Tech Support Guy banner
  • IMPORTANT: Only authorized members may reply to threads in this forum due to the complexity of the malware removal process. Authorized members include Malware Specialists and Trainees, Administrators, Moderators, and Trusted Advisors. Regular members are not permitted to reply, and any such posts will be deleted without notice or further explanation. Notice
Status
Not open for further replies.

wee, what fun to have a virus

764 views 4 replies 3 participants last post by  TOGG  
#1 ·
hello,
i've been having operational and reboot problems since a week and a half ago. i tried scanning and cleaning with the standard methods (norton, adaware, spybot) with no luck. i followed this with a reinstall of XP and it looks like my bios got infected as the same problems have shown themselves. i notice aube3.exe, mscman.exe, and a few other processes which are normally not found operating on my system. the reboots are particularly annoying, as they occur not only when disc accesses are made, but also when trying to use the net, or any cpu intensive activity that i attempt.

anywho, here's what hijack this spat out to me:

Logfile of HijackThis v1.96.0
Scan saved at 12:52:30 PM, on 11/08/2003
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Norton Internet Security\SymProxySvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\qzh\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System32\blank.htm
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

thanks for the help in advance.
getting frustrated as i just finished a master's degree and wanted time to play with Pure Data...
 
#3 ·
thanks for the quick post,

i'm not sure sure it's a hardware prob, as my athlon is running around 54 C and i'm not overclocking either it or my graphics card. the memory is both a 512 and a 256, and both chips are 333 running at 266.
then there's the fact that norton is telling me every few seconds when i reboot that there is a remote access occurring. plus, i noticed that my bios does not allow me to set a password anymore...
hmmm???
 
#4 ·
quinner,

I am not enough of an expert to know if there are any trojans that can escape detection by a HJT scan.

However, since you are getting NAV messages about remote access, have you tried any anti trojan programs? The wilders.org site lists some of the available programs that have trial periods.

You could also look at Trojan Remover from www.simplysup.com This is not a real-time scanner, it just searches the usual starting points for trojans or the whole HDD if you let it. It will amend files if it finds anything so you need to read all the information carefully before trying it. It's free for 30 days.
 
Save
#5 ·
Then again, reboots seem to be one of the symptoms of the W32 Blaster worm and XP is one of the OS's that are susceptible so perhaps you should investigate that possibility as well.

Symantec provide a removal tool http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Assuming, of course, that this worm can evade a HJT scan.

Addendum

This thread would appear to cast some doubt on my latest theory;
http://forums.techguy.org/t154874/s.html Did I mention that I wasn't an expert?
 
Save
Status
Not open for further replies.
You have insufficient privileges to reply here.