What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Delayed Pc Response On Commands And I.e Performance

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Ok Scotty …I think this is what you need
A


SDFix: Version 1.104

Run by [removed] on 12/09/2007 at 19:34

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
Terminal Device Services

ImagePath:
"C:\WINDOWS\system32\spoolvc.exe"

Terminal Device Services - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\27031_~1.EXE - Deleted
C:\VDMD0.TMP - Deleted
C:\VDMD1.TMP - Deleted
C:\168909~1 - Deleted
C:\WINDOWS\system32\2pac.txt - Deleted
C:\WINDOWS\system32\i - Deleted
C:\WINDOWS\system32\TFTP940 - Deleted



Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
——————




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"h"="h:*:Enabled:Microsoft Windows Update"

Remaining Files:
—————

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\Andreas\Desktop\All Andreas docs\misc docs from floppy\mums files\DAD\~WRL0656.TMP
C:\WINDOWS\system32\ijjlm.tmp

Finished!


Logfile of HijackThis v1.99.1
Scan saved at 19:45:46, on 12/09/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\My App\tmt.com
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Documents and Settings\Andreas\Desktop\Hijack This\HijackThis2.exe

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msennger] C:\Program Files\My App\tmt.com
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinReg] C:\Program Files\My App\tmt.com
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpeedItUpEX] C:\Program Files\SpeedItUpFree\SpeedItUp.exe -MINI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [hohohhaha] C:\Program Files\My App\tmt.com
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
Post #17
Upload a File to Virustotal
Please visit Virustotal
  • Click the Browse… button
  • Navigate to the file C:\Program Files\My App\tmt.com
  • Click the Open button
  • Click the Send button
  • Copy and paste the results back here please.
Post #18
File tmt.com received on 09.12.2007 21:52:12 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED


Result: 23/32 (71.88%)
Loading server information…
Your file is queued in position: 2.
Estimated start time is between 43 and 62 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2007.9.13.0 2007.09.12 Win-Trojan/MircPack.696320
AntiVir 7.6.0.10 2007.09.12 BDS/IRC.Zapchast.A3
Authentium 4.93.8 2007.09.12 -
Avast 4.7.1043.0 2007.09.12 Win32:Trojan-gen. {Other}
AVG 7.5.0.485 2007.09.12 -
BitDefender 7.2 2007.09.12 Win32.Worm.Ircbot.AZB
CAT-QuickHeal 9.00 2007.09.12 Client.mIRC.603 (Not a Virus)
ClamAV 0.91.2 2007.09.12 -
DrWeb 4.33 2007.09.12 BackDoor.IRC.based
eSafe 7.0.15.0 2007.09.12 Win32.Hacktool
eTrust-Vet 31.1.5128 2007.09.12 Win32/IRCFlood
Ewido 4.0 2007.09.12 -
FileAdvisor 1 2007.09.12 High threat detected
Fortinet 3.11.0.0 2007.09.12 Misc/MIRC
F-Prot 4.3.2.48 2007.09.12 -
F-Secure 6.70.13030.0 2007.09.12 Backdoor.Win32.mIRC-based
Ikarus T3.1.1.12 2007.09.12 Backdoor.Win32.Rbot
Kaspersky 4.0.2.24 2007.09.12 not-a-virus:Client-IRC.Win32.mIRC.603
McAfee 5118 2007.09.12 New Malware.bx
Microsoft 1.2803 2007.09.12 -
NOD32v2 2525 2007.09.12 probably unknown NewHeur_PE virus
Norman 5.80.02 2007.09.12 -
Panda 9.0.0.4 2007.09.12 W32/Ircbot.AZB.worm
Prevx1 V2 2007.09.12 -
Rising 19.40.22.00 2007.09.12 Trojan.Agent.cwf
Sophos 4.21.0 2007.09.12 Troj/IRCFlood-Q
Sunbelt 2.2.907.0 2007.09.12 -
Symantec 10 2007.09.12 Hacktool
TheHacker 6.1.10.184 2007.09.11 Aplicacion/mIRC.603
VBA32 3.12.2.4 2007.09.12 BackDoor.IRC.based
VirusBuster 4.3.26:9 2007.09.12 Trojan.ModifiedMIRC.A
Webwasher-Gateway 6.0.1 2007.09.12 Trojan.IRC.Zapchast.A3
Additional information
File size: 696320 bytes
MD5: 7412345b598bf933863ccd25af2881cc
SHA1: 371fc394fcc2449c67f6ad36d1320fc4d0b7e386
packers: MOLEBOX, UPX
Bit9 info: http://fileadvisor.bit9.com/services/extin…63ccd25af2881cc
packers: Molebox
Post #19
I think those results speak for themselves.

