‎Another VX2 attack on work computer

Start a discussion

UNSOLVED

formeremployee0

updated

21 years ago

F

formeremployee0

17 Posts

0

462

June 3rd, 2005 11:00

Another VX2 attack on work computer

After having cleaned up one VX2 infestation, i have found yat another infection.

Been off work for a while and come back to find Adaware says 181 files bad. Repairs all but 2 and then repairs after reboot.

Run Trend-micro and it finds and repairs 5 traojan downloaders. Cannot repair 1 downloader as file is in use. File is in system32 ndh???? cannot delete.

Run norton and find a specail adware program and run it. no good.

Run VX2 with adaware, no good

I have a freebie pop up stopper and it is working, but not grabbing everything.

Have Aurora popping up with ads like krazy.

Aurora- part of the ABI network.

Tried running FixBiNet with no success

There is 30 or so fellows who can access this computer.

Windows updates will not install for some reason.......

Run Hi Jack this and it is posted here.

Logfile of HijackThis v1.99.1
Scan saved at 8:08:39 AM, on 6/3/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
c:\windows\system32\tcvzqod.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.etsusainc.com/home.php
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [wxwgid] C:\WINDOWS\System32\wxwgid.exe
O15 - Trusted Zone: http://www.neededware.com
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

Thank you for any help

Bill @ ETS

Z
zbestwun2001
4 Apprentice
•
8831 Posts
172
0
Posted June 3rd, 2005 16:00
Hi and welcome

Please download the trial version of Ewido Security Suite here:

http://www.ewido.net/en/download/

Install it, and update the definitions to the newest files. Do NOT run a scan yet.

Please download Nailfix from here:

http://www.noidea.us/easyfile/file.php?download=20050515010747824

Unzip it to the desktop but please do NOT run it yet:

Next, please reboot your computer in Safe Mode by doing the following:

1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:

http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and
icons will disappear and reappear, and a window should open and close
very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan

When repost a new log make sure that ALL processes load at startup.
That is very important in reading a log.

Steve
F
formeremployee0
17 Posts
172
0
Posted June 3rd, 2005 17:00
Thank you. Will try the repair on sunday. Operations are shut down and it will be easier to do repair.

Bill @ ETS
F
formeremployee0
17 Posts
172
0
Posted June 8th, 2005 10:00
Ewido cut out at 77% and said to reboot with something like 23 files infected. I did not reboot. it took something close to an hour for that 77%. Unfortunately, i was unable to do repair on sunday and tried on Wed during production. I cant do repair while we run production again b/c of time restaints.

2 HJT logs

1st one is log in safe mode after Ewido

2nd is in normal running after Ewido

Followed by Ewido log.

Logfile of HijackThis v1.99.1
Scan saved at 7:29:42 AM, on 6/8/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
c:\windows\system32\zsgwbs.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.etsusainc.com/home.php
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/ndw2.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

Logfile of HijackThis v1.99.1
Scan saved at 7:33:39 AM, on 6/8/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jucheck.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.etsusainc.com/home.php
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/ndw2.cab
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:   7:29:00 AM, 6/8/2005
+ Report-Checksum:  2503708C

+ Date of database:  6/8/2005
+ Version of scan engine: v3.0

+ Duration:    43 min
+ Scanned Files:   32718
+ Speed:    12.43 Files/Second
+ Infected files:   23
+ Removed files:   23
+ Files put in quarantine:  23
+ Files that could not be opened: 0
+ Files that could not be cleaned: 0

+ Binder:  Yes
+ Crypter:  Yes
+ Archives:  Yes

+ Scanned items:
C:\
Y:\

+ Scan result:
C:\Documents and Settings\Evertz\Cookies\evertz@advertising[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Evertz\Cookies\evertz@atdmt[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Evertz\Cookies\evertz@cgi-bin[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Evertz\Cookies\evertz@doubleclick[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Evertz\Cookies\evertz@mediaplex[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Evertz\Cookies\evertz@servedby.advertising[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Evertz\Cookies\evertz@targetnet[2].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Documents and Settings\Evertz\Cookies\evertz@z1.adserver[1].txt -> Spyware.Tracking-Cookie -> Cleaned with backup
C:\Program Files\Winad Client\WinClt.exe -> Spyware.WinAD -> Cleaned with backup
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\popcaploader.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\Downloaded Program Files\EPXActiveX.ocx -> Spyware.Winsta -> Cleaned with backup
C:\WINDOWS\Downloaded Program Files\popcaploader.dll -> Spyware.Hijacker.Generic -> Cleaned with backup
C:\WINDOWS\Nail.exe -> Trojan.Nail -> Cleaned with backup
C:\WINDOWS\qkgebpavu.exe -> Spyware.BetterInternet -> Cleaned with backup
C:\WINDOWS\svcproc.exe -> Trojan.Stervis.c -> Cleaned with backup
C:\WINDOWS\system32\DrPMon.dll -> Trojan.Agent.db -> Cleaned with backup
C:\WINDOWS\system32\epx30104.exe -> TrojanDownloader.Lastad.h -> Cleaned with backup
C:\WINDOWS\system32\widra.exe -> TrojanDownloader.Lastad.h -> Cleaned with backup
C:\WINDOWS\system32\widrandw30104lib.dll -> TrojanDownloader.Lastad.h -> Cleaned with backup
C:\WINDOWS\system32\WinStat11.dll -> Spyware.Winsta -> Cleaned with backup
C:\WINDOWS\system32\wxwgid.exe -> TrojanDownloader.Lastad.h -> Cleaned with backup
C:\WINDOWS\system32\wxwgidndw30103lib.dll -> TrojanDownloader.Lastad.h -> Cleaned with backup
C:\WINDOWS\system32\zsgwbs.exe -> Spyware.BetterInternet -> Cleaned with backup

::Report End
Z
zbestwun2001
4 Apprentice
•
8831 Posts
172
0
Posted June 8th, 2005 12:00
Please try one more time and follow my instructions above.

Get rid of that F2 Nail.exe file when you doing the Nail fix.

Then reboot and rescan from normal mode and post that log.

The Nail.exe file should not be in the HJL after you do the Nail fix.

Steve

Another VX2 attack on work computer

Dell Support Resources

Latest Solutions

Tower ECT1250, 550W PSU?

Preparing for the Dell D-PVM-OE-01 PowerMax Operate Exam: What Is the Best Study Approach?

PC turns on no input from monitor(potentially POST Failure?)

Request for Laptop Support

how can I determine a vintage alienware model from the outside without turning it on?