PDA

View Full Version : Bafstone[dot]com Antivirus Pro Malware



leefy
2009-07-06, 07:03
Hi guys,

Please help me here. I spent a whole day trying to remove a malware from my computer. I'll describe what happened. It's long, but that's because it's been a long day. Usually I like getting things fixed, but I give up. Please see if you have any insights to help. I'd sure appreciate it.

I was listening to a music playlist on imeem[dot]com with firefox, then my computer became really slow and the music became glitchy. Suddenly a download box popped up. It's downloading 315.pdf from bafstone[dot]com (It didn't show the full path to the pdf file).

I didn't have chance to cancel the download because it's pretty fast and already downloaded and preparing to open. I waited to see what it was. After all, I'm quite intrigued, since it's only a pdf file and not application.

But it was no pdf file at all. It opened up a command prompt. The next thing I know, my computer turned to a blue screen. In the next instant my computer restarted.

After it restarted, an Antivirus Pro software popped up and scanned my comoputer. I know this software was a scam because I don't recognize "antivirus pro". This software offerred me a fix to all the infections its found if I were to purchase it. I might have agreed to the purchase, but that darn software froze. Can't click on any options, and can't even quit it. I also noticed that my firefox browser wont start.

I hit ctrl alt delete and msconfig and found tons of suspicious stuff. b92xa474l.exe, Id12.exe, mrofinu72.exe, and a bunch of others. I tired removing them, but it won't let me delete. Tried to end the process tree of some of them, and it worked, I was able to delete them.

I got malwarebytes on a stick and installed it. However, it won't let me delete the infected items nor run an update. It also shows that regedit was disabled and malwarebytes had to enable it several times throughout the cleaning process. What really killed malwarebytes was that at the end, when it tries to delete the infected files and send the log back to its server, it crashes. I did print a log file of all the infected files.

I tried to restart in safe mode by checking the option in msconfig. But safemode won't start, it kept on throwing me back to the selection screen. Finally I selected a normal start up, but now even that won't work.

I used knoppix linux on a disk and started in linux. Manually deleted all the files in the malwarebytes log file. Also changed boot.ini to cancel the safemode option.

This time, I was able to log into windows. However the problem with firefox not starting remains. IE also crashes when I try to load a webpage, even though it can start with about:blank. Almost anything else that tries to access the internet, such as malwarebyte update, outpost firewall, crashes. I also noticed that lavasoft adaware got disabled in the services.msc. I enabled it and tried to do a update on the definitions file, but just like malwarebytes, it crashes.

Winsock fix doesn't solve the problem. Only two software I know can access the web. Ping, and an old mozilla browser I have.

I'm so frustrated, I looked up whois on the domain bafstone[dot]com and found this.
It was registered by a guy in the US 7/1/09. The server is hosted in Germany.

I don't want to point fingers at the registrant of this website, but it's quite suspicious.

Can someone please give me some inputs on what to do? I really want to get my browsers to work again. I hope someone knowledgeable with computers can read the above description and be able to see what's going on here. Also, I want to report bafstone[dot]com to some authority so that other people won't have to go through what I did.

I spent my whole day frustrated because of this malware. It's so late now and I have to wake up early tommorrow. Sigh... If anyone can help out here, Id appreciate it so much.

-Leef

Blade81
2009-07-07, 11:45
Hi Leef,

Let's take a look into your system if you can provide me a few logs.


Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt

Save both reports to your desktop. Post them back to your topic.


Download GMER (http://www.gmer.net) here by clicking download exe -button and then saving it your desktop:
Double-click .exe that you downloaded
Click rootkit-tab and then scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log in your reply.

Blade81
2009-07-14, 11:13
Due to inactivity, this thread will now be closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.