Myspace Worm

RWB · October 2007

I have multiple systems effected at my workplace because someone with a My Space account got infected, overnight now all systems that were left on seem to be effected with the same problem. It's intermittent, I cannot seem to replicate it, I just get a white page that says "Error. Page cannot be displayed. Please contact service provider for details." and that is all, it is definitely not the usual page cannot be displayed message Firefox or Internet Explorer has, it's just the text, bold.

It happens randomly, and once it happens it seems to only last a minute or so then go away. When it does happen not all sites are effected. Some work, others have this message, again it's just random and makes no sense.

Funny enough this occured within 10 minutes of a client calling in with the same issue, then the guy who took that call got it after visiting his My Space page. I cannot find any information on this, others have called in with the same issue, and they are not connected to our network in any way.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:02:51 PM, on 10/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Updater.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ConnectWise\Psa.Net\PsaStarter.exe
C:\Program Files\ConnectWise\Psa.Net\2.0.0.14\Psa.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rwb.homedns.org:6000/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-725345543-688789844-839522115-1178\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'dbixler')
O4 - Global Startup: Pidgin.lnk = C:\Program Files\Pidgin\pidgin.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {210D0CBC-8B17-48D1-B294-1A338DD2EB3A} (VatCtrl Class) - http://24.249.91.2:9163/VatDec.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1184284724109
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1184292034640
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ze-net.local
O17 - HKLM\Software\..\Telephony: DomainName = ze-net.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ze-net.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ze-net.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 6443 bytes

Also just as I was surfing the forums after posting this, I was being redirected over and over by a site called adbaaz.com. I closed FF and reopened which seemed to fix that issue, which is a new symptom.

Trogan · October 2007

Hey RWB,

There isn't anything showing in the log, so lets try this:

Download ComboFix to your Desktop.

Double click on Combofix.exe & follow the prompts.
When the scan has finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

RWB · October 2007

ComboFix 07-10-07.2 - csklenarik 2007-10-07 15:39:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.447 [GMT -5:00]
Running from: C:\Documents and Settings\csklenarik\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-07 to 2007-10-07 )))))))))))))))))))))))))))))))
.

2007-10-07 15:38 51,200 --a

C:\WINDOWS\NirCmd.exe
2007-10-07 13:55 <DIR> d

C:\Program Files\Trend Micro
2007-10-07 13:55 <DIR> d

C:\Documents and Settings\csklenarik\Application Data\Wireshark
2007-10-07 13:47 <DIR> d

C:\Program Files\Wireshark
2007-10-07 13:47 <DIR> d

C:\Program Files\WinPcap
2007-10-07 13:42 <DIR> d

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-07 13:26 <DIR> d

C:\Program Files\Lavasoft
2007-10-07 13:26 <DIR> d

C:\Program Files\Common Files\Wise Installation Wizard
2007-10-07 13:26 <DIR> d

C:\Documents and Settings\csklenarik\Application Data\Lavasoft
2007-10-07 13:14 <DIR> d

C:\WINDOWS\system32\ActiveScan
2007-10-07 13:14 <DIR> d

C:\WINDOWS\LastGood
2007-10-06 12:27 <DIR> d

C:\Documents and Settings\dbixler\Application Data\connectwise
2007-10-06 12:26 <DIR> d

C:\Documents and Settings\dbixler\Application Data\.purple
2007-10-05 21:52 95,608 --a

C:\WINDOWS\system32\AvastSS.scr
2007-10-05 21:52 94,416 --a

C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-05 21:52 92,848 --a

C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-05 21:52 801,144 --a

C:\WINDOWS\system32\aswBoot.exe
2007-10-05 21:52 42,912 --a

C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-05 21:52 26,624 --a

C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-05 21:52 23,152 --a

C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-05 21:52 1,060,864 --a

C:\WINDOWS\system32\MFC71.dll
2007-10-05 21:52 <DIR> d

C:\Program Files\Alwil Software
2007-10-05 01:10 <DIR> d

C:\Documents and Settings\rcuevas\Application Data\gtk-2.0
2007-10-03 15:53 <DIR> d

C:\ActualtestsEngine
2007-09-27 18:28 <DIR> d

C:\Documents and Settings\chull\Application Data\gtk-2.0
2007-09-20 08:17 <DIR> d

