virus blitz :(

Printable View

Show 40 post(s) from this thread on one page

February 15th, 2005, 11:49 PM
stargazer777

Hi all . . .

Ann, I just did the things you said to. However, when I use HJT to delete

O15 - Trusted Zone: *.finefind.nettraffic2cash.biz

and then scan again just seconds later, it's back again !!

===============================

On the brighter side, I happened to try MSIE and it fired up and is working !!!

However, EZ AV popped up while I was resetting MSIE's security level and reported 4 instances of infection by the Win32.Bube virus (you had mentioned earlier) -- please see my attached JPG screenshot.

As you can see, EZ AV cleaned it from the C:\WINDOWS\system32 location, but was unable to clean it from the explorer.exe location.

Am going to try Housecall, then check back here later.

- Dave
February 16th, 2005, 12:42 AM
stargazer777

Oh, geezz ..... :mad: :mad: :mad:

First of all, I guess explorer.exe is whacked .... I must start it manually by doing a C-A-D and then select NEW TASK and start it.

Anyway ..... I just deleted all kinds of garbage after the a.v. scan, etc. .... did a Restart and then when my blank desktop showed up (only shows the display image, NO icons or taskbar), I performed the manual start for explorer.exe.

Immediately, a DOS window came up with dozens of lines zipping by, saying something like "Executing trojan blah blah blah (filenames etc.)" .... after I got past my shock I immediately hit the "X" button at the upper right on the DOS window.

Something in it cued me to the fact that this was all contained in a file named "tsc.exe". When I did a file search, using the criteria tsc.*, several items came up -- see attached JPG image.

Is this possible ..... someone installing a "seeding file" that executes dozens of trojan items all at once ??

Anne: I assume the items shown in the image file I've attached should all be deleted, but I hate assuming, when I'm not the wizard. I'll wait for your comments, and shut down.

- Dave
February 16th, 2005, 11:54 PM
AnnMarie

Can you send me a copy of that file please Dave. When you find it, copy it to a new folder, zip it up (this is important) and email it to me (include a link to this thread). My address is [email protected]. I will post back when I have checked it out.

A new verson of Hijack This was relased yesterday. Go here and download the latest version. Run Hijack This again and post a new log.
February 17th, 2005, 12:52 AM
stargazer777

Annie -

I downloaded the new HJT app as you instructed. Below is the resulting log:

Logfile of HijackThis v1.99.1
Scan saved at 11:46:36 PM, on 2/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\SYSTEM32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\explorer.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS2\System32\devldr32.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
D:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Logitech\iTouch\kbdtray.exe
C:\WINDOWS2\System32\ctfmon.exe
D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Plextor\PlexTool.exe
D:\Program Files\SpySubtract\SpySub.exe
D:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dave.DGATES1\Desktop\MALWARE Utilities\HijackThis.exe

O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CaAvTray] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PlexTools Professional.lnk = D:\Program Files\Plextor\PlexTool.exe
O4 - Global Startup: SpySubtract.lnk = D:\Program Files\SpySubtract\SpySub.exe
O8 - Extra context menu item: Allow personal info to reach this site - file://D:\Program Files\GhostSurf\info.allow.html
O8 - Extra context menu item: Allow popups on this site - file://D:\Program Files\GhostSurf\popup.allow.html
O8 - Extra context menu item: Allow this advertisement - file://D:\Program Files\GhostSurf\menu.allowimg.html
O8 - Extra context menu item: Block personal info from this site - file://D:\Program Files\GhostSurf\info.block.html
O8 - Extra context menu item: Block popups on this site - file://D:\Program Files\GhostSurf\popup.block.html
O8 - Extra context menu item: Block this advertisement - file://D:\Program Files\GhostSurf\menu.blockimg.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104543957578
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS2\System32\DRIVERS\WtSrv.exe

I keep deleting the entry
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
using HJT, but moments later it is back again.

- Dave
February 17th, 2005, 01:15 AM
AnnMarie

Try fixing the below entries using the latest version of Hijack This Dave. (close IE first).

O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)

Reboot afterwards and post a new log. I am sure that I mentioned this before but perhaps not, go here and download, unzip and run the Registry Search Tool. Type nettraffic2cash in the dialog box. Let it run and after a few minutes, a prompt will appear. Click OK to write the results to Notepad and post them.

I havent received that file yet but there is no evidence of new malware in your log. Can you still get online?
February 17th, 2005, 01:24 AM
stargazer777

Quote:

Originally posted by AnnMarie
I havent received that file yet but there is no evidence of new malware in your log. Can you still get online?

AnneMarie,

Yes, I still have online access, although I am using Mozilla Firefox instead of MSIE, just in case it is less vulnerable, as I have heard.

I am assuming that procedures performed with HJT and other tools should be done in SAFE mode. If there is anything that does NOT, let me know ... it's a pain switching back and forth between Normal and Safe, and I don't have internet usage in Safe mode.

Also, regarding your use of the term "malware" -- is HJT going to show items related to viruses and trojans ? I have been overrun with them, but I had the idea HJT was only for spyware and hijacking nasties.

Will be posting again soon .... thanks again.

- Dave
February 17th, 2005, 02:03 AM
AnnMarie

1 Attachment(s)

Thanks I received the file Dave. It's not a trojan, it's the Trend Micro Damage Cleanup Engine.

Quote:

is HJT going to show items related to viruses and trojans ? I have been overrun with them, but I had the idea HJT was only for spyware and hijacking nasties.

Hijack This shows 99% of trojans and most viruses, the exception being file infectors which you currently have.

I need you to be able to use Internet Explorer. Please run the IEfix utility. You can download it here. Close IE first and reboot afterwards.

I have attached a zipped copy of Explorer.exe (SP1) to this post. Download it to your Desktop and upzip it. Once you have confirmed that IE is operative, we are going to replace your infected version of Explorer.exe with a clean one.

Dont forget to post a new Hijack This log and the results of your registry search if the entry is still there.
February 17th, 2005, 09:33 AM
stargazer777

Thanks, Annie -

1.) I performed the Explorer Fix.

2.) How do I replace Explorer.exe ? I tried an overwrite, and as I expected, it gave me a message something like "Make sure the file or app isn't in use." Seems like a Catch-22 -- I need to replace a file that has to be running while I try to replace it. I'll try again tonight after work.

My new HJT log follows after my sig . . . as you can see, that ruddy 015 - nettraffic2cash.biz entry still shows up . . .

Cheers,
Dave

Logfile of HijackThis v1.99.0
Scan saved at 8:27:42 AM, on 2/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\SYSTEM32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\spoolsv.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\explorer.exe
D:\Program Files\Logitech\iTouch\iTouch.exe
D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS2\System32\devldr32.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
D:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
D:\Program Files\Microsoft AntiSpyware\gcasServ.exe
D:\Program Files\Logitech\iTouch\kbdtray.exe
C:\WINDOWS2\System32\ctfmon.exe
D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
D:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
D:\Program Files\Plextor\PlexTool.exe
D:\Program Files\SpySubtract\SpySub.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
D:\Program Files\HijackThis\HijackThis.exe

O4 - HKLM\..\Run: [zBrowser Launcher] D:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\Roxio\Roxio DVDMax Player\PDVDServ.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CaAvTray] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [gcasServ] "D:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] D:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = D:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PlexTools Professional.lnk = D:\Program Files\Plextor\PlexTool.exe
O4 - Global Startup: SpySubtract.lnk = D:\Program Files\SpySubtract\SpySub.exe
O8 - Extra context menu item: Allow personal info to reach this site - file://D:\Program Files\GhostSurf\info.allow.html
O8 - Extra context menu item: Allow popups on this site - file://D:\Program Files\GhostSurf\popup.allow.html
O8 - Extra context menu item: Allow this advertisement - file://D:\Program Files\GhostSurf\menu.allowimg.html
O8 - Extra context menu item: Block personal info from this site - file://D:\Program Files\GhostSurf\info.block.html
O8 - Extra context menu item: Block popups on this site - file://D:\Program Files\GhostSurf\popup.block.html
O8 - Extra context menu item: Block this advertisement - file://D:\Program Files\GhostSurf\menu.blockimg.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center - {578FC4E3-151E-456c-AF8E-B63061EFE228} - D:\Program Files\GhostSurf\LaunchPCC.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-17.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1104543957578
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O23 - Service: CAISafe - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: VET Message Service - Computer Associates International, Inc. - D:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
O23 - Service: WinTab Service - Tablet Driver - C:\WINDOWS2\System32\DRIVERS\WtSrv.exe
February 17th, 2005, 03:10 PM
AnnMarie

.

Quote:

How do I replace Explorer.exe ? I tried an overwrite, and as I expected, it gave me a message something like "Make sure the file or app isn't in use." Seems like a Catch-22 -- I need to replace a file that has to be running while I try to replace it. I'll try again tonight after work.

I will talk you through the process Dave. I need confirmation from you that Internet Explorer is fully functional first though.

Quote:

My new HJT log follows after my sig . . . as you can see, that ruddy 015 - nettraffic2cash.biz entry still shows up .

Yes, I am waiting for you to post the results of running the Registry Search utility. We need to get rid of that before we replace Explorer.
February 17th, 2005, 04:43 PM
stargazer777

OK, thanks Annie -

Yes, MSIE is running fine, it seems.

I'm at work now, and will be out for the evening, but will return later and perform the RegSearch.

I think you're 16 hours ahead of me, so I should be back online around 3 PM your time. I know you have your own schedule and things to do, that's just for your info :) I'll have around 3 hours after that to work on this stuff, but if it doesnt get done, I can continue in the morning.

FYI, EZ AV found another virus, but killed it.

- Dave

Show 40 post(s) from this thread on one page