Go here and download then run Silent Runners.vbs. Right click on the download link and select Save Target As. Save it to the desktop or to a folder in a permanent directory. It generates a log which will be created in the same folder you are running it from. Please post the information back in this thread.
If you have a script blocking program, please allow the file to run. It is not malicious.
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows 2000
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Active Desktop web content (hidden if disabled):
HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\
"FriendlyName" = "My Current Home Page"
"Source" = "About:Home"
"SubscribedURL" = "About:Home"
Startup items in "Administrator" & "All Users" startup folders:
---------------------------------------------------------------
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
"MailWasherPro" -> shortcut to: "D:\Programs\MailWasher Pro\MailWasher Pro\MailWasher.exe D:\Programs\MailWasher Pro\MailWasher Pro\MailWasher.exe" ["Firetrust Ltd"]
"Microsoft Office OneNote 2003 Quick Launch" -> shortcut to: "D:\Programs\Microsoft Office 2003\OFFICE11\ONENOTEM.EXE /tsr" [MS]
"SpywareGuard" -> shortcut to: "D:\Programs\SpywareGuard 2.2\SpywareGuard\sgmain.exe" [null data]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Acrobat Assistant" -> shortcut to: "D:\Programs\Adobe\Distillr\acrotray.exe" ["Adobe Systems Inc."]
"Microsoft Office OneNote 2003 Quick Launch" -> shortcut to: "D:\Programs\Microsoft Office 2003\OFFICE11\ONENOTEM.EXE /tsr" [MS]
"NTI Ninja" -> shortcut to: "D:\Programs\NTI Ninja - USB partitioning encryption\Open.exe" ["NewTech Infosystems"]
"SnagIt 8" -> shortcut to: "D:\Programs\SnagIt 8.2\SnagIt32.exe" ["TechSmith Corporation"]
Winsock2 Service Provider DLLs:
-------------------------------
HKLM\System\CurrentControlSet\Control\Print\Monitors\
Adobe PDF Port\Driver = "C:\WINNT\system32\AdobePDF.dll" ["Adobe Systems Incorporated."]
Microsoft Document Imaging Writer Monitor\Driver = "mdimon.dll" [MS]
Microsoft Office Live Meeting Document Writer Monitor\Driver = "lmdimon.dll" [MS]
----------
<<!>>: Suspicious data at a malware launch point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 50 seconds, including 8 seconds for message boxes)
I ran Ad-Aware this morning and had 41 data miners tracking cookies and items on MRU List.
I get two dialog boxes repeatedly, which are "A Script is Running" and "Error message - Do you want to Debug".
I get the "Do you want to debug" message as many as 30-40 times for a single webpage. Part of the error message says "Object not defined".
I have all scripts blocked in my Panda configuration. I had to remove this block in order for Silent Runners to run, so I don't know what this message means or where it is coming from.
I have attached a sample of both error messages. Whatever is going on is making my system creepy slow.
I will perform both of these procedures but there is one other central issue.
In the first thread, I posted the Kaspersky online scan, which identified a number of items as either trojans or a worm. In addition, twice I tried to use Panda to run a full scan of my computer ( I have two hard drives) but Panda was only able to complete 25% of the scan on my C hard drive.
So, I think that something else is going on but you are the expert in this area.
Here is the URL for my first post, which details everything that I did prior to posting this message in the HijackThis conference.
When I run the Kaspersky online scan, they do not make any recommendations about deleting files that I could find.
Summary Information:
1. Tried to run Panda scan twice and it failed twice.
2. SpyBot has updated their software including a registry backup. I downloaded and installed the new version 1.5.1 SpyBot. Then I checked for updates before running SpyBot. SpyBot found 6 tracking cookies which I removed and then I clicked immunize system against all exploits defined in SpyBot.
3. Ran Ad-Aware after checking for updates and it found 11 objects in MRU List -- Ad-Aware says that these are harmless but it is tracking which documents that I am using, etc.; so I don't think the designation of harmless is accurate. There were also 2 tracking cookie objects. The Tracking Cookie objects had a TAC rating of 3. I had Ad-Aware remove all.
4. Ran 2nd Kaspersky online scan and it overview report said 2 viruses and 6 infected objects as compared to the first report, which said 5 viruses and 9 infected objects. However, when I looked at the actual detail it showed 3 instances of net-worm ... (see attached) and 1 instance of email-worm (see attached.
All instances occurred in the directory where I used the program DBXpress to unpack a locked Inbox in Outlook Express. There should not be any infected files in the Inbox because they should have been caught by my various security measures.
The email-worm is reported to infect dbx files, among others.
One other pecularity is that my Google Toolbar in IE is no longer there. I went to download Google Toolbar but it wants me to enable Browser Helper Objects, which I decided not to do. I don't know if this is a good idea or not but first things first. I want to get this problem fixed first. Then I will deal with the Google Toolbar issue and switching to Kaspersky Internet Security suite. In FireFox, the Google Toolbar is still present in the browser.
Here is the Kaspersky online scan report:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 05, 2007 9:04:40 AM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 5/04/2007
Kaspersky Anti-Virus database records: 275190
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
Scan Statistics:
Total number of scanned objects: 121003
Number of viruses found: 2
Number of infected objects: 6 / 0
Number of suspicious objects: 0
Duration of the scan process: 07:56:58
Infected Object Name / Virus Name / Last Action
C:\DMI\WIN32\MifDB\errors.log Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\tmpLog.txt Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\Training\Training archive - junk.rot135 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\Training\Training archive - legitimate.rot135 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\MailWasherPro\Trash.rot135 Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\cert8.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\googlesafebrowsing.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\history.dat Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\key3.db Object is locked skipped
C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\parent.lock Object is locked skipped
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Business Contact Manager\MSBusinessContactManager.ldf Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Business Contact Manager\MSBusinessContactManager.mdf Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\ds7v9zn4.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012007040520070406\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DF6449.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\~DFFE3B.tmp Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0299c62c020608e5098b4319d3f79f3e_18a16916-c59e-484e-8235-a291578187d7 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\00000002.ps1 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\00000002.ps2 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\00010002.ci Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\cicat.fid Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\cicat.hsh Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiCL0001.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiP10000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiP20000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiPT0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiSL0001.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiSP0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiST0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\CiVP0000.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\INDEX.000 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\propstor.bk1 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\VISIO\catalog.wci\propstor.bk2 Object is locked skipped
C:\Inetpub\catalog.wci\00000002.ps1 Object is locked skipped
C:\Inetpub\catalog.wci\00000002.ps2 Object is locked skipped
C:\Inetpub\catalog.wci\00010002.ci Object is locked skipped
C:\Inetpub\catalog.wci\cicat.fid Object is locked skipped
C:\Inetpub\catalog.wci\cicat.hsh Object is locked skipped
C:\Inetpub\catalog.wci\CiCL0001.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiP10000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiP20000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiPT0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiSL0001.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiSP0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiST0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\CiVP0000.000 Object is locked skipped
C:\Inetpub\catalog.wci\INDEX.000 Object is locked skipped
C:\Inetpub\catalog.wci\propstor.bk1 Object is locked skipped
C:\Inetpub\catalog.wci\propstor.bk2 Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf Object is locked skipped
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG Object is locked skipped
C:\WINNT\CSC\00000001 Object is locked skipped
C:\WINNT\DEBUG\ipsecpa.log Object is locked skipped
C:\WINNT\DEBUG\oakley.log Object is locked skipped
C:\WINNT\DEBUG\PASSWD.LOG Object is locked skipped
C:\WINNT\ModemLog_Conexant HCF V90 56K Data Fax PCI Modem.txt Object is locked skipped
C:\WINNT\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.crmlog Object is locked skipped
C:\WINNT\SCHEDLGU.TXT Object is locked skipped
C:\WINNT\SoftwareDistribution\EventCache\{3476FEA5-661E-4130-8213-16311D26AD15}.bin Object is locked skipped
C:\WINNT\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINNT\SYSTEM32\CONFIG\SYSTEM.ALT Object is locked skipped
C:\WINNT\SYSTEM32\LogFiles\W3SVC1\ex070405.log Object is locked skipped
C:\WINNT\SYSTEM32\pavjob.log Object is locked skipped
C:\WINNT\SYSTEM32\Perflib_Perfdata_354.dat Object is locked skipped
C:\WINNT\SYSTEM32\Perflib_Perfdata_770.dat Object is locked skipped
C:\WINNT\WindowsUpdate.log Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx/[From "Returned mail" <[email protected]>][Date Fri, 28 Oct 2005 17:21:42 -0700]/UNNAMED/document.zip/[email protected] Infected: Net-Worm.Win32.Mytob.ck skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx/[From "Returned mail" <[email protected]>][Date Fri, 28 Oct 2005 17:21:42 -0700]/UNNAMED/document.zip Infected: Net-Worm.Win32.Mytob.ck skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx/[From "Returned mail" <[email protected]>][Date Fri, 28 Oct 2005 17:21:42 -0700]/UNNAMED Infected: Net-Worm.Win32.Mytob.ck skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\2005 Email thru 12-31-05.dbx Mail MS Outlook 5: infected - 3 skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\cleanup.log Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Folders.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Inbox.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\InboxBK1.dbx 634,894 KB\Output for InboxBK1.dbx\spam score 4 10pobox warning.eml/[From [email protected]][Date Wed, 18 Feb 2004 22:44:39 +0000]/mails.txt.com.b9 Infected: Email-Worm.Win32.NetSky.b skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\InboxBK1.dbx 634,894 KB\Output for InboxBK1.dbx\spam score 4 10pobox warning.eml Mail: infected - 1 skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Offline.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Pop3.log Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Pop3uidl.dbx Object is locked skipped
D:\Data Files\Backups before Re-install of OS\OE Local Folders Archive 10-29\Smtp.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\rawlog.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\seclog.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\syslog.log Object is locked skipped
D:\Programs\Panda Platinum 7 - 2007\Firewall\tralog.log Object is locked skipped
If I were you I would be deleting those backup files on 'D' you created that are coming up as infected. Whether your various security measures should have caught them or not is debatable, but imo, we should look on Kaspersky's results as being accurate .
MRU results are fairly benign as they only show the Most Recently Used files you have accessed.
Or is Kaspersky just reporting that there is a worm there that has not been activated yet?
Yes. As I pointed out in the original thread they are currently archived in a benign state in those email archives. The only way they could be activated is if you opened those emails and those attached viruses by importing them back into the email program.
I don't think your pc was infected at any point during this procedure... the non-activated viruses in the temp int folders were deleted and now there's just these archived emails. Any other problem would now need to be fixed in a more typical method of troubleshooting (which is not by more virus scanning ).
That one other .ini file does appear to have been a false positive.
This is all brand new to me, since I haven't gotten any infection or notification of infected file in 5.5 years. I will go delete those archived entries, then I will attempt to run another Panda scan followed by another Kaspersky online scan. If the Kaspersky scan comes up clean, then I will install Kaspersky.
BTW, does anyone have any idea why my Google Toolbar went poop? I made some changes in advanced mode for IE. Is there some change there, which could have made the toolbar go poop.
Reply With Quote
.
