 Browser Hijack/worm, I had noticed the sending of around 26000 packets with a receipt of 3 |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
BleepingComputer.com > Security > HijackThis Logs and Virus/Trojan/Spyware/Malware Removal > Misplaced HJT Logs  |
 Dec 21 2007, 08:33 PM
Post
#1
|
|
|
Member  Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104  |
Here is the port check report. FPort v2.0 - TCP/IP Process to Port Mapper Copyright 2000 by Foundstone, Inc. http://www.foundstone.com Pid Process Port Proto Path 1372 -> 135 TCP 4 System -> 139 TCP 4 System -> 445 TCP 2044 ccProxy -> 1025 TCP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 2504 -> 1026 TCP 2916 ccSvcHst -> 1032 TCP C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 5288 iexplore -> 2359 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2361 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2363 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2365 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2377 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2378 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2383 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2385 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2387 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2391 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2393 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2395 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2409 TCP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2413 TCP C:\Program Files\Internet Explorer\iexplore.exe 5304 firefox -> 3062 TCP C:\Program Files\Mozilla Firefox\firefox.exe 5304 firefox -> 3063 TCP C:\Program Files\Mozilla Firefox\firefox.exe 5304 firefox -> 3064 TCP C:\Program Files\Mozilla Firefox\firefox.exe 5304 firefox -> 3065 TCP C:\Program Files\Mozilla Firefox\firefox.exe 4 System -> 3097 TCP 5304 firefox -> 3104 TCP C:\Program Files\Mozilla Firefox\firefox.exe 2044 ccProxy -> 3105 TCP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 5304 firefox -> 3106 TCP C:\Program Files\Mozilla Firefox\firefox.exe 2044 ccProxy -> 3107 TCP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 1604 svnserve -> 3690 TCP c:\svn\bin\svnserve.exe 5288 iexplore -> 123 UDP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 137 UDP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 138 UDP C:\Program Files\Internet Explorer\iexplore.exe 1372 -> 445 UDP 4 System -> 500 UDP 1604 svnserve -> 1033 UDP c:\svn\bin\svnserve.exe 2044 ccProxy -> 1364 UDP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 5288 iexplore -> 1900 UDP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2065 UDP C:\Program Files\Internet Explorer\iexplore.exe 5288 iexplore -> 2081 UDP C:\Program Files\Internet Explorer\iexplore.exe 2044 ccProxy -> 2489 UDP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 2044 ccProxy -> 3106 UDP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 2504 -> 3776 UDP 2916 ccSvcHst -> 4293 UDP C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 5288 iexplore -> 4500 UDP C:\Program Files\Internet Explorer\iexplore.exe I am a 30 year IT professional that has dealt with OS installs and generally am fairly good at avoiding these issues. I even found a virus in China with Panda and Sent a copy to CERT for study. Had to kill a task in task manager and cleanup the hosts file to get to Panda to do the cleanup. So don't be afraid I am a complete newbie. |
 |
 
|
|
Dec 21 2007, 08:40 PM
Post
#2
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
They maybe tracking cookies but Norton has already found a tracking cookie and Adware has 30 entries to complain about as I did not flush the machine with privacy mantra before the scan I expect a large number of cookie issues. I also run eraser on this machine nightly along with a privacy mantra cleaning at least once a day. Firefoxand Netscape are set to purge everything configurable at the end of every session. IE is even set to flush his Temporary Internet folder on close. I will complete the full battery of scans recommended and report back when they are completed. Unless someone gets my attention before that is completed.
|
|
|
|
|
Dec 21 2007, 08:47 PM
Post
#3
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
I'm sorry this machine has Windows XP Media Center Fully patched (not Professional) -- the only machine I have with Media Center.
