tinyrick02
Topic Starter
Let me start off by first saying that I *did* read the Are you infected? sticky but before I go and download all the software to generate the logs etc I wanted to just make sure that this particular website would be an appropriate place for trying to fix the particular issues I am facing. If yes I will promptly post all the info asked for in the sticky ASAP, if not and someone could possibly point me in the direction of a more appropriate website to try and solve the issue it would be much appreciated.
Here's what I do know and have tried (I apologize in advance for the length- just wanted to be thorough):
I suspect that I may have been targeted with some kind of zero-day remote code execution type attack via an infected image on a website- why I suspect this is kind of a long story and not really important to fixing it (I don't think) but I'm almost certain the attack is originating from China. Whatever the infection is, it is completely undetectable by everything I've thrown at it thus far- mainly Norton, ESET and Malwarebytes. I've done FULL system scans (including operating memory, boot sector, etc) in safe mode to no avail so I think whatever it is is going to require some intensive manual removal.
At any given time I usually have at least two browsers open- usually Chrome and FireFox, sometimes Opera- and probably 100 some odd tabs open between all the browsers. I have 16GB memory and a fairly recent PC so normally this is not an issue. I first became suspicious when regular internet browsing became abnormally slow. Checked task manager and found that CPU use was idling in the 90% range with Chrome taking up most of the CPU. If I forced closed Chrome then Firefox would start taking all the CPU, if I force closed FireFox then Opera would start taking all the CPU and so on… Once all browser were closed the CPU usage would drop down to a normal range.
Knowing this was not normal behavior, I decided to check the logs on the firewall in my router. In place of a standard traditional consumer router I currently have a small linux box with Endian Firewall Community Edition doing all the routing for my network. My decision to switch to this setup was actually in part because of this malware issue I'm having but I quickly realized a better firewall was a temporary band-aid at best. Even with the IDS service (using standard snort rules) enabled in Endian I'm still having major problems. I had one website that I normally visit actually deny access with a message notifying me there was malicious traffic originating from my network.
What I found was that as soon as the infected computer is given access to the network, immediately you can see it shooting off hundreds of requests per minute to a variety of IP addresses on port 80 (which I assume just means it's being instructed to DOS those IP addresses remotely though I have not actually opened up Wireshark to check the contents of the packets).
I'm also certain there is some level of ARP cache poisoning involved. I noticed that buried in the ESET settings, coincidentally the notification specifically for ARP cache poisoning was disabled as well as the one for duplicate IP addresses detected. There were some other hints here and there- like pinging the IMAP server for my ISP's email would yield a different IP address on my phone not connected to Wifi versus pinging from a computer on my network (geolocating the bogus IP address lead to a Rackspace server in Texas obviously not associated with my ISP). Xarp for windows also is detecting ARP cache poisoning- specifically on all the windows PCs in the network.
There were also some suspicious entries in the HIPS logs in ESET allowing an executable titled MicrosoftEdgeCP to make changes to the system with some references to a folder titled "SleepStudy" in System32. When I tried to drill down the the directories mentioned in the logs, unsurprisingly I did not have permissions to open any of them. Trying to go to the Security tab for the folder and allow permissions would cause the system to freeze. Also noticed there were some users with full permissions that I definitely did not create. What I found particularly odd and perhaps a bit scary was in the one folder I was able to actually open I found a huge cache of VERY bizarre images that I've never seen before. I'm the only one who has access to this computer (physically) and I have not ever actually used Microsoft Edge to browse the internet on this PC. What that means I'm not entirely sure.
I also noticed that TOR browser keeps mysteriously getting uninstalled. I try to reinstall and a few minutes later its gone. I have to assume that this is also related to the rest of the activity though I am almost certain the infection came from a regular browser and not TOR.
There has has been some other odd behavior but these are all the ones that kind of stuck out at me or that I noticed recently. I've been battling this attack/infection for like a month now and just keep hitting dead ends so at this point any kind of direction would be appreciated here. Thanks in advance!
