Somehow unexpectedly my computer got infected with malware

Question

So I consider myself a pretty conscious computer user. I run Windows 7 SP1 Pro 64bit and I update it. For surfing on the web I use Firefox 20.0.1 - I keep it updated. I also have NoScript and AdBlock - both up-to-date and running all the time. If I trust a site, I allow scripts from it (sites like stackoverflow etc.). For virus protection I use MSE - I know it's apparently not the best free software out there, but I though it'd be sufficient. Ill also point out that I dont forward any ports to this PC.

On the 6.05 at around 10:00 I started to browse the internet. I visited sites like stackoverflow.com, teamliquid.net and others - generally sites which I trust. I also visited sites which contained information about MPI protocol, but as far as I recall, I didn't allow scripts to run on these sites.

At about 11:00 I went to bathroom. When I returned, say at 11:30, I noticed that software was installed on my PC ('freshly installed', highlighted in menu start). I didn't notice this software before leaving to bathroom, it might have been there already, but I think it was NOT there yet.

So this software is called QType (quicktype apparently). It's somehow connected with other software - DealPly. They actually both got installed on my PC at that time, however only QType appeared as 'freshly installed' in my start menu. This software could also be somehow connected to 337 Technology Limited company. When I booted my browsers, they were both hijacked. Start pages looked like google, but it was in fact www.qvo6.com/... So in fact my browsers got hijacked.

So after seeing it, I went to view Windows' Event Viewer-> Windows Logs -> System to do some research. I noticed this message: Information; 2013-05-06 11:15:58; A service was installed in the system. Service name: Qtype Service ... Just after this one, this server entered the running state. There is no information about the other software - DealPly. Next thing I did was check what happened just before this suspicious service got installed while I was away. So in the event viewer system logs I can see, that something was happening with my browser: 'The computer brwoser service entered the running state.' and after a couple of seconds (six seconds in each log im looking at atm) 'The computer browser service entered the stopped state'. This rebooting of the service happened quite a few times.

So I wanted to ask those of You, who have some understanding in this matter. How is it possible that this software got installed without my knowledge. Was it some site I visited? Is it possible if I have disabled running scripts on sites? I may have accidentaly enabled scripts on some malicious site, but I don't think so. Is it possible that I didn't enable those scripts and it still got through somehow? Or is it something entirely different? Could it be some PDF I opened weeks earlier? (I sometimes read PDFs about stuff, like just recently about CUDA - but I imagine they come from trusted sites, of course this is naive reasoning). Or is it something else? Does the fact that this software got installed without my knowledge imply that someone has taken control over my PC?

I run a full scan of MSE - detected no viruses. Right now ill be running some anti malware software to get rid of unwanted things. Im considering re-formatting the PC - this would be the safest way, but I really don't like the idea of having to install all the IDEs and software again.

This infection really came as a surprise to me. Please feel free to answer if you think you can provide some insight on this matter and perhaps explain what took place on my machine, I will greatly appreciate your time.

I will also appreciate any tips to prevent such situation from happening in the future.

Answer 1

The easy answer is: browser exploits. Not visiting "dodgy" sites does not, in any way, mean that you're 100% safe. There have been many cases of exploits loaded through flash or pure HTML/JS through ad networks, for instance (if you are a gamer, Curse had this two years ago).

Even if everything you have is up to date, there are still ways around it. There are hacking competitions every year with the sole aim to prove that 0day exploits (exploits used before the manufacturer is aware of the exploit) are still alive and kicking. Pwn2own proved this pretty clearly every year it ran. Take, for example, the 2011 results:

• stock IE (no plugins) fell on day 1
• Safari (latest + fully patched mac) also fell on day 1
• All phones were hacked on day 2
• At the end of the contest, Chrome and Firefox remained unhacked.

"Hacked" means in this case that the hacker had access to program execution (by running calculator.exe as a proof) and disk I/O (by writing a file to disk).

In 2012, Chrome fell, by the way. Along with Firefox.

All this is to say that, no matter what, a fully patched system does not equal to "secure". By the looks of it, you've been victim of a drive-by attack. DealPly has been reported to do this, by the way. A full security advisory for it is available from Symantec.

P.S: if you're running IE7 or 8...Neither of those has a sandbox.

Answer 2

I would say that the most likely explanation to how this program got installed is that there was something else installed in the past which installed something new. Could be some kind of tool bar or other potentially unwanted program that has been running that brought it something new.

Answer 3

Beside what you are doing for your security consider followings:

1. Get ready for worst scenario (Rootkits) and make an image from every OS on your PC at different stages (i.e after OS installed and updated, common programs installed and updated...) and update and replace them periodically. Then in case like this one happened to you can roll-back to a stable state. I'll not trust to such a computer you already have by just removing malware or rolling back to a restore point. You can use CloneZilla for create/restore images. Personally added a boot menu to it's live CD beside my other GRUB boot choices.
2. Move you offline-data to other partitions than OS so by restoring an image your personal (i.g. My Documents) and application data will not be overwritten.
3. Sync your online-data appropriately i.e. using Firefox Sync so while in an image restore don't touch your offline-data, your online-data get synchronized easily and fast after restore. Beside backing-up offline-data on other mediums i.g. DVDs your online-data is already backed-up.
4. Use online storage for cloning your sensitive data. Currently there's a online-storage-war is running and there are many choices available but personally believe those supported by OS providers i.g. Ubuntu One survive at long-term.
5. Use a personal firewall i.e. Comodo to find out malwares at early stages. For a professional Antiviruses have few benefits. They just catch malwares which have get famous enough so if a malware is in its Window Period AV fails to recognize it.
6. Use Virtual Machines whenever running an untrusted application (or sandbox it). I don't encourage using it for daily browsing unless you are visiting suspicious websites occasionally (maybe because of nature of your work, i.g. as a cyber-police).
7. Harden your OS.
8. Other choices are different security tools i.g. IDS, Anti-Malwares, Anti-Rootkits which should be used on demand.