topic Advanced Performance Platform Cashtitan in Norton Internet Security / Norton AntiVirus

Advanced Performance Platform Cashtitan

bigapplemc — Thu, 09 Dec 2010 15:08:57 GMT

Hi, It would be great if i can get some help on this "Advanced Performance Platform Cashtitan" removal. I am not sure how it got installed with Norton Internet Sec 2010 and Microsoft Security already present and running but...it just did. Anyway, I've updated all definitions and ran a full system scan with no success. As we speak, a 2nd system scan, this time under Safe Mode, is running at full speed however, I thought that if possible I should better look for some sort of help, direction, etc. Is there a way to get rid of it? Please note that Norton DOES block every 3 minutes or so a certain AD attempt to take place. It is kind of after the fact but it does block it. Microsoft Security did not. I've ran HijackThis and got its log attached. I don't know if that will help though. Thank you in advance! Windows 7 Pro 64 bit

Re: Advanced Performance Platform Cashtitan

SlamDunkley — Thu, 09 Dec 2010 15:42:37 GMT

Hi bigapplemc

First I want you to boot into safe mode, do this by pressing f8 when your computer boots up

Download and run Malwarebytes, run the update before scanning, here is the link, remove all infection it finds

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button

Download and run Superantispyware, run the update before scanning, here is the link, remove all infections it finds

http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

Download and run CCleaner to get rid of junk files and bad registry keys. When you open it, click on Run Cleaner and remove junk files.

Then click on Registry which is on the left, then click on 'Scan for issues' before getting rid of the bad registry traces, it will ask you if you want to create a system restore point, say Yes and save to wherever you want. that should be it

http://www.piriform.com/ccleaner/download/standard

Hope this helps, follow this properly :)

Re: Advanced Performance Platform Cashtitan

Quads — Thu, 09 Dec 2010 21:06:30 GMT

http://www.threatexpert.com/report.aspx?md5=98b8b214b30c40035793557f09802eeb

Quads

Re: Advanced Performance Platform Cashtitan

SendOfJive — Thu, 09 Dec 2010 23:07:35 GMT

SlamDunkley wrote:
First I want you to boot into safe mode, do this by pressing f8 when your computer boots up
Download and run Malwarebytes, run the update before scanning, here is the link, remove all infection it finds

Downloading and updating Malwarebytes' might be a bit problematic from Safe Mode.

Also, Malwarebytes' is meant to be run from a normal boot into Windows. Some of its drivers do not load in Safe Mode so the scan is not as thorough.

Re: Advanced Performance Platform Cashtitan

SlamDunkley — Fri, 10 Dec 2010 01:02:43 GMT

Sorry you would have to update in normal boot first, well Matt Mziros always scans with Malwarebytes in safe mode and he is a respected malware remover, so I guess he has been doing his job wrong then...

Re: Advanced Performance Platform Cashtitan

Quads — Fri, 10 Dec 2010 01:15:12 GMT

Even the Creators of Malwarebytes themselves some time ago stated that Malwarebytes is not designed for running in safe mode. Although it can run in safe mode but is less effective due to the difference in modes.

And you would be meaning Matt Rizos??

I still have no idea why a lot of these guys say with Ramnit (or similar) or combos to reformat the HD, when I see no reason to. as Ramnit etc. can be broken and cleaned correctly.

I would have to say someone infected would be very luck now if they just have a single little piece of Malware on it's own.

Quads

Re: Advanced Performance Platform Cashtitan

SendOfJive — Fri, 10 Dec 2010 01:25:10 GMT

SlamDunkley wrote:
Sorry you would have to update in normal boot first, well Matt Mziros always scans with Malwarebytes in safe mode and he is a respected malware remover, so I guess he has been doing his job wrong then...

Maybe not wrong, but not the way Malwarebytes' recommends:

http://forums.malwarebytes.org/index.php?showtopic=5590

(Who is that cgoldman, anyway? The name looks awfully familiar.) :smileyhappy:

Re: Advanced Performance Platform Cashtitan

SlamDunkley — Fri, 10 Dec 2010 01:23:35 GMT

Okay so why not start a scan in safe mode then a scan in normal boot mode? Best of both worlds, sometimes you need safe mode for those infections that won't let you do anything.

Re: Advanced Performance Platform Cashtitan

Quads — Fri, 10 Dec 2010 01:27:18 GMT

Unless you have no Safemode of the infection run in Safe Mode also, which is becoming more and more the case.

Quads

Re: Advanced Performance Platform Cashtitan

SendOfJive — Fri, 10 Dec 2010 01:32:19 GMT

SlamDunkley wrote:
Okay so why not start a scan in safe mode then a scan in normal boot mode? Best of both worlds, sometimes you need safe mode for those infections that won't let you do anything.

Nothing wrong with that. It is true that Safe Mode renders some malware easier to detect, however you need to balance that with the fact that the detection capabilities of that particular product are also reduced in Safe Mode. In the thread I linked to, one poster claims that a Safe Mode scan detected a rootkit that was missed in Normal Mode. Of course if the Safe Mode scan was run first there may have been no other threats to detect besides what had already been spotted.

Re: Advanced Performance Platform Cashtitan

SlamDunkley — Fri, 10 Dec 2010 02:01:57 GMT

so true, so true, I agree, when I scan a person's computer I generally scan in normal boot, but if it's a rogue I feel inclined to scan in safe mode just in case it attempts to stop removing it in normal boot mode.

Re: Advanced Performance Platform Cashtitan

Quads — Fri, 10 Dec 2010 08:24:56 GMT

It's not strictly what I call a rogue,

And rogues now also run in Safe Mode to, as the good Malware creators realise to block or run in Safe Mode also.

Quads

Re: Advanced Performance Platform Cashtitan

bigapplemc — Fri, 10 Dec 2010 16:13:32 GMT

Thank you for your help!

I've first ran all of those noted by you under Safe Mode and a "quick scan" scenario while I haven't had the definitions updated.

Malwarebytes got MOST of the inffected files and SuperAnti some other ones (mostly cookies). CCleaner did its job as well.

I have restarting under Normal Mode, updating all definitions mentioned above. Please note that at this stage I've un-installed the Microsoft Security so that only the Norton Int Sec 2010 was left running. Actually, I am not so sure about the running part while the Action Centre was reporting that I have not turned ON my firewall, antivius, etc., in other words a sign of more troubles...

Anyway, the "Advanced Performance Platform Cashtitan" line was still shown in the Programs list!

I've restarted in Safe Mode and ran again all those programs initially recommended. This time Malwarebytes found the real culprits (2 files @ Windows\System32).

Afterwards, to make sure that I do not miss something I've ran regedit and manually deleted (after backup) any keys refering to Cashtitan (if I remember correclty... 3).

Restarting the computer was this time flawless. No more CASH-TITAN!!!! No traces!

Once again: thank you!:smileyvery-happy:

P.S. I'll run some other "full scans" under normal mode as well sometime today.

Re: Advanced Performance Platform Cashtitan

SlamDunkley — Fri, 10 Dec 2010 20:51:18 GMT

You are welcome bigapplemc, I am glad I was of any use :)