Tech Support banner

Status
Not open for further replies.
1 - 2 of 2 Posts

·
Registered
Joined
·
2 Posts
Discussion Starter #1
Guys,

Thank you for the great job you'll are doing.

I had a problem with a windows explorer and few oracle related services on my system namely onrsd.exe (oracle client cache) and tnslsnr(listener) services. The programs keep crashing. I followed the steps mentioned and cleaned up many spyware on the system mainly PE_PASSMA.B

Please advise what else i need to do.

Thanks,
Loks

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 8/4/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.1
Scan saved at 9:13:15 AM, on 9/20/2005
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\netdde.exe
D:\WINDOWS\system32\serverappliance\appmgr.exe
D:\WINDOWS\system32\cisvc.exe
D:\WINDOWS\system32\clipsrv.exe
D:\WINDOWS\System32\dns.exe
D:\WINDOWS\system32\serverappliance\elementmgr.exe
D:\WINDOWS\System32\svchost.exe
e:\antispyware\ewido\security suite\ewidoctrl.exe
e:\antispyware\ewido\security suite\ewidoguard.exe
D:\WINDOWS\system32\inetsrv\inetinfo.exe
D:\WINDOWS\system32\imapi.exe
D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Program Files\Microsoft SQL Server\MSSQL$UDDI\Binn\sqlservr.exe
C:\oracle\ora92\bin\omtsreco.exe
D:\WINDOWS\Explorer.EXE
C:\oracle\ora92\bin\agntsrvc.exe
D:\WINDOWS\system32\cmd.exe
C:\oracle\ora92\bin\dbsnmp.exe
C:\oracle\ora92\Apache\Apache\apache.exe
C:\oracle\ora92\bin\pagntsrv.exe
C:\oracle\ora92\BIN\ENCSVC.EXE
D:\WINDOWS\system32\cmd.exe
D:\Program Files\Oracle\jre\1.1.8\bin\jre.exe
C:\oracle\ora92\BIN\AGNTSVC.EXE
C:\oracle\ora92\BIN\TNSLSNR.exe
c:\oracle\ora92\bin\ORACLE.EXE
D:\WINDOWS\system32\tcpsvcs.exe
D:\WINDOWS\system32\serverappliance\srvcsurg.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\tssdis.exe
D:\WINDOWS\System32\wins.exe
D:\Program Files\UltraVNC\winvnc.exe
D:\WINDOWS\system32\dllhost.exe
D:\WINDOWS\system32\mqsvc.exe
D:\WINDOWS\System32\svchost.exe
C:\oracle\ora92\Apache\Apache\apache.exe
C:\oracle\ora92\jdk\bin\java.exe
C:\oracle\ora92\jdk\bin\java.exe
c:\oracle\ora92\bin\isqlplus
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\cidaemon.exe
D:\WINDOWS\system32\cidaemon.exe
e:\antispyware\Spybot-Search&Destroy\TeaTimer.exe
E:\antispyware\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.182.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.182.*;<local>
O1 - Hosts: 202.159.228.4 mumbaiftp.mtnl.net.in
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - e:\antispyware\Spybot-Search&Destroy\SDHelper.dll
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] e:\antispyware\Spybot-Search&Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = D:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.maalaimalar.com/wfplayer/tdserver.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AA299E98-6FB5-409F-99D3-D30D749F4864} (kasRmtHlp Class) - https://ksa.accessredbox.net/inc/kaxRemote.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{04DCD920-D50C-4FBA-8991-7E80FA800480}: NameServer = 192.168.182.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9940E8E9-3D1E-462D-8C86-60ED10E4ED55}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS1\Services\Tcpip\..\{04DCD920-D50C-4FBA-8991-7E80FA800480}: NameServer = 192.168.182.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{04DCD920-D50C-4FBA-8991-7E80FA800480}: NameServer = 192.168.182.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: dimsntfy - D:\WINDOWS\SYSTEM32\dimsntfy.dll
O23 - Service: ANTS Load distributed test service (ANTSLoad) - Unknown owner - D:\Program Files\ANTS Load\RedGate.Ants.AntsService.exe
O23 - Service: ewido security suite control - ewido networks - e:\antispyware\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\antispyware\ewido\security suite\ewidoguard.exe
O23 - Service: ntop for Win32 (ntop) - Unknown owner - D:\Program Files\OPENXTRA\NTopWin32\ntop.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92Agent - Oracle Corporation - C:\oracle\ora92\bin\agntsrvc.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: OracleOraHome92HTTPServer - Unknown owner - C:\oracle\ora92\Apache\Apache\apache.exe" --ntservice (file missing)
O23 - Service: OracleOraHome92PagingServer - Unknown owner - C:\oracle\ora92/bin/pagntsrv.exe
O23 - Service: OracleOraHome92SNMPPeerEncapsulator - Unknown owner - C:\oracle\ora92\BIN\ENCSVC.EXE
O23 - Service: OracleOraHome92SNMPPeerMasterAgent - Unknown owner - C:\oracle\ora92\BIN\AGNTSVC.EXE
O23 - Service: OracleOraHome92TNSListener - Unknown owner - C:\oracle\ora92\BIN\TNSLSNR.exe
O23 - Service: OracleServiceORCL9 - Oracle Corporation - c:\oracle\ora92\bin\ORACLE.EXE
O23 - Service: VNC Server (winvnc) - Unknown owner - D:\Program Files\UltraVNC\winvnc.exe" -service (file missing)


End of KRC HijackThis Analyzer Log.
 

·
Premium Member
Joined
·
14,311 Posts
Welcome to TSF.

So do you still have problems with PE_PASSMA.B or is it just Oracle?

If just Oracle, that might just be a problem on its own. Have you tried uninstalling and reinstalling it?
 
1 - 2 of 2 Posts
Status
Not open for further replies.
Top