Spyware?

Printable View

May 19th, 2004, 09:51 AM
cgonzo

Spyware?

Running Windows XP pro. I have already used Spysweeper, AdAware, SpyBotS&D, Trojan Remover, HijackThis.
Here is the log for HT:
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\dpmw32.exe
C:\WINDOWS\System32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
\MANAGER_SCS_BOE\SYS\PUBLIC\NTDIAG.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\Oqrh8N.exe
C:\WINDOWS\System32\UjlhI59.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\rm160\Desktop\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://education.dellnet.com/
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\System32\dpmw32.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\JwimnC.exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...839.4529398148
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab

Every time I get rid of the entry directly under TrojanScanner, something else takes it's place. Also, in Taskmanager these processes keep rotating:
0qrh8N.exe
ZhqH.exe
UjlhI59.exe
Hxg525X7.exe
Mov4O.exe
ZptvKDJ.exe
I kill one and another comes back.

Also, several websites keeps coming up error 403 Forbidden
May 19th, 2004, 12:35 PM
hudsonsmith

Have you done a virus scan? I think you will find that C:\WINDOWS\system32\NOTEPAD.EXE is a trojan. Do a search on this file name and see if it matches the version in c:\windows
May 19th, 2004, 12:37 PM
cgonzo

Quote:

Originally Posted by hudsonsmith

Have you done a virus scan? I think you will find that C:\WINDOWS\system32\NOTEPAD.EXE is a trojan. Do a search on this file name and see if it matches the version in c:\windows

Um, Actually, I had notepad open at the time I ran the log. Antivirus is a couple of months old. Cant get it to update, cant get Spybot or Spysweeper to update either. I'll try a housecalls scan online.
May 19th, 2004, 12:44 PM
hudsonsmith

The fact that your antivirus won't update is certainly a clue. Spybot has a new version 1.3 out, which you have to download - version 1.2 will not update to it. See http://www.safer-networking.org/index.php?page=mirrors
May 19th, 2004, 12:45 PM
Stalemate

Not spyware, virus. :(
May 19th, 2004, 12:48 PM
Stalemate

This looks like it may be it, according to Google: Trjscan.exe

http://securityresponse.symantec.com...er.trojan.html
http://us.mcafee.com/virusInfo/defau...virus_k=100847

But from those random processes, you may also have another infection besides that trojan.
May 19th, 2004, 12:58 PM
Stalemate

Quote:

Originally Posted by a d e p t

...But from those random processes, you may also have another infection besides that trojan.

This may be it: http://securityresponse.symantec.com...2.bobax.a.html
May 19th, 2004, 01:00 PM
cgonzo

Quote:

Originally Posted by a d e p t

This may be it: http://securityresponse.symantec.com...2.bobax.a.html

Sounds like it. the user did say the computer would shut down unexpectedly. I'll get it patched asap.
May 19th, 2004, 01:28 PM
cgonzo

Quote:

Originally Posted by hudsonsmith

The fact that your antivirus won't update is certainly a clue. Spybot has a new version 1.3 out, which you have to download - version 1.2 will not update to it. See http://www.safer-networking.org/index.php?page=mirrors

Safer-networking is one of the sites that gives the 403 error. This is a nasty
bug...
Wait, I got it from MajorGeeks.com So far, Symantec is updated, found nothing, Housecalls found malware called BKDR sandbox.A
May 19th, 2004, 02:57 PM
cgonzo

Latest Update: Trend Micro found 10 trojans. I used their sysclean utility to delete them. Thanks, all.
May 19th, 2004, 03:34 PM
Stalemate

Excellent news.

Thanks for letting us know. https://forums.windrivers.com/images.../2005/03/1.gif
May 19th, 2004, 03:58 PM
hudsonsmith

Quote:

Originally Posted by cgonzo

Latest Update: Trend Micro found 10 trojans. I used their sysclean utility to delete them. Thanks, all.

Glad to hear it. Do I understand you correctly that Symantec missed 10 trojans that Trend found? What version of Norton is this?
May 19th, 2004, 04:09 PM
Stalemate

Quote:

Originally Posted by hudsonsmith

Glad to hear it. Do I understand you correctly that Symantec missed 10 trojans that Trend found? What version of Norton is this?

Must have been a bit more than a couple of months old.
May 21st, 2004, 07:08 AM
cgonzo

Quote:

Originally Posted by a d e p t

Must have been a bit more than a couple of months old.

Actually, Symantec Corporate. Before I updated it the lastest definitions were from February.
May 21st, 2004, 08:11 AM
hudsonsmith

But you scanned after you updated and it still didn't pick them up? Not exactly a ringing endorsement for the product.
May 21st, 2004, 08:17 AM
TripleRLtd

Quote:

Originally Posted by hudsonsmith

But you scanned after you updated and it still didn't pick them up? Not exactly a ringing endorsement for the product.

No, he said this: "Before I updated it the lastest definitions were from February."
May 21st, 2004, 08:37 AM
hudsonsmith

Quote:

Originally Posted by cgonzo

So far, Symantec is updated, found nothing

Look back
May 21st, 2004, 08:44 AM
TripleRLtd

We'll have to get to the bottom of this then. Symantec Corporate is an excellent tool. HouseCall doing better? Nah, something here doesn't sit right.
May 21st, 2004, 10:01 AM
Stalemate

Quote:

Originally Posted by TripleRLtd

We'll have to get to the bottom of this then. Symantec Corporate is an excellent tool. HouseCall doing better? Nah, something here doesn't sit right.

I agree.

One of those links I provided earlier points to a virus infection which disables and/or removes AV modules.