What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Needed With Possible Blaster Worm Problem

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
The log results as requested, main log:

Deckard's System Scanner v20070826.66
Run by [removed] on 2007-09-05 17:34:37
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
12: 2007-09-05 16:34:42 UTC - RP45 - Deckard's System Scanner Restore Point
11: 2007-09-04 18:13:46 UTC - RP44 - ComboFix created restore point
10: 2007-09-04 12:54:42 UTC - RP43 - System Checkpoint
9: 2007-09-02 18:30:23 UTC - RP42 - Software Distribution Service 3.0
8: 2007-08-23 13:54:12 UTC - RP41 - System Checkpoint


– First Restore Point –
1: 2019-08-08 01:13:21 UTC - RP34 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



– HijackThis (run as bigsi69.exe) ———————————————

Logfile of HijackThis v1.99.1
Scan saved at 17:35:11, on 05/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\bigsi69\Desktop\dss.exe
C:\PROGRA~1\HIJACK~1\bigsi69.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: MioSync.lnk = C:\Program Files\Mio Technology\MioSync\mioSync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1186551262375
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin…ows-i586-jc.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe


– HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) ——————–

backup-20070809-150648-392 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20070809-151256-596 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20070809-174240-924 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20070809-174443-987 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20070809-175143-716 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20070813-051701-245 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20070813-162336-110 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20080808-020023-794 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20080808-020935-948 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20080808-023035-558 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20080808-024850-625 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20080808-030654-535 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20090808-010335-868 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20100808-010104-516 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20100808-040415-137 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20120808-010259-835 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20150808-010630-924 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE
backup-20190808-010139-918 O4 - HKLM\..\Run: [] C:\WINDOWS\system32\MSCONFIG.EXE

– File Associations ———————————————————–

.scr - scrfile - shell\open\command - "%1" %*


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R3 catchme - c:\docume~1\bigsi69\locals~1\temp\catchme.sys (file missing)


– Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ——————–

R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe"
Post #47
Not seeing infection showing right now, and the error reports seem to suggest issues with the MioSync and Nokia software there. Putting the issue of the error when running FlashDisinfector aside, what issues are you seeing now on this drive?


Also if you would Go here and run the Kaspersky online scan, and post back the log it creates (it requires IE).

To use the scan, once the download has completed click Scan Settings, then make sure the "extended option" is checked (leave all others as they are) and click OK. Then click My Computer to begin the scan. Save the Report as a text file and post that back here.


To save it as a text file, still with the page in Internet Explorer, go to the top of the page and select File - Save As… Then make sure in the "Save as type" drop down you change it to "Text File(*.txt)".
Post #48
when i tried to run the kaspersky scanner it came up that i had to install ActiveX control which i agreed to however i then received a failed sign which read " The file '002E08D9.key' on (Unknown) is needed " I couldn't find the location of the file it required.
Post #49
You are the second person for me in the last few days that had this Kaspersky issue. Both had SpyBot and Ad-Aware, so be sure neither of those are enabled and try one additional time. Kaspersky downloads and unzips a file to the Temp folder, and something is blocking this far as I can tell. Really not the same scan method I was looking for at this point but if you are unable to run Kaspersky Disable your antivirus program (remember to re-enable it once this scan is complete) and go here (be sure to re-enable it after the scan completes) and run an online scan with BitDefender (you will need to use Internet Explorer for this scan). When the ActiveX Control has loaded, click on "Click here to scan" and take a break for a while.

When BitDefender completes the scan, select the "Detected Problems" tab. Click on "Click here to export the scan report". Save the file as an HTML to your Desktop. Then click on the saved file and allow it to open with your browser. Go to Edit - Select All. Then copy/paste that log back here.


The install I was asking about in relation to that Chinese origin toolbar is whatever you mentioned at the very beginning of this thread.
Post #50
i still couldn't run the kaspersky scanner, so this is the bit defender log: BitDefender Online Scanner Scan report generated at: Fri, Sep 07, 2007 - 16:41:50 Scan path: A:\;C:\;E:\;F:\;G:\;H:\;I:\;J:\; Statistics Time 00:33:18 Files 130310 Folders 3397 Boot Sectors 2 Archives 2029 Packed Files 7404 Results Identified Viruses 4 Infected Files 13 Suspect Files 0 Warnings 0 Disinfected 0 Deleted Files 13 Engines Info Virus Definitions 796051 Engine build AVCORE v1.0 (build 2411) (i386) (Jul 9 2007 12:10:22) Scan plugins 14 Archive plugins 38 Unpack plugins 7 E-mail plugins 6 System plugins 1 Scan Settings First Action Disinfect Second Action Delete Heuristics Yes Enable Warnings Yes Scanned Extensions *; Exclude Extensions Scan Emails Yes Scan Archives Yes Scan Packed Yes Scan Files Yes Scan Boot Yes Scanned File Status C:\Documents and Settings\bigsi69\Desktop\Flash_Disinfector.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Infected with: Trojan.Batc.Flashdis.A C:\Documents and Settings\bigsi69\Desktop\Flash_Disinfector.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Disinfection failed C:\Documents and Settings\bigsi69\Desktop\Flash_Disinfector.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Deleted C:\Documents and Settings\bigsi69\Desktop\Flash_Disinfector.exe=>(RAR Sfx o) Update failed C:\Documents and Settings\bigsi69\Local Settings\Application Data\Identities\{94C331E6-0AD7-4FA4-9400-DDA152FE61F8}\Microsoft\Outlook Express\Inbox.dbx=>(message 41) Infected with: Generic.Peed.Eml.E5C48AF0 C:\Documents and Settings\bigsi69\Local Settings\Application Data\Identities\{94C331E6-0AD7-4FA4-9400-DDA152FE61F8}\Microsoft\Outlook Express\Inbox.dbx=>(message 41) Disinfection failed C:\Documents and Settings\bigsi69\Local Settings\Application Data\Identities\{94C331E6-0AD7-4FA4-9400-DDA152FE61F8}\Microsoft\Outlook Express\Inbox.dbx=>(message 41) Deleted C:\Documents and Settings\bigsi69\Local Settings\Application Data\Identities\{94C331E6-0AD7-4FA4-9400-DDA152FE61F8}\Microsoft\Outlook Express\Inbox.dbx Update failed C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o)=>hosts\hosts.exe Infected with: Backdoor.Small.OY C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o)=>hosts\hosts.exe Disinfection failed C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o)=>hosts\hosts.exe Deleted C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o) Update failed C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o)=>urlmon\URLMon.exe Infected with: Backdoor.Small.OY C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o)=>urlmon\URLMon.exe Disinfection failed C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o)=>urlmon\URLMon.exe Deleted C:\Documents and Settings\bigsi69\My Documents\Azureus Downloads\One.Click.Ringtone.Converter.v1.9.Incl.Keymaker-CORE\final.exe=>(RAR Sfx o) Update failed C:\QooBox\Quarantine\C\Limit.exe.vir Infected with: Trojan.Autorun.E C:\QooBox\Quarantine\C\Limit.exe.vir Disinfection failed C:\QooBox\Quarantine\C\Limit.exe.vir Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP34\A0007041.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Infected with: Trojan.Batc.Flashdis.A C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP34\A0007041.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP34\A0007041.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP34\A0007041.exe=>(RAR Sfx o) Update failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP34\A0007042.cmd Infected with: Trojan.Batc.Flashdis.A C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP34\A0007042.cmd Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP34\A0007042.cmd Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP35\A0007206.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Infected with: Trojan.Batc.Flashdis.A C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP35\A0007206.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP35\A0007206.exe=>(RAR Sfx o)=>Flash_Disinfector.cmd Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP35\A0007206.exe=>(RAR Sfx o) Update failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP35\A0007220.cmd Infected with: Trojan.Batc.Flashdis.A C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP35\A0007220.cmd Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP35\A0007220.cmd Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP36\A0007351.exe Infected with: Trojan.Autorun.E C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP36\A0007351.exe Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP36\A0007351.exe Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008075.EXE Infected with: Trojan.Autorun.E C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008075.EXE Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008075.EXE Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008076.EXE Infected with: Trojan.Autorun.E C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008076.EXE Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008076.EXE Deleted C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008125.cmd Infected with: Trojan.Batc.Flashdis.A C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008125.cmd Disinfection failed C:\System Volume Information\_restore{AB91BDEA-6F70-49E9-A189-8A16018F5A61}\RP38\A0008125.cmd Deleted Now that my current hard drive is virtually virus free, do you think it would be possible to clean my other drive without the virus been carried over or would my only option be a total format, its just i have some documents on there that i'd like to salvage if possible. Many thanks
Post #51
If the other drive is not able to boot as an independent operating system, very likely you will get a repeat of cross infection from the duplicate system files and this particular infection. Another issue would be is this system to a point where it is cleaned of infection, or whether a reformat/reinstall would be still a solid option. One of the tougher points we as trained helpers face at times, though, is assisting on infected systems with indications of software piracy. Sorta might be providing an up side to a down side activity type scenario. In this case that crack copy of a $30 One.Click.Ringtone installer showing in the last log is that point. So I wish you well in your further choices for your system, and will be closing out our work here.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI