What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can't Get Rid Of W2k Scheduled Task - Spyware

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've been using HijackThis for many months to clean up people's computers and have been very successful at it - thanks to HijackThis!!. For stubborn processes, I end booting in SAFE mode and deleting the files.

But this latest one has me baffled…

I need to update HihackThis to the 1.98 version (this scan is for a computer not in my possession), and I will do that soon, but in the meantime, check out this scan. The entire scan is at the bottom. The parts I think are relevant to the problem are right here:
———————————————————–
Logfile of HijackThis v1.97.7
Scan saved at 3:43:38 PM, on 9/16/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\Tasks\winbin.exe
:

O2 - BHO: (no name) - {77849D67-5672-4B68-93E2-CCEFF1E3949E} - C:\DOCUME~1\GSSI\LOCALS~1\Temp\nibniw.dat
O4 - HKLM\..\Run: [*winbin] C:\WINNT\Tasks\winbin.exe
O4 - HKLM\..\RunOnce: [*winbin] C:\WINNT\Tasks\winbin.exe rerun

———————————————————–

Notice how the BHO is named "nibniw" which is "winbin" backwards. I've searched these forums and the Internet at large for info on WinBin or things getting into the ..\Tasks\ folder.

If I kill the tasks it keeps coming back. I've seen that behavior before so…

I boot in Safe Mode and go look in C":\WINNT\Tasks" there is nothing there. If I search the hard drive for winbin.exe - I don't find anything. I have turned on show hidden files, etc.

I also noticed that even in Safe Mode, winbin.exe seems to start running.

This has got me stumped. Any ideas?

Entire log to follow…
———————————————————–

Logfile of HijackThis v1.97.7
Scan saved at 3:43:38 PM, on 9/16/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\drivers\dcfssvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\KODAK\KODAK EASYSHARE Software\bin\ptssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINNT\Tasks\winbin.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\VCADD4\Programs\VCADD32.exe
C:\Apps\HijackThIS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents/Index.htm
O2 - BHO: (no name) - {77849D67-5672-4B68-93E2-CCEFF1E3949E} - C:\DOCUME~1\GSSI\LOCALS~1\Temp\nibniw.dat
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [*winbin] C:\WINNT\Tasks\winbin.exe
O4 - HKLM\..\RunOnce: [*winbin] C:\WINNT\Tasks\winbin.exe rerun
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4…0367/wmavax.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
Post #2 last edited
Greetings and welcome to TomCoyote.org!

What you have is a relatively new infection, known as the "Stopguard" infection. Indentified by the anagramatic (backward spelled malware files) as you have noticed.

I just help someone defeat that. Lets' see if the fix works for you also.

Link to solved Stopguard hijack

First push these three keys at the same time:



(The task manager appears on the screen).

Click the "Running processes" tab, then click on "Image name" to sort the processes alphabetically.

Find these processes (if they are in there):

nibniw.dat
winbin.exe

Click them to highlite them, then click "End process". Do this for all instances of those malware files found in the"running processes".

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This! and fix these items:

O2 - BHO: (no name) - {77849D67-5672-4B68-93E2-CCEFF1E3949E} - C:\DOCUME~1\GSSI\LOCALS~1\Temp\nibniw.dat

O4 - HKLM\..\Run: [*winbin] C:\WINNT\Tasks\winbin.exe

O4 - HKLM\..\RunOnce: [*winbin] C:\WINNT\Tasks\winbin.exe rerun

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab


Reboot in "safe" mode. Use the link in my signature to tell you how if necessary.

Find and delete:

c:\documents and settings\gssi\local settings\temp\ <—Delete all files in this FOLDER
(Be sure to show "hidden files" and delete them, too!)

c:\winnt\tasks\winbin.exe <— file

Some malware files may be "hidden". Use the link in my signature to explain how to show "hidden" files if necessary.

Reboot in normal mode and post a new log file. :)
Post #3 last edited
I got rid of it. WinBin.exe was a tricky one.

Micah - your instructions for showing Hidden files works most of the time, but it DOES NOT work for files stored in C:\WINNT\Tasks for some reason.

Also, winbin.exe was somehow set to run when Explorer.exe ran - even when starting in safe mode.

So here is how I got rid of it…

- Reboot Windows 2000 in SAFE mode, but to the command prompt. That way Explorer.exe doesn't start.

- At command prompt, execute:
CD \WINNT\Tasks

- Now if you do a DIR, nothing shows up. But do a ATTRIB instead and you will see the bad files along with their attributes. There was a winbin.exe, winbin.ini and a nibniw.dat file, all with the System and Hidden attributes on.

- So I ran ATTRIB -H -S *.* to unmark the files.

- I copied the files to a floppy and then deleted them.

- I ran EXPLORER from the command prompt. I got a message that Explorer could run winbin.exe.

- I ran HiJackThis and cleared all winbin.exe and nbniw.dat references.

- I deleted all files in my C:\DOCUME~1\GSSI\LOCALS~1\Temp\ folder.

- I then rebooted in normal mode and everything was great.

Some other things to keep in mind.

I could not stop the winbin.exe task from adding itself back into the registry for the RUN or RUNONCE entries because I couldn't stop the task. If I aborted the task using task manager - it would pop right back.

Remember to use ATTRIB at the command line to find hidden/system files in "Special" windows folders.

I kept the files WINBIN.EXE, etc and can provide them to anyone who wants to inspect them.

Thanks,
Scott (scokelly @ yahoo.com)

{edit by ChrisRLG - do not put email addresses without spaces etc - or spammers will harvest - you will not like that }
Post #5
Here is the cleaned log…. —————————————————————————— Logfile of HijackThis v1.98.2 Scan saved at 4:45:20 PM, on 9/20/2004 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\drivers\dcfssvc.exe C:\Program Files\NavNT\defwatch.exe C:\WINNT\System32\svchost.exe C:\Program Files\NavNT\rtvscan.exe C:\Program Files\KODAK\KODAK EASYSHARE Software\bin\ptssvc.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\mspmspsv.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\Program Files\NavNT\vptray.exe C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Outlook Express\msimn.exe C:\Apps\HijackThIS\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/Documents/Index.htm O4 - HKLM\..\Run: [CountrySelection] pctptt.exe O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
Post #6
Thank you! :)

Other than your Internet Explorer needing a few of the latest updates, the log looks good.

Thank you, also, for sharing your solution to the problem. I am sure we will see more of this infection in this forum as time progresses.

GOD bless!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #7
Glad we could be of assistance. This topic is now closed. If you wish it
reopened, please send us an email (Click here to email) with a link to your thread.

Donations in support of this Web Site are always appreciated

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI