) when I run it.
* - Aura - Nov 28, 2014
(Nov 28, 2014 02:49 PM)justg Wrote: I do. I have ran it several times, and always comes up with file/registry errors (The same 5) when I run it.
When you try to uninstall Sweetpack via CCleaner or when you try to start it ?
* - justg - Nov 28, 2014
(Nov 28, 2014 02:56 PM)Aurа Wrote: When you try to uninstall Sweetpack via CCleaner or when you try to start it ?
When you try to Uninstall via CCleaner it just gives and error saying access is denied. When you run the cleaner it comes up with 5 Errors, all based around sweetpacks.
* - Aura - Nov 28, 2014
(Nov 28, 2014 02:59 PM)justg Wrote: When you try to Uninstall via CCleaner it just gives and error saying access is denied. When you run the cleaner it comes up with 5 Errors, all based around sweetpacks.
Right-click on CCleaner and select "Run as Admin". Then try to uninstall it.