Too many pings! (Resolved)

jumba92jumba92
edited August 2009 in Spyware & Virus Removal
So, I looked into my trend micro internet security logs and under the "Personal Firewall" pulldown menu option, I found a TON or pings (echo requests, as trend puts it)! About 4 of them every minute or so that this computer and my Westell Versalink modem/router (don't know which it is) are both on at the same time. Is this a DoS attack, or is this something wrong with my pc and/or network like a virus? And in either case, how do I fix it and/or stop the attack? The echo requests come from IP 192.168.1.1 (my router/modem) and stop here at 192.168.1.43 (my local IP). Trend niether gives me a source port nor a destination port, or an application path or application description. Just the time, Protocol (it says "ICMP"), type (it says Firewall), Description (it says "Echo Request"), and of course the 2 IPs I already mentioned. I'm at a loss because whatever I do doesn't seem to stop them from appearing, and I can't seem to find more information about them other than what I've already told you. The funny thing is I haven't seen any effects on my pc that suggest it might be a DoS attack other than maybe the occasional lag spike in wow, and the fact that my latency is kinda high (around 200 :sad2:). So, any help would be appreciated.
By the way if it helps at all my ISP is Fairpoint.

Comments

  • KatanaKatana
    edited August 2009
    Do you have, or have you ever had any P2P progams on the machine ?
  • jumba92jumba92
    edited August 2009
    I am ashamed of it, but yeah I did used to use Utorrent. It has since been uninstalled.

    EDIT:
    Recently while web-browsing (pretty much actually just here at Icrontic XD) I try to go to a new page via either clicking a link or plugging in a URL and I get an error message saying my connection was interrupted. It didn't happen often, only once every 5 or ten minutes, depending on how often I switched to a different page. Just now, though, It happened like 5 times in a row, and it's somewhat nerve wracking because I've had PC security problems before and it's never any fun to deal with, at least not for me. Your mention of P2P programs reminds me of the last time I had to bring it in to be fixed. I'm not sure what the technician did with it, but most of my programs and data were gone afterwards, including utorrent. I havn't used it or done anything with a P2P program since, but could it be the cause of what's happening now? Like, did it inadvertently open up some back door that just now someone's taking advantage of? I did have my modem's firewall set to port forward for it, but that stopped when UTorrent did. Anyways, I'm just telling you all this so that you have as much info as I can give you that might help. Thanks :)
  • KatanaKatana
    edited August 2009
    When you use any P2P program, you broadcast your address to the entire internet.
    It's possible that the "pings" you are seeing are just other machines trying to see if you still have files to share.

    We can run a few scans if you like to make sure nothing nasty is present.


    Download and Run ComboFix
    Please delete the copy of ComboFix that you have and download an updated copy from one of the links below
    • Please visit this webpage for instructions on using ComboFix:
      http://www.bleepingcomputer.com/combofix/how-to-use-combofix

      ComboFix.exe
      ComboFix.exe
    • You must download it to and run it from your Desktop
    • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
    • Re-enable all the programs that were disabled during the running of ComboFix..


    Note:
    Do not mouse-click combofix's window while it is running. That may cause it to stall.

    CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    ComboFix SHOULD NOT be used unless requested by a forum helper
  • jumba92jumba92
    edited August 2009
    As for the batch file:

