Here is a Fun Virus

[rockhoptec]

Came across this one today on a clients computer. this machine was infected to the tilt and used all the normal programs such as malwarebytes, ComboFix, multiple AVs, superantispyware, some online scanners. The viruses they had caused all sorts of problems such as could not see HDD in Disk Management, connect jumpdrive - did not show up in my computer or Disk Management. Anti-virus would not update, Security Center went nuts, Help and Support deleted and a few other weird things.

Finally got everything removed, things looked good until I went online and when I did a search and clicked on one of the choices, it would redirect to some ad sites. Looked high and low until I found this:

http://spillspace.com/2009/new-firefox-virus/

Basically the steps are:

The short fix:
You will find this one living in the extensions folder of Firefox. What you need to do is find the offending file, delete or encrypt it, then replace it with a blank dummy file.
Here are the steps:

1. Navigate to: C:\Program Files\Mozilla Firefox\extensions\, look for a folder that is a string of letters, created around the time you began having the problem. Something like “{BCB94CDD-5542-403F-9FB3-07D3DB1E9951}”
2. Open the folder, and then open the folder called “chrome”, then “content”, and look for a file inside called overlay.xul (variants may have different names).
3. Verify that it is the virus: does it have code similar to this: click to see code
4. If you have found the culprit, delete the file (or encrypt with Axcrypt which is reversible).
5. Replace it with a blank text file with the same name and extension.
6. Repeat the process - you may have multiple copies in multiple folders.
7. Test: Go back to Google, try your search results again.
8. If no redirects: Sing Hallelujah.

The better fix:
What you will do here is the short fix listed above, plus you will also run several Malware programs, remove all old versions of Java and download the new Java. If that doesn’t cure your problem you may need to run some more serious software. Here are the steps:

1. Do the “short fix” listed above.
2. Remove old versions of Java by downloading JavaRa and unziping it to your desktop.
3. Double-click on JavaRa.exe to start the program and Click on Remove Older Versions.
4. Download and install the latest version of Java (Most likely the first download you see here).
5. Install Malwarebytes and SuperAntiSpyware
6. Update them, run them, and delete all bad stuff.
7. Shutdown, restart, run them again.
8. If you are clean then test for redirects in Google.
9. If no redirects: Sing Hallelujah.

Figured I would share this since it is only affecting Firefox and not IE. Followed the steps and everything happy again.

Thought I would share in case anyone else comes across this... if already posted sorry for the double

 

[rockhoptec]

Wow, great find! That sounds crazy.

Strange things was really not a virus so the scanning never did anything, once you open Firefox do a search click on one of the links the thing would take you to some odd sites. Really Crazy....

 

[Starsky]

How did you fix the problem of the hard drive not showing in disk management? I have had the same problem with another PC I removed a virus from and now it doesn't detect any USB flash drives when connected, or show the C: in disk management, even though I can access C: through "my computer" (though cant access usb drives at all)

I was about to format the damn thing! If you can help me out that would be awesome!

Cheers,

Starsky.

 

[Jory]

I've seen this before, and I'm pretty sure I talked about it a bit in a topic here. It drove me completely nuts because the system was pristine, and after much troubleshooting I determined it had to be a setting/extension in Firefox.

 

[rockhoptec]

How did you fix the problem of the hard drive not showing in disk management? I have had the same problem with another PC I removed a virus from and now it doesn't detect any USB flash drives when connected, or show the C: in disk management, even though I can access C: through "my computer" (though cant access usb drives at all)

I was about to format the damn thing! If you can help me out that would be awesome!

Cheers,

Starsky.

Starsky - I ran ComboFix and rebooted and the Disk Management and USB devices came back, looking into the logs there were 6 rootkit virus that were removed. One of them (can't remember the name will look it up) was affecting the disk management and USB. I read about this one and it does this so people like us can not attach a USB stick and install programs to remove it.

After that I ran SuperAntispyware which removed the remainder of the infections.

I will get the log file from ComboFix and get it to everyone so everyone knows.

 

[rockhoptec]

I've seen this before, and I'm pretty sure I talked about it a bit in a topic here. It drove me completely nuts because the system was pristine, and after much troubleshooting determined it had to be a setting/extension in Firefox.

This one inserted itself into the plugins of Firefox but was not listed. So removing the file and making a blank file fixed the issue. (noted above in the steps)

Yea I know the feeling of driving you nuts, we use Firefox for the reason of no problems but since Firefox's #'s are increasing so are the infections...

 

[Jory]

This one inserted itself into the plugins of Firefox but was not listed. So removing the file and making a blank file fixed the issue. (noted above in the steps)

Yea I know the feeling of driving you nuts, we use Firefox for the reason of no problems but since Firefox's #'s are increasing so are the infections...

Yeah, I went through every single extension, every menu, and even looked at every single line in about:config. I'll have to look in the extensions folder next time instead of trusting the list in Tools>Add-ons.