Malicious Program Sending Spam Emails From My PC !!! - Page 3

ruthy · 06-18-2006, 07:32 AM

Hmmmmmmmmmmm did that but nothing I think: -

________________________________________________________________
HAXFIX logfile - by Marckie
______________
version 3.01
18/06/2006 14:28:57.37

checking for haxdoor
--------------------
checking for a3d files....
a3d files not found

checking for matching notify keys....
no matching notify keys found

checking for matching services....
matching services found
Aspi32

checking for matching safeboot services....
matching safeboot services found
drtw6a.sys

Checking for goldun
-------------------
checking for notify keys....
no notify keys found

checking for services....
no services found

Finished
________________________________________________________________

So ok tell me you thought that lol! But now for your strategy as mine don't seem to work haha! Tell me what order to things and I will go for it!

Ruth XXX

ruthy · 06-18-2006, 07:43 AM

Ohhhhhhhhhhh I just notice that there are some matching services and matching safeboot services !!! Must put my glasses on in the future!! - what does this mean?

Ruth XXX

sUBs · 06-18-2006, 07:45 AM

drtw6a.sys - It did find something. Let's work on that for the moment. Considering what happened yesterday, I'm more inclined to tread carefully

Download & extract this file to it's own folder - Registry Search

Launch Registry Search
In the search box, enter drtw6a.sys & click "Ok".
Notepad will open with some text in it (the file will also be saved in the program's folder as well).
Post this text in your next reply

ruthy · 06-18-2006, 07:57 AM

Ok done that here is the results: -
__________________________________________________________

REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 18/06/2006 14:53:10 for strings:
; 'drtw6a.sys'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\drtw6a.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\drtw6a.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Control\SafeBoot\Minimal\drtw6a.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Control\SafeBoot\Network\drtw6a.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\drtw6a.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\drtw6a.sys]

; End Of The Log...
________________________________________________________________

But what about the other - Aspi32 ??

Ruth

sUBs · 06-18-2006, 08:16 AM

Ruth,

I've attached a batch file to this post.
Double click on it & it shall remove those reg entries you posted.
It shall also produce a log on your Desktop - report.txt

Please post the contents of that log.

ruthy · 06-18-2006, 08:42 AM

Sorry sUBs but I transferred the file to my desktop - no report was produced after double clicking it and when running it again I think I detected that it was unable to find the entries!

Help!

Ruth

ruthy · 06-18-2006, 08:49 AM

Just wondering.... it seemed to be checking my desktop for the entries - I thought it should be checking the registry?

Ruth

sUBs · 06-18-2006, 08:58 AM

Sorry about that. If you look at the contents of the batch, you would see that I made a minor error with the variable userprofile. It should be %userprofile%.

No worry though, that wouldnt delete any files.
Please do another Regsearch & let me know if those drtw6a.sys still exist.

ruthy · 06-18-2006, 09:10 AM

Ok done that and from the following, I don't think it exists anymore, whatever it deleted lol!
_______________________________________________________________

REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 18/06/2006 16:01:01 for strings:
; 'drtw6a.sys'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS

; End Of The Log...
_______________________________________________________________

I don't know anything about batch files I'm afraid, so I haven't done anything with it I'm afraid.

So what's next? - do we assume the Haxdoor vaiant has been destroyed now and hopefully I won't get the BSOD's? - we could always try running gmer again to see if that invokes a crash again, but I'm going to wait for you now, I'm in your hands now lol! XX

Ruth

sUBs · 06-18-2006, 09:14 AM

Okay...that removed the Haxdoor entry.

Please reboot once so that the reg deletions may take effect.
Then try gmer again

Dont get your hopes too high though. Haxdoor isnt known to be a mailbot

ruthy · 06-18-2006, 09:28 AM

I know that but maybe the BSOD's might be fixed lol! - I'm hoping...................... Ruth

ruthy · 06-18-2006, 09:38 AM

Nahhhhhhhhhhh BSOD kicked in again lol! : -

0x0000008E OxC000005 0xB8224CF0 0x000000

Rebooted and waiting for you

Ruth

ruthy · 06-18-2006, 09:44 AM

Thing is with this fault, I don't understand why it's saying check my disc space - there's plenty, it also suggests to check my drivers - no exclamation marks in Device Manager and it also suggest checking my BIOS - it's up to date to, I think.

