Spyware, viruses, & security forum: "Web attack: Blackhole toolkit detected" -- Now what?

...loads and is visible for only a fraction of a second. From the glimpses I've caught, it looks like a DOS screen and includes random characters in different colors. I haven't ever noticed it before, and it is not the malware message screen shot you offered.

I haven't kept track of the webpages that are so excruciatingly slow to load, but it definitely isn't all webpages. These aren't just momentary response lags, but delays of 5 seconds or more before anything happens. This is on a wired network, not wireless. I haven't noticed an obvious pattern to them, but will try to track them the next day or so and report back if you think that info might be helpful.

Thanks for the Symantec links. I'll try running an SEP scan in Safe Mode as well using ESET, and see what is reported. I searched Symantec's site and,in addition to the Blackhole Theory article you noted, found only the following 'helpful' guidance (http://www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=24092)

Severity: High. This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.
Description: This signature detect attempts to download exploits from a malicious toolkit which may compromise a computer through various vendor vulnerabilities.
Additional Information: This signature detect attempts to download exploits from a malicious toolkit which may compromise a computer through various vendor vulnerabilities.
Affected: Various.
Response NA.

Thanks, Carol.

BobMac..

The message in the shot I included regarding Rkill, had no significance. I was only asking if the screen looked similar. Your description of the DOS screen, which contains random characters in different colors, has me wondering if it's related to "malware". Are you SURE it wasn't there before the intrusion attempt? I'm asking on the outside chance, SEP did block it.

You say some of the pages will load normally. Which browser are you using? And have you tried using another browser? Does it make a difference?

As previously suggested, scan with SEP in safe mode. And also see if ESET finds anything. Let us know how things go.

Carol

Apparently the screen flash problem during bootup was the graphics card itself b/c it failed. Started getting a "No DVI-D signal" message at bootup. Replaced the card and that particular problem went away. Hope you're not going to tell me that this -- causing a graphics adapter to fail -- could be an outcome of a Blackhole toolkit intrusion?

We have IE8 installed on this particular PC. Haven't tried any other browsers. I've noticed that the sluggishness is particularly severe on MSNBC's news site.

Last night, I booted into safe mode to run a full SEP scan. When I opened SEP, there was a message that "File system auto-protect is malfunctioning. File system auto-protect is not functioning correctly. Your protection definitions may be damaged or your product installation may be corrupt." This message was NOT there before or after booting into safe mode. The safe mode full scan by SEP found no risks. I also performed a full Malware Bytes scan in safe mode and found no risks.

Do I run the ESET scan in safe mode? Thanks.

BobMac..

In regard to the "File System Auto-Protect is not function correctly. Your protection definitions may be damaged or your product installation may be corrupt"" warning, read the below document.

"File System Auto-Protect is malfunctioning"
http://www.symantec.com/business/support/index?page=content&id=TECH102962

Also read this thread titled, "File System Auto-Protect is malfunctioning", where the "Symantec Trusted Advisor" suggested to "Update virus definition files using the Intelligent Updater".

You wrote, "Hope you're not going to tell me that this -- causing a graphics adapter to fail -- could be an outcome of a Blackhole toolkit intrusion?"

No. I'm not going to tell you, your graphics adapter failed because of the intrusion. In fact, I'm still questioning whether your problems are related to a BlackHole intrusion. The intrusion SEP supposedly blocked. More so now, that you mention IE8 is particularly sluggish, when visiting MSNBC.

You mentioned you haven't tried using a different browser. Is it because you don't have another one installed? I'm going to presume that's the case. It might help to install Firefox to see if the problem persists.

There's no point in my "questioning and guessing". It's not going to help you. If you want to completely rule out the BlackHole exploit, or any other "unwanted visitors", I would suggest posting at a HijackThis forum. They utilize specialized diagnostic and removal tools, which we don't use here. It will allow them to better see, what's going on with your system.

If you decide to go that route, you can find a list of the forums, at the left-hand side of this page. It may take a few days for them to get back to you, but they will. It's worth the wait. And it's worth your peace of mind. (Or at least in my opinion it is)

Carol

bobmac... how can you remove it from a website. My forum membesr are still seeing a warning with foxfire and not IE? I think I have the script contained, but I still see a funny looking addy in the the data transfer bar in the lower left. That could have always been there and I just noticed it. It flashs by so quick I can't copy it. Any help would be great. kiLLer-

I took Carol's good advice and went to Hijack This (http://hjt-data.trendmicro.com/hjt/analyzethis/index.php), picked one of the forums (DSL Reports, which I had some experience with), and posted a description of what happened. They directed me to some diagnostic tools, several runnings of which turned up no evidence of a rootkit or other infection. I haven't experienced any more warnings since. Give Hijack This a try. Good luck.