prefetch, read and ran first complete.

Discussion in 'Malware Help (A Specialist Will Reply)' started by flycast007, Feb 19, 2007.

  1. flycast007

    flycast007 Private E-2

    I ran all the scans yesterday. A few items were found as you will be able to see from the logs. First thing this morning I ran 'Advanced System Optimizer' "Spyware Detective" and once again I have GhostKeyLogger object C:\windows\prefetch\ntvdm.exe-1a10a423.pf . It has not executed yet but I also have a modemspy object C:\windows\prefetch\win32hlp.exe "with some numbers following it". I deleted the last copy I had of it. I am sure it will show up again.

    thx
    Robert
     

    Attached Files:

    flycast007, Feb 19, 2007
    #1
  2. flycast007

    flycast007 Private E-2

    Here are the remaining files.
     

    Attached Files:

    flycast007, Feb 19, 2007
    #2
  3. flycast007

    flycast007 Private E-2

    Is there something I missed? This post has been noticably skipped. To the best of my ability I followed the instructions in Read and Run this first. If my issue is beyond your expertise then say so. Thx anyways.
    Robert
     
    flycast007, Feb 19, 2007
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    Sorry for the delay! We have been swamp with requests for help and only a couple helpers have been able to post here during the last week.

    You need to uninstall Spyware Detective if it is the program telling you that those two files are malware. That is ridiculous. They are required Windows System processes. The real files are located in C:\windows\system32. You should get a better antispyware program.

    I do see some other things to clean up and I have a couple questions.

    First the questions!


    Do you know what the below two files are for? Is the iwlufklg.dll related to System Mechanic?
    Code:
    "C:\WINDOWS\"
iwlufklg.dll  Dec 15 2006         274  "iwlufklg.dll"
 
"C:\WINDOWS\system32\"
d84def~1.dll  Feb  4 2007          80  "D84DEF6B6A.dll"
    Do you know whether the below files are all part of SPSS 15.0 for Windows Evaluation Version which was installed on Jan 10th?
    Code:
    "C:\WINDOWS\system32\"
lsprst7.dll   Jan 10 2007         205  "lsprst7.dll"
nsprs.dll     Jan 10 2007           0  "nsprs.dll"
serauth1.dll  Jan 10 2007           0  "serauth1.dll"
serauth2.dll  Jan 10 2007           0  "serauth2.dll"
ssprs.dll     Jan 10 2007           0  "ssprs.dll"
sysprs7.dll   Jan 10 2007        1025  "sysprs7.dll"

    The below registry setting indicates that you have Disabled Internet Connection wizard. Did you do this yourself?


    Uninstall the below old versions of software:
    Java 2 Runtime Environment Standard Edition v1.2.2
    Mozilla Firefox (1.5.0.7)
    Make sure you reboot after uninstalling the above!

    Then install the current version of FireFox from: Mozilla Firefox

    Okay now uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders left behind by the uninstall:
    C:\Documents and Settings\All Users\Application Data\Sunbelt Software
    C:\Program Files\Sunbelt Software
    Continue by downloading a tool we will need - Pocket KillBox

    Save it to its own folder somewhere that you will be able to locate it later.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - {39B41CBB-DA5D-D5D3-7F95-872D66D8AC93} - (no file)
    O2 - BHO: (no name) - {39B41CBB-DA5D-D5D3-7F95-872D66D8AC93} - (no file)
    O2 - BHO: TBSB09718 - {571E3F7F-B6B5-4350-ADDE-F16ED678E0D3} - (no file)
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    After clicking Fix, exit HJT.

    Please delete the below folders that are from a PurtityScan infection. Ask Spyware Detective why they did not find this which is true malware. Note that the Questionmarks represent unprintable characters that were found during the scans, but they may appear to you as normal characters when you locate them using Windows Explorer. I will add comments in RED next to each item. Note the date of the folders which will help you to properly locate and identify them:
    Code:
    "C:\Program Files\Common Files\"
APPATC~1      Dec 10 2006              "A?pPatch"     [B][COLOR=red]<-- may look like AppPatch[/COLOR][/B]
SEMBLY~1      Dec 10 2006              "??sembly"     [B][COLOR=red]<-- may look like Assembly[/COLOR][/B]

    Now attach the below new logs and tell me how the above steps went.