Ruth

sUBs · 06-18-2006, 09:44 AM

It looks likely that we have to use the gmer game plan. But let's give it one more chance & try out another rootkit scanner.

Download and run Blacklight

Note that you must have local administrative privileges to run the program.

Click Scan. BlackLight will use Windows Explorer (the desktop process) to scan for hidden items. Your anti-virus software or personal firewall might display a warning that says Blacklight (blbeta.exe) is trying to manipulate the Windows Explorer process (explorer.exe). If you want to continue the scan, you should allow BlackLight to do this

When it finishes, click Next. You may get a screen similar to the picture below. Click on Close

BlackLight beta would create a log file "fsbl-<date-and-time>.log". By default, the log file is in the same directory as the executable. Please post the log

sUBs · 06-18-2006, 09:52 AM

Quote:

Originally Posted by ruthy

Thing is with this fault, I don't understand why it's saying check my disc space - there's plenty, it also suggests to check my drivers - no exclamation marks in Device Manager and it also suggest checking my BIOS - it's up to date to, I think.

Ruth

That's just a standard Window's checklist. Is your machine set to reboot automatically when the BSOD occurs? If so, you can configure it to do differently....

Go to Start > Run - type in control sysdm.cpl & click OK

In the new window, under 'Startup & Recovery', click 'Settings'

Untick 'Automatically Restart' & click OK

That should give you plenty of time to read the entire message.

ruthy · 06-18-2006, 09:57 AM

Yes the program cannot get the required priviledges to run. It says it could be that these have been altered maliciously. Can you advise what to do to change them back if at all? - under User Accounts in control-panel, it shows Ruth and Administrator - and Ruth has administrator rights!

Ruth XX

sUBs · 06-18-2006, 09:58 AM

Please show me the complete error message. Does it say something about SeDeBug Privileges?

ruthy · 06-18-2006, 10:02 AM

Quote:

Originally Posted by sUBs

Go to Start > Run - type in control sysdm.cpl & click OK

In the new window, under 'Startup & Recovery', click 'Settings'

Untick 'Automatically Restart' & click OK

That should give you plenty of time to read the entire message.

No when I type that all that comes up is the system properties dialogue, which you get if you right click My Computer and click properties !

Ruth

sUBs · 06-18-2006, 10:05 AM

Yes..that's what I wanted.

I left out the part where I wanted you to click the 'Advanced' tab.

ruthy · 06-18-2006, 10:06 AM

yes it says it could not acquire necessary privileges[SeDebugPrivilege]

Ruth

06-18-2006, 07:45 AM	#43 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,422 OS: N/A	drtw6a.sys - It did find something. Let's work on that for the moment. Considering what happened yesterday, I'm more inclined to tread carefully Download & extract this file to it's own folder - Registry Search Launch Registry Search In the search box, enter drtw6a.sys & click "Ok". Notepad will open with some text in it (the file will also be saved in the program's folder as well). Post this text in your next reply __________________ Question - what have you done for the community today?

06-18-2006, 08:16 AM	#45 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,422 OS: N/A	Ruth, I've attached a batch file to this post. Double click on it & it shall remove those reg entries you posted. It shall also produce a log on your Desktop - report.txt Please post the contents of that log. __________________ Question - what have you done for the community today? Last edited by sUBs; 06-18-2006 at 01:37 PM.

06-18-2006, 08:58 AM	#48 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,422 OS: N/A	Sorry about that. If you look at the contents of the batch, you would see that I made a minor error with the variable userprofile. It should be %userprofile%. No worry though, that wouldnt delete any files. Please do another Regsearch & let me know if those drtw6a.sys still exist. __________________ Question - what have you done for the community today?

06-18-2006, 09:14 AM	#50 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,422 OS: N/A	Okay...that removed the Haxdoor entry. Please reboot once so that the reg deletions may take effect. Then try gmer again Dont get your hopes too high though. Haxdoor isnt known to be a mailbot __________________ Question - what have you done for the community today?

06-18-2006, 09:44 AM	#54 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,422 OS: N/A	It looks likely that we have to use the gmer game plan. But let's give it one more chance & try out another rootkit scanner. Download and run Blacklight Note that you must have local administrative privileges to run the program. Click Scan. BlackLight will use Windows Explorer (the desktop process) to scan for hidden items. Your anti-virus software or personal firewall might display a warning that says Blacklight (blbeta.exe) is trying to manipulate the Windows Explorer process (explorer.exe). If you want to continue the scan, you should allow BlackLight to do this When it finishes, click Next. You may get a screen similar to the picture below. Click on Close BlackLight beta would create a log file "fsbl-<date-and-time>.log". By default, the log file is in the same directory as the executable. Please post the log __________________ Question - what have you done for the community today?

06-18-2006, 07:32 AM	#41 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Hmmmmmmmmmmm did that but nothing I think: - ________________________________________________________________ HAXFIX logfile - by Marckie ______________ version 3.01 18/06/2006 14:28:57.37 checking for haxdoor -------------------- checking for a3d files.... a3d files not found checking for matching notify keys.... no matching notify keys found checking for matching services.... matching services found Aspi32 checking for matching safeboot services.... matching safeboot services found drtw6a.sys Checking for goldun ------------------- checking for notify keys.... no notify keys found checking for services.... no services found Finished ________________________________________________________________ So ok tell me you thought that lol! But now for your strategy as mine don't seem to work haha! Tell me what order to things and I will go for it! Ruth XXX

06-18-2006, 07:43 AM	#42 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Ohhhhhhhhhhh I just notice that there are some matching services and matching safeboot services !!! Must put my glasses on in the future!! - what does this mean? Ruth XXX

06-18-2006, 07:57 AM	#44 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Ok done that here is the results: - __________________________________________________________ REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 18/06/2006 14:53:10 for strings: ; 'drtw6a.sys' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\drtw6a.sys] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\drtw6a.sys] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Control\SafeBoot\Minimal\drtw6a.sys] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Control\SafeBoot\Network\drtw6a.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\drtw6a.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\drtw6a.sys] ; End Of The Log... ________________________________________________________________ But what about the other - Aspi32 ?? Ruth

06-18-2006, 08:42 AM	#46 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Sorry sUBs but I transferred the file to my desktop - no report was produced after double clicking it and when running it again I think I detected that it was unable to find the entries! Help! Ruth

06-18-2006, 08:49 AM	#47 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Just wondering.... it seemed to be checking my desktop for the entries - I thought it should be checking the registry? Ruth

06-18-2006, 09:10 AM	#49 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Ok done that and from the following, I don't think it exists anymore, whatever it deleted lol! _______________________________________________________________ REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 18/06/2006 16:01:01 for strings: ; 'drtw6a.sys' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS ; End Of The Log... _______________________________________________________________ I don't know anything about batch files I'm afraid, so I haven't done anything with it I'm afraid. So what's next? - do we assume the Haxdoor vaiant has been destroyed now and hopefully I won't get the BSOD's? - we could always try running gmer again to see if that invokes a crash again, but I'm going to wait for you now, I'm in your hands now lol! XX Ruth

06-18-2006, 09:28 AM	#51 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	I know that but maybe the BSOD's might be fixed lol! - I'm hoping...................... Ruth

06-18-2006, 09:38 AM	#52 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Nahhhhhhhhhhh BSOD kicked in again lol! : - 0x0000008E OxC000005 0xB8224CF0 0x000000 Rebooted and waiting for you Ruth

06-18-2006, 09:44 AM	#53 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Thing is with this fault, I don't understand why it's saying check my disc space - there's plenty, it also suggests to check my drivers - no exclamation marks in Device Manager and it also suggest checking my BIOS - it's up to date to, I think. Ruth

06-18-2006, 09:57 AM	#56 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	Yes the program cannot get the required priviledges to run. It says it could be that these have been altered maliciously. Can you advise what to do to change them back if at all? - under User Accounts in control-panel, it shows Ruth and Administrator - and Ruth has administrator rights! Ruth XX

06-18-2006, 09:58 AM	#57 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,422 OS: N/A	Please show me the complete error message. Does it say something about SeDeBug Privileges? __________________ Question - what have you done for the community today?

06-18-2006, 10:05 AM	#59 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,422 OS: N/A	Yes..that's what I wanted. I left out the part where I wanted you to click the 'Advanced' tab. __________________ Question - what have you done for the community today?

06-18-2006, 10:06 AM	#60 (permalink)
ruthy Registered User Join Date: Jun 2006 Posts: 72 OS: XP Pro (SP2)	yes it says it could not acquire necessary privileges[SeDebugPrivilege] Ruth