Jump to content


Photo

Deep buried malware


  • Please log in to reply
4 replies to this topic

#1 JohnG

JohnG

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 30 June 2004 - 04:26 PM

I have repeatedly run both Ad-aware and Spybot against this system and when I
go to use IE, I get the pop-ups and page hijacks again. I have also seen 3 files that I have deleted from the desktop twice. (Silent.exe, o.bat and o)

can anyone help me with this??? :huh:
===========================
here is the log:

Logfile of HijackThis v1.97.7
Scan saved at 4:54:42 PM, on 6/30/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINJECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTSERVICE.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\USBMMKBD.EXE
C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\PROGRAM FILES\WUSB11 WLAN MONITOR\WLAN_CFG.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\AOL SPYWARE PROTECTION\AOLSP SCHEDULER.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTTRAYAPP.EXE
C:\PROGRA~1\NETROPA\ONSCRE~1\OSD.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PALM\HOTSYNC.EXE
C:\PROGRAM FILES\MSWORKS\CALENDAR\WKCALREM.EXE
C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BACKWEB.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\AMERICA ONLINE 8.0B\AOLTRAY.EXE
C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\TOOLS_95\IMGICON.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON CLEANSWEEP\CSINSM32.EXE
C:\PROGRAM FILES\BHODEMON\BHODEMON.EXE
C:\Program Files\Norton SystemWorks\Norton CleanSweep\Monwow.exe
C:\WINDOWS\SYSTEM\YWQLN.EXE
C:\WINDOWS\SYSTEM\YWQLN.EXE
C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\FREXT.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
A:\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.casescases.com/
F1 - win.ini: run=hpfsched
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar_en_2.0.111-deleon.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll (disabled by BHODemon)
O2 - BHO: (no name) - {00000000-0000-0000-0000-000000000221} - C:\PROGRAM FILES\LYCOS\IEAGENT\CSIE.DLL
O2 - BHO: (no name) - SOFTWARE - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar_en_2.0.111-deleon.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [USBMMKBD] usbmmkbd.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [WLAN_Cfg.exe] C:\Program Files\WUSB11 WLAN Monitor\WLAN_Cfg.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] c:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [42HNQFX5S@X5SW] C:\WINDOWS\SYSTEM\Ahm9.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [CSINJECT.EXE] c:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] c:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [GhostStartService] C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON GHOST\GHOSTSTARTSERVICE.EXE
O4 - HKLM\..\RunServices: [NPROTECT] c:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Startup: HP Updates.lnk = C:\Program Files\BackWeb\BackWeb\Program\backweb.exe
O4 - Startup: America Online Tray Icon.lnk = C:\Program Files\America Online 8.0b\aoltray.exe
O4 - Startup: Iomega Startup Options.lnk = C:\Tools_95\IMGSTART.EXE
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Startup: Iomega Watch.lnk = C:\Tools_95\IOWATCH.EXE
O4 - Startup: Zip Disk Icons.lnk = C:\Tools_95\IMGICON.EXE
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:\Program Files\Norton SystemWorks\Norton CleanSweep\csinsm32.exe
O4 - Startup: BHODemon.lnk = C:\Program Files\BHODemon\BHODemon.exe
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR_EN_2.0.111-DELEON.DLL/cmtrans.html
O8 - Extra context menu item: SirSearch - file://C:\Program Files\PWRSTRAF\Cache\SelectedContextSearch.htm
O9 - Extra button: Real.com (HKLM)
O16 - DPF: Yahoo! Backgammon - http://download.game...nts/y/at0_x.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.ma...ash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...8156.6217824074
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.s.../ActiveData.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.s...ta/SymAData.cab

#2 Surferess

Surferess

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 30 June 2004 - 04:29 PM

see this posting to get rid of the pop ups anyway:
http://www.surferess.com/coolwebsearch

#3 JohnG

JohnG

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 30 June 2004 - 05:09 PM

It took about 6 entries into the restricted list, but that seems to have slowed down the pop-ups. Thanks Surferess.

Now if can figure out the entry that feeds this stuff.

#4 Surferess

Surferess

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 30 June 2004 - 09:48 PM

I am so glad it helped someone. I did later find out that after reboot if sent me to a different site which I also added into the restricted it was c1dcon.d8t.biz

It does help if you do not open MSIE the 'usual' way, by clicking on the icon. Instead I Open up Outlook and click on any link inside outlook which bypasses the home page deal. Then you can go in and reset your home page. If the home page setting says about: home, don't believe it. If you click the default home page button you will see that all is not well. There is a redirect on the home page. Instead, type in a URL that you trust as the default url (like your own URL?) and use the http://www before the URL so it cannot redirect you.

I am still afraid we cannot use our banking program, paypay, ebay or any other password signon website. It is sad, but true. The news media who have traced the keylogger back to Russia have also mentioned that the server has been taken offline. However, how long till the perpetrators just upload a new html file with a new server and URL? I understand their network includes possibly as many as 80 servers.

We have installed Mozilla.org Firefox and have gone away from Microsoft. Heck with them anyway! Although, I have read the source of the original "search for.. page and it lists all the browsers and tries to change every single one to a different number count:
Here is a long and involved html coded page from their server file (this was difficult to get to) Maybe someone who knows javascript can dissect this better than I can.

<HTML><HEAD>
<TITLE>Welcome to the System Performance Wizard</TITLE>
<STYLE type=text/css>
BODY
{
FONT-FAMILY: MS Sans Serif, Verdana, Arial;
}
TD
{
FONT-SIZE: 12px;
}
P
{
FONT-SIZE: 12px;
}
DIV
{
FONT-SIZE: 12px;
}
.title
{
FONT-WEIGHT: bold;
FONT-SIZE: 13px;
FONT-FAMILY: Verdana, Arial;
}
.hand
{
CURSOR: hand;
}
</STYLE>

<script language=JavaScript>
var sUserAgent;
var agt=navigator.userAgent.toLowerCase();
var bWindows = ( (agt.indexOf("win")!=-1) || (agt.indexOf("16bit")!=-1) );
var bWindows95 = ((agt.indexOf("win95")!=-1) || (agt.indexOf("windows 95")!=-1));
var bWindowsme = ((agt.indexOf("win 9x 4.90")!=-1));
var bWindows2k = ((agt.indexOf("windows nt 5.0")!=-1));
var bWindowsXP = ((agt.indexOf("windows nt 5.1")!=-1));
var bWindows98 = ((agt.indexOf("win98")!=-1) || (agt.indexOf("windows 98")!=-1));
var bWindowsnt = ((agt.indexOf("winnt")!=-1) || (agt.indexOf("windows nt")!=-1));
if (bWindowsXP == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1"></sup></font> XP';
else if (bWindows2k == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1"></sup></font> 2000';
else if (bWindowsme == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1"></sup></font> Me';
else if (bWindowsnt == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1"></sup></font> NT';
else if (bWindows95 == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1"></sup></font> 95';
else if (bWindows98 == true) sUserAgent = 'Windows<sup><font face="Tahoma" size="1"></sup></font> 98';
else sUserAgent = 'Windows<sup><font face="Tahoma" size="1"></sup></font>';

function Trim(inString)
{
var retVal = "";
var start = 0;
while ((start < inString.length) && (inString.charAt(start) == ' '))
{
++start;
}
var end = inString.length;
while ((end > 0) && (inString.charAt(end - 1) == ' ')) {
--end;
}
retVal = inString.substring(start, end);
return retVal;
}

function BrowserDetector(ua)
{
this.browser = "Unknown";
this.platform = "Unknown";
this.version = "";
this.majorver = "";
this.minorver = "";
uaLen = ua.length;
var preparens = "";
var parenthesized = "";
i = ua.indexOf("(");
if (i >= 0)
{
preparens = Trim(ua.substring(0,i));
parenthesized = ua.substring(i+1, uaLen);
j = parenthesized.indexOf(")");
if (j >= 0)
{
parenthesized = parenthesized.substring(0, j);
}
}
else
{
preparens = ua;
}
var browVer = preparens;
var tokens = parenthesized.split(";");
var token = "";
for (var i=0; i < tokens.length; i++)
{
token = Trim(tokens[i]);
if (token == "compatible")
{
}
else if (token.indexOf("MSIE") >= 0)
{
browVer = token;
}
else if (token.indexOf("Opera") >= 0)
{
browVer = token;
}
else if ((token.indexOf("X11") >= 0) || (token.indexOf("SunOS") >= 0) || (token.indexOf("Linux") >= 0))
{
this.platform = "Unix";
}
else if (token.indexOf("Win") >= 0)
{
this.platform = token;
}
else if ((token.indexOf("Mac") >= 0) || (token.indexOf("PPC") >= 0))
{
this.platform = token;
}
}
var msieIndex = browVer.indexOf("MSIE");
if (msieIndex >= 0)
{
browVer = browVer.substring(msieIndex, browVer.length);
}
var leftover = "";
if (browVer.substring(0, "Mozilla".length) == "Mozilla")
{
this.browser = "Netscape";
leftover = browVer.substring("Mozilla".length+1, browVer.length);
}
else if (browVer.substring(0, "Lynx".length) == "Lynx")
{
this.browser = "Lynx";
leftover = browVer.substring("Lynx".length+1, browVer.length);
}
else if (browVer.substring(0, "MSIE".length) == "MSIE")
{
this.browser = "IE";
leftover = browVer.substring("MSIE".length+1, browVer.length);
}
else if (browVer.substring(0, "Microsoft Internet Explorer".length) == "Microsoft Internet Explorer")
{
this.browser = "IE";
leftover = browVer.substring("Microsoft Internet Explorer".length+1, browVer.length);
}
else if (browVer.substring(0, "Opera".length) == "Opera")
{
this.browser = "Opera";
leftover = browVer.substring("Opera".length+1, browVer.length);
}
leftover = Trim(leftover);
i = leftover.indexOf(" ");
if (i >= 0)
{
this.version = leftover.substring(0, i);
}
else
{
this.version = leftover;
}
j = this.version.indexOf(".");
if (j >= 0)
{
this.majorver = this.version.substring(0,j);
this.minorver = this.version.substring(j+1, this.version.length);
}
else
{
this.majorver = this.version;
}
}
var bd = new BrowserDetector(navigator.userAgent);
function checksize()
{
window.resizeTo(640,230);
}
checksize();
</SCRIPT></HEAD>
<BODY onselectstart="return false;" ondragstart="return false;" oncontextmenu="return false;" text=#000000 bottomMargin=0 bgColor=#fdfbec leftMargin=0 topMargin=0 rightMargin=0 marginheight="0" marginwidth="0">
<TABLE height="100%" cellSpacing=0 cellPadding=0 width="100%" align=center border=0>
<TR>
<TD vAlign=top>
<TABLE cellSpacing=0 cellPadding=0 width="100%" align=left border=0>
<TBODY>
<TR>
<TD bgColor=#fdfbec height=10>
</TD></TR>
<TR>
<TD bgColor=#fdfbec>
<TABLE cellSpacing=0 cellPadding=0 width=590 align=center
border=0><TBODY>
<TR vAlign=bottom align=left>
<TD width=91 height=30>OS Check:</TD>
<TD width=499 height=27><FONT color=blue><B>
<script
language=javascript>document.write(sUserAgent)</SCRIPT>
</B></FONT>detected &nbsp;&nbsp;<B><FONT
color=green>Clean</FONT></B></TD></TR>
<TR vAlign=bottom align=left>
<TD width=91 height=30>Browsers Check:</TD>
<TD width=499><FONT color=blue><B>
<script language=JavaScript>document.write(bd.browser+' '+bd.version)</SCRIPT>
</B></FONT>detected &nbsp;&nbsp; <B><FONT
color=green>Clean</FONT></B></TD></TR>
<TR>
<TD vAlign=top width=91><BR>SpyWare Check:<BR></TD>
<TD vAlign=top width=499><BR><IMG height=32 alt=""
src="popup7/icon.gif"
width=35 align=right border=0>
<P><FONT color=red><B>WARNING!!!</B> Your PC may be infected
with <B>SpyWare</B>. <BR>&nbsp;Click OK below to scan your
system Absolutely FREE for potentially harmful SpyWare
installed on your PC. </FONT></P>
<DIV align=center><INPUT onclick="java script:window.open('http://s13ds.d8t.biz...spyware removal' '_blank');self.close();" type=button value=" OK ">
</DIV></TR></TBODY></TABLE></TD></TR>
<TR>
<TD bgColor=#fdfbec height=10></TD></TR>
</TBODY></TABLE></TD></TR></TBODY></TABLE></BODY></HTML>

Edited by Surferess, 30 June 2004 - 09:51 PM.


#5 JohnG

JohnG

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 01 July 2004 - 01:20 PM

I let the system run all night and this morning. Again I had a screen full of pop-ups. I was busy killing processes when I got a error and a blue screen. The mother loader has to be buried deep in the registry. But I can't find it for the life of me. This is a kid's PC and a lot of the pop-ups are not "family friendly" :techsupport:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button