C:\Program Files\EVEMon
2007-09-20 08:17 <DIR> d

C:\Documents and Settings\csklenarik\Application Data\EVEMon
2007-09-20 02:12 <DIR> d

C:\Program Files\CCP
2007-09-16 00:56 <DIR> d

C:\astroempires
2007-09-14 22:49 <DIR> d

C:\Documents and Settings\rcuevas\Application Data\Help
2007-09-14 16:38 <DIR> d

C:\Documents and Settings\rcuevas\Application Data\connectwise
2007-09-14 16:35 <DIR> d

C:\Documents and Settings\rcuevas\Application Data\.purple
2007-09-09 01:20 <DIR> d

C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-09-08 05:43 <DIR> d

C:\Program Files\Bonjour
2007-09-08 05:35 <DIR> d

C:\Program Files\Common Files\Macrovision Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-07 15:37

d

C:\Documents and Settings\csklenarik\Application Data\.purple
2007-10-07 11:07

d

C:\Documents and Settings\dbixler\Application Data\.purple
2007-10-06 22:25

d

C:\Documents and Settings\chull\Application Data\.purple
2007-10-06 08:05

d

C:\Documents and Settings\rcuevas\Application Data\.purple
2007-10-05 16:57

d

C:\Documents and Settings\jmaples\Application Data\.purple
2007-10-05 16:45

d

C:\Documents and Settings\jmaples\Application Data\Skype
2007-10-03 16:47

d

C:\Documents and Settings\jmaples\Application Data\uTorrent
2007-09-20 15:30

d

C:\Documents and Settings\jmaples\Application Data\gtk-2.0
2007-09-05 11:48

d

C:\Documents and Settings\jmaples\Application Data\WinRAR
2007-08-30 19:56

d

C:\Documents and Settings\csklenarik\Application Data\WinRAR
2007-08-24 22:01

d

C:\Documents and Settings\csklenarik\Application Data\Hamachi
2007-08-21 13:46

d

C:\Program Files\SolarWinds
2007-08-20 14:04

d

C:\Documents and Settings\dmatthews\Application Data\.purple
2007-08-18 22:48

d

C:\Program Files\TightVNC
2007-08-15 00:44

d

C:\Program Files\DivX
2007-08-13 12:21

d

C:\Documents and Settings\jmaples\Application Data\Media Player Classic
2007-08-13 12:02

d

C:\Documents and Settings\All Users\Application Data\Skype
2007-08-11 20:48

d

C:\Program Files\mIRC
2007-08-07 03:03

d

C:\Documents and Settings\csklenarik\Application Data\Media Player Classic
2007-08-07 03:01

d

C:\Program Files\Combined Community Codec Pack
2007-07-30 19:19 92504 --a

C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 --a

C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 --a

C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 --a

C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 --a

C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 271224 --a

C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 --a

C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 --a

C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 --a

C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 --a

C:\WINDOWS\system32\wups.dll
2007-07-25 21:53 200704 --a

C:\WINDOWS\system32\ssldivx.dll
2007-07-25 21:53 1044480 --a

C:\WINDOWS\system32\libdivx.dll
2007-07-12 22:46 73216 --a

C:\WINDOWS\ST6UNST.EXE
2007-07-12 22:46 286720

C:\WINDOWS\Setup1.exe
2007-07-12 21:44 487424 --a

C:\WINDOWS\system32\msvcp70.dll
2007-07-12 21:44 344064 --a

C:\WINDOWS\system32\msvcr70.dll
2007-07-12 20:26 499712 --a

C:\WINDOWS\system32\msvcp71.dll
2007-07-12 20:26 348160 --a

C:\WINDOWS\system32\msvcr71.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 09:35]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 09:32]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 09:36]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 14:42]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" []
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24]
"iRiver Updater"="\Updater.exe" [2004-07-01 16:20]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 05:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Pidgin.lnk - C:\Program Files\Pidgin\pidgin.exe [2007-06-15 07:21:50]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

R3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys

*Newly Created Service* - CATCHME
*Newly Created Service* - NM
*Newly Created Service* - NPF
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-07 15:41:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-07 15:42:58
.
--- E O F ---

Trogan · October 2007

Nothing in that log either.

Could you do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)

Scan Options:

Scan Archives
Scan Mail Bases
[*]Click OK
[*]Now under select a target to scan:

SelectMy Computer
[*]This will program will start and scan your system.
[*]The scan will take a while so be patient and let it run.
[*]Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

[*]Save the file to your desktop.
Post the Kaspersky log back here.

RWB · October 2007

KASPERSKY ONLINE SCANNER REPORT
2007-10-07 06:59
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 8/10/2007
Kaspersky Anti-Virus database records: 428879

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
Y:\
Z:\

Scan Statistics:
Total number of scanned objects: 121953
Number of viruses found: 11
Number of infected objects: 31
Number of suspicious objects: 4
Duration of the scan process: 02:24:36

Infected Object Name / Virus Name / Last Action
C:\ac5f003f11134bc710353b49f1\%temp%dd_msxml_retMSI.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\csklenarik\Application Data\.purple\logs\aim\badbreff\.system\2007-10-07.141133-0500CDT.html Object is locked skipped
C:\Documents and Settings\csklenarik\Application Data\.purple\logs\irc\machinegundojo@excalibur.esper.net\.system\2007-10-07.141132-0500CDT.html Object is locked skipped
C:\Documents and Settings\csklenarik\Application Data\.purple\logs\irc\rwb@irc.rizon.net\#icrontic.chat\2007-10-07.163619-0500CDT.html Object is locked skipped
C:\Documents and Settings\csklenarik\Application Data\.purple\logs\irc\rwb@irc.rizon.net\%5bleet%5d\2007-10-07.163619-0500CDT.html Object is locked skipped
C:\Documents and Settings\csklenarik\Application Data\.purple\logs\irc\rwb@irc.rizon.net\.system\2007-10-07.141143-0500CDT.html Object is locked skipped
C:\Documents and Settings\csklenarik\Application Data\.purple\logs\msn\csklenarik@hotmail.com\.system\2007-10-07.141136-0500CDT.html Object is locked skipped
C:\Documents and Settings\csklenarik\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\csklenarik\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\csklenarik\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\csklenarik\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\csklenarik\Local Settings\History\History.IE5\MSHist012007100720071008\index.dat Object is locked skipped
C:\Documents and Settings\csklenarik\Local Settings\Temp\~DFB34D.tmp Object is locked skipped
C:\Documents and Settings\csklenarik\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\csklenarik\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\csklenarik\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\csklenarik\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\dbixler\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\dbixler\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\ltodd\Desktop\SolarWinds-TFTP-Server.exe/WISE0048.BIN Infected: not-a-virus:Server-FTP.Win32.Tftp.500 skipped
C:\Documents and Settings\ltodd\Desktop\SolarWinds-TFTP-Server.exe WiseSFX: infected - 1 skipped
C:\Documents and Settings\ltodd\Desktop\SolarWinds-TFTP-Server.exe WiseSFX Dropper: infected - 1 skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\Program Files\SolarWinds\Free Tools\TFTP-Server.exe Infected: not-a-virus:Server-FTP.Win32.Tftp.500 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{43BC03E8-7569-49AF-AD8F-E81FEE7537B7}\RP109\change.log Object is locked skipped
C:\System Volume Information\_restore{43BC03E8-7569-49AF-AD8F-E81FEE7537B7}\RP89\A0017908.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\System Volume Information\_restore{43BC03E8-7569-49AF-AD8F-E81FEE7537B7}\RP89\A0017908.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
C:\System Volume Information\_restore{43BC03E8-7569-49AF-AD8F-E81FEE7537B7}\RP89\A0017908.exe NSIS: infected - 2 skipped
C:\System Volume Information\_restore{43BC03E8-7569-49AF-AD8F-E81FEE7537B7}\RP89\A0017911.exe/data0006 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1370 skipped
C:\System Volume Information\_restore{43BC03E8-7569-49AF-AD8F-E81FEE7537B7}\RP89\A0017911.exe Inno: infected - 1 skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_73c.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Z:\Users\*******\Video Insight Camera Recording software\Complete_Install_2-65.zip/Utilities/VNC/vnc-4_1_2-x86_win32.exe/file1 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
Z:\Users\*******\Video Insight Camera Recording software\Complete_Install_2-65.zip/Utilities/VNC/vnc-4_1_2-x86_win32.exe/file2 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
Z:\Users\*******\Video Insight Camera Recording software\Complete_Install_2-65.zip/Utilities/VNC/vnc-4_1_2-x86_win32.exe/file3 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
Z:\Users\*******\Video Insight Camera Recording software\Complete_Install_2-65.zip/Utilities/VNC/vnc-4_1_2-x86_win32.exe/file5 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
Z:\Users\*******\Video Insight Camera Recording software\Complete_Install_2-65.zip/Utilities/VNC/vnc-4_1_2-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped
Z:\Users\*******\Video Insight Camera Recording software\Complete_Install_2-65.zip ZIP: infected - 5 skipped
Z:\Users\********\olbackup.pst/Personal Folders/Quarantine/Potentially unwanted message body detected, entire message has b/16 Sep 2004 07:30 from ******* *****:Potentially unwanted message.rtf Infected: Trojan-Dropper.VBS.Zerolin skipped
Z:\Users\********\olbackup.pst/Personal Folders/Quarantine/Potentially unwanted message body detected, entire message has b/16 Sep 2004 09:15 from ***** *****:Potentially unwanted message .rtf Infected: Trojan-Downloader.JS.gen skipped
Z:\Users\********\olbackup.pst Mail MS Mail: infected - 2 skipped
Z:\Users\********\outlook backup\backup.pst/Personal Folders/Inbox/02 Dec 2002 21:54 from *********:Hotmail .rtf Suspicious: Exploit.HTML.Iframe.FileDownload skipped
Z:\Users\********\outlook backup\backup.pst Mail MS Mail: suspicious - 1 skipped
Z:\Users\*****\SolarWinds-TFTP-Server.exe/WISE0048.BIN Infected: not-a-virus:Server-FTP.Win32.Tftp.500 skipped
Z:\Users\*****\SolarWinds-TFTP-Server.exe WiseSFX: infected - 1 skipped
Z:\Users\*****\SolarWinds-TFTP-Server.exe WiseSFX Dropper: infected - 1 skipped
Z:\Users\*****\My Data Sources\My Pictures\SolarWinds-PE-V7-Eval.exe/WISE0289.BIN Suspicious: not-a-virus:Server-FTP.Win32.Tftp.500 skipped
Z:\Users\*****\My Data Sources\My Pictures\SolarWinds-PE-V7-Eval.exe WiseSFX: suspicious - 1 skipped
Z:\Users\******\documents backup\ipscan.exe Infected: not-a-virus:NetTool.Win32.Portscan.c skipped
Z:\Users\******\documents backup\SolarWinds-TFTP-Server.exe/WISE0048.BIN Infected: not-a-virus:Server-FTP.Win32.Tftp.500 skipped
Z:\Users\******\documents backup\SolarWinds-TFTP-Server.exe WiseSFX: infected - 1 skipped
Z:\Users\******\documents backup\SolarWinds-TFTP-Server.exe WiseSFX Dropper: infected - 1 skipped
Z:\Users\********\Scott's Stuff\backup.pst/Personal Folders/Inbox/Personal/Chris Hull/02 Mar 2000 05:39 from Chris Hull:FUNNY **** HEADED YOUR WAY.../rumor.exe Infected: not-virus:BadJoke.Win32.Stupen.c skipped
Z:\Users\********\Scott's Stuff\backup.pst/Personal Folders/Inbox/12 Oct 2000 22:09 from Randall Jamison:ZE-NET Financial Presenta/ze-net financing.doc Infected: Virus.MSWord.Class.b skipped
Z:\Users\********\Scott's Stuff\backup.pst/Personal Folders/Inbox/16 Oct 2000 22:29 from Randall Jamison:ZE-NET FINANCIAL AND COST/ze-net financing.doc Infected: Virus.MSWord.Class.b skipped
Z:\Users\********\Scott's Stuff\backup.pst/Personal Folders/Inbox/04 Apr 2001 23:33 from Hahaha:Snowhite and the Seven Dwarfs - Th/joke.exe Infected: Email-Worm.Win32.Hybris.b skipped
Z:\Users\********\Scott's Stuff\backup.pst Mail MS Mail: infected - 4 skipped

Scan process completed.

