Blackworm virus???

Discussion in 'Malware Help (A Specialist Will Reply)' started by feljeer, Mar 30, 2006.

  1. feljeer

    feljeer Private E-2

    I have coppied and pasted the following from another thread because I am having the same problems as they did......

    _______________________________________________________________
    Many thanks in advance for your help with this. This site is a blessing.

    I am having a problem with Internet Explorer. When I start it and it directs me to my home page everything is perfect. Shortly after I attempt to enter any other site one of two messages pop up.

    The first is an error message that says my computer may be infected with the "blackworm virus" and that I must remove it immediately. The site it refers me to reads:

    "You may be infected by 'Blackworm'! We recommend you DOWNLOAD
    one of these security software programs to prevent further malware infections

    The dangerous 'Blackworm' computer virus activated February 2006 and has started destroying data on computers it has reached. The lethal virus, which has already infected over 1,000,000 computers in several countries, continues to spread rapidly over the Internet.

    Attention! Security Center has detected spyware on your PC sending private information and documents to a remote computer. One of the processes (Win32res.exe) has just sent this information"


    Even if I press cancel I am still directed to thiswebpage that reads like a virus scan log and recommends that I install WinAntiVirusPro and the web page address is www.amaena.com (i think). It then freezes my explorer if I attempt to cancel it.

    The second message that appears says something like my registry files are corrupt and I need to immediately download Win Fixer 2006 to fix it. Same problem, I try and cancel and it freezes.
    ____________________________________________________

    How can I fix this????? I cant work out how to submit the file so I will paste the Hijackthis File.....

    Logfile of HijackThis v1.99.1
    Scan saved at 8:38:40 AM, on 31/03/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\windows\mousepad6.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Symantec AntiVirus\VPC32.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\F.R.E.D\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.commbank.com.au/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.scu.edu.au
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
    R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [mousepad] C:\windows\mousepad6.exe
    O4 - HKLM\..\Run: [keyboard] C:\windows\keyboard6.exe
    O4 - HKLM\..\Run: [newname] C:\windows\newname6.exe
    O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O4 - HKLM\..\RunServices: [csr] csrrs.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
    O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
    O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.scu.edu.au
    O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zan...77b3ec2c642b:d65dcad4d7f23d81ea8a8b93e75306fe
    O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
    O20 - AppInit_DLLs: repairs303169566.dll
    O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\n8l80i3ue8.dll
    O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\spndcmsg.dll (file missing)
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
    O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
    O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
    O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


    Please help

    Cheers
    A
     
    feljeer, Mar 30, 2006
    #1
  2. feljeer

    feljeer Private E-2

    My Apologies, I did not read the stuff telling me not to paste my Log.......Hope it doesnt cause too many headaches.

    I have coppied and pasted the following from another thread because I am having the same problems as they did......
    _______________________________________________________________
    Many thanks in advance for your help with this. This site is a blessing.

    I am having a problem with Internet Explorer. When I start it and it directs me to my home page everything is perfect. Shortly after I attempt to enter any other site one of two messages pop up.

    The first is an error message that says my computer may be infected with the "blackworm virus" and that I must remove it immediately. The site it refers me to reads:

    "You may be infected by 'Blackworm'! We recommend you DOWNLOAD
    one of these security software programs to prevent further malware infections

    The dangerous 'Blackworm' computer virus activated February 2006 and has started destroying data on computers it has reached. The lethal virus, which has already infected over 1,000,000 computers in several countries, continues to spread rapidly over the Internet.

    Attention! Security Center has detected spyware on your PC sending private information and documents to a remote computer. One of the processes (Win32res.exe) has just sent this information"


    Even if I press cancel I am still directed to thiswebpage that reads like a virus scan log and recommends that I install WinAntiVirusPro and the web page address is www.amaena.com (i think). It then freezes my explorer if I attempt to cancel it.

    The second message that appears says something like my registry files are corrupt and I need to immediately download Win Fixer 2006 to fix it. Same problem, I try and cancel and it freezes.
    ____________________________________________________

    How can I fix this????? my hijack this log is attatched
     

    Attached Files:

    feljeer, Mar 30, 2006
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    You must not post any HJT logs without having run the cleaning procedures covered in the READ & RUN ME sticky thread and repeated below. Also you must install HJT properly. You need to run the SurfSideKick removal procedure to which is mentioned in one of the links title Special Removal Procedures.

    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)
      • Bitdefender
      • Panda Scan
      • HijackThis
    .
     
    chaslang, Mar 31, 2006
    #3
  4. feljeer

    feljeer Private E-2

    I have tried running the panda online scan a dozen or so times but I cant get it to work..... any ideas?

    Do I really need it? I have done the bitdefender scan
     
    feljeer, Mar 31, 2006
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It can be very useful, but if you cannot get it to run jus skip it and complete the other steps. Did you try running it in normal boot mode instead of safe mode? What is the exact problem?
     
    chaslang, Mar 31, 2006
    #5
  6. feljeer

    feljeer Private E-2

    a couple of problems. re: the panda software..... I just cant download it. Every time I try to (and have tried heaps of ways) at some stage it comes up with "errors on page" and wont allow the download. Same thing happens with the online scan.