    1. ShowNew
    2. HJT
     
    chaslang, Feb 20, 2007
    #4
  5. flycast007

    flycast007 Private E-2

    ---Quote
    You need to uninstall Spyware Detective if it is the program telling you that those
    two files are malware. That is ridiculous. They are required Windows System processes.
    The real files are located in C:\windows\system32. You should get a better antispyware
    program.
    ---End Quote---

    Normally I would agree with you with regards to the prefetch files. But, I am still suspicious of
    their presence. An example would be, tonight I ran a help file. This caused the prefetch file
    WINHLP32.EXE-27E3937B.pf to be created. However when I ran Spyware Detective this file
    WINHLP32.EXE-2C18E975.pf is identified as modemspy. I cannot at this time recreate this
    behavior with ntvdm.exe. But I do not access that program directly ever. And the WINHLP32
    also loads itself. I do not have to use winhelp in order for it to be loaded. Also if you
    check the capabilities of both ModemSpy and GhostKeylogger you will note that both are
    capable of stealth mode in which their processes are not detectable by Windows Task Manager
    or any other tool that uses a similar method for determining running processes. And, finally,
    running Spyware Detective on my wifes pc does not produce the same results. I therefore am
    still very suspicious that the modemspy process and ghostkeylogger process are being started
    on my pc and the prefetch file is my evidence.I am not saying that Spyware Detective is
    conclusive by any means. Just as you use many different programs to look for different things,
    so do I.


    ---Quote

    *Do you know what the below two files are for? Is the iwlufklg.dll related to System
    Mechanic?*

    Code:
    ---------
    "C:\WINDOWS\"
    iwlufklg.dll Dec 15 2006 274 "iwlufklg.dll"
    ---End Quote---

    //---------------------------------------------------------------
    I do not think that it is related to System Mechanic. It's creation date is in December.
    I installed System Mechanic in January, last week. I just moved that file to a different location.
    It does not state who created it. Hex editor reveals only sonkite and a few other letters.
    //---------------------------------------------------------------

    ---Quote

    "C:\WINDOWS\system32\"
    d84def~1.dll Feb 4 2007 80 "D84DEF6B6A.dll"

    ---End Quote---

    //---------------------------------------------------------------
    No idea. No name for the creator. And it appears to be attempting to be a hidden file.
    Considering moving it. It is a very small file only 80 bytes. I moved it.
    //---------------------------------------------------------------

    ---Quote
    Do you know whether the below files are all part of *SPSS 15.0 for Windows Evaluation
    Version* which was installed on Jan 10th?
    ---End Quote---

    "C:\WINDOWS\system32\"
    lsprst7.dll Jan 10 2007 205 "lsprst7.dll"
    //------------------------------
    Again an unknown file. 205 bytes Created at 12:53PM
    //-----------------------------
    nsprs.dll Jan 10 2007 0 "nsprs.dll"
    //------------------------------
    Again an unknown file. 0 bytes Created at 12:54PM
    //-----------------------------
    serauth1.dll Jan 10 2007 0 "serauth1.dll"
    //------------------------------
    Again an unknown file. 0 bytes Created at 12:54PM
    //-----------------------------
    serauth2.dll Jan 10 2007 0 "serauth2.dll"
    //------------------------------
    Again an unknown file. 0 bytes Created at 12:54PM
    //-----------------------------
    ssprs.dll Jan 10 2007 0 "ssprs.dll"
    //------------------------------
    Again an unknown file. 0 bytes Created at 12:54PM
    //-----------------------------
    sysprs7.dll Jan 10 2007 1025 "sysprs7.dll"
    //------------------------------
    Again an unknown file. 1 KB Created at 12:53PM
    //-----------------------------


    Uninstalled:
    Java 2 Runtime Environment Standard Edition v1.2.2
    and Mozilla Firefox (1.5.0.7)

    Installed Current Version of Mozilla Firefox

    Uninstalled Sunbelt Counterspy

    Downloaded Pocket Killbox

    Ran HJT and NewFiles

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - {39B41CBB-DA5D-D5D3-7F95-872D66D8AC93}
    - (no file)
    O2 - BHO: (no name) - {39B41CBB-DA5D-D5D3-7F95-872D66D8AC93} - (no file)
    O2 - BHO: TBSB09718 - {571E3F7F-B6B5-4350-ADDE-F16ED678E0D3} - (no file)
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    //-----------------------
    020-Winlogon Notify: AutorunDisabled- C:\WINDOWS\
    Is in that place now. Did not delete.
    //-----------------------
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    fixed the rest.

    Deleted:
    C:\Program Files\Common Files\AppPatch
    C:\Program Files\ Common Files\assembly

    //--------------------------------------------------------------
    Since my post I have continued to look for a solution to my possible problem.
    On 2/20/07 I ran all of the tests on Sheilds Up. Except for responding to pings
    my computer appears to be in a complete stealth mode online. I then installed
    Zone Alarm and uninstalled Norton System Works 2005, updated. No unfamiliar
    processes have tried to communicate from my pc. I also installed What's Running
    and WinSonar. WinSonar is a bit squirrelly but I was unable to identify an unknown
    process attempting to run. Also, I uninstalled Sunbelt Counterspy. When I did so
    Norton said a malicious script was being run so I blocked it. This totally
    screwed up my modem and caused repeated minidumps. Everytime I would attempt
    to dial into my isp my pc would shut down and a minidump would occur. I then
    reinstalled Sunbelt Counterspy, updated it, ran it and reuninstalled it. The
    minidumps continued. It seemed that a program had more control over my modem
    than I did. And, I was unable to determine what settings were used to do this.
    This morning I purchased a new USB modem and this seems to have eliminated that
    problem for now.
    //--------------------------------------------------------------

    Files attached


    Thx Robert


    I just noticed the question about wheather I disabled my dial up wizard. No I did not and I did not see this part of your post in my initial reciept of your reply. That may be one part of why my modem has been acting so squirrelly.
     

    Attached Files:

    flycast007, Feb 21, 2007
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please learn to use quote boxes like I'm using to make messages and replies easier to read. Click the Quote button to make a reply and then just copy & past additional quote boxes around sections to show my quotes follow by your replies.

    I repeat these are normal files to see even in prefetch. If you run any particular DOS type tools (including GetRunKey and ShowNew) you are going to make use of ntdvm.exe and it will be in prefetch. If you run Windows help or anything else that calls a Windows type help file, you will also see winhlp32.exe in the prefetch folder. I have 4 Win XP system right next to me where I'm writing this reply from. They all have those files in prefetch. Check your wifes PC (I assume it is Windows XP) yourself using Windows Explorer. Look in c:\windows\prefetch Are similarly named files there?

    If SpywareDetector is so good, why aren't they just removing the two prefetch files it is complaining about. They are not protected and you can even do this manually. But they are going to come back.

    File dates don't necessarily indicate the install date. System Mechanic will install many files while running its installation procedure, and many of the file dates will be the dates of the files from when the version of the application itself was built. Just like now if you install Windows XP on a system, you will see file dates based on the Windows XP CD date. Are you saying if you right click on the file there is no Version tab under Properties.

    Okay! That is what I owuld have suggested. Either moving or renaming. Make sure it (or something similar) does not come back after a reboot.

    Unknown processes are not necessarily bad. They are just unknown to the application doing the checking. This happens all the time.

    You should not have blocked it. You were trying to uninstall a program and its uninstall routine is what was running. What Norton probably said was that a potentially malicious script was trying to run. It frequently will even do this when you try to run tools like GetRunKey, ShowNew or try to perform registy patches. It does not mean it is definitely bad. You have to know the difference between when you are causing something to run and when it is running on its own. If you don't allow things to run that need to run, whatever you were trying to do will not work properly.

