Detecting damage done by virus

Question

This morning after I went to college, a virus infected my PC without any user interaction at my end. When I came home my computer was completely frozen and infected with lots of trojans. I have not typed anything important since returning so keys cannot be logged. However I want to know exactly when my computer crashed from the time of infection to see what could potentially be done remotely by a hacker.

The virus my pc was diagnosed with was "fakespypro" on a fully updated Windows 7 installation with firewall enabled. My computer was connected to an internal dorm room network, so probably that has had to do something with it.

Any further information about how I could backtrace this virus infection or ways to discover what data might be stolen would be greatly appreciated.

Answer 1

Unless you have logging turned on (which isn't by default) it is very unlikely you will know what was taken.

However, I have come across this (and similar) malware and they are generally used just to make people purchase rubbish / fake software, they are not trojens in the typical sense that send your files and information to a third party.

I am not saying it isn't possible, but it is unlikely.

If however you want to detect the damage done to your actual system, you can try downloading the good search tool everything (available on Ninite) and sort by date order - this will show you everything copied and modified at the date (there are many similar (built in) tools, but, I think this is the fastest.

Also, from the command prompt, you can type SFC /SCANNOW in order to check the integrity and status of Windows System Files.

Answer 2

The link you included in your question describes specifically what the virus does.

Trojan:Win32/FakeSpypro may be installed from the program's web site or by social engineering from third party web sites. When executed, Win32/FakeSpypro copies itself to "%windir%\sysguard.exe" and sets a registry entry to run itself at each system start:

Adds value: "system tool"
With data: "%windir%\sysguard.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run

It drops a DLL component to "\iehelper.dll" and sets the following registry values to load the dropped DLL at Windows start and to register the DLL component as a BHO:

Adds value: "(default)"
With data: “bho”
To subkey: HKLM\SOFTWARE\Classes\CLSID\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}

Adds value: "(default)"
With data: “\iehelper.dll”
To subkey: HKLM\SOFTWARE\Classes\CLSID\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}\InProcServer32

Adds value: "(default)"
With data: "0”
To subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9C42510-9B21-41c1-9DCD-8382A2D07C61}

It also creates the following registry subkey:

HKCU\Software\AvScan
HKCU\Software\AVSuite 

The DLL, "\iehelper.dll", installed by Win32/FakeSpypro is used to moderate the affected user's Internet use. For example, it may modify search results for the following search engines, by appearing to direct users to browser-security.microsoft.com:

    * yahoo.com
    * google
    * msn.com
    * live.com

Win32/FakeSpypro may modify the Hosts file under \drivers\etc\hosts, to ensure that users visiting 'browser-security.microsoft.com' are directed to the listed IP address as in the following example:

195.245.119.131 browser-security.microsoft.com 

There is no mention of opening any back doors and that is not something I have heard of before so I doubt that a hacker was 'in' you computer. I suggest you look at the user accounts though to verify that someone has not created an account they can use at their leisure. This particular trojan is most often picked up as a drive-by download meaning that you do immediately not realize you got it. It can happen even when you visit a reputable site if the site has been hacked. The scary part is if you do not know exactly when you were infected any information entered into your browser could have been intercepted. The good news is this virus does not lay quietly, but bothers you to buy it. I believe it also detected by most anti-virus programs. I like Wil's suggestion about searching your hard drive for recently modified files, but I have my doubts about how much help that will actually be.

Answer 3

i'd suggest not to depend on the infected machine for scan; there are two options I'd have opted for

[1.] attached this HDD to another system... and scanned it booting from an un-infected machine

if don't have access to other machine

[2.] make a USB Drive bootable by using Unetbootin and any Linux Distro u like, install a good free latest A/V over it and scan the HDD booting from that USB

Answer 4

The worst case scenario here is that any saved/cached passwords stored on the machine were compromised and your social security number was stolen. It's unlikely anything else was taken. Beyond stealing that specific info, other motivation for malware includes showing you ads and using your computer's processor and network time to perpetuate ddos attacks and other zombie activities. These days it all comes down to money, and it's too hard to collect payment from individuals to make removing data files from your system worthwhile.

To protect yourself, I would go to a clean machine and change any passwords that come to mind: e-mail, online banking, facebook/social networks, World of Warcraft/Steam/Gaming, vpn, etc. You may also want to put a fraud alert on your credit report.

Then, use a usb flash drive or writeable DVDs to make backup of all your data - any files and settings on the computer, or any programs that you can't easily install on a new system. When that's done, format your hard drive, re-install your operating system and applications (and this time remember to turn on windows updates), and finally restore your data.

The key point here is that once your system is infected, you can never be sure you've got it fully clean again. It used to be good enough to be sure any malware was no longer bothering you, but these days the best (read: worst) malware wants to stay hidden, and the kind of data you have on your system makes it no longer worth the risk to try to clean the computer. You need to wipe it and start over.