    File Found

    Now, I have both of the logs that you requested from me, but there's a little thing about how I've been forced to post them... After the HiJack This scan and log (i didn't tell it to fix anything at all just to scan and make a log file) I found that I couldn't use any browser (firefox or IE) to access any website at all. I wasn't even being given an error, I would just type in the URL and the page woul come up blank, with "Done" in the bottom left-hand corner. So, I restarted and had the same problem. I looked in trend micro's log files to see (to my dismay) that the pings were coming in an erratic pattern, sometimes 3 times in one second, sometimes once per minute, but just in one random minute i saw a total of 36 echo requests. I'm just gonna hazard a guess and say it's a dos attack, since i cant do anything online, and not really something connected to P2P in the way you expect, especially since the pings only showed up a month ago. Anyways, I used my flash drive to copy the logs and I'm on my friend's laptop (it apparently hasn't become swamped by pings yet, although it is getting them) and now I'm postimg them from here. And here they are:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:07:50 AM, on 8/16/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    C:\Program Files\Ahead\InCD\InCD.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\PROGRA~1\AVG\AVGLS\avgtray.exe
    C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\Trend Micro\BM\TMBMSRV.exe
    C:\PROGRA~1\AVG\AVGLS\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
    C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
    C:\PROGRA~1\AVG\AVGLS\avgnsx.exe
    C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\nipalsm.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVGLS\avgssie.dll
    O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVGLS\Toolbar\IEToolbar.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVGLS\Toolbar\IEToolbar.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVGLS\avgtray.exe
    O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
    O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\microsoft frontpage\version3.0\bin\FPSRVADM.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1224357387787
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVGLS\avgpp.dll
    O23 - Service: AVG LinkScanner® WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVGLS\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Update Service (gupdate1c9c6872e78cc95) (gupdate1c9c6872e78cc95) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: nipxirmu - National Instruments Corporation - C:\WINDOWS\system32\nipalsm.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
    O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
    O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 7393 bytes



    And.....

    ComboFix 09-08-10.06 - Sephiroth 08/16/2009 9:53.1.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.658 [GMT -4:00]
    Running from: c:\documents and settings\Sephiroth\Desktop\ComboFix.exe
    AV: Trend Micro Internet Security *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
    FW: Trend Micro Personal Firewall *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\Installer\122666a.msp
    c:\windows\Installer\c962e.msi
    c:\windows\system32\mdm.exe

    .
    ((((((((((((((((((((((((( Files Created from 2009-07-16 to 2009-08-16 )))))))))))))))))))))))))))))))
    .