    I doubt it and it was there all along....even before you uninstall CounterSpy. But if you did not make this setting, you should fix it.
     
    chaslang, Feb 21, 2007
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Here is the fix for the connection wizard registry key.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Why did you attach two HJT logs in your last message? I only asked for one after the procedure was done.
     
    chaslang, Feb 21, 2007
    #7
  8. flycast007

    flycast007 Private E-2

    I included a HJT log file from before the fix and after the fix. I always err on the side of giving too much information whenever possible. Question, if Spyware Detective is incorrect, is there another definite way to find out if modemspy or Ghostkeylogger are hiding on my HD?
     
    flycast007, Feb 21, 2007
    #8
  9. flycast007

    flycast007 Private E-2

    I am repeatedly removing the files. And yes, they keep coming back. They are prefetch files. They are created by the windows memory management process to facilitate a faster start up the next time they are accessed. Once a prefetch file is created the program is already running on my system. Spyware Detector does not identify every win32hlp.exe(plus some numbers).pf file as modem spy.
    This file "WINHLP32.EXE-27E3937B.pf " is not identified as modemspy.
    This file "WINHLP32.EXE-2C18E975.pf " is always identified as modemspy. Note the 2C18E975. That number is always the same for the file identified as modemspy. I know you may think I am being a bit thick. But, I am still concerned about their presance.

    Is there a program that can read a prefetch file and identify the program it was created from?
     
    flycast007, Feb 21, 2007
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes I know what they are and I know they will keep coming back if you do run anything that causes the process to load.

    They are binary files and you could open them to look at them yourself just using Wordpad. But you would have to know what you are looking for. You will notice the name of the EXE file in the beginning but it will just tell you that it is winhlp32.exe

    Try the below procedure!

    Empty the contents of the IE Temporary Internet Folder cache (TIF)
    Click Start --> Control Panel --> Internet Options --> Delete Files
    Make sure you also check the option to Delete offline content too.
    Then click OK!


    Download the following two files, create a folder on your desktop, call it TSC. Save these 2 files there.

    Note: They must be in the same directory for it to work properly!

    Sysclean Package

    Trend Micro Pattern File for Windows

    After you complete the above, Extract the contents of the pattern file to the same folder where you downloaded the above two items to. The pattern file will be named something like lptxxx.zip (where xxx is the current pattern number - currently it is lpt285.zip but it changes frequently)

    Once you complete the steps above, REBOOT INTO SAFE MODE!

    Once in Safe Mode double click the file sysclean.com. When the system cleaner loads, click SCAN to start the scanner. After you complete the scan reboot and attach the Trend SysClean Log.

    Then see if you are still detecting modem spy. If so, scan any files detected as modemspy using the below online scan site. It will run a load of scanning utils. Tell me what they find:

    http://virusscan.jotti.org/


    Note: I will be out of town until next Monday evening! So unless another
    malware helper is around to pick this up, you will have to wait until I return.
     
    chaslang, Feb 21, 2007
    #10
  11. flycast007

    flycast007 Private E-2

    Alrighty now,
    Well, I ran the sysclean scan. The log file is attached. Nothing showed up. I installed a new USB modem Wednesday. I had not seen Modemspy or Ghostkeylogger most of the week. Tonight though, Modemspy showed up again, in the form of the prefetch file WINHLP32.EXE-2C18E975.pf. I also have the file WINHLP32.EXE-27E3937B.pf in my prefetch folder. I am attaching both for you to examine or share with someone that can dig into them. I scanned the file WINHLP32.EXE-2C18E975.pf at http://virusscan.jotti.org/ but it is clean according to the scan. My guess is that Ghostkeylogger is still on my hd as well. It has not showed up yet. Hope you had a good weekend. I look forward to your return.

