W32/Backdoor - need help to get rid of this

glr · 10-29-2004, 11:19 AM

undefined

OS = Windows 2000 on Compaq Armada 2000

Anti-virus/Firewall = Norman (updated) - Scan hard disk regulary

Stinger / Spybot / Ad Aware scans carried out regularly

Hi tech support

I have just discovered your site and am hoping you might be able to help me.

In September, an image of the data on a previous hard disk was transferred to a brand new hard disk. Within a couple of days, or immediately (I don't know), the computer was infected. Either the virus was transferred over on the image, or when I connected to the net.

Since then, I have been running successive scans using Norman, which each time says that it has deleted Backdoor or quarantined it. Somehow Backdoor copies itself because after about 20-30 scans over the last month, it is still there.

I have also used Stinger but that hasn't helped much either.

I hope I have included enough info. Have also copied some of the scan results at the end of this thread. I'm not a "computer guy" so I may have left something out...apologies in advance if so. On the other hand, I'm keen to learn more...

I would really appreciate your help in solving this one.

CHeers,
Gareth

Logfile of HijackThis v1.98.2
Scan saved at 19:34:16, on 29/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\ati2evxx.exe
C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Norman\NVC\BIN\Zanda.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\system32\Atiptaxx.exe
C:\WINNT\system32\winupdate.exe
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\WINNT\system32\winupdate.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\NORMAN\Nvc\BIN\npfmsg2.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\system32\svhost.exe
C:\WINNT\system32\cnnet.exe
C:\WINNT\system32\svhost.exe
C:\WINNT\SYSTEM32\gsdgfw.exe
C:\WINNT\system32\bbsbw.exe
C:\WINNT\SYSTEM32\bfdbsas.exe
C:\WINNT\system32\svchostss.exe
C:\WINNT\system32\svhost.exe
C:\download\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dmi.dk/dmi/index/danmark.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4CFB462F-B136-1197-D350-615508D27F3A} - C:\WINNT\system32\ymjqbhmn.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Microsoft Synchronization Manager] cnnet.exe
O4 - HKLM\..\Run: [msword] Xcalibre.exe
O4 - HKLM\..\Run: [Windows Registry Checker] winupdate.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Configuration Loader] svchostss.exe
O4 - HKLM\..\Run: [cftmon] cftmon.exe
O4 - HKLM\..\Run: [Windows update configs] svhost.exe
O4 - HKLM\..\Run: [vDSAGGQEvbA ASDAS dqdw] C:\WINNT\SYSTEM32\gsdgfw.exe
O4 - HKLM\..\Run: [gdagdgajs] bbsbw.exe
O4 - HKLM\..\RunServices: [Microsoft Synchronization Manager] cnnet.exe
O4 - HKLM\..\RunServices: [msword] Xcalibre.exe
O4 - HKLM\..\RunServices: [Windows Registry Checker] winupdate.exe
O4 - HKLM\..\RunServices: [cftmon] cftmon.exe
O4 - HKLM\..\RunServices: [Windows update configs] svhost.exe
O4 - HKLM\..\RunServices: [gdagdgajs] bbsbw.exe
O4 - HKLM\..\RunServices: [Configuration Loader] svchostss.exe
O4 - HKCU\..\Run: [Windows Configuration Loader] realplays.exe
O4 - HKCU\..\Run: [Configuration Loader] svchostss.exe
O4 - HKCU\..\Run: [Win Command] command32.exe
O4 - HKCU\..\Run: [Windows NT Login] ntlogin32.exe
O4 - HKCU\..\Run: [Microsoft Synchronization Manager] cnnet.exe
O4 - HKCU\..\Run: [Microsoft Windows Update] svchos.exe
O4 - HKCU\..\Run: [gqvqevs] seeffkme.exe
O4 - HKCU\..\Run: [msword] Xcalibre.exe
O4 - HKCU\..\Run: [Windows Registry Checker] winupdate.exe
O4 - HKCU\..\Run: [cftmon] cftmon.exe
O4 - HKCU\..\Run: [Windows update configs] svhost.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
O4 - Global Startup: EPSON CardMonitor.lnk = C:\Program Files\EPSON\EPSON CardMonitor\EPSON CardMonitor1.2.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office-start.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download...basetup145.cab

