Number of issues..

Hello to all the helping soul,

It appears to me that I have few issues on my windows 2000 box. Please help me to get rid of it. Few of the problems are :

1) I am continously getting email which has subject line " Mail Delivery (failure bigzero@******.com)" from email id which seems to be valid in most of the case. But in reality, I never sent any emails to that ids. The content of email is even more intresting. It says something like this :

If the message will not displayed automatically,follow the link to read the delivered message.

Received message is available at:

http://www.*******.com/inbox/bigzero/...?sessionid-8827
Please tell me what it's and how can I get rid of it ?

2) Secondly, I also getting emails at regular interval which has attachments of 24 bytes which has only 1-2 line of text like, Please read the important document, important document for you etc and etc

Help me to get rid of it also.

3)My computer takes lot of time in booting. It takes more then 6-7 minutes to show me the desktop.

FYAI, I am fully up to date with all the latest patches and have N2k3 having Virus defination 12 Jan 2005. I had scan my machines quite a times but getting no information about the bugs..

Thanks in advance.

BigZero

What e-mail service do you use ? Is it spam > Im sleepy and tired so im not gonna look into it much tonight,

Quote:

---

3)My computer takes lot of time in booting. It takes more then 6-7 minutes to show me the desktop.

---

Did u check what starts up ? click start-> run -> msconfig (does that work on 2000 anyways ?, i think it does) and check what all starts under the "Startup" tab and de-select everything you dont want to run at startup and you'll get your desktop instantly....

Thanks Copyright for the prompt reply.

Quote:

---

What e-mail service do you use ?

---

Well, am getting these emails on my dad office domain account. I can't say whether it's a spam or something else. One of my classmate says that it's a virii activity and he even named that virii i.e. Netsky.P@mm. I have already checked whatever published on the Norton websites but, I can't see anything suspicious on my windows 2k pro box.

Quote:

---

Did u check what starts up ? click start-> run -> msconfig (does that work on 2000 anyways ?, i think it does) and check what all starts under the "Startup" tab and de-select everything you dont want to run at startup and you'll get your desktop instantly....

---

Well, being a kid and curious to know sevral things loads of applications are installed on my machine but none of them are started automatically except Norton.

With Thanks !
BigZero

First of all..

Don't open those emails..

your recieving them from an infected client (another computer user).

I would recommend rereading HOW Netsky collects the email addresses for sending itself out..

then check other computers on the network incase one of them is infected.. check all of them..

I would recommend downloading and running McAfee Stinger on each machine.. that is load it on restart in safe mode and start a scan..
..

OH BTW: Netsky is not the only email virus/worm that uses the "Mail delivery Error"as part of its delivery..

the virus it self may not even be on any machine on the network..
just alot of people have your email addy who are infected..
not much you can do untill they are all clean..

use a mail filter prog like Mailwasher.

cheers

Like suggested above, check your computer for virusses and ad/spyware. For the latter, I'd recomment http://www.hitmanpro.nl

[edit]Oh, crap. The program is only available in Dutch for now. They're working on an English (and German, for that matter) version though.[/edit]

Quote:

---

would recommend rereading HOW Netsky collects the email addresses for sending itself out..

---

As I understand it Netsky collects email addresses from infected machines address books and then it picks one address at random and pretends to be from that address. In nutshell, Netsky has infected a computer that had your address in its address book..

As undertaker stated, you can't do much untill all infected machines are clear from the virus who has your address.

Newkid

Another good way to see what programs are starting up automagically is to use Mike Lin's startup control panel application.

http://www.mlin.net/StartupCPL.shtml

Why don't you start by deleting the trash, temp files. Then get you computer scanned online at http://housecall.trendmicro.com.
You can then download Hijackthis and put its log online here (include your startup entries)
Get a spyware cleaner like spybot, ad-adaware or you can also try microsoft's beta spyware cleaner.

Now you have not mentioned you computer's hardware configuration like what processor and amount of ram, because if you have norton antivirus installed your startup time increase a lot (but not to 5-6 minutes except your computer's hardware configuration just meet's the recommended level's and you have lot of startup programs)

Also its a safe practise NOT TO OPEN ANY ATTACHMENT'S from unknown person.

Now this is by no means a tutorial on how to safeguard your E-Mail address but you can keep following in mind :
1. its nice to make 2 E-mail address. One should be always given to known people (like family member's,friend's and to trusted sites etc) and the second one to web-sites and newsgroups. Now when i mean trusted web-sites i mean web-sites of reputed companies.

2. If you receive any mail from unknown person on your first ID (the one you gave to family members and friend's etc) and is classified as spam by your service provider NEVER EVER OPEN IT OR EVEN IF YOU HAVE OPENED IT THEN DONT CLICK ON ANY LINKS. Even the link given at the bottom which states "click here if you do not wish to receive mails from our company again......"

3. set your junk mail filter to atleast high

4. use your 2nd ID (for web-sites etc) more often then first when you give it out on the internet to unknown people or for downloading a software. (note: lets say you want to download a nice software for free but is not know that well give this address, but let's say you want to download a trialware or shareware or even a free ware from known companies like symantec, iomega, trend-micro etc give your first ID {atleast thats what I do, so i have to check the second ID less times}

At the end remember after taking all these precaution's you can still get infected if your anti-virus is not updated or even if any of your friends or family member's get infected by a worm. so always remember to scan any attachments before opening no matter who sent the mail. AND NEVER CLICK ANY HYPERLINK SENT TO YOU BY A UNKNOWN PERSON (it doesn't matter Whether it says you have won a million $ or you have won a IBM mainframe :D )

Also keep in mind that if you use program like outlook express to read your mail configure them to show the mail in plaintext format
here's what you should do

-> Start Outlook Express
--> Tools
---> Options
----> Read
-----> Enable: Read all messages in plaintex
----> Send
-----> Mail sending format
------> Select: Plain text
----> Security
-----> Disable: Do not allow attachments to be saved or opened that could potentially be a virus (if you dont disable this one, your ability to receive attachments is almost zero. Your email virus protection should rely on the fact that you do NOT open files that you receive as email attachments if you are not ABSOLUTELY sure they are safe to be run.)
----> Maintenance
-----> Enable: Purget deleted messages when leaving IMAP folders

If you get a worm from any of your family members or any one you know tell them about it and also tell them how to get rid of it.

Thanks you all for your valuable time.

Undertaker:

Do you have any URL/ tutorial/ which can guide me 'How Netsky can collect the email address'? What are the various security precautions one should take ? How to remove individual email ids from that loop?

Guus:

FYI, there is no virus/adware/spyware on my machine. I had checked it quite a times. Two times from norton ( safe mode; w/o safe mode), 1 time from Trendmicro online( http://housecall.trendmicro.com). Not only this, I had run the Netsky removal tool but nothings comes out so far..

Newkid:

Is there anyway to break the loop and remove individual ids from Netsky log?

Brentlea:

Thanks for the URL. As mentioned earlier, there is nothing in the startup except Norton Antivirus but still machines take lots of time in booting.

Edit Message:

ByteWrangler:

There is nothing suspicious in HJT log nor in Spybot S and D. I already scanned the machine with them. Machine configurations are as follows:

Windows 2000 with Service Pack 4
Internet Explorer 6 with SP 1
Pentium 4 Processor having clock speed 2.1 Ghz
512 MB DDR RAM

Do you need any more detail ? Please let me know...

With Thanks !
BigZero

How netsky works:

http://reviews-zdnet.com.com/4520-6600_16-5122164.html

Try Disabled NAV and see if it boots faster, if not then hmmm, see what programs are running right when you boot your computer, does it boot slow in safe mode too ? Maybe its a slow PC :p ....

edit: ugh, 2.1 Ghz, not the CPU than :)

Quote:

---

Netsky.b then searches the infected hard drive for usable e-mail addresses.

---

If its okay with you why dont you post your Hijack this log here. And also see how many program are at start-up. Also one more thing why dont you try defragmenting your hard drive ( I would recommend diskeeper. its an excellent software)

Quote:

---

As I understand it Netsky collects email addresses from infected machines address books and then it picks one address at random and pretends to be from that address. In nutshell, Netsky has infected a computer that had your address in its address book..

---

Utter and absolute BULLSHIT - netsky and many other Viruses Will scan documents in your computer looking for email addies. Any virus writter wirth his salt knows that there are richer pickings in the header information of a email than you would find in the best corporate address book.. in saying that I spot a virii yesterday that uses the Windows address book..would be the first one in a long time..

If you want info on viruses go to the people who come up with the cures.. the AV companies..

where do I go for info..

http://securityresponse.symantec.com/
is my first port of call..

for info on netsky: http://[email protected]

But remember Netsky is not the only Virus that farms a PC for email addies, and is not the only one that uses the "Mail Delivery Error" method of delivery

If your recieving a lot of these messages it is very likely that a pc on the domain (I am assuming that the pc is member of a larger network) is infected.. the admin could look for unusual traffic from a machine on Port 25.

As for your machine.. Follow through on the information given above.. to be certain that it is clean (prolly full of parasite crap - that is Adware -spyware)

Cheers

As requested by ByteWrangler, Hijackthis log is as follow:

Quote:

---

Logfile of HijackThis v1.98.2
Scan saved at 10:57:24 AM, on 1/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
d:\oracle\oracle9i\bin\ORACLE.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Sify Broadband\BBClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
D:\Security\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.zdnetindia.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{05A3ABD6-64ED-4605-B55F-FDC9F8B798E5}: NameServer = 202.144.115.4,202.144.66.6

---

ByteWrangler:

Honestly, I can't do defragmentation at this stage. As I have to finish lots of assignment of this sem module and have to prepare for the exam which is drawing near.. Sorry ! :(

Und3ertak3r:

What do you think about Symantec support? Had you ever get a chance to call them and ask for support ? If not then go and ask for help, you'll change your opinion on the same day.

©opy®ight:

I had follow your suggestions and found that hardly some seconds(30-40) difference in booting when disabled norton at bootup. As stated earlier, being a kid and developer, I have plenty of application of my win2k box wiz..MS SQL Server 2000, Oracle 10g, Apache, J2SDK 1.3, Visual Studio dot net and what not... but none of them are booting at startup. I'll run thw application as and when needed.


With Thanks!
BigZero

Greeting's:
The first line of your Hijackthis log shows that your version is old. you may want to download the newer version from : http://www.hijackthis.de/downloads/hijackthis_199.zip.

besides that i see no malware entries in the log. have you done an online scan in last few days also have you installed a firewall ?

ByteWrangler,

There is hardly a difference between the newer version and 1.98.2.

Yes, I have done online scan in last few days. You might be wondering as you couldn't see any O16 DPF entries in the log. It's because I had remove all the O16 entries from the log when did the HJT scan last to last time.

As of now there is no firewall on my machine.

With Thanks !
BigZero