Options
Unwanted connection established
Hi, i'm a first timer in this forum, but i thought you could be able to help me out of this one.
I play a multiplayer game called Tibia, that's about heroes, magic, etc. There's a program called TibiCAM, not official from the game, it records a part of your game by intercepting the sent packets or something like that, and then you can watch it later using the same program. the fact is that i downloaded a trick version of the program,didn't load, and i got a ghost keylogger to get my account # (the hacked accounts / items from the game are sold for Real life money :S), fortunately i found out because of my firewall and succesfully deleted it.
Then i downloaded a clean version (i think), and works perfectly, but when i use it to play a recording while being offline, i get this in netstat:
TCP t0r:3385 1ad2srvr-cpt-v1.com:3386 ESTABLISHED
TCP t0r:3386 1ad2srvr-cpt-v1.com:3385 ESTABLISHED
TCP t0r:3501 1ad2srvr-cpt-v1.com:7171 ESTABLISHED
TCP t0r:7171 1ad2srvr-cpt-v1.com:3500 TIME_WAIT
TCP t0r:7171 1ad2srvr-cpt-v1.com:3501 ESTABLISHED
and it works, i guess thats like a proxy or something, i don't know, i'm completely offline, i think its like internal comunication, but, i googled the website that appears there and its like a spy or something, then i checked it out in my hosts file and its the first host in the list.
Here comes the tricky part, when i'm online and playing the game and recording with the program, the connection is still on, i guess that's ok, but i don't know if my data could be in danger. Anyways, what bothers me the most is that when i lauch Mozilla Firefox, (my default browser), the connection starts by itself
Proto Dirección local Dirección remota Estado
TCP t0r:3267 baym-cs67.msgr.hotmail.com:1863 ESTABLISHED
TCP t0r:3447 209.59.143.50:http CLOSING
TCP t0r:3468 64.233.187.99:http ESTABLISHED
TCP t0r:3475 209.59.143.50:http ESTABLISHED
TCP t0r:3385 1ad2srvr-cpt-v1.com:3386 ESTABLISHED
TCP t0r:3386 1ad2srvr-cpt-v1.com:3385 ESTABLISHED
It uses various ports, like randomly. I close firefox and it dissappears, if i open IE , nothing happens. I used TCPView a netstat-like program, and the connection there appears like localhost to localhost or something like that.
I ran hijackthis, ad-aware and spybot S&D but found nothing that i thought could be related. i don't know what's going on, could my information be in danger?
I await for your answer, thanks in advance everyone.
Hector
I play a multiplayer game called Tibia, that's about heroes, magic, etc. There's a program called TibiCAM, not official from the game, it records a part of your game by intercepting the sent packets or something like that, and then you can watch it later using the same program. the fact is that i downloaded a trick version of the program,didn't load, and i got a ghost keylogger to get my account # (the hacked accounts / items from the game are sold for Real life money :S), fortunately i found out because of my firewall and succesfully deleted it.
Then i downloaded a clean version (i think), and works perfectly, but when i use it to play a recording while being offline, i get this in netstat:
TCP t0r:3385 1ad2srvr-cpt-v1.com:3386 ESTABLISHED
TCP t0r:3386 1ad2srvr-cpt-v1.com:3385 ESTABLISHED
TCP t0r:3501 1ad2srvr-cpt-v1.com:7171 ESTABLISHED
TCP t0r:7171 1ad2srvr-cpt-v1.com:3500 TIME_WAIT
TCP t0r:7171 1ad2srvr-cpt-v1.com:3501 ESTABLISHED
and it works, i guess thats like a proxy or something, i don't know, i'm completely offline, i think its like internal comunication, but, i googled the website that appears there and its like a spy or something, then i checked it out in my hosts file and its the first host in the list.
Here comes the tricky part, when i'm online and playing the game and recording with the program, the connection is still on, i guess that's ok, but i don't know if my data could be in danger. Anyways, what bothers me the most is that when i lauch Mozilla Firefox, (my default browser), the connection starts by itself
Proto Dirección local Dirección remota Estado
TCP t0r:3267 baym-cs67.msgr.hotmail.com:1863 ESTABLISHED
TCP t0r:3447 209.59.143.50:http CLOSING
TCP t0r:3468 64.233.187.99:http ESTABLISHED
TCP t0r:3475 209.59.143.50:http ESTABLISHED
TCP t0r:3385 1ad2srvr-cpt-v1.com:3386 ESTABLISHED
TCP t0r:3386 1ad2srvr-cpt-v1.com:3385 ESTABLISHED
It uses various ports, like randomly. I close firefox and it dissappears, if i open IE , nothing happens. I used TCPView a netstat-like program, and the connection there appears like localhost to localhost or something like that.
I ran hijackthis, ad-aware and spybot S&D but found nothing that i thought could be related. i don't know what's going on, could my information be in danger?
I await for your answer, thanks in advance everyone.
Hector
0
Comments
Looks like an ad server to me. You may have adware running. Post an HJT log here, and we'll move the thread over to the SVT forum to get you some help.
Dexter...
Here's my log
Logfile of HijackThis v1.99.1
Scan saved at 05:58:18 p.m., on 12/05/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\atievxx.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\x\Escritorio\HijackThis1991.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onxsys.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1C044AAD-7955-4cbd-8175-501A165C4E5D} - C:\WINDOWS\System32\req.dat (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar2.dll
O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\Config\msvcbas.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Google Search - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/inflaterball/miniclipGameLoader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (Control HouseCall) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: msvcbas - C:\WINDOWS\Config\msvcbas.dll
O20 - Winlogon Notify: req - C:\WINDOWS\System32\req.dat (file missing)
O23 - Service: GFI LANguard N.S.S. 5.0 attendant service - Unknown owner - C:\Archivos de programa\GFI\LANguard Network Security Scanner 5.0\lnssatt.exe" -service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
Delete the following:
O2 - BHO: (no name) - {1C044AAD-7955-4cbd-8175-501A165C4E5D} - C:\WINDOWS\System32\req.dat (file missing)
O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\Config\msvcbas.dll
O20 - Winlogon Notify: msvcbas - C:\WINDOWS\Config\msvcbas.dll
O20 - Winlogon Notify: req - C:\WINDOWS\System32\req.dat (file missing)
reboot, and then post a new log
Logfile of HijackThis v1.99.1
Scan saved at 07:02:17 p.m., on 12/05/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\atievxx.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\x\Escritorio\HijackThis1991.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onxsys.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar2.dll
O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\Config\msvcbas.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Archivos de programa\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Google Search - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/inflaterball/miniclipGameLoader.dll
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (Control HouseCall) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab30149.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: msvcbas - C:\WINDOWS\Config\msvcbas.dll
O23 - Service: GFI LANguard N.S.S. 5.0 attendant service - Unknown owner - C:\Archivos de programa\GFI\LANguard Network Security Scanner 5.0\lnssatt.exe" -service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
O20 - Winlogon Notify: msvcbas - C:\WINDOWS\Config\msvcbas.dll
Then, go into C:\WINDOWS\CONFIG\ and delete msvcbas.dll
Reboot and post again.