I'm afraid I have unpleasant news for you. You have a Dangerous infection on this machine.
The infection is delivered by a Backdoor Trojan.
It allows outsiders COMPLETE access to every keystroke, account, and password you use while on this machine, and complete access to any other data present…
IF this computer has been used for any kind of important data, my best recommendation is to Disconnect from Internet, Re-Format the entire drive and re-install your Operating system and Applications.

We can likely clean the infected files off the computer, and if you wish we will attempt to do so, but we cannot be sure that the infection didn't do something to your system to reduce the system security. In that instance, even after removal of the infection, you could be subject to another attack or takeover as soon as you re-connect to the Internet.

The Decision Whether to ReFormat or Not should be based on:
  • The use of the computer - this is the primary factor in the decision whether to re-format and re-install, or just disinfect.
  • The variety of malware - this influences the decision on whether to re-format and re-install, or just disinfect.
If the Computer has been used for any important data, you are strongly advised to do the following, immediately:
  • Disconnect the infected computer from the internet and from any networked computers until the computer can be cleaned.
  • Back up all important data on the machine. Do not back up any Applications (programs). Those should be re-installed from the original source CDs or websites.
  • If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
    Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
  • From a clean computer, change ALL your online passwords – for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
  • DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
  • Take any other steps you think appropriate for an attempted identity theft.
While you are deciding whether to ReFormat and Re-Install, a useful link is here: http://www.dslreports.com/faq/10063
Please let me know what you decide.
Post #20
Scotty Yes, I use my pc for online banking and other financial transactions, so yes ill probably need to reformat and reinstall, which I have never done, so unsure where to start. I am dissappointed it has got to this really…I joined this site to try and free up some virtual ram for speedier performance, and find myself with an unusable infected pc. Perhaps the virustotal scan should have been carried out earlier with the first Hijackthis report….before combofix screwed up things, particularly my firewall settings as they were fine before. That’s when the real problems started…. On hindsight, I don’t think I should have been advised to go online with no firewall on, even for a second , as I guess it only takes this long to infect a pc and maybe that’s when all this started. Please send as much info in one go as you can, as I only have access to an hour a day Thanks, A
Post #21
Hi

Im sorry you feel like it was our fault but if you look at the very first log you posted, these were infections

C:\WINDOWS\System32\gztucqp.exe
[Microsoft Windows Update] gztucqp.exe

then in your second post, before I even started fixing, these appeared too

[msennger] C:\Program Files\taskmngr\tasket.com
[hohohhaha] C:\Program Files\taskmngr\tasket.com

The fact you were running XP with just Service Pack 1 is most likely the reason you were infected. Nothing new appeared at the time I asked you to download SDFix.

Here is a walkthrough on formatting and reinstalling.

http://windowsxp.mvps.org/XPClean.htm

When you are up and running again, I suggest you follow these precautions to stay clean.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here


Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Here is a more in-depth look at staying protected.
http
://users.telenet.be/bluepatchy/miekiem…revention.html
Post #22

I am dissappointed it has got to this really…I joined this site to try and free up some virtual ram for speedier performance, and find myself with an unusable infected pc.

Looking at your first HijackThis log are indications your pc was infected.

Perhaps the virustotal scan should have been carried out earlier with the first Hijackthis report….before combofix screwed up things, particularly my firewall settings as they were fine before. That’s when the real problems started….

The tool would have given the same results.

On hindsight, I don’t think I should have been advised to go online with no firewall on, even for a second , as I guess it only takes this long to infect a pc and maybe that’s when all this started.

If I read your post correctly, you stated the only way you could do anything was with the firewall disabled.

Do you use the LogMeIn program to login into other pc's? If so, that pc is probubly infected as well.

Another issue is your windows os.
You should have updated to SP2 years ago. Any reason you haven't updated?
Post #23
Hi I take your points to hand and appreciate the efforts and help I have received. Sorry, I did not realise my pc was infected until it was brought to my attention which was after the sdfix virusscan, although there was clearly something wrong after the combofix download/run. The Log me in programm is a very recent download (2/3 weeks ago) and has not been used yet, so no contact with outside activity there. i didnt know about SP2, when I bought the pc it came with SP1, so wasnt aware i needed to change this. Regarding the firewall, i think i reported that with Sygate on, that since the Combofix download, I could gain internet access but not browsing access, so was unsure what to do re unfirewalled downloads. Im sorry if my post sounds like a complaint, I guess i feel Im in a bigger mess than when I started, but am aware that things can occur during fixing process. I think I have followed all instructions to date, but not sure reformatting is something I feel confident on doing on my own. andy.t
Post #24
We can clean up if you wish to proceed that way, there is just no guarantees you will be spotless. We can run a scan to check for hidden processes to begin with.
Post #25
Ok Scotty…..I think thats the way to go Dont know how long the back door trojan has been on my pc, but my details havent been tampered with in any way. To be sure though Ive changed all my important passwords from another pc . So i guess going online to download cant really make things any worse now right? Anyway, lets proceed with the clean up….once again it will save sme time if you can give/request as much info as poss in each post, until its safe to go back oline at home Thanks again Andy.T
Post #26
Hi

Okay, first of all, when you do go on the Net and need to disable Sygate, follow these instructions. Enable the Internet Connections Firewall.

