Tech Support Guy banner
  • IMPORTANT: Only authorized members may reply to threads in this forum due to the complexity of the malware removal process. Authorized members include Malware Specialists and Trainees, Administrators, Moderators, and Trusted Advisors. Regular members are not permitted to reply, and any such posts will be deleted without notice or further explanation. Notice
Status
Not open for further replies.
1 - 4 of 4 Posts

·
Registered
Joined
·
4 Posts
Discussion Starter · #1 ·
I am running Windows XP pro on an 2.5GHz Athlon system with 1 gig of RAM. It normally runs smoothly.

Recently I have been experiencing my computer becoming sluggish, and also internet explorer becoming slow at opening web pages etc.
This slowing down of performance coincides with three running processes appearing, which I am not used to seeing.
They are msdtc.exe and two instances of dllhost.exe.

I often use a-squared hijack free (a better task manager than the winodws one) to see what processes are running and
to close down ones i don't need, so i am pretty familiar with what processes are normally running on my computer.
This msdtc and two instances of dllhost are new to me, they are not normally running.
When i end them, the performance deterioration also ends.

Could these processes be being called by a virus, spyware, or a hacking attack?
I do not have remote assistance or remote desktop enabled.

Below is the HJT log, made while msdtc.exe and dllhost.exe were running, and below it are reports on msdtc
and the 2 dllhost instances, generated by a-squared hijack free.
HJT doesn't seem to detect msdtc.exe as a running process but a-squared hijackfree does.

Notes: I set the firewall to block all mode once i found msdtc and dllhost running, so this HJT log and a-squared reports
were made while the internet connection was blocked by the firewall.

See also this thread from someone else in this forum, which is unresolved, and looks related:
http://forums.techguy.org/malware-removal-hijackthis-logs/590556-dllhost-exe-hjt-log-included.html

I got a-squared hijack free from here:
http://www.hijackfree.com/en/

Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:32:15, on 11/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
E:\Program Files\a-squared Free\a2service.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
E:\Program Files\Comodo\Firewall\cmdagent.exe
E:\WINDOWS\system32\inetsrv\inetinfo.exe
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\System32\snmp.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\sstray.exe
E:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
E:\Program Files\Comodo\Firewall\cfp.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Free Download Manager\FUM\fumoei.exe
E:\Program Files\Kontiki\KHost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\dllhost.exe
E:\Program Files\a-squared HiJackFree\a2hijackfree.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/advanced_search?hl=en
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = edin-cache-2.server.ntli.net:8080
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - E:\Program Files\Internet Download Manager\IDMIECC.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - E:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - (no file)
O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: IE DOM Explorer - {CC7E636D-39AA-49b6-B511-65413DA137A1} - E:\Program Files\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O3 - Toolbar: Developer Toolbar - {CC962137-2E78-4f94-975E-FC0C07DBD78F} - E:\Program Files\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [avgnt] "E:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO Firewall Pro] "E:\Program Files\Comodo\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Uploader Oe Integration] E:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [kdx] E:\Program Files\Kontiki\KHost.exe -all
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all with Free Download Manager - file://E:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://E:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://E:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://E:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - E:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - E:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - E:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - E:\Program Files\Free Download Manager\FUM\fumiebtn.dll
O12 - Plugin for .nwc: E:\Program Files\NoteWorthy Software\NWC Browser Plugin\npnwcw32.dll
O15 - Trusted Zone: http://*.nahoo.net
O15 - Trusted IP range: http://192.168.1.1
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} - 
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - 
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - 
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - 
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - 
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://spring1.ura.gov.sg/mapguide6/mgaxctrl.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - 
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - 
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-8D54A7E8A790} - 
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.5.0_02) - 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5079/mcfscan.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O18 - Filter: text/plain - (no CLSID) - (no file)
O20 - AppInit_DLLs:  E:\WINDOWS\system32\guard32.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - E:\Program Files\a-squared Free\a2service.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - E:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - E:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe

--
End of file - 10424 bytes
a-squared hijack free report file on msdtc process when it is running follows:

Code:
File properties:
File name:	msdtc.exe
File path:	E:\WINDOWS\System32\
Description:	MS DTC console program
Company:	Microsoft Corporation
Version:	2001.12.4414.258
Copyright:	Copyright (C) Microsoft Corp. 1995-1998

Process details:
Run as service:	Yes
Started by autorun:	No
Open TCP ports:	-
Open UDP ports:	-

