ProxiesFood: Unlimited Residential Proxy ◆ Private Crypter - Unique Private Stubs ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Whitehat • Blue Team • Defensive Security Malware, Rat, and Virus Removal › [Infected] Fairly sure there's SOME type of infection.

Thread Closed 
Infected 

Fairly sure there's SOME type of infection.
justg
justg Offline
C.R.E.A.M.
***
HF Ub3r
Posts:
3,433
Threads:
72
Credibility:
100
Popularity:
105
βytes:
β 0
Game XP:
0
Nov 27, 2014 10:25 PM
Came home from college, and the desktop I usually used when I was home (Family Desktop) was running at a snail's pace. There are certain times it will run fine, and then others the usage is very choppy and slow.

I asked my mother about it, and learned that the three smaller girls we have (ages 7-10) had been on the computer a lot while I've been gone. I figured they probably downloaded something that infected the computer with some adware or malware.

Run CCleaner to clear out temporary system files, just in case it was just that. However, it gets stuck at 34% under System temp files. I stop the CCleaner scan and run a Malwarebytes scan, and find 2 Trojan's and quite a few file registry/key/value errors. I let malwarebytes handle that, run the CCleaner again, and the same thing happens.

Next I check under task manager and check for open processes. I notice that with only One tab in google chrome open that there are 98 processes, so I end a few. Even after ending a few, CPU Usage has stayed up near 100%, while physical memory in between 40 and 60.

If I run Malwarebytes now, it ALWAYS comes up with the same 5 errors - which is from the Sweetpacks Adware, which after multiple tries, I can not seem to get rid of. I also figured it couldn't be the Sweetpacks slowing this computer down and making CPU usage 100%. Also, on top of this, at least once a day there is a pop up that tells me Windows Powershell has stopped working.


Any help here guys?
[Image: AoAXTY9.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 27, 2014 10:30 PM
Follow the instructions here :

https://hackforums.net/showthread.php?tid=4486298

Post the log either here or there. Give me a few to reply to it since I'm on my phone.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
desynk
desynk Offline
Security Engineer
***
HF Ub3r
Posts:
520
Threads:
4
Credibility:
000
Popularity:
51
βytes:
β 25
Game XP:
11
Nov 28, 2014 02:36 AM
Sounds like it's infected with Poweliks. If you are awake right now I can remove it if you pm me your TeamViewer details, otherwise you'll have to wait for tomorrow unless someone else gets to you first.
ven0m
ven0m Offline
cathedra mea, regulae meae
****
HF Ub3r
Posts:
5,857
Threads:
5
Credibility:
000
Popularity:
358
βytes:
β 671
Game XP:
1,022
Nov 28, 2014 07:09 AM
Have resolved the issue or require further assistance?
kitty had a snack
-Hyperion
-Hyperion Offline
Windows/Mac Malware Specialist
***
HF Ub3r
Posts:
3,945
Threads:
190
Credibility:
000
Popularity:
4
βytes:
β 0
Game XP:
0
Nov 28, 2014 09:18 AM
If you are only using MWB it will not remove it. Please follow these instructions here http://malwaretips.com/blogs/remove-sweetpacks-toolbar/
[Image: T2TtNNn.png]
justg
justg Offline
C.R.E.A.M.
***
HF Ub3r
Posts:
3,433
Threads:
72
Credibility:
100
Popularity:
105
βytes:
β 0
Game XP:
0
Nov 28, 2014 11:50 AM
I will be following Aura's advice when I get back to the PC later after work.
[Image: AoAXTY9.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 28, 2014 01:43 PM
(Nov 28, 2014 11:50 AM)justg Wrote:  I will be following Aura's advice when I get back to the PC later after work.

That's fine with me. If ven0m's wants to jump in however, I strongly recommend you to follow his instructions over the instructions of anyone else here since he's way more qualified than me in that domain. For now, I'm good with that :smille:
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
justg
justg Offline
C.R.E.A.M.
***
HF Ub3r
Posts:
3,433
Threads:
72
Credibility:
100
Popularity:
105
βytes:
β 0
Game XP:
0
Nov 28, 2014 02:15 PM
http://pastebin.com/ZaYqp8zF

That's the log.
[Image: AoAXTY9.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 28, 2014 02:18 PM
(Nov 28, 2014 02:15 PM)justg Wrote:  http://pastebin.com/ZaYqp8zF

That's the log.

