PatrickS
Topic Starter
Hi,
Well I know I at least have something called Belt.exe to get rid of, as my Panda Antivirus/firewall blocked it from connecting to the internet.
I am relatively new to the IT world (basically learning on the job) and I just started to manage about 24 windows machines and a couple of Linux servers for a very small Non-Profit.
I've done complete virus scans and installed anti-virus/firewalls on all windows machines, but it seems we are still having viral/hijacking activity. Many scans and spoofing being blocked by Panda and our little Netgear security router. But I'm not sure if we are blocking it all.
A couple of weeks ago we got a report for our satellite internet service provider that we were using way too much upstream bandwidth (we're allowed 100MB a week), they say we were using +500MB/week. I did find a few instances of Klez and removed them. But I still have my suspisions that something else is going on, ie: virus, spam relay, etc. I don't think we would be much good to a "live" hijacker, so to speak, because of all the latency involved with satellites. But who knows.
Anyway, I think I should go to every windows machine and at least run Hijackthis and see what I come up with.
Here's the Hijackthis log from my computer (you'll notice that I deleted the Proxy address from one line and removed DNS server addresses as well on the last 3 lines. Should I be worried about conveying this info on a public forum?):
Logfile of HijackThis v1.97.6
Scan saved at 1:32:26 PM, on 11/13/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv50.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINNT\system32\MSTask.exe
C:\Program Files\Photodex\CompuPicPro\ScsiAccess.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\mqsvc.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ahead\InCD\InCD.exe
C:\PROGRA~1\FILEBA~1\FILEBACK.EXE
C:\Program Files\DU Meter\DUMeter.exe
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\Secure IE\PrivateIE.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Secure IE\PrivateIE.exe
C:\Program Files\Secure IE\PrivateIE.exe
C:\WINNT\System32\mdm.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lycos.com/msie4.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINNT\bi.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [FileBackPC] C:\PROGRA~1\FILEBA~1\FILEBACK.EXE
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Passphrase Keeper] C:\Program Files\Passphrase Keeper\Passphrase Keeper.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Belt] C:\WINNT\Belt.exe
O4 - HKCU\..\Run: [SureCleanProfessional] "C:\PROGRA~1\PANICW~1\SURECL~1\SRClean.exe"
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Zip Express.lnk = C:\Program Files\Zip Express\zipex.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Netilla App Basic Component - https://demo2.netillavo.com/tarantella/java/asadJ-du.cab
O16 - DPF: Netilla App Proxy Component - https://demo2.netillavo.com/tarantella/java/proxyJ-du.cab
O16 - DPF: Netilla App Security Component - https://demo2.netillavo.com/tarantella/java/tspJ-du.cab
O16 - DPF: Netilla FileHandler Applet - https://demo.netillavo.com/webapp/webfile/FileHandler.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/downlo…20/payload2.cab
O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/downlo…39120/flash.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/19c94952955561466719/…ip/RdxIE601.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
O16 - DPF: {6FB9FE59-7D3B-483D-9909-C870BE5AFA1F} (DiskHealth Class) - http://www.pcpitstop.com/pcpitstop/diskhealth.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7874.6163310185
O16 - DPF: {B1AC334E-F814-4884-937D-07EBBA652ED2} (AllControls.AllControl) - http://www.tinysoftware.com/tiny2/files/ac…AllControls.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedCon…n/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AF0E9D9-CF39-4784-9521-A12B15733E7F}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{3AF0E9D9-CF39-4784-9521-A12B15733E7F}: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\..\{3AF0E9D9-CF39-4784-9521-A12B15733E7F}: NameServer =
Any advice would be greatly appreciated!
Thanks,
Patrick
Well I know I at least have something called Belt.exe to get rid of, as my Panda Antivirus/firewall blocked it from connecting to the internet.
I am relatively new to the IT world (basically learning on the job) and I just started to manage about 24 windows machines and a couple of Linux servers for a very small Non-Profit.
I've done complete virus scans and installed anti-virus/firewalls on all windows machines, but it seems we are still having viral/hijacking activity. Many scans and spoofing being blocked by Panda and our little Netgear security router. But I'm not sure if we are blocking it all.
A couple of weeks ago we got a report for our satellite internet service provider that we were using way too much upstream bandwidth (we're allowed 100MB a week), they say we were using +500MB/week. I did find a few instances of Klez and removed them. But I still have my suspisions that something else is going on, ie: virus, spam relay, etc. I don't think we would be much good to a "live" hijacker, so to speak, because of all the latency involved with satellites. But who knows.
Anyway, I think I should go to every windows machine and at least run Hijackthis and see what I come up with.
Here's the Hijackthis log from my computer (you'll notice that I deleted the Proxy address from one line and removed DNS server addresses as well on the last 3 lines. Should I be worried about conveying this info on a public forum?):
Logfile of HijackThis v1.97.6
Scan saved at 1:32:26 PM, on 11/13/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv50.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE
C:\WINNT\system32\MSTask.exe
C:\Program Files\Photodex\CompuPicPro\ScsiAccess.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\mqsvc.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\System32\cidaemon.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ahead\InCD\InCD.exe
C:\PROGRA~1\FILEBA~1\FILEBACK.EXE
C:\Program Files\DU Meter\DUMeter.exe
C:\WINNT\system32\atiptaxx.exe
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe
C:\Program Files\Secure IE\PrivateIE.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Secure IE\PrivateIE.exe
C:\Program Files\Secure IE\PrivateIE.exe
C:\WINNT\System32\mdm.exe
C:\PROGRA~1\WinZip\winzip32.exe
C:\unzipped\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lycos.com/msie4.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINNT\bi.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [FileBackPC] C:\PROGRA~1\FILEBA~1\FILEBACK.EXE
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [Passphrase Keeper] C:\Program Files\Passphrase Keeper\Passphrase Keeper.exe
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe"
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [Belt] C:\WINNT\Belt.exe
O4 - HKCU\..\Run: [SureCleanProfessional] "C:\PROGRA~1\PANICW~1\SURECL~1\SRClean.exe"
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Zip Express.lnk = C:\Program Files\Zip Express\zipex.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Netilla App Basic Component - https://demo2.netillavo.com/tarantella/java/asadJ-du.cab
O16 - DPF: Netilla App Proxy Component - https://demo2.netillavo.com/tarantella/java/proxyJ-du.cab
O16 - DPF: Netilla App Security Component - https://demo2.netillavo.com/tarantella/java/tspJ-du.cab
O16 - DPF: Netilla FileHandler Applet - https://demo.netillavo.com/webapp/webfile/FileHandler.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…director/sw.cab
O16 - DPF: {20000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/downlo…20/payload2.cab
O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/downlo…39120/flash.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/19c94952955561466719/…ip/RdxIE601.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
O16 - DPF: {6FB9FE59-7D3B-483D-9909-C870BE5AFA1F} (DiskHealth Class) - http://www.pcpitstop.com/pcpitstop/diskhealth.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7874.6163310185
O16 - DPF: {B1AC334E-F814-4884-937D-07EBBA652ED2} (AllControls.AllControl) - http://www.tinysoftware.com/tiny2/files/ac…AllControls.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedCon…n/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3AF0E9D9-CF39-4784-9521-A12B15733E7F}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{3AF0E9D9-CF39-4784-9521-A12B15733E7F}: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\..\{3AF0E9D9-CF39-4784-9521-A12B15733E7F}: NameServer =
Any advice would be greatly appreciated!
Thanks,
Patrick