    My theory here is that someone modified the modemspy files for install on the victom hd so that they would pretend to be normal system files. It is possible. In fact, Ghostkeylogger web site suggests for insertion onto an unsuspecting pc that the three files required by ghostkeylogger be changed to any name they want, as long as the three file have the same basic name. Myfile.dll, Myfile.exe and the other one. I will need to look at their documentation again to recall the third required file. My problem lies in the idea that modemspy and Ghostkeylogger are in stealth mode and cannot be found without more expertise than I have. I'm sure there is a way but I assume it is a secret that few would like to see revealed.

    Thx
    Robert
     

    Attached Files:

    flycast007, Feb 23, 2007
    #11
  12. flycast007

    flycast007 Private E-2

    I have another dumb question. Why, when I moved the WINHLP32.exe file from the WINDOWS\System32 folder did it almost immediately recreate itself? And the same question applies to the ntdvm.exe file in the same folder.
    Ghostkeylogger was detected a few minutes ago as this file, NTVDM.EXE-1A10A423.pf.
     
    flycast007, Feb 23, 2007
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Because they are valid required Windows files that your Window OS needs and it will replace them when they are deleted from backups.

    I REPEAT! You not have any malware. Your detections are false. If you don't want to except this fact then you are free to go elsewhere and get the same information (unless you goto a site that does not know what they are doing). Even the 25 or 30 scans from Jotti told you the file was clean and so did TSC, The program you are using is giving you false positives.

    You can give the below rootkit scan a try if you want to dig deeper for a stealth rootkit, but I don't expect it to find anything.

    Please download Blacklight Beta
    • Download blbeta.exe and save it to the Desktop.
    • Once saved... double click blbeta.exe to install the program.
    • Click accept agreement and Click scan
      This app too may fire off a warning from antivirus. Let the driver load.
      Wait for it to finish.
    • If it displays any items...don't do anything with them yet. Just hit exit (close)
    • It will drop a log on Desktop that starts with fsbl....big number
    Please post contents of the BlackLight log.
     
    chaslang, Feb 26, 2007
    #13
  14. flycast007

    flycast007 Private E-2

    chaslang,
    I do appreciate your assistance in attempting to determine what is going on on my pc. I have learned alot. I am also beginning to study assembly, because I do realize that most of us do not have a clue what goes on inside our pc's. I am beginning to accept the idea that there is nothing on my hd except a program that is showing false positives. I have found other programs that have shown other false positives that I was more readily able to dismiss a such. Btw except is spelled accept. And I am willing to accept this possibility. Besides, I have a firewall blocking all access to the net and I do not even have an email client that could phone home if it wanted to. Though you provided much insight into the ways to scan and analyse the contents of my hd for viruses I never felt that you addressed my primary concern regarding keyloggers that run in stealth mode. This would not have been a case where I dled the program to play with it and then could not figure out how to remove it. It was potentailly a situation where a keylogger was secretly installed on my hd and I had no idea where to find it or what to look for when I began this process. I hope in the future you can be a bit more empathetic to the concerns of one like me and not quite so demeaning. Thanks again for your very useful assistance. You have been a great help. My current running processes is down to 32 from 43. I am happy.

    Have a Great Day!
    Robert
     
    flycast007, Feb 26, 2007
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    We addressed you problems directly! You had no keylogger. Many of the scans will detect a variety of keyloggers (even some of the stealth ones), but you had none showing. Nothing was meant to be demeaning. You kept insisting that you had a problem no matter how many times I told you that there was no problem and that you were getting a false positive. The final rootkit scan I gave to you was a last attempt to look for a possible hidden rootkit (stealth) process. It probably would not have found anything as I said previously, but it would just add to the information indicating that you had no problems to be concerned with.

    True commercial stealth keyloggers are things that you would have to purchase and knowingly install for it to be able to completely hide. In some instances certain rootkit scans may still detect some of the processes in other cases they may not. I have not seen any malware keyloggers that are able to totally hide from all the scanning tools that we use.
     
    chaslang, Feb 28, 2007
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds