Windows XP Puzzlement? solved

Printable View

January 9th, 2004, 02:30 AM
MrLinus

Windows XP Puzzlement?

I'm trying to help a student with an issue via chat and something he gave to me has me a bit puzzled. From what I can tell his machine is named your-us67pi6luv. Now here's the puzzlement: this "name" is all over the Internet. I want to eliminate it as a potential virus/worm effect but I'm not sure if this is a default name giving by a manufacturer or by Microsoft.

Anyone seen this as a machine name on a Windows box?

[Edit]

I have suspicions of SoBig.F@mm.... but not sure as I can't find any matches to this.
January 9th, 2004, 02:38 AM
slick8790

i googled it and saw it occuring a lot in mail headers... is he running a mail server on his computer?

slick
January 9th, 2004, 02:40 AM
pooh sun tzu

I don't have too much time on me right now, but I have noticed that

your-us67pi6luv

points to (at least in email headers) a university, and a relgious group discussion?

example: http://www.ibiblio.org/pardo/birds/a.../msg01333.html

I don't see anything calling it a virus, but it makes me wonder if it is being used only internally for that system alone. A bit busy, but as soon as I get a moment I'll look more into it.

However, what does make me hesitant is I saw it being used as a direct HTML link, not even as a proper standard.

<BODY bgColor=3D#ffffff=20 background=3Dcid:016801c3945c$6db2c3c0$88f71643@yourus67pi6luv> on

http://lists.eskiedog.com/pipermail/...er/002432.html

Anyways, have to run! Goodluck!
January 9th, 2004, 02:41 AM
MrLinus

Nope. No webserver either...

Part of his netstat -a

Quote:

Proto Local Address Foreign Address State
TCP your-us67pi6luv:epmap your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:microsoft-ds your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:1025 your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:1029 your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:1034 your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:1050 your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:5000 your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:1041 your-us67pi6luv:0 LISTENING
TCP your-us67pi6luv:netbios-ssn your-us67pi6luv:0 LISTENING

And I don't think he has a firewall (he's not a full student of mine... yet :D)
January 9th, 2004, 02:46 AM
MrLinus

pooh, interesting that you bring this up:

Quote:

However, what does make me hesitant is I saw it being used as a direct HTML link, not even as a proper standard.

<BODY bgColor=3D#ffffff=20 background=3Dcid:016801c3945c$6db2c3c0$88f71643@yourus67pi6luv> on

Because check this picture's name
January 9th, 2004, 02:46 AM
slick8790

looked at SoBig.F@mm and according to symantec:

Quote:

The worm uses its own SMTP engine to propagate.

However, the article continued:

Quote:

The worm de-activates on September 10, 2003. The last day after which the worm should stop spreading is September 9, 2003.

Is his system clock up to date? An out of date sytem clock would probably let the worm stay.

slick
January 9th, 2004, 02:49 AM
MrLinus

Well, see.. here's the thing that's bugging me: one of the reasons I've been helping him is that he claims the school's website is giving him pop-ups (which no one else experiences -- he's got a thread on the school forum that I've been going through with him). He's run various spybot, adaware and AV software with no luck.

It makes me think variant. At least, I suppose I can eliminate that this is a default name put in by MS and/or a manufacturer like Dell?

In addition, all the definitions of So.Big.F@mm don't mention machine name changes.
January 9th, 2004, 02:58 AM
slick8790

How many people have confirmed no popups? i'd like to see a link, just in case. maybe try booting in safe mode and run adaware and spybot and AV? i dunnno, this is an unusual one, im just throwing out ideas.

slick
January 9th, 2004, 03:41 AM
phishphreek

When I get new computers from dell, they computer name has to do with dell and then random characters after that.

like: dell-d3a5s68 or somthing of the sort.

I have to setup another one tommorrow... so if you can wait till tomorrow... I can confirm this.

when you install it yourself, it asks you what you want to make it.

some manufacturers will go only as far as to install and to the point where you name it yourself and then setup user accounts.
January 9th, 2004, 03:56 AM
pooh sun tzu

I looked around more and it seems like it is coming from a university, and maybe as a mask to each user's real IP behind the university's connection. Check this out, a security advisory for UFL:

http://www.health.ufl.edu/mail-archi.../msg00017.html

Does he/she attend ufl or utk?

Also, I found a linking jpg to that hostname:

http://groups.msn.com/LittleRockAdul...o&PhotoID=3601

From a little Rock community? Man, I can't find any documentation on this hostname.
January 9th, 2004, 04:06 AM
MrLinus

That was the picture link I had posted earlier, which makes me think "virus/worm". And no, the student doesn't attend or is anywhere near UTK.

I went through the thread he posted on the student forum and he mentions that every time he changed his "internet options" they got changed again. The popup is for a "survey" (to make money at home).
January 9th, 2004, 04:08 AM
pooh sun tzu

My apologies for reposting the picture, when I tried your link it came up as "could not find search".

Hmm, why not have him scan for a virus:

http://housecall.antivirus.com

A free, online based ActiveX virus scanner that has never failed me. Better to scan and be sure than wonder if it is in fact a virus.
January 9th, 2004, 04:10 AM
MrLinus

I'll suggest it to him.. If it doesn't pull anything I'm gonna be at a loss of where to search. I've also given the student some registry keys to check (in case something is there).

I'm beginning to wonder if this is a new variant of something.. That picture with the weird-ass name might be worthwhile for someone to poke around in to see if there's something there..
January 9th, 2004, 04:28 AM
Sheperd

possible

go to download.com get a prog thats called hijackthis and run it. what it will do is scan ur registery and show u both legit and **** software keys (spyware). u can tell it to remove all the keys and see if that pop comes back (warning u may need to reinstall programs and special plugins) and have both ad-aware and spybot up to date and if it is an NT machince (2000 or XP) lock the HOSTS file and remove anyother entery in it except localhost.

see if that helps other than that he can always format and reinstall the OS and that should fix all of his/her problems (hehehe)
January 9th, 2004, 04:32 AM
pooh sun tzu

Quote:

warning u may need to reinstall programs and special plugins

I really don't like the sound of that. If it deletes legit programs then I wonder what else it deletes that we can't detect.

I do recommend, to both the user MsMitten is talking to, and Shepard, to use Spy Bot Search and Destroy as a spyware removal tool.

http://www.safer-networking.org/

It's freeware, it's updated very often, and searches for a huge list of specific spyware, ad ware, and worm builds, and snags the deeply registry hiding things that ad-aware tends to miss. Since he hand codes in the search locations the programs looks for, we know it is only snagging real and legitimate spyware rather than taking a crack guess and removing Photoshop 7 :) Just my advice, because from my experience, like the virus scanner above, it has never failed me or the people I get to run it.
January 9th, 2004, 04:39 AM
Sheperd

hijackthis only deletes registry keys not the actuall programs files
thus the file will be intact but they programs wont work properly because they are not linked

and u can always tell the program not to delete the keys that u dont want to and if u do by accident it keeps a back up of everthing it removes

so its a relitively safe program if your not a total idiot but from the sounds of it, doesnt seem like we have an issue in that department
January 9th, 2004, 04:46 AM
Striek

Seeing that it appears usually in email and bbs message headers (where a human wouldn't put it), I would agree with Phish and say that it is a default name of a manufacturer somewhere. Every reference to it seems to be the computer's name, and none seem to be placed there by humans. It could also be a proxy service used by a few ISP's.

I wouldn't worry about it being a sign of something else, though. There just aren't enough refernces to it being related to a virus to draw that conclusion IMHO.
January 9th, 2004, 07:33 AM
Noia

Hijackthis DOES delete files if you ask it to, thats why it makes backups of every thing. I think Hijackthis is your best bet at the moment, it might well be a BHO
January 9th, 2004, 10:23 AM
xicepik

No funny processes are running on his computer? (I guess he already look for that but who knows)

You can also look for BHO Cop, a great program that I use for checking those nasty BHO.

Oh, and I found a lot of stat pages for web sites that has this computer name as the remote host and they are kind of old, so it's probably not a virus (well for the hostname part).. If it is, well the virus is out since a lot of time without anybody noticing it. So my guess is also a default config or a proxy somewhere (still talking about the host name problem).

For the popups part, you can also look at CVWShredder and also try hijack-this. Maybe it's one variant of CWS spyware.
(http://www.spywareinfo.com/~merijn/downloads.html)
(http://www.spywareinfo.com/~merijn/cwschronicles.html)
(http://www.spywareguide.com/product_show.php?SPY=599)

Also, what happen if he enters a bad url in IE? The "normal" DNS not found or some kind of search page ? And what if he clicks on the Search button of his browser? The left panel is "normal" or is that another look of search than the default IE?
January 9th, 2004, 11:58 AM
MrLinus

Well, I think I found it (and xicepik was the closest on the solution). The student answered my PM about what the page sets itself to. I got an interesting response..

Quote:

My default webpage was set to about:blank , but no matter how many times i change it, in about 5 minutes or so it will automatically change to a page named "res://mshp.dll/index.html#37049". I dont think it is a web page since it does not begins with http and it looks like it is some file inside my machine that is automatically changing my internet settings. And also i found out that the "res://mshp.dll/index.html#37049" will automatically link to a search page called "http://www.search-aid.com"

The mshp.dll/index.html was what I used for the Google search (and boy, did I find lots). This is a nasty piece of work. I'm surprised in some ways that AV companies don't consider this malicious enough for AV Software. But I suppose it isn't really a virus, it isn't really a worm, it's not really spyware (or is it?). He'll be busy today I suspect.

Now, I'm not fully familar with XP (I don't have a spare box to run it on) but shouldn't it's registry have the following:

Quote:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

He says he's missing his. I don't think I've ever run across a Windows machine without these...

Many thanks to everyone who helped. :D
January 9th, 2004, 03:00 PM
phishphreek

Quote:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr
entVersion\RunOnce

Quote:

He says he's missing his. I don't think I've ever run across a Windows machine without these...

Yes, they *should* be there. Maybe he's just looking in the wrong place?

Have him run "msconfig" from start, run.

Then click on the startup tab. He should also see his startup items in there. He can check/uncheck what he wants starting up. This is for troubleshooting purposes. I'd still delete the registry entries if you find some you don't like.

To help prevent this in the future, have him get the freeware regprot. When a new registry key is going to be added, it will ask him to allow/deny it.

It is a bit of a pain when installing software, so he can just kill the "regprot.exe" process in task manager and then when he reboots, it will be running again. It takes up VERY little memory. Right now, it is using 112k memory. That is the smallest amout of memory that ANY of my other processes are currently using.

Windows XP Puzzlement? *solved*

Windows XP Puzzlement? solved