Trojan?

Discussion in 'Malware Help (A Specialist Will Reply)' started by nilsA, Oct 20, 2007.

  1. nilsA

    nilsA Private E-2

    After running all the proigrams - there is still a problem with a computer that every now and then is connected to my network.

    It gets to the Internet before we log on, and keeps sending and receiving files.

    The offline, safe mode tests gave nothing in the logs, so I don't attach them.

    Ther rest is here - hopingh to get help.
     

    Attached Files:

    nilsA, Oct 20, 2007
    #1
  2. nilsA

    nilsA Private E-2

    And here:
     

    Attached Files:

    nilsA, Oct 20, 2007
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking Fix, exit HJT.

    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now attach new logs for:

    * GetRunKey
    * ShowNew
    * HJT
     
    TimW, Oct 20, 2007
    #3
  4. nilsA

    nilsA Private E-2

    Thank you, Tim!

    Here's the new logs.

    The PC seems still to be leaking after re-boot, so I'll leave it offline ...
     

    Attached Files:

    nilsA, Oct 21, 2007
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Is this a home network? Does it happen when only this computer is on?
    Let's try two things, since I am not seeing anything malicious:

    1)Download this file - Combofix.exe
    Double click combofix.exe & follow the prompts.
    When finished, it will produce a log for you. Attach this log to your next reply

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    2) Download and run AVG-Antirootkit

    Attach both of the logs.
     
    TimW, Oct 21, 2007
    #5
  6. nilsA

    nilsA Private E-2

    Yes, it's a mixed home wireless and wire network, running Kubuntu, W2000, XP.

    And yes, this happens also when this PC is the only one running.

    What happens is - the first seconds I have been able to see, a few hundred packets are sent and received; close to 200 there's a burst to some 4000+, and then it keeps slowly exchanging(?) packets. A little more out than in.

    I can't see any log to the AVG? Maybe because nothing was found?

    So, here's the combofix file, anyway.
     
    nilsA, Oct 21, 2007
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You did not attach the log.

    What makes you think the activity is malicious? It would be normal for many programs to update or look for updates....as well as packets being exchanged with your ISP....

    A good firewall will alert you to malicious things .....
     
    TimW, Oct 21, 2007
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    One other thing....
    YOu should delete these:
    C:\145.tmp
    C:\1a2.tmp
    C:\208.tmp
    C:\68.tmp
    C:\d0.tmp
    C:\de.tmp

    Avast, Download manager,Nero, Adobe, Acrobat --> all can be accessing the web at start up.

    You may wish to use a Startup Manager
     
    TimW, Oct 21, 2007
    #8
  9. nilsA

    nilsA Private E-2


    The log should be here now.

    The thing that worried me was - the network connection seems never to go down. But now I tried to remove the new network drive - and it seems the issue has something to do with this.


    There also seems to be some network problem when this computer is in the network, or possibly just with this computer. As this came just a few days ago, my guess was something having hijacked the network connection on this PC.

    Anyway, it's a relief to know there isn't anything bad here, so I'll just go on looking for what causes whatever is going on. It's not heavy-weight anyway - 1 or 2% taskmngr.exe.

    Thanks for your help!
     

    Attached Files:

    nilsA, Oct 22, 2007
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Process Explorer 10.21
    Use this rather than task manager ...it will show verified and non-verified processes ...let me know if it finds/shows anything bad.
     
    TimW, Oct 22, 2007
    #10
  11. nilsA

    nilsA Private E-2

    I can't find anything that looks strange to me. The processes involved when data is shifted between this PC and the network drive are network drive stuff, and these are not going up to 1% CPU.

    Possibly nothing but inefficient net drive routines? And the network trouble I encountered just bad luck/timing.

    Or is the ati2evxx.exe a problem? Seems a little strange that it is not signed by ATI? Some places on the net I see this listed as one hijacked frequently -
    it's in \WINNT\SYSTEM32\ folder - 276 kB, last change 2003.

    I've attached the procexp.txt file in case you think there may be something here.
     

    Attached Files:

    nilsA, Oct 23, 2007
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    ati2evxx.exe ---> is not a problem, though it can be a resource hog.
    http://www.bleepingcomputer.com/startups/ati2evxx.exe-379.html

    You may wish to use a Startup Manager

    Your logs look clean. You may uninstall any programs we had you download (including CounterSpy, etc).

    If you are not having any other malware problems, it is time to do our final steps:

    1. If we used Pocket Killbox during your cleanup, do the below
    * Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    7. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    8. If you are running Windows XP or Windows ME, do the below:
    * go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
    * How to Protect yourself from malware!
     
    TimW, Oct 23, 2007
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds