Trojans galore

Hi all.

I seem to have allowed trojans into my laptop. Right now I am running the following: svchost, ( which has lodgesd itself into my c: drive) and one clled MDM.exe. And those are the ones I have been able to identify. I am running Windows XP with the latest upgrades and Norton Antivirus with the latest virus definitions.

One of these trojans has proved very annoying since it changes my starting page on Internet Explorer to various german porn sites.

Thanks in advace for the help you might give me.

P.S. Forgot to mention I also run Spybot and it tells me my system is clean.

Have you tried running TheCleaner yet? It's anti-trojan software. If something resides on the machine TheCleaner will likely find it.

http://www.moosoft.com/products/cleaner/

They have a trial version that works well.

Svchost is not a trojan, it is a valid network process. Svshost on the otherhand is a problem. Notice the difference.

As imitationrust has said download the cleaner install and run it. Do this to be on the safe side. This is more likely to be a adaware/malware/spyware problem. Download and run this http://209.133.47.200/~merijn/files/HijackThis.exe

And this http://209.133.47.200/~merijn/files/CWShredder.exe

This should sort you out.

mdm is not a trojan either its microsofts debugger. this is not to say a trojan cannot be nammed mdm. search your computer for all instances of both files. right click on them, go to properties and check under version. they should all be in the system32 or i386 directory and have all ms's version information.

i dont think scvhost is a trojan either. i've been running it and nothing detects it as a trojan. windows runs about 5 processes of it for me. its always been on my system since i bought it and did a clean install of windows xp home.

Thanks to all those that replied.

I did what you recommended, I installed and ran "The Cleaner 4.1" and it weeded out the trojans that it detected.

But, after I rebooted I found myself with the same problem again. My startup page for Internet Explorer is some weird german site.

Also, I should point out that I have "Syste restore" off. I did this to allow Norton and any other security program to rewrite the registry without having it come back again with the malicious script.

Does anyone have any idea what can be done?

Nassef

P.D. I am running the cleaner again, but it is taking forever and I have no guarantee I will not suffer the same problem again after I reboot.

Quote:

---

Originally posted here by antichevere
Thanks to all those that replied.

I did what you recommended, I installed and ran "The Cleaner 4.1" and it weeded out the trojans that it detected.

But, after I rebooted I found myself with the same problem again. My startup page for Internet Explorer is some weird german site.

---

jinxy's suggestion should have done the trick for you, concerning this. You were able to run hijackthis (and TheCleaner, for that matter) with high enough privileges right? hijackthis may be too complicated for you unless you know precisely what you're looking for, given the fact that it shows you both the "good" and the "bad".

If that doesn't do the trick, just do it manually. Go to Tools-->Internet options--> General: and under homepage, set it accordingly. If that doesn't do it, try checking your hosts file.

good luck.

Thanks for answering

Well I did run HijackThis!, but, as you said, it is too advanced for me. I really don´t know what to do there.

As for changing my startup, I have done that consistently for the past three days and it just changes back.

P.S. I would also like to add that this "thing" is adding links to my "Favorites" folder.

Ok, so I am going to try my luck with HijackThis!, but since I do not know which processes to "clean" I would like for you guys to give me suggestions. Here is my log:

Logfile of HijackThis v1.97.7
Scan saved at 12:10:52 PM, on 11/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\carpserv.exe
C:\Archivos de programa\Apoint2K\Apoint.exe
C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe
C:\ARCHIV~1\NORTON~1\navapw32.exe
C:\Documents and Settings\Nassef\Configuración local\Datos de programa\System\svchost.exe
C:\Archivos de programa\Yahoo!\Messenger\ypager.exe
C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe
C:\ARCHIV~1\PANICW~1\POP-UP~1\PSFREE.EXE
C:\Documents and Settings\Nassef\Datos de programa\oaao.exe
C:\WINDOWS\System32\wcpcc.exe
C:\Archivos de programa\Apoint2K\Apntex.exe
C:\WINDOWS\DvzCommon\DvzMsgr.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\trojan cleaner\HijackThis.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = VÃ*nculos
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.microsoft.com/isapi/redir...0&plcid=0x0c0a
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Archivos de programa\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll (file missing)
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Apoint] C:\Archivos de programa\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AgenteADSL_15] C:\Archivos de programa\Telefonica\KitAIM\AimExDll.exe AimGestA.dll 7
O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NAV Agent] C:\ARCHIV~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [System] C:\Documents and Settings\Nassef\Configuración local\Datos de programa\System\svchost.exe /run
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Archivos de programa\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Archivos de programa\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\ARCHIV~1\PANICW~1\POP-UP~1\PSFREE.EXE"
O4 - HKCU\..\Run: [Rlts] C:\Documents and Settings\Nassef\Datos de programa\oaao.exe
O4 - HKCU\..\Run: [WINT] C:\WINDOWS\System32\wcpcc.exe
O4 - Startup: HotSync Manager.lnk = C:\Archivos de programa\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: DataViz Messenger.lnk = C:\WINDOWS\DvzCommon\DvzMsgr.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/09cc0249...dxIE601_es.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F0D827-8FAF-4A8F-A770-26C9468130EC}: NameServer = 80.58.4.33 80.58.34.97

Try starting SpyBot S&D in "advanced" mode and click on "tools" in the left column. Then look at BHOs, Browser pages etc and delete anything that relates to your malware problems.

Also, run the "immunize" option, and check the box (near the bottom) that protects your startpage.

Then manually reset your browser page.

Update Spybot and run it in safe mode. Whilst you are on the Spybot site get CWShredder and run that as well.

Good Luck

Thanks! Apparently that did the trick. There IS one last nagging detail. While runing Ad-Aware it told me that there was a problem cleaning wcpcc.exe and if I wanted to rebot and have it cleaned immediatly afterwards. I said yes, but it wasn´t even detected although it does show up in HijackThis!

Any ideas if this might still be a problem?

Hi,

Boot into safe mode and run AdAware again..............see if it finds anything?

Reboot into normal mode and run HijackThis again, and see if it is still running.

One more tool for you:

http://www.winpatrol.com

That should just about give you a complete set :D

Good luck

wcpcc.exe is PurityScan.b you can find removal instructions at the below link.

http://www.kephyr.com/spywarescanner....b/index.phtml

in addition to the above..

svchost should not be located and run from here..
C:\Documents and Settings\Nassef\Configuración local\Datos de programa\System\svchost.exe

there are a few viruses that will mimic that valid process.. I'd check to see the file size/properties of the one you have in the above directory.

this one is a bad guy too.. put a check mark next to it in hijackthis and have HJT delete
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/09cc024...RdxIE601_es.cab

this one here is a "blazefind" toolbar/adware leftover.. have hijckthis delete it.
O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - c:\progra~1\iesearchbar\iesearchbar.dll (file missing)

http://pestpatrol.com/PestInfo/b/bla...esearchbar.asp
more info here.


this one here is an unknown..google doesn't find any references to AgenteADSL_15, AimGestA.dll or AimExDll.exe. There are some references to "KitAIM" .. do you know what it is ? Is it something that's for AIM but in your native language ?

O4 - HKLM\..\Run: [AgenteADSL_15] C:\Archivos de programa\Telefonica\KitAIM\AimExDll.exe AimGestA.dll 7

there are a few more things you don't really need to have running and I might of missed something else.. but once you've cleaned up what we've seen so far, then it'd be best to post another log..

to nihil.. cwshredder is ok for coolwebsearch hijacks but this is not the situation here.. it's not a catch all tool.. although it doesn't hurt to run it once in a while and getting the latest version of it is mandatory as CWS is always changing it's spots.

Suggestion, harden IE, it's just good practice.

so !mitationRust.. how exactly would you "harden IE" besides keeping it updated ?

I posted some of my methods here in the thread linked below.. are there any more that would be helpful ?
http://www.antionline.com/showthread...hreadid=256621

Hi, sumdumguy

You are quite right, I did not see anything that indicated CWS, but thought I had better mention CWShredder because it will find instances that SpyBot does not, also it is updated very frequently. As you rightly point out, it is an add-on to SpyBot, certainly NOT a replacement!.

My general advice is to run all AV, Antispy, Anti Ad, anti Trojan software regularly, AFTER updating it.

Quote:

---

O4 - HKLM\..\Run: [AgenteADSL_15] C:\Archivos de programa\Telefonica\KitAIM\AimExDll.exe AimGestA.dll 7

---

antichevere appears to be using "Telefonica" (one of the largest Spanish telephone companies) to supply him with an ADSL service, and this is part of their AIM offering? If not, he has a problem!

Given this, antichevere, I would suggest that you try the online scan from Panda Software, as they are most likely to be up to the minute on local viruses?...............that is AV rather than trojan/spyware/adware advice, but might be worth keeping in mind for the future?

EDIT: Just had a thought..........check out BitDefender .............they do some free security software for AIM type applications.

Good luck

:)
Hi,
a couple of pennies,
did a fresh install recently, after I mucked up some network configuration by renaming one of my LAN connections. In the process I still had the DSL hooked up. I also transferred some back-up files onto the fresh install. The moment I ran my AV, it picked up on Win32/nachi* and some infected "svchost.exe" files, according to my AV. I double checked the back-ups and they were clean, so I must have picked them up while I was configuring the firewall and AV. I vaguely remember that I had an active connection *hammer hits head* at some time during the config process.
All is well now, I think...ran Housecall,Stinger,etc.

g8tway2u

edit: it may just have been "svchosts .exe

Came in late for tyhis one,

nihil and sumdumguy have pinned this down.. my 2cents is more a tutorial..

If you see something.. a running process.. that you are not sure about.. check it out here

http://www.liutilities.com/products/...rocesslibrary/

for this one here is the link for svchost:
http://www.liutilities.com/products/...brary/svchost/

Mind I did find the link by using google..

And The Tools mentioned Are very handy to have in you kit.. ie on a CD..

the tools I keep are:
AdAware v6
Spybot S&D and a recent Includes File
CWShredder
HiJackThis
AVG ..(I d/l a fresh copy each month for my tools cd.. but the copy on one of my machines is over a year old)
A HTML File with Links to a couple of Online AV scanners .
And a little white pill incase it all goes A.. Up..

Cheers

yeah nihil.. I'm sorry if my comments about cwshredder sounded "stand-offish".. I certainly meant no offense.. but I think you understood that. I know you know better but it's just that I see SO MANY people suggest it as some sort of cure-all for spyware or even for just any old IE hijacker that comes down the pike.

You are most likely right about that Telefonica/AIM thing.. but when google doesn't show something in a search, I usually suspect or at least raise my concern level a notch.

Und3ertak3r.. LOL.. a little white pill ? so.. how is that pill inserted ? my cd carrier doesn't have a space for little pills.. can I just glue a few to my hard drives ? :D

honestly.. deciphering hjt logs for me, is just searching google for the strings/files.. there's no magic in it and it's damn time consuming sorting through the crap.. one thing that can be helpful is Tony Klein's BHO Collection list .. that can be found along with other downloadable goodies ... right here.

Well guys (and gals if there are any)... thanks a ton. My computer is running squeaky clean from what I can gather now. I installed or upated most of the programs you suggested and haven´t had a single problem since (well after eliminating wcpcc.exe). Thanks again.

Nassef

if you want to post another log.. we can double check.. I'd do it with all your startup items re-enabled via msconfig like I suggested earlier..

but if you feel reasonably secure, then ok.. good luck and your welcome..

Im going on an old memory, but i take it you never have any problems with messages popping up saying "This computer is being shutdown by NT AUTHORITY"?

I seem to remember a notice from Microsoft saying that if you connected to the internet to download your updates, an RPC Explit that i cant remember the name of monitors the connections to the windows update site, and infects your PC, using the svchost file (i seem to remember files in the 'wins' folder within the windows folder)

Im not sure if this is anything to do with what you are suffering, butit might spark a thought in these guys who may know a little more about this.

eRK,

Research MSBLAST, Blaster Virus, Mydoom, and novarg viruses

start your search here:
www.google.com
and
http://securityresponse.symantec.com/

Even a serach of the AntiVirus Discussions forum will reveal a small discussion or 3 about the RPC-DCOM problems..

Is this what your trying to remember?

Cheers

Oh and the Little White Pill? A pain Killer.. For when the problem requires the brain to do some work.. I carry a box of them.. "you did what with the attachment!!!!?" 2 pills, "You brought what from home!!!" 1-3 pills.. Codine works well..

Yeh thats the one.. i did a lot of Research at the time, but non of which i can remember right now, just the file name that was involved :)

Cheers

What has Happend Is the Person That was in your Computer through The trojan changed ur settings.