Recurring Infection After Laptop Format

[BobMorane]

Hello,
I am new to Rogue Killer and I am using it on 3 devices.
One seems clean. Two of them seem to have problems:

1) The scan detects Malwarebytes as Malware but I am guessing that is because I have Malware Bytes and Rogue Killer installed on different disks, and probably I should not be concerned.

2) The second detection looks like a more serious one.
The scan detects two instances of PUM:

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.48.20.11 ([])  -> Found
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{1d22f487-b6aa-405e-b179-1ed50869d723} | DhcpNameServer : 10.48.20.11 ([])  -> Found

I will then remove them with Rogue Killer, restart the machine, run Rogue Killer again and both instances are detected once again.

I even fully formatted the hard drive and installed everything again. The problem persists.
As this is an hp laptop with factory installed software, I am guessing that the infection is somewhere in that factory installed area that the new format will never erase.

I have Malwarebytes and Norton also installed and none of them detect anything.

Can you please give me some advice on how to proceed for removal?

Thank you.

[Curson]

Hi Bob,

Welcome to Adlice.com Forum.

Yes, RogueKiller is detecting MalwareBytes malware database.
This issue has been fixed when MBAM is installed on standard location but since you run it from the another drive, the detection is still present.

PUM stands for Potentially Unwanted Modification. In your case, thoses entries are perfectly legit and necessary to access Internet.
For more information, please refer to RogueKiller Documentation.

However, the network class of these address is not common. Do you use a VPN service ?

Regards.

Note : This thread has been moved to the "RogueKiller" section for clarity.

[BobMorane]

Hey Curson!

Thank you for welcoming me. I am just loving the Rogue Killer experience: GREAT PRODUCT and very friendly community. What can you ask more?

Sorry that I posted on the wrong place but I really did not know better. This might also not be the ideal spot as I bought a premium license (after testing and using Rogue Killer for a couple of weeks), my modest way of supporting Rogue Killer. If you have to move this thread, just move ahead, please. Next time I will know where to post.

Back to the problem at hands.

1) Previous to posting here I uninstalled MBAM and the RK detection went away. I installed again, and the detection came back. I have 2 other devices with MBAM installed as well (with all programs installed in the same disk this time) and RK never detected it as a problem, so I figured it was a false positive related to the program location on the hard drive. But nothing like the expert confirmation for some peace of mind. Thank you for that. Problem 1) solved.

2) The two PUM detections actually happened on a different device. This device is used by the kids, so it gathers all the worst crap you would expect from the internet. When I read the MBAM logs (also installed on this device) I will see several daily instances of different malware detections: Rootkit this, Rootkit that, lately some coin mining virus, etc....

In order to cope with it,  I initially formatted this device, installed a couple of antivirus and created a VLAN on the home router specifically for this single device. I figured this would keep the (potential)  infections under control and they would not spread to my main home network. Anyway, I am not a computer expert , just a hobbyist that likes tech and does not really know what he is doing 50% of the time, so I hope this is not a very bad configuration. I am open to much better suggestions on how to handle the kids (regularly infected) laptop.
 
To answer your question, yes this device had a vpn installed but then I removed it and formatted the hard disk. Since it is an hp laptop, the format is never total as the factory settings always remain untouched. I ran RK before and imediately after formatting (before installing anything except for Windows 10 and Rogue Killer). Both times it showed the same PUM detections.

Another strange fact is that I have the same vpn in the other two devices and none of those entries were detected after running RogueKiller on them.

I also ran another (free) RootKit detector and it detected malware on the device (previous to formatting, did not run those afterwards again).

The machine itself was EXTREMELY slow, before formatting and Norton scans actually removed the coin mining virus several times, so it was infected for sure.

Now (after the format) everything looks fine with that particular device, and I even reinstalled the vpn once again. However Rogue Killer keeps detecting those two entries.

Anyway, maybe I am being too paranoid if you say that both entries are legit and necessary to access the internet. I just find it strange that the other two (very clean) devices connected to the same home network, with the same vpn installed do not show any of those entries when I run RK on them.

I am not too concerned as it is a machine that gathers a ton of crap weekly and that I will format it every few months, but I would like to keep it under control and avoid some weird situation where a very sophisticated virus might manage to jump vpns to my main network: It seems highly unlikely, but weirder things have happened in the last 30 years in the computer world. 

Hope you have a better picture of the situation now.


Thank you for your help.
Regards.

[Curson]

Hi Bob,

I'm glad you like our product.
Don't worry too much about the thread location, by the way.

2) The two PUM detections actually happened on a different device. This device is used by the kids, so it gathers all the worst crap you would expect from the internet.[...]
[...], so I hope this is not a very bad configuration. I am open to much better suggestions on how to handle the kids (regularly infected) laptop.

Using a separate VLAN for "risky" devices is a really good idea. However, you can drastically reduce the surface of potential infections creating limited accounts for the kids, installing a sandbox application like Sandboxie and forcing the system browsers to start within it.
Please also be sure to to keep all installed software updated.

To answer your question, yes this device had a vpn installed[...]
Another strange fact is that I have the same vpn in the other two devices and none of those entries were detected after running RogueKiller on them.

Since you configured a custom VLAN, it's normal.

I am not too concerned as it is a machine that gathers a ton of crap weekly and that I will format it every few months, but I would like to keep it under control and avoid some weird situation where a very sophisticated virus might manage to jump vpns to my main network: It seems highly unlikely, but weirder things have happened in the last 30 years in the computer world.

Malware evoluted a lot during the last few years and became more aggressive.
I advice you to install an Adblocker on the browser used in your network, since ads are a potential vector for infections : uBlock Origin for FireFox and uBlock Origin for Chrome.

Thank you for your help.

You are very welcome.

Regards.

[BobMorane]

Hi Curson,

Thank you VERY MUCH for all your help and advice.

I am very glad it was all a VLAN configuration trace and nothing more. It actually makes a lot of sense since this is the only device on a VLAN, I would expect some kind of a different internet access rule/filter or whatever...

Your other advice is GREAT, as well. Thank you very much. I was already using ad blockers but will now change to uBlock Origin, since you recommend it.

I had no idea that Sandboxie even existed, and it looks like the PERFECT solution for the kids laptop. I am going for it. Thank you once again.

The limited accounts sound like a very good idea too. I will read more about it, before changing anything as windows permissions can be somewhat tricky. Once I am more knowledgeable about it, i will set the recommended limited accounts.

These simple measures, on top of the VLAN, will certainly improve the safety of my home network.

You have been of GREAT HELP.

THANK YOU SO MUCH.

All the best,
Rod.

[Curson]

Hi Rod,

You are very welcome.
By the way, the website is not very clear about it, but a free version of Sandboxie is available.

Regards.

[BobMorane]

Hey Curson,

Thank you VERY MUCH.
Even better.

Best regards,
Rod

[Curson]

Hi Rod,

You are very welome again.

Regards.