Freaky virus thing

[steviedee]

Hey.
This probably isn't the place, but I'd like to get a variety of advice
anyway.
I seem to have some sort of virus or trojan or spyware, it spams
constantly.
I've tried most of the antivirus packages I can get my hands on, but
none of them find anything.
A. is there a way of blocking port 25 with maybe windows firewall /
IPsec (which I don't really understand)
B. the mail is being sent by explorer.exe, which I've replaced, so my
guess is that something is using explorer.exe almost like a proxy to
send the mail for it, is there a way to see what is doing that (if
that's the case)
but any advice / help is DEFINATELY welcome, I'm totally stumped and
frustrated by this.
Thanks
Steven

 

[David H. Lipman]

From: "steviedee" <[email protected]>

| Hey.
| This probably isn't the place, but I'd like to get a variety of advice
| anyway.
| I seem to have some sort of virus or trojan or spyware, it spams
| constantly.
| I've tried most of the antivirus packages I can get my hands on, but
| none of them find anything.
| A. is there a way of blocking port 25 with maybe windows firewall /
| IPsec (which I don't really understand)
| B. the mail is being sent by explorer.exe, which I've replaced, so my
| guess is that something is using explorer.exe almost like a proxy to
| send the mail for it, is there a way to see what is doing that (if
| that's the case)
| but any advice / help is DEFINATELY welcome, I'm totally stumped and
| frustrated by this.
| Thanks
| Steven

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *

 

[steviedee]

Hi,
Looks like a pretty cool tool! will defiantely come in handy!
when I'm done I'll report back.
Thanks
Steven

 

[steviedee]

ok,
I scanned with all 4 in normal mode (took an AGE)

Results:

--------------------------------------------------------------------------------------------

01/17/2006 13:28:53


Options:
"C:\" /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL
/MIME /PROGRAM /EXCLUDE C:\AV-CLS\EXCLIST.TXT /HTML
"C:\AV-CLS\MCAFEE\SCANREPORT.HTML"

Scanning C: [Win]
Scanning C:\*.*

Summary report on C:\*.*
File(s)
Total files: ........... 191309
Clean: ................. 191230
Possibly Infected: ..... 0
Cleaned: ............... 0
Non-critical Error(s): 3


Time: 00:55.08

------------------------------------------------------------------------------------------

Report Date : 1/16/2006 23:09:30
VSAPI Engine Version : 8.000-1001
VSCANTM Version : 1.1-1001
Virus Pattern Version : 159 (119398 Patterns) (2006/01/15) (315900)
Command Line: c:\AV-CLS\Trend\VSCANTM.BIN /NBPM /S /CLEANALL /LAPPEND
/LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=c:\AV-CLS\Trend

66370 files have been read.
66370 files have been checked.
51674 files have been scanned.
100104 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 1/17/2006 00:44:43

-------------------------------------------------------------------------------------------------

2 master boot records swept.
104569 files swept in 4 hours, 15 minutes and 11 seconds.
98 errors were encountered.
No viruses were discovered.
42 encrypted files were not checked.
Ending Sophos Anti-Virus.

--------------------------------------------------------------------------------------------

Scan process completed.

Result for all objects:

Sector Objects : 0 Known viruses : 4
Files : 266727 Virus bodies : 12
Folders : 4800 Disinfected : 0
Archives : 1849 Deleted : 11
Packed : 238 Warnings : 0
Suspicious : 0
Scan speed (Kb/sec) : 787 Corrupted : 0
Scan time : 03:33:58 I/O Errors : 0

--------------------------------------------------------------------------------------------

While scanning with Kaspersky Norton and F-prot popped up a few times
saying they'de found PWSteal.cain and Trojan.Dropper and Adware.Istbar,
they were all in the Temp folder, and it was when Kaspersky was
scanning something in my "Documents and settings" folder.

I'll run it in Safe mode tonight and tomorrow (takes LONG) and add
those results too.

Hopefully I'm fixed up now?

Steven

 

[David H. Lipman]

From: "steviedee" <[email protected]>

< snip >

| While scanning with Kaspersky Norton and F-prot popped up a few times
| saying they'de found PWSteal.cain and Trojan.Dropper and Adware.Istbar,
| they were all in the Temp folder, and it was when Kaspersky was
| scanning something in my "Documents and settings" folder.
|
| I'll run it in Safe mode tonight and tomorrow (takes LONG) and add
| those results too.
|
| Hopefully I'm fixed up now?
|
| Steven

Known viruses : 4
Virus bodies : 12
Disinfected : 0

You filtered out the area showing the report what those 4 known viruses were found in the 12
bodies and in what location. That is something I want to see !

Adware.Istbar is indicative on non-viral malware.

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/

* SpyBot Search and Destroy v1.4
http://security.kolla.de/

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

 

[steviedee]

Hi,
The safe mode scan is almost finnished, when it's done I'll attach all
those logs, and a bigger bit of the Kaspersky log.
I have spybot and ad-aware, keep my PC clean with them, they're up to
date.
Thanks
Steven

 

[steviedee]

Hi,
The safe mode scans wew all clean except Kaspersky's:

Scan process completed.

Result for all objects:

Sector Objects : 0 Known viruses : 1
Files : 270190 Virus bodies : 1
Folders : 4827 Disinfected : 0
Archives : 1900 Deleted : 1
Packed : 229 Warnings : 0
Suspicious : 0
Scan speed (Kb/sec) : 1198 Corrupted : 0
Scan time : 02:22:12 I/O Errors : 0


c:\WINDOWS\SYSTEM32\WS_32.DLL infected: Trojan-Proxy.Win32.Webber.u
c:\WINDOWS\SYSTEM32\WS_32.DLL deleted: Trojan-Proxy.Win32.Webber.u


my PC seems to have stopped sending mail now which is great, but it
also seems slow and getting onto the internet is a pain, but I'm sure
I'll be adle to sort all that out with time.

the safe-mode scan over-wrote the log files, but I'll scan again in
normal mode tonight and see if it finds anything.

Steven