Recent Scans

NORMAN

Scan 29 Oct 2004
W32/Backdoor virus located at: C:\cnnet.exe quarantined
C:\svhost.exe quarantined
WINNT\system32\cnnet.exe deleted
WINNT\system32\svhost deleted
DocsandSettings\Administrator\cnnet.exe quarantined
DocsandSettings\All Users\Documents\cnnet quarantined
DocsandSettings\Administrator\payload.dat quarantined

Scan 27 Oct 2004

W32/Backdoor virus located at:
WINNT\system32\cnnet.exe deleted
\msfix.exe quarantined
DocsandSettings\Administrator\ quarantined
docsandsettings\Allusers\documents quarantined

Virus scan 11 Oct 2004
 Norman scan (11 Oct) detected 21 viruses – 14 were quarantined and 7 deleted.
 location of viruses: explore.exe/slhost.exe/svhost.exe/xcalibre.exe… all in WINNT\system32

Virus called:
 REG/Lowzones.C located at c:\windowsupdate.Reg
 W32.Randex located at c:\WINNT\systemconfig.exe
 Administration\MSWword.dat

STINGER

Scan initiated on Wed Oct 27 21:27:25 2004

C:\WINNT\system32\svhost.exe\svhost.exe

Found the W32/Sdbot.worm.gen virus !!!
C:\WINNT\system32\svhost.exe\svhost.exe has been deleted.

C:\WINNT\svhost.exe\svhost.exe

Found the W32/Sdbot.worm.gen virus !!!
C:\WINNT\svhost.exe\svhost.exe has been deleted.

C:\WINNT\system32\svhost.exe\svhost.exe

Found the W32/Sdbot.worm.gen virus !!!

C:\WINNT\system32\svhost.exe\svhost.exe has been deleted.

Number of clean files: 59608

Number of infected files: 3

Number of files deleted: 3

Scan initiated on Sun Oct 24 20:56:53 2004

C:\WINNT\system32\zbbvbva.exe\zbbvbva.exe

Found the W32/Sdbot.worm.gen virus !!!

C:\WINNT\system32\zbbvbva.exe\zbbvbva.exe has been deleted.

Number of clean files: 58667

Number of infected files: 1

Number of files deleted: 1

Virus scan 11 Oct 2004
 Sophus scan on 8 oct found two viruses : w32/Sdbot.fam, located at C:\WINNT\system32\seeffkme.exe and ….32\bgqbm.exe

greyknight17 · 10-29-2004, 11:32 AM

Welcome to TSF.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

If you have a fast internet connection (broadband), run an online virus scan at TrendMicro. Make sure to select the Autoclean option. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan. Probably best to do it online since you used Norman already - but make sure you have a fast internet connection for this.

Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):

C:\WINNT\system32\winupdate.exe
C:\WINNT\system32\winupdate.exe
C:\WINNT\system32\svhost.exe
C:\WINNT\system32\cnnet.exe
C:\WINNT\system32\svhost.exe
C:\WINNT\SYSTEM32\gsdgfw.exe
C:\WINNT\system32\bbsbw.exe
C:\WINNT\SYSTEM32\bfdbsas.exe
C:\WINNT\system32\svchostss.exe
C:\WINNT\system32\svhost.exe

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

O2 - BHO: (no name) - {4CFB462F-B136-1197-D350-615508D27F3A} - C:\WINNT\system32\ymjqbhmn.dll (file missing)
O4 - HKLM\..\Run: [Microsoft Synchronization Manager] cnnet.exe
O4 - HKLM\..\Run: [msword] Xcalibre.exe
O4 - HKLM\..\Run: [Windows Registry Checker] winupdate.exe
O4 - HKLM\..\Run: [Configuration Loader] svchostss.exe
O4 - HKLM\..\Run: [Windows update configs] svhost.exe
O4 - HKLM\..\Run: [vDSAGGQEvbA ASDAS dqdw] C:\WINNT\SYSTEM32\gsdgfw.exe
O4 - HKLM\..\Run: [gdagdgajs] bbsbw.exe
O4 - HKLM\..\RunServices: [Microsoft Synchronization Manager] cnnet.exe
O4 - HKLM\..\RunServices: [msword] Xcalibre.exe
O4 - HKLM\..\RunServices: [Windows Registry Checker] winupdate.exe
O4 - HKLM\..\RunServices: [Windows update configs] svhost.exe
O4 - HKLM\..\RunServices: [gdagdgajs] bbsbw.exe
O4 - HKLM\..\RunServices: [Configuration Loader] svchostss.exe
O4 - HKCU\..\Run: [Windows Configuration Loader] realplays.exe
O4 - HKCU\..\Run: [Configuration Loader] svchostss.exe
O4 - HKCU\..\Run: [Win Command] command32.exe
O4 - HKCU\..\Run: [Windows NT Login] ntlogin32.exe
O4 - HKCU\..\Run: [Microsoft Synchronization Manager] cnnet.exe
O4 - HKCU\..\Run: [Microsoft Windows Update] svchos.exe
O4 - HKCU\..\Run: [gqvqevs] seeffkme.exe
O4 - HKCU\..\Run: [msword] Xcalibre.exe
O4 - HKCU\..\Run: [Windows Registry Checker] winupdate.exe
O4 - HKCU\..\Run: [Windows update configs] svhost.exe
O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

Reboot into Safe Mode (hit F8 key until menu shows up). Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINNT\system32\winupdate.exe
C:\WINNT\system32\winupdate.exe
C:\WINNT\system32\svhost.exe
C:\WINNT\system32\cnnet.exe
C:\WINNT\system32\svhost.exe
C:\WINNT\SYSTEM32\gsdgfw.exe
C:\WINNT\system32\bbsbw.exe
C:\WINNT\SYSTEM32\bfdbsas.exe
C:\WINNT\system32\svchostss.exe
C:\WINNT\system32\svhost.exe

Also delete ALL those EXE and DLL files (in their corresponding directory) listed above in RED.

Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean.

To help prevent future spyware installations/infections, please read the Anti-Spyware Section and use the tools provided.

10-29-2004, 11:19 AM	#1 (permalink)
glr Registered User Join Date: Oct 2004 Posts: 15 OS: Windows 2000	W32/Backdoor - need help to get rid of this undefined OS = Windows 2000 on Compaq Armada 2000 Anti-virus/Firewall = Norman (updated) - Scan hard disk regulary Stinger / Spybot / Ad Aware scans carried out regularly Hi tech support I have just discovered your site and am hoping you might be able to help me. In September, an image of the data on a previous hard disk was transferred to a brand new hard disk. Within a couple of days, or immediately (I don't know), the computer was infected. Either the virus was transferred over on the image, or when I connected to the net. Since then, I have been running successive scans using Norman, which each time says that it has deleted Backdoor or quarantined it. Somehow Backdoor copies itself because after about 20-30 scans over the last month, it is still there. I have also used Stinger but that hasn't helped much either. I hope I have included enough info. Have also copied some of the scan results at the end of this thread. I'm not a "computer guy" so I may have left something out...apologies in advance if so. On the other hand, I'm keen to learn more... I would really appreciate your help in solving this one. CHeers, Gareth Logfile of HijackThis v1.98.2 Scan saved at 19:34:16, on 29/10/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\csrss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\ati2evxx.exe C:\NORMAN\Nvc\BIN\NPFSVICE.EXE C:\Norman\NVC\BIN\Zanda.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\system32\stisvc.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\NORMAN\Nvc\BIN\NJEEVES.EXE C:\NORMAN\Nvc\BIN\nipsvc.exe C:\NORMAN\Nvc\BIN\nvcoas.exe C:\NORMAN\Nvc\BIN\NVCSCHED.EXE C:\WINNT\Explorer.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINNT\system32\Atiptaxx.exe C:\WINNT\system32\winupdate.exe C:\NORMAN\Nvc\BIN\ZLH.EXE C:\WINNT\system32\winupdate.exe C:\Program Files\Sophos SWEEP for NT\ICMON.EXE C:\NORMAN\Nvc\BIN\cclaw.exe C:\NORMAN\Nvc\BIN\NYMSE.EXE C:\NORMAN\Nvc\BIN\NIP.EXE C:\Program Files\Microsoft Office\Office\OSA.EXE C:\NORMAN\Nvc\BIN\npfmsg2.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINNT\system32\svhost.exe C:\WINNT\system32\cnnet.exe C:\WINNT\system32\svhost.exe C:\WINNT\SYSTEM32\gsdgfw.exe C:\WINNT\system32\bbsbw.exe C:\WINNT\SYSTEM32\bfdbsas.exe C:\WINNT\system32\svchostss.exe C:\WINNT\system32\svhost.exe C:\download\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dmi.dk/dmi/index/danmark.htm O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {4CFB462F-B136-1197-D350-615508D27F3A} - C:\WINNT\system32\ymjqbhmn.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe O4 - HKLM\..\Run: [Microsoft Synchronization Manager] cnnet.exe O4 - HKLM\..\Run: [msword] Xcalibre.exe O4 - HKLM\..