6 replies to this topic

[wormhater]

I have an unidentified E-mail worm, which appears to be sending messages over my address. Using Rootkit Revealer, I came across a Registry entry containing nulls at: HKLM\SECURITY|policy\Secrets\XATM: 29bb158c-1647-4cce-9b59-46a880003426 and two ~.tmp files which resisted deletion. Even after permissioning myself I couldn't touch the registry entry, presumably because of the nulls. My HJT log goes: Logfile of HijackThis v1.99.1 Scan saved at 6:12:07 PM, on 18/02/2007 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\MSTask.exe C:\WINDOWS\System32\WBEM\WinMgmt.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\internat.exe C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe C:\Program Files\PowerQuest\Privoxy\privoxy.exe C:\Program Files\VIA Technologies, INC\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.exe C:\PROGRA~1\FUJIXE~1\CENTRE~1\EASYOP~1\CWCOMMU.EXE C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN C:\Protection\HijackThis\hijackthis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PowerQuest Startup Utility] C:\Program Files\PowerQuest\PartitionMagic4\UTILITY\MMOVER32\PQINIT.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\RunOnce: [Eraserl.exe] "C:\WINDOWS\system32\Eraserl.exe" -rl "C:\WINDOWS\system32\1171784910.(null)" O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Printer Monitor.lnk = C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe O4 - Global Startup: Privoxy.lnk = C:\Program Files\PowerQuest\Privoxy\privoxy.exe O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, INC\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: VLOQLWQRF - Sysinternals - www.sysinternals.com - C:\DOCUME~1\Me\LOCALS~1\Temp\VLOQLWQRF.exe O23 - Service: Windows Security Manager - Unknown owner - C:\WINDOWS\system32\vcmon.exe (file missing) I'm running w2000, and i use the Opera browser. Can anyone help? If the registyr entry is a worm signature, it would be nice to know what it is.

[shelf life]

hi wormhater, go to start>run and type in--> services.msc,<--in the list of services that comes up look for>> VLOQLWQRF right click on it and select properties. under the general tab: make sure that the service status is: Stopped and the Startup type is: disabled do the same for this one: Windows Security Manager. -------------------------------------- next see if you can locate and delete this file: vcmon.exe located here>>C:\WINDOWS\system32 next using explorer delete what you can here: C:\Documents and Settings\-Your Profile-\Local Settings\Temp\ --------------------------------- reboot computer normally rescan and post anew hjt log please. shelf life

[wormhater]

Ar there shelf life, Thanks for replying. I have followed your instructions. I did not find vcmon.exe in \WINDOWS|system32. I have rebooted, and here is the new HJT scan: Logfile of HijackThis v1.99.1 Scan saved at 8:43:55 PM, on 20/02/2007 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\MSTask.exe C:\WINDOWS\System32\WBEM\WinMgmt.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\internat.exe C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe C:\Program Files\PowerQuest\Privoxy\privoxy.exe C:\Program Files\VIA Technologies, INC\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN C:\PROGRA~1\FUJIXE~1\CENTRE~1\EASYOP~1\CWCOMMU.EXE C:\Protection\HijackThis\hijackthis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PowerQuest Startup Utility] C:\Program Files\PowerQuest\PartitionMagic4\UTILITY\MMOVER32\PQINIT.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Printer Monitor.lnk = C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe O4 - Global Startup: Privoxy.lnk = C:\Program Files\PowerQuest\Privoxy\privoxy.exe O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, INC\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe O23 - Service: IFOTFKADU - Unknown owner - C:\DOCUME~1\Me\LOCALS~1\Temp\IFOTFKADU.exe (file missing) O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe Thanks again for your help; I await your comments with interest. Wormhater

[shelf life]

hi wormhater,

good, seems one has changed and is still there.
lets try this:

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
[*]Restart your computer
[*]After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
[*]Instead of Windows loading as normal, the Advanced Options Menu should appear;
[*]Select the first option, to run Windows in Safe Mode, then press Enter.
[*]Choose your usual account.

[*] Open the extracted SDFix folder and double click RunThis.bat to start the script.
[*] Type Y to begin the cleanup process.
[*] It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
[*] Press any Key and it will restart the PC.
[*] When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
[*] Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
[*] Finally paste the contents of the Report.txt back here and a new HijackThis log

shelf life

[wormhater]

G'day again shelf life, SDfix process completed. Appended are SDfix log and the new HijackThis log. SDFix: Version 1.67 Run by Me - Wed 21/02/2007 @ 16:42:34.56 Microsoft Windows 2000 [Version 5.00.2195] Running From: C:\SDFix Safe Mode: Checking Services: Name: Path: Windows Security Manager Deleted Restoring Windows Registry Entries Restoring Default Hosts File Rebooting... Normal Mode: Checking Files: Below files will be copied to Backups folder then removed: C:\WINDOWS\system32\i - Deleted ADS Check: C:\WINDOWS\system32 No streams found. Final Check: Remaining Services: ------------------ Remaining Files: --------------- Backups Folder: - C:\SDFix\backups\backups.zip Checking For Files with Hidden Attributes : C:\Program Files\Uninstall Information\IE40.Comctl32\AINF0000 C:\Program Files\Uninstall Information\mshtml.DllReg\AINF0000 Add/Remove Programs List: 98lite Uninstall Adobe Acrobat 4.0 AVG Free Edition Canon PIXMA iP8500 Canon PIXMA iP8500 Corel Applications Corel WordPerfect Suite 8 Canon Utilities Easy-PhotoPrint Canon Utilities Easy-PrintToolBox Handy Recovery 1.0 HijackThis 1.99.1 InCD IsoBuster 1.4 JAP CD-LabelPrint InCD EasyWrite Reader Windows Messaging Update 1 Nero 6 Ultra Edition NoteTab Light NVIDIA Display Driver PartitionMagic 4.01 Privoxy (remove only) RegScrubXP 3.25 Tor 0.1.1.24 VIA Audio Driver Setup Program Vidalia 0.0.7 Uninstall Windows 98 Second Edition Delete Windows 98 Second Edition uninstall information The GIMP 2.2.13 GTK+ 2.10.6-1 runtime environment WinRAR archiver XnView 1.19 Windows Installer Clean Up PIXELA ImageMixer J2SE Runtime Environment 5.0 Update 4 OpenOffice.org 2.1 ABBYY PDF Transformer 1.0 Opera 9.02 Fuji Xerox Network Scanner Utility2 Fuji Xerox CentreWare EasyOperator Sunbelt Kerio Personal Firewall ViewSonic Monitor Drivers Eraser 5.8 RegEditer Cruzer Mini/Micro Fuji Xerox USB Print Utility v1.1.0l Finished Logfile of HijackThis v1.99.1 Scan saved at 4:53:00 PM, on 21/02/2007 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\MSTask.exe C:\WINDOWS\System32\WBEM\WinMgmt.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\NOTEPAD.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\internat.exe C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe C:\Program Files\PowerQuest\Privoxy\privoxy.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\VIA Technologies, INC\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe C:\Program Files\OpenOffice.org 2.1\program\soffice.exe C:\PROGRA~1\FUJIXE~1\CENTRE~1\EASYOP~1\CWCOMMU.EXE C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN C:\Program Files\EditPadLite\EditPad.exe C:\Program Files\Opera\Opera.exe C:\Protection\HijackThis\hijackthis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PowerQuest Startup Utility] C:\Program Files\PowerQuest\PartitionMagic4\UTILITY\MMOVER32\PQINIT.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [internat.exe] internat.exe O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe O4 - Global Startup: Printer Monitor.lnk = C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe O4 - Global Startup: Privoxy.lnk = C:\Program Files\PowerQuest\Privoxy\privoxy.exe O4 - Global Startup: AudioDeck.lnk = C:\Program Files\VIA Technologies, INC\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe O23 - Service: IFOTFKADU - Unknown owner - C:\DOCUME~1\Me\LOCALS~1\Temp\IFOTFKADU.exe (file missing) O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe Let's hope that fixes it! As a matter of interest, was the problem an identifiable worm or trojan, and if so, does it have a name? With many thanks, Wormhater

[shelf life]

hi wormhater,

good thanks for the info.


you can run hjt and have it fix this:

O23 - Service: IFOTFKADU - Unknown owner - C:\DOCUME~1\Me\LOCALS~1\Temp\IFOTFKADU.exe (file missing)

then delete what you can here:
C:\Documents and Settings\-Your Profile-\Local Settings\Temp\

Empty your Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin
----------------------------------------
it was a worm:
http://www.sophos.co...2tilebotic.html

shelf life

[little eagle]

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php