    2009-08-15 17:18 . 2009-08-15 17:18
    d
    w- c:\documents and settings\Sephiroth\Local Settings\Application Data\AVG Security Toolbar
    2009-08-15 17:16 . 2009-08-15 17:16 253576 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-08-15 17:16 . 2009-08-15 17:16 108296 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2009-08-15 17:15 . 2009-08-15 17:17
    d
    w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
    2009-08-15 17:15 . 2009-08-15 17:15
    d
    w- c:\program files\AVG
    2009-08-15 17:15 . 2009-08-15 17:15
    d
    w- c:\documents and settings\All Users\Application Data\avg8ls
    2009-08-15 17:11 . 2009-08-15 17:11
    d
    w- c:\documents and settings\Sephiroth\Application Data\AVG8
    2009-08-14 15:16 . 2009-08-14 15:16
    d
    w- C:\NVIDIA
    2009-08-14 15:12 . 2009-08-14 15:12
    d
    w- c:\program files\SystemRequirementsLab
    2009-08-14 15:11 . 2009-08-14 15:12
    d
    w- c:\documents and settings\Sephiroth\Application Data\SystemRequirementsLab
    2009-08-14 15:11 . 2009-08-14 15:11 290816 ----a-w- c:\documents and settings\Sephiroth\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll
    2009-08-14 15:11 . 2009-08-14 15:11 290816 ----a-w- c:\documents and settings\Sephiroth\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll
    2009-08-14 15:11 . 2009-08-14 15:11 290816 ----a-w- c:\documents and settings\Sephiroth\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll
    2009-08-14 15:11 . 2009-08-14 15:11 290816 ----a-w- c:\documents and settings\Sephiroth\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll
    2009-08-14 03:16 . 2009-08-14 03:22
    d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2009-08-11 01:15 . 2009-08-11 01:15
    d
    w- c:\windows\system32\XPSViewer
    2009-08-11 01:14 . 2009-08-11 01:14
    d
    w- c:\program files\MSBuild
    2009-08-11 01:14 . 2009-08-11 01:14
    d
    w- c:\program files\Reference Assemblies
    2009-08-11 01:14 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-08-11 01:14 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-08-11 01:14 . 2008-07-06 12:06 575488
    w- c:\windows\system32\xpsshhdr.dll
    2009-08-11 01:14 . 2008-07-06 12:06 117760
    w- c:\windows\system32\prntvpt.dll
    2009-08-11 01:14 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-08-11 01:14 . 2009-08-11 01:14
    d
    w- C:\923a7f70f8af07ab03d0c9
    2009-08-11 01:14 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
    2009-08-11 01:14 . 2008-07-06 12:06 1676288
    w- c:\windows\system32\xpssvcs.dll
    2009-08-11 01:14 . 2009-08-11 02:12
    d
    w- c:\windows\SxsCaPendDel
    2009-08-10 19:23 . 2009-08-10 19:25 34 ----a-w- c:\documents and settings\Sephiroth\jagex_runescape_preferences.dat
    2009-08-10 19:23 . 2009-08-10 19:23
    d
    w- c:\windows\.jagex_cache_32
    2009-08-10 19:23 . 2009-08-10 19:23
    d
    w- c:\windows\Sun
    2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
    2009-07-31 13:44 . 2008-07-29 16:30 595208 ----a-w- c:\documents and settings\All Users\Application Data\Trend Micro\OL\engine\02\tmaseng.dll
    2009-07-31 13:44 . 2008-07-29 16:30 595208 ----a-w- c:\documents and settings\All Users\Application Data\Trend Micro\OL\tmaseng.dll
    2009-07-31 13:44 . 2008-07-29 16:30 595208 ----a-w- c:\documents and settings\All Users\Application Data\Trend Micro\OL\engine\01\tmaseng.dll
    2009-07-30 03:05 . 2009-07-30 03:05
    d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-07-18 18:37 . 2009-08-04 17:09
    d
    w- c:\program files\World of Warcraft Public Test
    2009-07-17 19:01 . 2009-07-17 19:01 58880 -c----w- c:\windows\system32\dllcache\atl.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-14 15:19 . 2008-11-11 23:26
    d
    w- c:\program files\Google
    2009-08-14 13:56 . 2008-10-27 04:54 75112 -c--a-w- c:\documents and settings\Sephiroth\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-14 13:00 . 2009-02-17 22:04
    d
    w- c:\program files\Image-Line
    2009-08-13 03:50 . 2008-11-05 02:00
    d
    w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2009-08-12 15:54 . 2009-02-18 00:00
    d
    w- c:\documents and settings\Sephiroth\Application Data\U3
    2009-08-05 09:01 . 2002-08-29 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-08-04 12:58 . 2009-02-18 02:05
    d
    w- c:\program files\World of Warcraft
    2009-07-31 13:36 . 2009-02-20 02:15
    d
    w- c:\documents and settings\All Users\Application Data\Trend Micro
    2009-07-18 19:03 . 2008-11-01 01:29
    d
    w- c:\program files\Common Files\Blizzard Entertainment
    2009-07-17 19:01 . 2002-08-29 12:00 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-16 14:09 . 2009-02-17 22:05
    d
    w- c:\program files\VstPlugins
    2009-07-15 18:42 . 2009-07-15 18:38
    d
    w- c:\program files\LEGO Company
    2009-07-15 18:38 . 2009-07-15 18:38
    d
    w- c:\documents and settings\Sephiroth\Application Data\LEGO Company
    2009-07-15 14:32 . 2009-07-15 14:21
    d
    w- c:\program files\Robolab29
    2009-07-15 14:32 . 2009-07-15 14:32
    d
    w- c:\program files\WinVDIG
    2009-07-15 14:31 . 2009-07-15 14:30
    d
    w- c:\program files\National Instruments
    2009-07-15 13:55 . 2009-07-15 13:55
    d
    w- c:\documents and settings\Sephiroth\Application Data\JoCar Consulting
    2009-07-14 03:43 . 2004-08-04 07:56 286208
    w- c:\windows\system32\wmpdxm.dll
    2009-07-08 23:06 . 2009-05-07 20:45
    d
    w- c:\program files\Common Files\Binaries
    2009-07-05 22:54 . 2009-07-05 22:53
    d
    w- c:\documents and settings\Sephiroth\Application Data\ViStart
    2009-07-03 17:09 . 2002-08-29 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-06-25 08:25 . 2002-08-29 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
    2009-06-25 08:25 . 2002-08-29 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
    2009-06-25 08:25 . 2002-08-29 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
    2009-06-25 08:25 . 2002-08-29 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
    2009-06-25 08:25 . 2002-08-29 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
    2009-06-25 08:25 . 2002-08-29 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
    2009-06-24 11:18 . 2002-08-29 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
    2009-06-16 14:36 . 2002-08-29 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
    2009-06-16 14:36 . 2002-08-29 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2009-06-14 01:06 . 2009-06-14 01:06 152576 ----a-w- c:\documents and settings\Sephiroth\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
    2009-06-12 12:31 . 2002-08-29 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
    2009-06-12 12:31 . 2002-08-29 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
    2009-06-10 14:13 . 2002-08-29 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
    2009-06-10 13:19 . 2008-10-18 18:24 2066432 ----a-w- c:\windows\system32\mstscax.dll
    2009-06-10 06:14 . 2002-08-29 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
    2009-06-03 19:09 . 2002-08-29 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
    2009-05-22 08:02 . 2009-01-21 19:40 225296 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
    2009-05-22 08:00 . 2009-01-21 19:40 36368 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
    2009-05-22 07:45 . 2009-01-21 19:40 1220120 ----a-w- c:\windows\system32\drivers\vsapint.sys
    2009-05-21 15:33 . 2009-02-02 21:12 410984 ----a-w- c:\windows\system32\deploytk.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
    2009-07-24 13:56 1090816 ----a-w- c:\program files\AVG\AVGLS\Toolbar\IEToolbar.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVGLS\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2008-07-29 497008]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
    "OrderReminder"="c:\program files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-01-30 98304]
    "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2003-06-30 1130546]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-04-01 995528]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
    "AVG8_TRAY"="c:\progra~1\AVG\AVGLS\avgtray.exe" [2009-08-15 1950488]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-10-22 1622016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2008-07-29 497008]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Symantec Fax Starter Edition Port.lnk - c:\program files\microsoft frontpage\version3.0\bin\FPSRVADM.EXE [1999-3-22 16449]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\WINDOWS\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

    R1 AvgLdx86;AVG LinkScanner® AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/15/2009 1:16 PM 253576]
    R1 AvgTdiX;AVG LinkScanner® Network Redirector;c:\windows\system32\drivers\avgtdix.sys [8/15/2009 1:16 PM 108296]
    R2 avg8wd;AVG LinkScanner® WatchDog;c:\progra~1\AVG\AVGLS\avgwdsvc.exe [8/15/2009 1:15 PM 298776]
    R2 nidimk;nidimk;c:\windows\system32\drivers\nidimk.dll [4/23/2003 8:15 PM 107102]
    R2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmk.dll [4/18/2003 1:45 PM 36463]
    R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [1/21/2009 3:40 PM 36368]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/30/2008 8:49 PM 24652]
    R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [7/29/2008 12:06 PM 335376]
    S2 gupdate1c9c6872e78cc95;Google Update Service (gupdate1c9c6872e78cc95);c:\program files\Google\Update\GoogleUpdate.exe [4/26/2009 11:53 AM 133104]
    S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2/19/2009 10:16 PM 50192]
    S2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [12/26/2008 11:32 AM 497008]
    S2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2/19/2009 10:16 PM 677128]
    S3 FANTOM;LEGO MINDSTORMS NXT Driver;c:\windows\system32\drivers\fantom.sys [3/10/2006 3:55 PM 39424]
    S3 LTower;LEGO USB Tower Driver;c:\windows\system32\drivers\LTower.sys [11/3/2008 5:04 PM 36981]
    S3 NiViPxiK;NiViPxiK;c:\windows\system32\drivers\NiViPxiK.sys [6/24/2003 6:41 PM 17920]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - AVG8WD
    *NewlyCreated* - AVGLDX86
    *NewlyCreated* - AVGTDIX

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-13 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

    2009-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 15:53]

    2009-08-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-26 15:53]
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Aim6 - (no file)


    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.aol.com/?src=aim
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    FF - ProfilePath - c:\documents and settings\Sephiroth\Application Data\Mozilla\Firefox\Profiles\a7kiz290.default\
    FF - prefs.js: browser.startup.homepage - hxxp://pandora.com/
    FF - component: c:\program files\AVG\AVGLS\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVGLS\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
    FF - component: c:\program files\AVG\AVGLS\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
    FF - component: c:\program files\AVG\AVGLS\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
    FF - component: c:\program files\AVG\AVGLS\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
    FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-08-16 09:56
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2009-08-16 9:58
    ComboFix-quarantined-files.txt 2009-08-16 13:57

    Pre-Run: 58,775,744,512 bytes free
    Post-Run: 59,237,965,824 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

    209 --- E O F --- 2009-08-14 07:00


    There you go, I hope this helps.
  • KatanaKatana
    edited August 2009
    Did you lose connection after running HJT or Combofix ?


    Download and Run RSIT
    • Please download Random's System Information Tool by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open:
      • log.txt will be opened maximized.
      • info.txt will be opened minimized.
    • Please post the contents of both log.txt and info.txt.
      ( They can also be found in the C:\RSIT folder )
  • jumba92jumba92
    edited August 2009
    I'm pretty sure I lost connection after HJT, because I was able to browse to download HJT. Also, the new pings that are happening much more often now (sometimes 12 times a second now) I just noticed aren't going from my router to my pc but from my pc to some random IP address(es). Or actually there are some from Random IP's to my PC too. All of those ones are described as "Destination Unreachable," or "Security Rule Matched." I used TM's network cutoff switch to stop all network/internet traffic. Now, I also didn't yet do what you requested last post because I went to click on the link you gave me, and when I did TM opened a page instead saying that it doesn't reccomend going to that link because it's potentially dangerous (this is on the laptop, of course, which also has Trend Micro Internet Security). Anyways, thanks again.
  • KatanaKatana
    edited August 2009
    HJT doesn't make any changes unless you tell it to, so I don't see how that could have stopped your internet.
    Combofix creates a fresh restore point before it runs, please restore to that point.

    FYI, any links I post are safe
  • jumba92jumba92
    edited August 2009
    Alright the only system restore point I saw for that day (and I made sure of the date by looking at the Combofix log) was a software distribution restore point (no idea what it was for...). So, I went to the previous day and here I am sitting on the problem computer now able to once again access the internet. :) The two other types of firewall troubles have stopped, pretty much. Once in a while I get a random "security rule matched" TCP... thing, and of course the usual ICMP pings, but other than that the rest are gone. So, that being said would you like me to download and run RSIT now?
  • KatanaKatana
    edited August 2009
    There is no need to post logs if you aren't having any problems :)
  • jumba92jumba92
    edited August 2009
    Well, just to be sure I'm still getting the many echo requests, but as far as I can tell they aren't causing anything else bad to happen to my pc, other than making a ton of entries in my TM logs. Should I be worried if that's just the case? Also, should I be worried about the few "Security Rule Matched" entries in the log that happen every so often (like, a few times an hour maybe)? They go to an IP I looked up, apparently it's the Internet Assigned Numbers Authority.
  • KatanaKatana
    edited August 2009
    There will always be machines trying to contact your computer.
    It's the nature of the internet.

    Unless you are actually having problems, I wouldn't worry about it.
  • jumba92jumba92
    edited August 2009
    sweet! :D Thank you so much for the help :)
Sign In or Register to comment.