|
|
|
|
|
Dec 22 2007, 08:31 AM
Post
#4
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
The browser hangs may have been because I failed to reboot after installing SpywareGuard. Norton finished finding 1 tracking cookie -- cleaned. Adware hung scanning folders after finding 32 items would not stop scan -- could not get to clean. Ran Privacy Mantra to flush trash including IE items similar to the purges set for the other browsers above. Restarted machine CCSVCHST was slow to shutdown, sysfader hung twice had to cancel to restart. I took a new fport scan. restarted adware scan, started panda, trend micro and bitdefender simultaneously. Bitdefender flags but cannot clean SuSe 10 amavisd installer RPM package file names indicate sample virus signatures associated with the linux anti-virus package. Panda's online scanner page just expired and bitdefender and trend micro appear to be hung. I will run these serially along with fsecure after reboot on completion of adware scan.
Startup fport scan minus a couple of servers I shut down. FPort v2.0 - TCP/IP Process to Port Mapper Copyright 2000 by Foundstone, Inc. http://www.foundstone.com Pid Process Port Proto Path 1344 -> 135 TCP 4 System -> 139 TCP 4 System -> 445 TCP 248 ccProxy -> 1025 TCP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 4 System -> 1026 TCP 2924 -> 1027 TCP 1508 ccSvcHst -> 1033 TCP C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 4 System -> 123 UDP 1508 ccSvcHst -> 123 UDP C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 4456526 -> 137 UDP 3276851 -> 138 UDP 1344 -> 445 UDP 4 System -> 500 UDP 7602297 -> 1900 UDP 4 System -> 1900 UDP 248 ccProxy -> 3776 UDP C:\Program Files\Common Files\Symantec Shared\ccProxy.exe 2924 -> 4500 UDP |
|
|
|
|
Dec 23 2007, 11:46 AM
Post
#5
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
IE Browser hangs - this time after completion of bitdefender scan. IE browser is prone to crash when editing text on a retrieved page -- disk tends to get very active just before the crash and request to send to Microsoft. Scanned with Norton, Panda, Trend Micro, BitDefender and F-Secure -- all clean.
hijackthis log after crash -- IE windows still on screen unclosed Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:40:40 AM, on 12/23/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\arservice.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\iPod\bin\iPodService.exe c:\windows\system\hpsysdrv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Program Files\Privacy Mantra 2.04\privacymantra.exe" -minimized O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adaptive Server Anywhere - utlDbSvc (ASANYs_utlDbSvc) - iAnywhere Solutions, Inc. - C:\Program Files\Sybase\SQL Anywhere 9\win32\dbsrv9.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: SNV Repository (SVNService) - http://subversion.tigris.org/ - c:\svn\bin\svnserve.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 8397 bytes Please help |
|
|
|
|
Dec 23 2007, 03:22 PM
Post
#6
|
|
 BC 1st Responder Group: Global Moderator Posts: 10,542 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
Hi pasha19
I have moved your Topic that includes a HijackThis log here to the Misplaced HJT Logs forum. You posted your log in a forum not intended for HijackThis logs analysis and probably missed the directions we provide to those who require assistance. We can only allow topics with such logs in the HijackThis Logs and Malware Removal forum. This restriction is to ensure you get the best help available, from those who specialize in malware anlaysis and removal. It also should prevent you from receiving ineffective or even potentially dangerous advice, whether well meaning or not. Prior to posting a HJT log, we ask that you please read and follow all instructions in the pinned topic titled Preparation Guide For Use Before Posting A Hijackthis Log. Following the steps in this Guide will allow the HJT Team to quickly help you with specific fixes for what may remain on your system. Please complete all the steps in the Guide. If you have performed some of them already, then just continue with the next. If you can't perform a step, then skip it and continue with the next. The last step will include downloading and using the most current version of HijackThis if the first line of your log does not appear as follows: Logfile of Trend Micro HijackThis v2.0.2 Please note that it is important that HijackThis be run and a log created while in normal mode. If you run it and create your log while in safe mode, you will be asked to redo it again properly. When you have completed those steps, start a new topic in the HijackThis Logs and Malware Removal forum as directed in the Guide to post a new log. Please DO NOT post any more logs to this topic, or post a log again in the wrong forum. The Misplaced HJT Logs forum is strictly a holding area where the BC Staff can assist you with preparations for and to properly post your log. If you have a question or encounter a problem in the Prep Guide, please do post back to this topic; that is what it is here for. When your new HJT log is posted in the proper forum, please reply to this topic with a link to your new topic. Once that is done, a Member of the HJT Team will analyze your log and assist you with step by step instructions to clean your computer or otherwise advise what needs to be done. Thanks for your cooperation and good luck. The BC Staff ~ rigel -------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook Happy Valentines Day!!! |
|
|
|
|
Dec 23 2007, 07:55 PM
Post
#7
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
Nigel;
There are two different machines this is a HP desktop Win XP Media Center -- this and the udp 6646 issue are is a Tecra 8000 WIn XP Pro. Please do not confuse the two. I did not do an HJT on the Toshiba, yet. |
|
|
|
|
Dec 23 2007, 08:02 PM
Post
#8
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
Nigel I will go back to the beginning and do them correctly -- thanks for the notice to clean up my act.
|
|
|
|
|
Dec 23 2007, 09:14 PM
Post
#9
|
|
|
BC 1st Responder Group: Global Moderator Posts: 10,542 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
My apologies pasha19. I will now reopen the other topic.
rigel -------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook Happy Valentines Day!!! |
|
|
|
|
Dec 25 2007, 10:36 AM
Post
#10
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
Both machines seem to be detecting and cleaning adware-memwatcher with trend micro.,repeatedly in separate runs I have a feeling it is reinfecting one machine from the other so I am currently cleaning one machine with the other off and will clean the other after shutting off the first. I hope this will cause adware-memwatcher go away for good.
Second Issue Panda has found a "potentially unwanted tool:Application/KillApp.b" as file c:\hp\bin\killit.exe. Is there any chance this is legit from HP or should I delete it? Third issue -- more of a gotcha with Avast! AntiVirus running I could not run Panda -- it detected a virus in one of the panda downloads -- I assume to be strings for the AV checks. -- the Panda scan is clean Avast is restored to active protection status and I will redo all other scans on the affected machine as the virusscanner was down to run Panda. Fourth issue is Adware 2007 considered equavalent to adware SE if not I will uninstall and reinstall as indicated.? Thanks so far with any luck I may successfully complete step 4 soon. |
|
|
|
|
Dec 26 2007, 07:35 AM
Post
#11
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
HP Core Duo tower Microsoft Windows Media Center SP2 Fully Patched Windows Simple File Sharing Off Normal Protection Norton Internet Security 2008 scans nightly SpyBot S&D update daily scans about every other day and when updated SpywareGuard (after infection) update daily SpywareBlaster update daily Adware 2007 update daily scans about every other day and when updated Browsers/Maintenance Internet Explorer Purge cache on close Firefox Purge all configurable items on close Netscape Purge all configurable items on close Privacy Mantra Purge all configurable items except User Plugins Eraser -- cleans up freespace nightly Scanned with all of the above multiple times until the following state was achieved F-Secure Online Scanner Panda ActiveScan Trend Micro HouseCall BitDefender Mcafee Stinger v3.8.0 Mostly tracking cookies found Cleaning and reinfection and recleaning Of Adware - memwatcher By Trend Micro Housecall Last cleaning this and a linux box where only machines on local network Possible undesired Application/KillApp.B in file C:\hp\bin\Killit.exe Should this be deleted Issues Something is undoing portions of Spybot's immunizations 98 - 800 items are missing between runs. This was during a scan after all of the above was completed. All scans had reported this machine to be clean. I was getting ready to submit the HJT log for this machine and freeze changes. I was making one last Trend Micro Housecall pass just to be sure. Adware - memwatcher continually seems to reappear no matter how I scan -- how do I get rid of this pest. Is this one of those things that must be removed in safe mode with recovery off? Just got a message early during this rerun of Trend micro after removing adware - memwatcher for around the third time on this machine that a virus was found that could not be cleaned. Instructions are supposed to appear in red in the results window to notify me what needs to be done -- no such instructions have appeared. The scan seems to be reinitiating from the beginning. The scan finished and there was no indication of the infected file to remove. Symptom History NIS has reported 2-3 unsuccessful attacks in last couple of days seeming associated with web pages Have been browsing for others Voluntary Help activity scans all followed attacks the items flagged did not penetrate Browser hangs -- numerous during scanning as well as normal browsing Browser crashes after whir of disk activity sometimes while browsing sometimes while entering data on a web page Seems to occur after an hour or two online and become frequent Got really bad after SpywareGuard was introduced into the system for IE and FireFox has gotten better with cleanup Netscape appears unaffected CCSvcHst slow to shutdown but does SysFader almost always must be canceled after two attempts to wait for close The SysFader part now appears to be intermittent perhaps associated with a browser hang. Can run Privacy Mantra Clean more than once before clean function reports already cleaned New symptom today IE just literally disappeared from my screen with a whir of disk activity and no requirement to abort or request to send to Microsoft. Have had Wireshark running on the same machine did not notice anything peculiar associated with incidents on this machine. Current Status I am not sure this machine is free of Adware - memwatcher This machine still contains c:\hp\bin\Killit.exe, as noted above. IE has not been used except for the scans therefore has hung and aborted less in the last 24 hours. However IE did literally just disappear as noted this morning. Any assistance will be appreciated -- thanks for being here. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:34:23 AM, on 12/26/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\arservice.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe C:\WINDOWS\ARPWRMSG.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\HP\KBD\KBD.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Wireshark\wireshark.exe C:\Program Files\Wireshark\dumpcap.exe c:\windows\system\hpsysdrv.exe C:\Program Files\Netscape\Navigator 9\navigator.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [DMAScheduler] c:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [com.codeode.privacymantra] "C:\Program Files\Privacy Mantra 2.04\privacymantra.exe" -minimized O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - S-1-5-18 Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe (User 'SYSTEM') O4 - .DEFAULT Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe (User 'Default user') O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user') O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{C4B25B6D-CFBA-4B1B-932E-B795B409C1F3}: NameServer = 192.168.53.4 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adaptive Server Anywhere - utlDbSvc (ASANYs_utlDbSvc) - iAnywhere Solutions, Inc. - C:\Program Files\Sybase\SQL Anywhere 9\win32\dbsrv9.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: SNV Repository (SVNService) - http://subversion.tigris.org/ - c:\svn\bin\svnserve.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 8914 bytes I will freeze software changes and submit an HJT log and hope someone wiser than me can assure this adware-memwatcher goes away for good. |
|
|
|
|
Dec 26 2007, 07:40 AM
Post
#12
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
rigel;
Sorry about the error in making the last post copying test and opening it in the correct place and going to try to reply to this to close it. |
|
|
|
|
Dec 26 2007, 07:59 AM
Post
#13
|
|
|
Member Group: Members Posts: 92 Joined: 21-December 07 From: Michigan Member No.: 178,104 |
This has been moved to the correct place, i hope, and should be closed. Thanks for the patience.
|
|
|
|
|
Dec 27 2007, 12:30 AM
Post
#14
|
|
 Bleepin' Animinion Group: Site Admin Posts: 10,613 Joined: 18-August 05 From: Now On... Member No.: 31,547 |
Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.
From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean. Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond. If after 5 days you still have received no response, then post a link to your HJT log in the thread titled "Haven't Had A Reply In Five Days?". To avoid confusion, I am closing this topic. -------------------- The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life. Andrew Brown  "On the keyboard of life, always keep one finger on the escape key." — Scott Adams. Become a BleepingComputer fan: Facebook |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 9th February 2010 - 03:51 PM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.