\Run: [Windows Registry Checker] winupdate.exe O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH O4 - HKLM\..\Run: [Configuration Loader] svchostss.exe O4 - HKLM\..\Run: [cftmon] cftmon.exe O4 - HKLM\..\Run: [Windows update configs] svhost.exe O4 - HKLM\..\Run: [vDSAGGQEvbA ASDAS dqdw] C:\WINNT\SYSTEM32\gsdgfw.exe O4 - HKLM\..\Run: [gdagdgajs] bbsbw.exe O4 - HKLM\..\RunServices: [Microsoft Synchronization Manager] cnnet.exe O4 - HKLM\..\RunServices: [msword] Xcalibre.exe O4 - HKLM\..\RunServices: [Windows Registry Checker] winupdate.exe O4 - HKLM\..\RunServices: [cftmon] cftmon.exe O4 - HKLM\..\RunServices: [Windows update configs] svhost.exe O4 - HKLM\..\RunServices: [gdagdgajs] bbsbw.exe O4 - HKLM\..\RunServices: [Configuration Loader] svchostss.exe O4 - HKCU\..\Run: [Windows Configuration Loader] realplays.exe O4 - HKCU\..\Run: [Configuration Loader] svchostss.exe O4 - HKCU\..\Run: [Win Command] command32.exe O4 - HKCU\..\Run: [Windows NT Login] ntlogin32.exe O4 - HKCU\..\Run: [Microsoft Synchronization Manager] cnnet.exe O4 - HKCU\..\Run: [Microsoft Windows Update] svchos.exe O4 - HKCU\..\Run: [gqvqevs] seeffkme.exe O4 - HKCU\..\Run: [msword] Xcalibre.exe O4 - HKCU\..\Run: [Windows Registry Checker] winupdate.exe O4 - HKCU\..\Run: [cftmon] cftmon.exe O4 - HKCU\..\Run: [Windows update configs] svhost.exe O4 - Global Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe O4 - Global Startup: EPSON CardMonitor.lnk = C:\Program Files\EPSON\EPSON CardMonitor\EPSON CardMonitor1.2.exe O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Microsoft Office-start.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download...basetup145.cab Recent Scans NORMAN Scan 29 Oct 2004 W32/Backdoor virus located at: C:\cnnet.exe quarantined C:\svhost.exe quarantined WINNT\system32\cnnet.exe deleted WINNT\system32\svhost deleted DocsandSettings\Administrator\cnnet.exe quarantined DocsandSettings\All Users\Documents\cnnet quarantined DocsandSettings\Administrator\payload.dat quarantined Scan 27 Oct 2004 W32/Backdoor virus located at: WINNT\system32\cnnet.exe deleted \msfix.exe quarantined DocsandSettings\Administrator\ quarantined docsandsettings\Allusers\documents quarantined Virus scan 11 Oct 2004  Norman scan (11 Oct) detected 21 viruses – 14 were quarantined and 7 deleted.  location of viruses: explore.exe/slhost.exe/svhost.exe/xcalibre.exe… all in WINNT\system32 Virus called:  REG/Lowzones.C located at c:\windowsupdate.Reg  W32.Randex located at c:\WINNT\systemconfig.exe  Administration\MSWword.dat STINGER Scan initiated on Wed Oct 27 21:27:25 2004 C:\WINNT\system32\svhost.exe\svhost.exe Found the W32/Sdbot.worm.gen virus !!! C:\WINNT\system32\svhost.exe\svhost.exe has been deleted. C:\WINNT\svhost.exe\svhost.exe Found the W32/Sdbot.worm.gen virus !!! C:\WINNT\svhost.exe\svhost.exe has been deleted. C:\WINNT\system32\svhost.exe\svhost.exe Found the W32/Sdbot.worm.gen virus !!! C:\WINNT\system32\svhost.exe\svhost.exe has been deleted. Number of clean files: 59608 Number of infected files: 3 Number of files deleted: 3 Scan initiated on Sun Oct 24 20:56:53 2004 C:\WINNT\system32\zbbvbva.exe\zbbvbva.exe Found the W32/Sdbot.worm.gen virus !!! C:\WINNT\system32\zbbvbva.exe\zbbvbva.exe has been deleted. Number of clean files: 58667 Number of infected files: 1 Number of files deleted: 1 Virus scan 11 Oct 2004  Sophus scan on 8 oct found two viruses : w32/Sdbot.fam, located at C:\WINNT\system32\seeffkme.exe and ….32\bgqbm.exe