    At some stage my norton has been messed with and has dissapeared with no input from me. I have run bitdefender 4 times with new stuff found each time. I have done everything I have been told to do so far but no luck.

    Have attached the last bitdefender and HJT log

    A
     

    Attached Files:

    feljeer, Mar 31, 2006
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not run the Bitdefender online scan and attach the log as requested in step 6 of the read me. What you attach is some configuration info for the full Bitdefender 8 program. Why did you install this while you still have Symantec/Norton install and running? Uninstall Symantec if it seems broken or you do not use it. You must only use one antivirus application.

    Please follow directions and run the Bitdefender online scan in step 6. And follow the directions EXACTLY as written for attaching a log or you will do it wrong.

    Let's get an installed programs list from HijackThis too!
    • Run HijackThis, click Open the Misc Tools section
    • Click Open Uninstall Manager
    • Click Save List (generates uninstall_list.txt)
    • Click Save, to save it to a file where you can find it.
    • Attach the uninstall_list.txt file to your next message.
    Now please download Look2Me-Destroyer.exe to your desktop.
    • Close all windows before continuing.
    • Double-click Look2Me-Destroyer.exe to run it.
    • Put a check next to Run this program as a task.
    • You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
    • When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
    • Once it's done scanning, click the Remove L2M button.
    • You will receive a Done Scanning message, click OK.
    • When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
    • Your computer will then shutdown.
    • Turn your computer back on.
    • Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.
    If Look2Me-Destroyer does not reopen automatically, reboot and try again.

    If you receive a message from your firewall about this program accessing the internet please allow it.

    If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
    http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
     
    Last edited: Mar 31, 2006
    chaslang, Mar 31, 2006
    #7
  8. feljeer

    feljeer Private E-2

    ok now I believe I have done everything required. Lets see how it went.
     

    Attached Files:

    feljeer, Apr 3, 2006
    #8
  9. feljeer

    feljeer Private E-2

    oops forgot the bitdefender log
     

    Attached Files:

    feljeer, Apr 3, 2006
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay I still see Symantec. Have you decided to keep it and remove Bitdefender? Is Symantec still broken?

    Go to Add/Remove programs and uninstall the below (also listed in step 0 of the READ ME):
    Command
    J2SE Runtime Environment 5.0 Update 3 <-- not malware. Just old version not needed!
    Network Monitor
    webHancer Customer Companion
    WinFixer 1.1.62.4

    Then attach a new HJT log so we can manually fix what remains!
     
    chaslang, Apr 3, 2006
    #10
  11. feljeer

    feljeer Private E-2

    C:\program files\winfixer\uninst001.dat does not exist. cannot uninstall.



    yes I reinstalled norton.
     

    Attached Files:

    feljeer, Apr 4, 2006
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'. On the page that opens, scroll down to Command Service... then right click the entry, select 'Properties' and press 'Stop Service'. When it shows that it is stopped, next please set the 'Start-up Type' to 'Disabled'. Press 'OK' until you get back to Windows.

    Next, run HJT, but instead of scanning, click on the "None of the above, just start the program" button at the bottom of the choices. At the lower right, click on the 'Config" button, and then the Misc tools' button ... select 'Delete an NT Service" ... copy/paste the following into the box that opens, and press "OK":

    cmdService

    Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.


    Make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
    O4 - HKLM\..\RunServices: [csr] csrrs.exe
    O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} - http://static.zangocash.com/cab/Zango/ie/bridge-c356.cab?3d78641c35c285f0b5af11442c6472c051b3f64c8f7f5822a4301327b3f9141d5c15113deef26ab072e4b9823d59ace9d9365ca936542977b3ec2c642b:d65dcad4d7f23d81ea8a8b93e75306fe
    O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} (Progetto1.int_ver34) - http://advnt01.com/dialer/int_ver34.CAB
    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SnVkcmVk\command.exe

    After clicking Fix, exit HJT.
    Boot into safe mode and use Windows Explorer to delete    :
    C:\WINDOWS\SnVkcmVk\command.exe
    C:\WINDOWS\system32\csrrs.exe <--- only delete this exact file name if found. DO NOT delete csrss.exe.

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

    Let's use HijackThis to try and delete the WinFixer 1.1.62.4 program from the installed programs list.
    • Run HijackThis, click Open the Misc Tools section
    • Click Open Uninstall Manager
    • Locate the WinFixer 1.1.62.4 program in the list and click it.
    • Then click Delete this entry on the right side of the screen.
    • Let me know if that removes it from the list


    Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
    Now run Ccleaner (installed while running the READ ME FIRST)    .

    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    chaslang, Apr 4, 2006
    #12
  13. feljeer

    feljeer Private E-2

    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SnVkcmVk\command.exe

    C:\WINDOWS\SnVkcmVk\command.exe
    C:\WINDOWS\system32\csrrs.exe

    The above files were not there.

    The winfixer delete worked fine thanks.

    So far every thing seems fine.

    Thank you very much for your help!!!
     

    Attached Files:

    feljeer, Apr 5, 2006
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Apr 5, 2006
    #14

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds