I have some sort of Malware, requesting assistance

[Woolong]

Nevermind this post, I'm retarded.

 

[Woolong]

As much as I hate bumping this topic so much, I ran Kaspersky in safe mode. Again. Found nothing.

Windows Defender: Nothing
Spybot: A few bots, nothing much else
Adaware: A few tracking cookies

Total time: Atleast 7 hours wasted.

And I'm going to be blowing even more when I reformat. Again.

If not for the fact that no data has been stolen/corrupted, I'd be going on a killing spree right now.

Edit: New Hijackthis log I ran in Safe Mode:

Logfile of HijackThis v1.99.1
Scan saved at 8:12:00 PM, on 1/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\HJT\ShitKiller.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.luelinks.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda...86/client/wuweb_site.cab?1167281989234
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup...86/client/muweb_site.cab?1167699915312
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

 

[mechBgon]

If you're interested in some more stuff to try, John has a super anti-malware guide on this page. The antivirus scanning is just one prong of the overall attack, and I may put too much hope on it solving problems by itself.

 

[Woolong]

deleted: Trojan program Trojan.Win32.DNSChanger.as File: F:\System Volume Information\_restore{2ADD4CDD-EB0C-4D81-93FA-647572C9BEEC}\RP138\A0008454.exe//PE-Crypt.PolyCryptA
deleted: Trojan program Backdoor.Win32.Magicon.f File: F:\System Volume Information\_restore{2ADD4CDD-EB0C-4D81-93FA-647572C9BEEC}\RP138\A0008456.dll//UPX
deleted: Trojan program Trojan.Win32.DNSChanger.as File: F:\System Volume Information\_restore{2ADD4CDD-EB0C-4D81-93FA-647572C9BEEC}\RP138\A0008457.exe//PE-Crypt.PolyCryptA

Kaspersky just found these.

Edit: Could I have some recommendations? I'm running out of patience and am just about ready to take a sledge to my hard drive.

My new God damn hard drive...

 

[mechBgon]

Originally posted by: Woolong
deleted: Trojan program Trojan.Win32.DNSChanger.as File: F:\System Volume Information\_restore{2ADD4CDD-EB0C-4D81-93FA-647572C9BEEC}\RP138\A0008454.exe//PE-Crypt.PolyCryptA
deleted: Trojan program Backdoor.Win32.Magicon.f File: F:\System Volume Information\_restore{2ADD4CDD-EB0C-4D81-93FA-647572C9BEEC}\RP138\A0008456.dll//UPX
deleted: Trojan program Trojan.Win32.DNSChanger.as File: F:\System Volume Information\_restore{2ADD4CDD-EB0C-4D81-93FA-647572C9BEEC}\RP138\A0008457.exe//PE-Crypt.PolyCryptA

Kaspersky just found these.

Ah HAH. Do you recall seeing anything like this pic or this pic (minus my added text), because those are a trap. And DNSChangers are one of the usual payloads.

Looks like the updated Kaspersky definitions are helping get some headway, at any rate.

 

[Woolong]

Not really. Is there a way to check my codecs/running activex files?

Something else: The DEP error never popped up in Safe Mode.

 

[mechBgon]

Edit: Could I have some recommendations?

Yeah. Back up your stuff to your spare drive, unplug it, nuke the other drive like I explained before, and reinstall Windows. Get it fully secured and defended before you plug in your old drive to transfer stuff off of it.

In the future, consider using a Limited account and possibly slap a SRP on top of that, as well as antivirus, firewall, router, tons of skeptical common sense against using warez/etc (just sayin'), and keeping your software updated. The power to keep the system clean is yours to keep, or yours to gamble with & lose, and a Limited account is a major improvement in many ways.

 

[Woolong]

Limited account... So I'd have to enter my admin account to install/uninstall programs?

Seems like a pain, since I do that often.

 

[mechBgon]

Originally posted by: Woolong
Limited account... So I'd have to enter my admin account to install/uninstall programs?

Seems like a pain, since I do that often.

Yes, you would have to bust out the Admin account or else use RunAs to run specific things with your Admin account's credentials. To see RunAs, hold the shift key down and right-click a program shortcut. One of the options is RunAs, which lets me run stuff as an Admin from within my Limited account, or vice versa, as long as the account has a password.

Think of it this way: you grab my Glock out of my holster and try to shoot me with it, but HAHA SUCKAH IT'S NOT LOADED :evil: That's what a Limited account does for you, there's no power laying around to do the stuff that Kaspersky is now finding you got done to you. And Limited+SRP is like an unloaded pistol that's not even able to take ammo.

 

[Woolong]

I'll think about it.

Any more programs I could try in safe mode?

Edit: In order to have a more open minded approach, from here on I'd like to consider this problem Malware, not specifically a worm, as I don't exactly know what it is yet.

 

[mechBgon]

Originally posted by: Woolong
I'll think about it.

Any more programs I could try in safe mode?

Yeah, try the stuff in John's malware-removal guide that I linked to above. He removes malware for a living, so he probably knows what he's talking about 🙂

 

[Woolong]

Originally posted by: mechBgon

Originally posted by: Woolong
I'll think about it.

Any more programs I could try in safe mode?

Yeah, try the stuff in John's malware-removal guide that I linked to above. He removes malware for a living, so he probably knows what he's talking about 🙂

How did I miss this?

*facepalm*

Edit: Anyway, I'm probably going to go out and buy a DVD burner next week. I'm going to make a checklist of all of my important files, make sure I have backups of my programs and things (such as DeadAIM, of which a friend 'liberated' for me), make sure I find my program DVD's that are somewhere around here... And then I'm going to NUKE both of these Hard Drives. If I can't find this problem by this weekend (which I doubt I will) I'm just going to restart all together. If it happens AGAIN, well, I'll have to find the offending program that's doing it. Does anyone here have a list of programs that contain such malware? Perhaps it's embedded in a Firefox extension I have? Or maybe from Avant Browser (which I recently removed)? I may have overlooked something somewhere.

 

[mechBgon]

Does anyone here have a list of programs that contain such malware?

Warez, cracks, keygens, etc. Think about it.

 

[Woolong]

Well... Hm. I don't have basically any 'liberated' games... There's one I have, but that only came about after I had my new hard drive, plus my friend has it. I have another, as well as two other applications, but those all came way before the problem even arose on the first hard drive.

I don't bother with warez and cracks unless other people have used them successfully. And I don't do Keygens at all.

I do, however, download torrents... Perhaps that has something to do with it. I'll have to try and remember what I downloaded around the time the problem arose... I know the website it came from, since I only download videos from one tracker.

<_<

 

[Woolong]

Well, I've been digging through my registry in hopes of finding whatever file it is that's running when I boot Windows, hogging my system resources. So far, DEP shuts off an instance of svchost, and there's also an instance of it in the task manager that's hogging system memory for seemingly no real reason.

What is svchost, anyway? Is it just an executable that runs a .dll file? Because if it is, I've been wondering how to scan my currently in use .dll's to see if there's a mofodick running when he shouldn't even exist.

And yes, I know about rundll32.exe, as I see that in my process list a lot as well. And right now, I'm skeptical of it.

Edit for about the fourth time now: I fixed the startup lag problem: I had one hard drive as slave, the other as CS. This hasn't been a problem until now, and for some reason after it having arisen, a simple switch of a plastic circuit completer fixed that problem... DEP still ruins the day, though.

I'm running anther virus scan. And to be safe, I'm going to unplug my computer from the network unless I really need the connection for something.

Also: I installed CCleaner. Should I clean my registry with it? I'm always quite iffy about those kinds of things.

Side note: I hate Logitech. Goddamn Setpoint, resetting my lefthanded click to righthanded every time I reset the computer... Their keyboard software doesn't log my toggles, either, so every time I restart I have to reenable num lock to type in my password.

Screw you, Logitech.

Speaking of which, is there a way to lock the windows reg key, 'lefthandedclick', or something to that extent? Then I won't have to worry about that.

Thanks again.

 

[mechBgon]

I just got home from a super-long day at work 🙁 so to be quick:

The real svchost.exe is part of normal Windows operation, a completely clean system will have several of it running. Malware could use that name to run from some other folder, and malware could be using svchost too.

I don't know the answer to the lefthandclick question 🙁

 

[Woolong]

Son of a bitch. Still nothing.

I'm beginning to think I don't actually have a malware based problem, just a corrupted Windows file that somehow jumped from one drive to the next.

...

 

[Woolong]

Well, I did a Hijackthis log of my system startup processes...

StartupList report, 1/5/2007, 3:10:35 PM
StartupList version: 1.52.2
Started from : C:\HJT\ShitKiller.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.5730.0011)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sstray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS\regedit.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\HJT\ShitKiller.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
Logitech SetPoint.lnk = ?

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

nForce Tray Options = sstray.exe /r
TCASUTIEXE = TCAUDIAG.exe -off
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
NeroCheck = C:\WINDOWS\system32\\NeroCheck.exe
SunJavaUpdateSched = "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
zBrowser Launcher = C:\Program Files\Logitech\iTouch\iTouch.exe
DeadAIM = rundll32.exe "C:\PROGRA~1\AIM\\DeadAIM.ocm",ExportedCheckODLs
IMJPMIG8.1 = "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
MSPY2002 = C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
PHIME2002ASync = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A = C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
Logitech Hardware Abstraction Layer = "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
(Default) =
Kernel and Hardware Abstraction Layer = KHALMNPR.EXE
Windows Defender = "C:\Program Files\Windows Defender\MSASCui.exe" -hide
AVP = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

googletalk = "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
Steam =
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

--------------------------------------------------

Enumerating Task Scheduler jobs:

MP Scheduled Scan.job

--------------------------------------------------

Enumerating Download Program Files:

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\System32\LegitCheckControl.DLL
CODEBASE = http://download.microsoft.com/download/...617-af65a72a0465/LegitCheckControl.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupda...86/client/wuweb_site.cab?1167281989234

[MUWebControl Class]
InProcServer32 = C:\WINDOWS\system32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftup...86/client/muweb_site.cab?1167699915312

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 6,085 bytes
Report generated in 0.047 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Can anyone tell me if the things that I have running on startup are problematic?

 

[btcomm1]

What is the exact message you are getting about DEP?

Do you have an HP printer?

I did some research and found some people keeping getting an DEP error message that is caused by HP Software Update. If you uninstall that from add/remove programs you may get a bunch of DEP errors but after that the issue may completely go away.

 

[Woolong]

...I didn't even think of this. I do have an HP printer.

Thing is, I'm not the only one on the network who uses it. My entire family does. Yet I'm the only one getting the problem. Perhaps I should check for updates...

As for the exact message, It says 'Generic Host Process for Win32 Services has encountered a problem and needs to close.'

 

[Maxspeed996]

hmmm...that's just odd...but you got me thinking about my own main machine as well....I've got like 9 instances of svchost.exe running at any given time....it just makes me think something is going on in the background....I think that a good ol' backup ....format , and reinstallation of windows is in order.....then definately set up your user accounts as limited...these things will go a long way in keeping your box secure for longer.

 

[Woolong]

I really don't want to do the limited accounts, since I save in Windows quite often.

And come to think of it, I installed the HP drivers and around that time the DEP error started. Also, I don't know what's causing the lag, but when I enter the task manager, an instance of svchost is running at 100,000k or so using nearly 100% CPU usage.

Edit: Well, I stopped all HP related components from running on my computer on startup... I'll see what happens the next time I restart.