10-29-2004, 11:32 AM	#2 (permalink)
greyknight17 Analyst, Security Team Join Date: Jul 2004 Location: New York Posts: 14,327 OS: Windows 98 & Windows XP Home/Pro My System	Welcome to TSF. Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below. Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked. If you have a fast internet connection (broadband), run an online virus scan at TrendMicro. Make sure to select the Autoclean option. Otherwise, make sure your antivirus program has the latest definitions and run a full system scan. Probably best to do it online since you used Norman already - but make sure you have a fast internet connection for this. Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it): C:\WINNT\system32\winupdate.exe C:\WINNT\system32\winupdate.exe C:\WINNT\system32\svhost.exe C:\WINNT\system32\cnnet.exe C:\WINNT\system32\svhost.exe C:\WINNT\SYSTEM32\gsdgfw.exe C:\WINNT\system32\bbsbw.exe C:\WINNT\SYSTEM32\bfdbsas.exe C:\WINNT\system32\svchostss.exe C:\WINNT\system32\svhost.exe Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): O2 - BHO: (no name) - {4CFB462F-B136-1197-D350-615508D27F3A} - C:\WINNT\system32\ymjqbhmn.dll (file missing) O4 - HKLM\..\Run: [Microsoft Synchronization Manager] cnnet.exe O4 - HKLM\..\Run: [msword] Xcalibre.exe O4 - HKLM\..\Run: [Windows Registry Checker] winupdate.exe O4 - HKLM\..\Run: [Configuration Loader] svchostss.exe O4 - HKLM\..\Run: [Windows update configs] svhost.exe O4 - HKLM\..\Run: [vDSAGGQEvbA ASDAS dqdw] C:\WINNT\SYSTEM32\gsdgfw.exe O4 - HKLM\..\Run: [gdagdgajs] bbsbw.exe O4 - HKLM\..\RunServices: [Microsoft Synchronization Manager] cnnet.exe O4 - HKLM\..\RunServices: [msword] Xcalibre.exe O4 - HKLM\..\RunServices: [Windows Registry Checker] winupdate.exe O4 - HKLM\..\RunServices: [Windows update configs] svhost.exe O4 - HKLM\..\RunServices: [gdagdgajs] bbsbw.exe O4 - HKLM\..\RunServices: [Configuration Loader] svchostss.exe O4 - HKCU\..\Run: [Windows Configuration Loader] realplays.exe O4 - HKCU\..\Run: [Configuration Loader] svchostss.exe O4 - HKCU\..\Run: [Win Command] command32.exe O4 - HKCU\..\Run: [Windows NT Login] ntlogin32.exe O4 - HKCU\..\Run: [Microsoft Synchronization Manager] cnnet.exe O4 - HKCU\..\Run: [Microsoft Windows Update] svchos.exe O4 - HKCU\..\Run: [gqvqevs] seeffkme.exe O4 - HKCU\..\Run: [msword] Xcalibre.exe O4 - HKCU\..\Run: [Windows Registry Checker] winupdate.exe O4 - HKCU\..\Run: [Windows update configs] svhost.exe O4 - Global Startup: Microsoft Hurtig søgning.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE Reboot into Safe Mode (hit F8 key until menu shows up). Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist: C:\WINNT\system32\winupdate.exe C:\WINNT\system32\winupdate.exe C:\WINNT\system32\svhost.exe C:\WINNT\system32\cnnet.exe C:\WINNT\system32\svhost.exe C:\WINNT\SYSTEM32\gsdgfw.exe C:\WINNT\system32\bbsbw.exe C:\WINNT\SYSTEM32\bfdbsas.exe C:\WINNT\system32\svchostss.exe C:\WINNT\system32\svhost.exe Also delete ALL those EXE and DLL files (in their corresponding directory) listed above in RED. Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean. To help prevent future spyware installations/infections, please read the Anti-Spyware Section and use the tools provided. __________________ Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. Adaware :: CWShredder :: HijackThis :: Panda ActiveScan :: Spybot S&D Anti-Spyware Tutorial :: Spyware Prevention Tools