Alright let's see :
  • Uninstall Catalina Savings Printer;

  • Uninstall Coupon Printer for Windows;

  • Uninstall Java 7 Update 67 - You'll have to install the latest version from Java.com, do not Accept the Ask Toolbar;

  • Uninstall Internet Explorer Toolbar 4.8 by SweetPacks;

  • Uninstall QuickTime;

  • Update Sandboxie;

  • Update Skype - We are on v6.22;

  • Uninstall Skype Click to Call;

  • Update WinRAR - From RARLabs, install the 64-bits version;


The Updates can wait, go with the Uninstalls.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
justg
justg Offline
C.R.E.A.M.
***
HF Ub3r
Posts:
3,433
Threads:
72
Credibility:
100
Popularity:
105
βytes:
β 0
Game XP:
0
Nov 28, 2014 02:42 PM
(Nov 28, 2014 02:18 PM)Aura Wrote:  Alright let's see :
  • Uninstall Catalina Savings Printer;

  • Uninstall Coupon Printer for Windows;

  • Uninstall Java 7 Update 67 - You'll have to install the latest version from Java.com, do not Accept the Ask Toolbar;

  • Uninstall Internet Explorer Toolbar 4.8 by SweetPacks;

  • Uninstall QuickTime;

  • Update Sandboxie;

  • Update Skype - We are on v6.22;

  • Uninstall Skype Click to Call;

  • Update WinRAR - From RARLabs, install the 64-bits version;


The Updates can wait, go with the Uninstalls.

Can not find the Catalina Savings Printer in "uninstall a program".
When I attempt to remove the Sweetpacks toolbar, it comes up with this:
https://gyazo.com/1a60c5f9f84e3e7baa45d93fabf91c12

Updated Skype and Java, decided to remove Sandboxie and WinRAR, will decide if I want them back at a later time.
[Image: AoAXTY9.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 28, 2014 02:47 PM
(Nov 28, 2014 02:42 PM)justg Wrote:  Can not find the Catalina Savings Printer in "uninstall a program".
When I attempt to remove the Sweetpacks toolbar, it comes up with this:
https://gyazo.com/1a60c5f9f84e3e7baa45d93fabf91c12

Updated Skype and Java, decided to remove Sandboxie and WinRAR, will decide if I want them back at a later time.

Was expecting that error from Sweetpack, since the previous deletion of it's files by Malwarebytes most likely corrupted it's installation.
Do you have CCleaner (I don't remember) ?
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
justg
justg Offline
C.R.E.A.M.
***
HF Ub3r
Posts:
3,433
Threads:
72
Credibility:
100
Popularity:
105
βytes:
β 0
Game XP:
0
Nov 28, 2014 02:49 PM
(Nov 28, 2014 02:47 PM)Aura Wrote:  Was expecting that error from Sweetpack, since the previous deletion of it's files by Malwarebytes most likely corrupted it's installation.
Do you have CCleaner (I don't remember) ?

I do. I have ran it several times, and always comes up with file/registry errors (The same 5) when I run it.
[Image: AoAXTY9.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 28, 2014 02:56 PM
(Nov 28, 2014 02:49 PM)justg Wrote:  I do. I have ran it several times, and always comes up with file/registry errors (The same 5) when I run it.

When you try to uninstall Sweetpack via CCleaner or when you try to start it ?
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
justg
justg Offline
C.R.E.A.M.
***
HF Ub3r
Posts:
3,433
Threads:
72
Credibility:
100
Popularity:
105
βytes:
β 0
Game XP:
0
Nov 28, 2014 02:59 PM
(Nov 28, 2014 02:56 PM)Aura Wrote:  When you try to uninstall Sweetpack via CCleaner or when you try to start it ?

When you try to Uninstall via CCleaner it just gives and error saying access is denied. When you run the cleaner it comes up with 5 Errors, all based around sweetpacks.
[Image: AoAXTY9.png]
Aura
Aura Offline
[g0d@HF:]
******
HF Ub3r
Posts:
33,920
Threads:
533
Credibility:
000
Popularity:
655
βytes:
β 568.2
Game XP:
11
Nov 28, 2014 03:01 PM
(Nov 28, 2014 02:59 PM)justg Wrote:  When you try to Uninstall via CCleaner it just gives and error saying access is denied. When you run the cleaner it comes up with 5 Errors, all based around sweetpacks.

Right-click on CCleaner and select "Run as Admin". Then try to uninstall it.
Fiat justitia ruat cælum

My era of providing technical support and malware removal on HackForums is over, so you can stop PM'ing me about it. Sorry.
Next Oldest | Next Newest
Thread Closed 


Possibly Related Threads...
Thread / Author Replies Views Last Post
[Infected] by PapaWembaNov 28, 2019 12:12 PM 2 146 Nov 28, 2019 12:12 PM
Last Post: Bastille
[Infected] by mixedBasketAug 31, 2017 05:09 PM 16 546 Aug 31, 2017 05:09 PM
Last Post: NeverForgotten.
by GenoApr 18, 2015 11:48 AM 8 290 Apr 18, 2015 11:48 AM
Last Post: Tha Sneak