Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Get Rid of this Botnet


  • This topic is locked This topic is locked
3 replies to this topic

#1 threehappypenguins

threehappypenguins

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:58 AM

Posted 29 October 2014 - 04:06 PM

I have a friend with a Windows XP computer (who, by the way, I warned a long time ago that it is a sitting duck for botnets since Windows stopped updates) that I suspect is infected with a botnet.
 
I am not *entirely* clear on how they work. I have run a scan with Malwarebytes Anti-Malware, and it got rid of some minor stuff, but the problem continues.
 
On his router I have Tomato firmware running with the Web Usage feature. I can see all websites and all search queries. His computer is going NUTS with activity. The botnet (or whatever it is) is searching for anything from porn to barbies to clothing... like every 30 seconds. But he could be doing nothing on the computer, and it will do this. So I ran Hijack This and I was hoping someone can look at it and help me get rid of this thing.
 
I also looked at userinit in the registry and didn't see anything suspicious, and I looked at the host file in H:\Windows\System32\Drivers\Etc and I didn't see anything suspicious (just the localhost 127.0.0.1). Yes, his hard drive is the H drive (and not the C drive). You'll probably see stuff for Team Viewer and Winvnc (Ultra VNC). That is normal.

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 5:53:13 PM, on 29/10/2014
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)

FIREFOX: 32.0.3 (x86 en-US)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
h:\PROGRA~1\AVG\AVG2015\avgrsx.exe
H:\Program Files\AVG\AVG2015\avgcsrvx.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\Windows SteadyState\SCTSvc.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
H:\Program Files\Intel\AMT\atchksrv.exe
H:\Program Files\AVG\AVG2015\avgfws.exe
H:\Program Files\AVG\AVG2015\avgidsagent.exe
H:\Program Files\AVG\AVG2015\avgwdsvc.exe
H:\Program Files\Bonjour\mDNSResponder.exe
H:\Program Files\Java\jre7\bin\jqs.exe
H:\Program Files\Intel\AMT\LMS.exe
H:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\Wacom_Tablet.exe
H:\Program Files\AVG\AVG2015\avgnsx.exe
H:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
H:\Program Files\Intel\AMT\UNS.exe
H:\Program Files\uvnc bvba\UltraVNC\WinVNC.exe
H:\Program Files\uvnc bvba\UltraVNC\WinVNC.exe
H:\Program Files\iPod\bin\iPodService.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\Program Files\TeamViewer\Version9\TeamViewer.exe
H:\WINDOWS\Explorer.EXE
H:\Program Files\TeamViewer\Version9\tv_w32.exe
H:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe
H:\WINDOWS\system32\Wacom_Tablet.exe
H:\Program Files\Intel\AMT\atchk.exe
H:\Program Files\Analog Devices\Core\smax4pnp.exe
H:\Program Files\Parental Control\ParentalControl.Exe
H:\WINDOWS\vVX3000.exe
H:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
H:\Program Files\iTunes\iTunesHelper.exe
H:\Program Files\AVG\AVG2015\avgui.exe
H:\Program Files\Windows SteadyState\Bubble.exe
H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
H:\WINDOWS\system32\ctfmon.exe
H:\WINDOWS\system32\wbem\unsecapp.exe
H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
H:\WINDOWS\system32\NOTEPAD.EXE
H:\Documents and Settings\dad\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "H:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [atchk] "H:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [APSDaemon] "H:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] H:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [StartCCC] "H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ParentalControl] H:\Program Files\Parental Control\ParentalControl.Exe /SERVICE
O4 - HKLM\..\Run: [VX3000] H:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [PDVDDXSrv] "H:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG_UI] "H:\Program Files\AVG\AVG2015\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [Bubble] H:\Program Files\Windows SteadyState\Bubble.exe
O4 - HKLM\..\Run: [Logoff] H:\Program Files\Windows SteadyState\SCTUINotify.exe
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1844237615-261478967-1801674531-1008\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe (User 'ThomasSchool')
O4 - HKUS\S-1-5-21-1844237615-261478967-1801674531-1009\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe (User 'ThomasKubik')
O4 - HKUS\S-1-5-21-1844237615-261478967-1801674531-500\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - H:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - H:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - H:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - H:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - H:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - H:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - H:\Program Files\AVG\AVG2015\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - H:\Program Files\AVG\AVG2015\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - H:\Program Files\AVG\AVG2015\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - H:\Program Files\Java\jre7\bin\jqs.exe
O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel - H:\Program Files\Intel\AMT\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - H:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: repeater_service - Unknown owner - h:\Program Files\uvnc bvba\UltraVNC\distributer.exe (file missing)
O23 - Service: Skype C2C Service - Skype Technologies S.A. - H:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - H:\Program Files\Skype\Updater\Updater.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - H:\WINDOWS\system32\Wacom_Tablet.exe
O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - H:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel - H:\Program Files\Intel\AMT\UNS.exe
O23 - Service: uvnc_service - UltraVNC - H:\Program Files\uvnc bvba\UltraVNC\WinVNC.exe

--
End of file - 9113 bytes


Edit: Moved topic from Windows XP to the more appropriate forum.~ Animal

BC AdBot (Login to Remove)

 


m

#2 threehappypenguins

threehappypenguins
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:58 AM

Posted 30 October 2014 - 04:53 PM

*Update*

 

I formatted the hard drive and reinstalled Windows. The problem still persists, but only from that computer's IP address and no other computers in the house. Could it be network based (the router is hacked)? If so, why only the XP computer?



#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,549 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:58 AM

Posted 04 November 2014 - 03:55 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/553899 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,549 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:58 AM

Posted 04 November 2014 - 04:02 PM

You have stated that you no longer need help with this issue, therefore I am closing this topic. If that is not the case and you need or wish to continue with this topic, please send any Moderator a Personal Message (PM) that you would like this topic re-opened.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users