Tech Support Forum - View Single Post - services32 worm HJT log

mary macIlvain · 10-14-2005, 10:08 AM

hi sUBs and the tech support team!
first, i can't thank you enough. that was some awful stuff in there. i went through the cleaning directions step by step and things are looking better but probably not perfect yet. services32 is gone from the processes list in the task manager. i had a few minor things different during the process that i wanted to note here.

1) when I ran Killbox there was no C:\WINDOWS\etb\ folder and i went back to windows explorer and clicked show hidden files etc just to be sure.
also, C:\Windows\system32\windir32.exe was not there but i checked my notes and i did delete that file myself the week before in an attempt to remove windir32

2) when i went into Safe mode to Add/Remove programs,Surf Accuracy was not in there. The SP2 Connection Patcher was in there but i did not touch it as the directions did not say to do so at this point. I did delete this where it said to, using Windows Explorer C:\Program Files\SP2 Connection Patcher\

3) when I ran the Panda Active Scan i did pull the DSL wire when it got going but i forgot to turn off the Norton antivirus program so i don't know if this messed up the report from Panda. i also noticed that there are some Norton updates waiting to be installed in the system tray but i did not do that yet as i thought i should wait till i know i have a clean system.

Please let me know what else to do to make sure my PC is clean, and then I need to address what I can do to protect my system better, or point me to which forum discusses these issues if there are general guidelines and recommendations to follow for safe computing.
Thanks!
mary

Here is the new HiJackThis log run through HiJackThis Analyzer,
followed by the Panda ActiveScan Report which did find some things.

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 9/28/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 11:28:44 AM, on 10/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Ulead Systems\Ulead PhotoImpact 4.2\ABMTSR.EXE
C:\WINDOWS\System32\mdm.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus7.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus7.hpwis.com/
O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - Startup: Memento.lnk = C:\Program Files\Memento\Memento.exe
O4 - Global Startup: Album Fast Start.lnk = C:\Program Files\Ulead Systems\Ulead PhotoImpact 4.2\ABMTSR.EXE
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://dcon.futuremark.com/global/msc37.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

End of KRC HijackThis Analyzer Log.
====================================================================

Panda ActiveScan

Incident Status Location

Adware:adware/maxifiles No disinfected C:\PROGRAM FILES\COMMON FILES\services.exe
Dialer:dialer.bny No disinfected C:\WINDOWS\pcconfig.dat
Adware:adware/elitebar No disinfected C:\Documents and Settings\Owner.MaryPC\Favorites\Casino & Carrers
Adware:adware/ist.istbar No disinfected Windows Registry
Possible Virus. No disinfected C:\downloads\Sorrows_Furnace_Mini-Pak.exe
Possible Virus. No disinfected C:\Program Files\2Wire\sy_apps\dllupdate.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\AIM95\mc-110-12-0000080.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\InetGet\mc-110-12-0000080.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\InetGet2\mc-110-12-0000080.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\mc-110-12-0000080.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\services.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\system32.dll[gui.exe]
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\system32.dll[cwebpage.dll]
Adware:Adware/Maxifiles No disinfected C:\Program Files\DNS\cwebpage.dll
Adware:Adware/Maxifiles No disinfected C:\Program Files\DNS\gui.exe
Adware:Adware/StripPlayer No disinfected C:\WINDOWS\inf\strip-player.inf
Virus:Trj/Downloader.DFM Disinfected C:\WINDOWS\system32\msCMTsrvc.exe

10-14-2005, 10:08 AM	#5 (permalink)
mary macIlvain Registered User Join Date: Oct 2005 Posts: 5 OS: XP	Results of Cleaning hi sUBs and the tech support team! first, i can't thank you enough. that was some awful stuff in there. i went through the cleaning directions step by step and things are looking better but probably not perfect yet. services32 is gone from the processes list in the task manager. i had a few minor things different during the process that i wanted to note here. 1) when I ran Killbox there was no C:\WINDOWS\etb\ folder and i went back to windows explorer and clicked show hidden files etc just to be sure. also, C:\Windows\system32\windir32.exe was not there but i checked my notes and i did delete that file myself the week before in an attempt to remove windir32 2) when i went into Safe mode to Add/Remove programs,Surf Accuracy was not in there. The SP2 Connection Patcher was in there but i did not touch it as the directions did not say to do so at this point. I did delete this where it said to, using Windows Explorer C:\Program Files\SP2 Connection Patcher\ 3) when I ran the Panda Active Scan i did pull the DSL wire when it got going but i forgot to turn off the Norton antivirus program so i don't know if this messed up the report from Panda. i also noticed that there are some Norton updates waiting to be installed in the system tray but i did not do that yet as i thought i should wait till i know i have a clean system. Please let me know what else to do to make sure my PC is clean, and then I need to address what I can do to protect my system better, or point me to which forum discusses these issues if there are general guidelines and recommendations to follow for safe computing. Thanks! mary Here is the new HiJackThis log run through HiJackThis Analyzer, followed by the Panda ActiveScan Report which did find some things. ==================================================================== Log was analyzed using KRC HijackThis Analyzer - Updated on 9/28/05 Get updates at http://www.greyknight17.com/download.htm#programs *Security Programs Detected* C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Logfile of HijackThis v1.99.1 Scan saved at 11:28:44 AM, on 10/14/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Ulead Systems\Ulead PhotoImpact 4.2\ABMTSR.EXE C:\WINDOWS\System32\mdm.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus7.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus7.hpwis.com/ O4 - HKLM\..\Run: [MoneyStartUp10.0] "c:\Program Files\Microsoft Money\System\Activation.exe" O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM95\\DeadAIM.ocm",ExportedCheckODLs O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_02\bin\jusched.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - Startup: Memento.lnk = C:\Program Files\Memento\Memento.exe O4 - Global Startup: Album Fast Start.lnk = C:\Program Files\Ulead Systems\Ulead PhotoImpact 4.2\ABMTSR.EXE O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://dcon.futuremark.com/global/msc37.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing) O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe End of KRC HijackThis Analyzer Log. ==================================================================== Panda ActiveScan Incident Status Location Adware:adware/maxifiles No disinfected C:\PROGRAM FILES\COMMON FILES\services.exe Dialer:dialer.bny No disinfected C:\WINDOWS\pcconfig.dat Adware:adware/elitebar No disinfected C:\Documents and Settings\Owner.MaryPC\Favorites\Casino & Carrers Adware:adware/ist.istbar No disinfected Windows Registry Possible Virus. No disinfected C:\downloads\Sorrows_Furnace_Mini-Pak.exe Possible Virus. No disinfected C:\Program Files\2Wire\sy_apps\dllupdate.exe Adware:Adware/Maxifiles No disinfected C:\Program Files\AIM95\mc-110-12-0000080.exe Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\InetGet\mc-110-12-0000080.exe Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\InetGet2\mc-110-12-0000080.exe Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\mc-110-12-0000080.exe Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\services.exe Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\system32.dll[gui.exe] Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\system32.dll[cwebpage.dll] Adware:Adware/Maxifiles No disinfected C:\Program Files\DNS\cwebpage.dll Adware:Adware/Maxifiles No disinfected C:\Program Files\DNS\gui.exe Adware:Adware/StripPlayer No disinfected C:\WINDOWS\inf\strip-player.inf Virus:Trj/Downloader.DFM Disinfected C:\WINDOWS\system32\msCMTsrvc.exe