Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

So I consider myself a pretty conscious computer user. I run Windows 7 SP1 Pro 64bit and I update it. For surfing on the web I use Firefox 20.0.1 - I keep it updated. I also have NoScript and AdBlock - both up-to-date and running all the time. If I trust a site, I allow scripts from it (sites like stackoverflow etc.). For virus protection I use MSE - I know it's apparently not the best free software out there, but I though it'd be sufficient. Ill also point out that I dont forward any ports to this PC.

On the 6.05 at around 10:00 I started to browse the internet. I visited sites like stackoverflow.com, teamliquid.net and others - generally sites which I trust. I also visited sites which contained information about MPI protocol, but as far as I recall, I didn't allow scripts to run on these sites.

At about 11:00 I went to bathroom. When I returned, say at 11:30, I noticed that software was installed on my PC ('freshly installed', highlighted in menu start). I didn't notice this software before leaving to bathroom, it might have been there already, but I think it was NOT there yet.

So this software is called QType (quicktype apparently). It's somehow connected with other software - DealPly. They actually both got installed on my PC at that time, however only QType appeared as 'freshly installed' in my start menu. This software could also be somehow connected to 337 Technology Limited company. When I booted my browsers, they were both hijacked. Start pages looked like google, but it was in fact www.qvo6.com/... So in fact my browsers got hijacked.

So after seeing it, I went to view Windows' Event Viewer-> Windows Logs -> System to do some research. I noticed this message: Information; 2013-05-06 11:15:58; A service was installed in the system. Service name: Qtype Service ... Just after this one, this server entered the running state. There is no information about the other software - DealPly. Next thing I did was check what happened just before this suspicious service got installed while I was away. So in the event viewer system logs I can see, that something was happening with my browser: 'The computer brwoser service entered the running state.' and after a couple of seconds (six seconds in each log im looking at atm) 'The computer browser service entered the stopped state'. This rebooting of the service happened quite a few times.

So I wanted to ask those of You, who have some understanding in this matter. How is it possible that this software got installed without my knowledge. Was it some site I visited? Is it possible if I have disabled running scripts on sites? I may have accidentaly enabled scripts on some malicious site, but I don't think so. Is it possible that I didn't enable those scripts and it still got through somehow? Or is it something entirely different? Could it be some PDF I opened weeks earlier? (I sometimes read PDFs about stuff, like just recently about CUDA - but I imagine they come from trusted sites, of course this is naive reasoning). Or is it something else? Does the fact that this software got installed without my knowledge imply that someone has taken control over my PC?

I run a full scan of MSE - detected no viruses. Right now ill be running some anti malware software to get rid of unwanted things. Im considering re-formatting the PC - this would be the safest way, but I really don't like the idea of having to install all the IDEs and software again.

This infection really came as a surprise to me. Please feel free to answer if you think you can provide some insight on this matter and perhaps explain what took place on my machine, I will greatly appreciate your time.

I will also appreciate any tips to prevent such situation from happening in the future.

share|improve this question
add comment

2 Answers

The easy answer is: browser exploits. Not visiting "dodgy" sites does not, in any way, mean that you're 100% safe. There have been many cases of exploits loaded through flash or pure HTML/JS through ad networks, for instance (if you are a gamer, Curse had this two years ago).

Even if everything you have is up to date, there are still ways around it. There are hacking competitions every year with the sole aim to prove that 0day exploits (exploits used before the manufacturer is aware of the exploit) are still alive and kicking. Pwn2own proved this pretty clearly every year it ran. Take, for example, the 2011 results:

  • stock IE (no plugins) fell on day 1
  • Safari (latest + fully patched mac) also fell on day 1
  • All phones were hacked on day 2
  • At the end of the contest, Chrome and Firefox remained unhacked.

"Hacked" means in this case that the hacker had access to program execution (by running calculator.exe as a proof) and disk I/O (by writing a file to disk).

In 2012, Chrome fell, by the way. Along with Firefox.

All this is to say that, no matter what, a fully patched system does not equal to "secure". By the looks of it, you've been victim of a drive-by attack. DealPly has been reported to do this, by the way. A full security advisory for it is available from Symantec.

P.S: if you're running IE7 or 8...Neither of those has a sandbox.

share|improve this answer
    
Do you have any advice on how to improve my security measurments? Or should I just keep it as it is, knowing that every trusted site I enter can pwn me. Or maybe use a VM to browse the internet? –  roxyfm May 9 '13 at 18:39
    
@roxyfm: use a browser with a sandbox, keep disk images. Basically, don't think "I'm unpwnable". Think "I'll get pwned someday" and adjust what you do accordingly. a VM for the internet is a possible way forward, though simple things like Adobe Acrobat also have holes in them. –  Sébastien Renauld May 9 '13 at 18:44
    
Not to be pedantic but you mean security measures, not measurements. –  SteveS May 9 '13 at 18:48
    
I use a snapshotted VM to run a browser and use the VM in transparent mode to make it look like a normal browser. The VM gets reverted to its original state when I reboot nightly. This helps protect me as I browse the shadier side of the 'net and I have detected no breaches of my host system. –  schroeder May 9 '13 at 22:12
    
@roxyfm - I recommend Qualys Browser Check to make sure your plugins/extensions aren't leaving you vulnerable. I would also run Secunia PSI and make sure all your programs are up to date. If you really want to take it to the next level, download the community versions of RetinaCS by BeyondTrust or Nexpose by Rapid7. –  k1DBLITZ May 14 '13 at 16:19
add comment

Beside what you are doing for your security consider followings:

  1. Get ready for worst scenario (Rootkits) and make an image from every OS on your PC at different stages (i.e after OS installed and updated, common programs installed and updated...) and update and replace them periodically. Then in case like this one happened to you can roll-back to a stable state. I'll not trust to such a computer you already have by just removing malware or rolling back to a restore point. You can use CloneZilla for create/restore images. Personally added a boot menu to it's live CD beside my other GRUB boot choices.
  2. Move you offline-data to other partitions than OS so by restoring an image your personal (i.g. My Documents) and application data will not be overwritten.
  3. Sync your online-data appropriately i.e. using Firefox Sync so while in an image restore don't touch your offline-data, your online-data get synchronized easily and fast after restore. Beside backing-up offline-data on other mediums i.g. DVDs your online-data is already backed-up.
  4. Use online storage for cloning your sensitive data. Currently there's a online-storage-war is running and there are many choices available but personally believe those supported by OS providers i.g. Ubuntu One survive at long-term.
  5. Use a personal firewall i.e. Comodo to find out malwares at early stages. For a professional Antiviruses have few benefits. They just catch malwares which have get famous enough so if a malware is in its Window Period AV fails to recognize it.
  6. Use Virtual Machines whenever running an untrusted application (or sandbox it). I don't encourage using it for daily browsing unless you are visiting suspicious websites occasionally (maybe because of nature of your work, i.g. as a cyber-police).
  7. Harden your OS.
  8. Other choices are different security tools i.g. IDS, Anti-Malwares, Anti-Rootkits which should be used on demand.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.