Trogan · October 2007

Do you know what the following are? Are they work related?

C:\Documents and Settings\ltodd\Desktop\SolarWinds-TFTP-Server.exe
C:\Program Files\SolarWinds\Free Tools\TFTP-Server.exe
Z:\Users\*******\Video Insight Camera Recording software\Complete_Install_2-65.zip
Z:\Users\*****\SolarWinds-TFTP-Server.exe
Z:\Users\******\documents backup\ipscan.exe
Z:\Users\******\documents backup\SolarWinds-TFTP-Server.exe

If the following are not needed, I would delete them.

Z:\Users\********\Scott's Stuff\backup.pst <-- this contains:
Personal Folders/Inbox/Personal/Chris Hull/02 Mar 2000 05:39 from Chris Hull:FUNNY **** HEADED YOUR WAY.../rumor.exe
Personal Folders/Inbox/12 Oct 2000 22:09 from Randall Jamison:ZE-NET Financial Presenta/ze-net financing.doc
Personal Folders/Inbox/16 Oct 2000 22:29 from Randall Jamison:ZE-NET FINANCIAL AND COST/ze-net financing.doc
Personal Folders/Inbox/04 Apr 2001 23:33 from Hahaha:Snowhite and the Seven Dwarfs - Th/joke.exe

Z:\Users\********\olbackup.pst <-- this contains:
Personal Folders/Quarantine/Potentially unwanted message body detected, entire message has b/16 Sep 2004 07:30 from ******* *****:Potentially unwanted message.rtf
Personal Folders/Quarantine/Potentially unwanted message body detected, entire message has b/16 Sep 2004 09:15 from ***** *****:Potentially unwanted message .rtf

Has anything changed with the browser error?

RWB · October 2007

All the stuff on the Z drive is a network share... everything I saw are our normal programs or email backups. And as far as if it has or will stop the browser error, the annoying thing is that this doesn't happen all the time, it happens randomly. It may go 2 hours between times it shows up.

Trogan · October 2007

Let me know if it comes back please.

RWB · October 2007

It's back.... several of our machines are infected with this problem. On other machines it would occur all the time, constantly for only certain websites like digg.com for one user, google.com searches for another, myspace.com for another... so on... meanwhile other sites work.

It's trying to load an adbaaz.com thing now, constantly refreshing until it gives a URL too long message. I thought I got rid of the issue by placing the Spybot S&D hosts list on these computers and also having Spybot S&D immunize the systems... it did allow the problem to be less annoying, but it still occurs, just not as much.

Trogan · October 2007

I found THIS. Does it sound related to the problem?

RWB · October 2007

We have found that too, other than the name I can not find ANY correllation between the two problems.

I mean this code that site is mentioning is running on the server side with the webpages, the pages that I've been told are being effected do not have this code.

RWB · October 2007

I am also trying to make heads or tails of this site... which mentions it as if they wanted it?
http://www.surftalkplus.com/vbforums/showthread.php4?p=7530

Trogan · October 2007

Let me ask some other folks to see if they have any ideas about this.

Trogan · October 2007

I haven't heard back from anyone, so a little bit stumped on this.

Please download Deckard's System Scanner (DSS) to your desktop.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, a text file will open - Main.txt
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of Main.txt in your thread in the HijackThis Log Help Forum.
A folder, C:\Deckard\System Scanner, will also open. In it will be another text file, Extra.txt.
Please also copy the contents of Extra.txt to your post as well.
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

What DSS will do:
create a new System Restore point in Windows XP and Vista.
clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

BrianHilfiger · October 2007

We had the same issue and is now resolved. Static public DNS servers into your server or firewall..... 208.67.222.222; 208.67.222.220 It is an issue with AT&T and their DNS servers.

RWB · October 2007

Brian.... my hero.... it is fixed!

My guess is that it was the DNS servers that are being infected because we have multiple sites that use different DNS servers.

jmoney3457 · October 2007

since this issue appears resolved its now locked:)

Myspace Worm

Comments