1. Click Start, click Run, type control.exe netconnections, and then click OK.
2. Right-click the connection on which you would like to enable ICF, and then click Properties.
3. On the Advanced tab, click the box to select the option to Protect my computer or network.

To help others in the future, I need you to upload this file. Navigate to this folder

C:\Program Files\My App

and locate the tmt.com file. Now right-click on it, select Send To then Compressed (zipped) folder.

Next go here

http://security-central.us/forums/showthread.php?t=270 and follow the instructions to upload that zipped folder you just created. You do not have to register to do this.

Reboot into SAFE MODEBy pressing the F8 key right when Windows starts, usually right after you hear your computer
beep when you reboot it (some versions of windows will display 'Starting Windows' with a grey progress bar)
you will be brought to a menu where you can choose to boot into safe mode.

If it does not work on the first try, reboot and try again, as you have to be quick when you press it.

I have found that during boot up, right after the computer displays the equipment , memory, etc
installed on your computer, if you start lightly tapping the F8 key, the system will usually display the menu.
Navigate to and delete the following files and/or folders (if they are present):

Files:
C:\WINDOWS\System32\gztucqp.exe

Folders:
C:\Program Files\taskmngr
C:\Program Files\My App

BLACKLIGHT
  • Please download F-Secure Blacklight (fsbl.exe) from here
  • Save into C:\ with a name of fsbl.exe
  • Go to Start > Run
  • Copy and paste the contents of the below codebox into the run box 
    C:\fsbl.exe /expert
  • Click OK
  • This will launch BlackLight
  • Select I accept the agreement
  • Click Next
  • Click Scan
  • Wait for the scan to finish
  • Click on Next>
  • Click Exit
  • A logfile will have been created in the C:\ drive
  • It will be named fsbl-xxxxxxxxxxxxxx.log where xxxxxxxxxxxxxx is the date and time of the scan
  • Use notepad to open that log
  • Post the contents of that log as a reply to this topic together with a new HijackThis log.
Post #27
Scotty It is not possible to connect to the internet in safe mode…is this something to do wit h the enabling the icf? Also, I went to the link you gave but does not allow uploads from guests at present, I tried it from google too, but there is no manage files option that I can see. Anyway I opened the compressed file I was supposed to upload but there was nothing in it, so unsure whats happening there either.. Please advise on this and what I should do re the safe mode prob. Thanks A
Post #28
Sorry. I should have told you to reboot back into normal mode after deleting thos files. :wacko: Ill pass on the message about the upload, if you could get that Blacklight scan done?
Post #29

Also, I went to the link you gave but does not allow uploads from guests at present, I tried it from google too, but there is no manage files option that I can see.


Did you use the username: tester
Password; tester
Post #30
Scotty

I have deleted C:\Program Files\taskmngr and C:\Program Files\My App…..however I have not emptied my recycle bin……..wont I need these folders at some point?

The file : C:\WINDOWS\System32\gztucqp.exe was not there.

The fsbl.exe file was saved on to my desktop not Cdrive, so couldn’t open it from run, had to open and scan from the desktop icon. will that make a difference to the scan results? It reported back as no hidden files found.

Anyway, here is the info you required


09/18/07 11:16:58 [Info]: BlackLight Engine 1.0.64 initialized
09/18/07 11:16:58 [Info]: OS: 5.1 build 2600 (Service Pack 1)
09/18/07 11:16:59 [Note]: 7019 4
09/18/07 11:16:59 [Note]: 7005 0
09/18/07 11:18:06 [Note]: 7006 0
09/18/07 11:18:06 [Note]: 7011 1144
09/18/07 11:18:07 [Note]: 7026 0
09/18/07 11:18:07 [Note]: 7026 0
09/18/07 11:18:11 [Note]: FSRAW library version 1.7.1022
09/18/07 11:20:18 [Note]: 2000 1012
09/18/07 11:26:16 [Note]: 7007 0


Logfile of HijackThis v1.99.1
Scan saved at 11:30:25, on 18/09/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Andreas\Desktop\Hijack This\HijackThis2.exe

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msennger] C:\Program Files\My App\tmt.com
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinReg] C:\Program Files\My App\tmt.com
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpeedItUpEX] C:\Program Files\SpeedItUpFree\SpeedItUp.exe -MINI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [hohohhaha] C:\Program Files\My App\tmt.com
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI