Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Background uploader problem


  • This topic is locked This topic is locked
2 replies to this topic

#1 DaveUK9xx

DaveUK9xx

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 28 July 2009 - 07:59 AM

Hi chaps. First time in here. Something is constantly ticking away in the background uploading stuff and using about 1/3 of my total upload bandwidth (80kb/s or so of 288kb/s).

Running Netstat -b it seems to be sending data to various IP addresses followed by the word "microsoft-ds"

It's also preventing Firefox or IE from accessing the MBAM website and MBAM therefore can't update itself although I've solved that by downloading the latest MBAM Rules.ref file manually. Anyway even fully updated MBAM finds nothing wrong.

Every now and then a Google search won't access the result page and sometimes I can't even get into Google itself although a reboot has always solved that. I've deleted a few things that HiJackThis found and am left with logs that look pretty ok but the problem persists. Here's my latest log. If anyone can spot a problem I'd be most grateful.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:58:09, on 28/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Thomson\SpeedTouchUSB\Dragdiag.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\AOL\1222127742\ee\AOLSoftware.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\AOL9\aoltray.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {B12141EF-19FC-40E5-BA0E-92D718E77B87} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouchUSB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1222127742\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [AOL Dialer] C:\Program Files\Common Files\AOL\ACS\AOlDial.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\AOL9\aoltray.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{CC5318A5-AD04-4438-9C6E-7FD968ABD619}: NameServer = 92.31.242.20 92.31.242.21
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 3069 bytes

Forgot to add. System Restore is also not working anymore and I can't access any antivirus related website although other Google searches still work fine. I'm guessing this thing has a big list of sites it wants to stop you getting into.

Edited by DaveUK9xx, 28 July 2009 - 08:54 AM.


BC AdBot (Login to Remove)

 


#2 DaveUK9xx

DaveUK9xx
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 28 July 2009 - 10:53 PM

Ok solved it myself finally. There was a hidden malware dll file in the system32 directory called Gremyvk.dll. I deleted it via the Recovery Console and everything is back to normal. If anyone has similar symptoms - uploading going on in the background, unable to access any antivirus sites and system restore disabled then have a look for something similar.

#3 Guest_The weatherman_*

Guest_The weatherman_*

  • Guests
  • OFFLINE
  •  

Posted 29 July 2009 - 05:03 PM

Thanks for letting us know DaveUK9xx.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users