Loaded modules:
E:\WINDOWS\System32\msdtc.exe
E:\WINDOWS\system32\ntdll.dll
E:\WINDOWS\system32\kernel32.dll
E:\WINDOWS\system32\msvcrt.dll
E:\WINDOWS\System32\MSDTCTM.dll
E:\WINDOWS\system32\ADVAPI32.dll
E:\WINDOWS\system32\RPCRT4.dll
E:\WINDOWS\System32\DNSAPI.dll
E:\WINDOWS\System32\WS2_32.dll
E:\WINDOWS\System32\WS2HELP.dll
E:\WINDOWS\system32\GDI32.dll
E:\WINDOWS\system32\USER32.dll
E:\WINDOWS\System32\MSDTCLOG.dll
E:\WINDOWS\system32\ole32.dll
E:\WINDOWS\System32\MSDTCPRX.dll
E:\WINDOWS\System32\MSVCP60.dll
E:\WINDOWS\System32\MTXCLU.DLL
E:\WINDOWS\System32\COMRes.dll
E:\WINDOWS\system32\VERSION.dll
E:\WINDOWS\System32\WSOCK32.dll
E:\WINDOWS\system32\NETAPI32.dll
E:\WINDOWS\System32\Secur32.dll
E:\WINDOWS\System32\WINMM.dll
E:\WINDOWS\System32\MSWSOCK.dll
E:\WINDOWS\System32\XOLEHLP.dll
E:\WINDOWS\System32\ShimEng.dll
E:\WINDOWS\AppPatch\AcGenral.DLL
E:\WINDOWS\system32\OLEAUT32.dll
E:\WINDOWS\System32\MSACM32.dll
E:\WINDOWS\system32\SHELL32.dll
E:\WINDOWS\system32\SHLWAPI.dll
E:\WINDOWS\system32\USERENV.dll
E:\WINDOWS\System32\UxTheme.dll
E:\WINDOWS\system32\IMM32.DLL
E:\WINDOWS\System32\LPK.DLL
E:\WINDOWS\System32\USP10.dll
E:\WINDOWS\system32\guard32.dll
E:\WINDOWS\System32\fltLib.dll
E:\WINDOWS\System32\winsta.dll
E:\WINDOWS\System32\CLUSAPI.DLL
E:\WINDOWS\System32\RESUTILS.DLL
E:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
E:\WINDOWS\system32\comctl32.dll
E:\WINDOWS\System32\MTxOCI.Dll
E:\WINDOWS\System32\CLBCATQ.DLL
a-squared hijack this report on first instance of dllhost.exe process.
The report for the second instance of dllhost.exe looks the same.

Code:
File properties:
File name:	dllhost.exe
File path:	E:\WINDOWS\system32\
Description:	COM Surrogate
Company:	Microsoft Corporation
Version:	5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Copyright:	© Microsoft Corporation. All rights reserved.

Process details:
Run as service:	Yes
Started by autorun:	No
Open TCP ports:	-
Open UDP ports:	-


Loaded modules:
E:\WINDOWS\system32\dllhost.exe
E:\WINDOWS\system32\ntdll.dll
E:\WINDOWS\system32\kernel32.dll
E:\WINDOWS\system32\msvcrt.dll
E:\WINDOWS\system32\ole32.dll
E:\WINDOWS\system32\ADVAPI32.dll
E:\WINDOWS\system32\RPCRT4.dll
E:\WINDOWS\system32\GDI32.dll
E:\WINDOWS\system32\USER32.dll
E:\WINDOWS\system32\ShimEng.dll
E:\WINDOWS\AppPatch\AcGenral.DLL
E:\WINDOWS\system32\WINMM.dll
E:\WINDOWS\system32\OLEAUT32.dll
E:\WINDOWS\system32\MSACM32.dll
E:\WINDOWS\system32\VERSION.dll
E:\WINDOWS\system32\SHELL32.dll
E:\WINDOWS\system32\SHLWAPI.dll
E:\WINDOWS\system32\USERENV.dll
E:\WINDOWS\system32\UxTheme.dll
E:\WINDOWS\system32\IMM32.DLL
E:\WINDOWS\system32\LPK.DLL
E:\WINDOWS\system32\USP10.dll
E:\WINDOWS\system32\guard32.dll
E:\WINDOWS\system32\fltLib.dll
E:\WINDOWS\system32\winsta.dll
E:\WINDOWS\system32\NETAPI32.dll
E:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
E:\WINDOWS\system32\comctl32.dll
E:\WINDOWS\system32\CLBCATQ.DLL
E:\WINDOWS\system32\COMRes.dll
E:\WINDOWS\system32\xpsp2res.dll
E:\WINDOWS\system32\COMSVCS.DLL
E:\WINDOWS\system32\colbact.DLL
E:\WINDOWS\system32\Secur32.dll
E:\WINDOWS\system32\MTXCLU.DLL
E:\WINDOWS\system32\WSOCK32.dll
E:\WINDOWS\system32\WS2_32.dll
E:\WINDOWS\system32\WS2HELP.dll
E:\WINDOWS\system32\CLUSAPI.DLL
E:\WINDOWS\system32\RESUTILS.DLL
E:\WINDOWS\system32\rsaenh.dll
E:\WINDOWS\system32\ODBC32.DLL
E:\WINDOWS\system32\comdlg32.dll
E:\WINDOWS\system32\odbcint.dll
E:\WINDOWS\System32\es.dll
E:\WINDOWS\system32\wtsapi32.dll
E:\WINDOWS\system32\inetsrv\wam.dll
E:\WINDOWS\system32\MFC42.DLL
E:\WINDOWS\system32\inetsrv\ISATQ.dll
E:\WINDOWS\system32\IisRTL.DLL
E:\WINDOWS\system32\mswsock.dll
E:\WINDOWS\system32\hnetcfg.dll
E:\WINDOWS\System32\wshtcpip.dll
E:\WINDOWS\system32\inetsrv\iwrps.dll
\\?\E:\WINDOWS\system32\inetsrv\asp.dll
E:\WINDOWS\system32\ATL.DLL
E:\WINDOWS\system32\CRYPT32.dll
E:\WINDOWS\system32\MSASN1.dll
E:\WINDOWS\system32\ADMWPROX.DLL
E:\WINDOWS\system32\msi.dll
\\?\E:\WINDOWS\system32\inetsrv\asptxn.dll
E:\WINDOWS\system32\SXS.DLL
E:\WINDOWS\system32\vbscript.dll
E:\WINDOWS\system32\pdm.dll
 

·
Registered
Joined
·
4 Posts
Discussion Starter · #2 ·
PS: I don't know if this is related, but of late i have also noticed that the icons in the system tray
in the task bar, at the bottom right of my desktop, have disappeared. There used to be icons there
for the comodo firewall, antivir, volume control, and the safely remove hardware
(for USB devices) icon. Now those icons are missing.
 
1 - 4 of 4 Posts
Status
Not open for further replies.
Top