Help identify virus? these symptoms....

J

jeffc

jeffc said:
the
cache ? It only

I don't understand "it only needs to be 10M". I don't know if it's hidden
or not because I have everything unhidden in Windows Explorer. I have
already deleted all files and content from IE options.

I see what you mean now. I clear this content regularly. Something else is
putting all those files there.
 
J

jeffc

postminimalist said:
this link may help if it's a rootkit:
http://home.arcor.de/scheinsicherheit/rootkits.htm

it lists a raw registry editor.

I also downloaded TaskInfo, but I get error "Can't find TSKNF501.sys" when I
try to run it. It does come up, but I don't know if it's running correctly
(the screen shot on the web site shows TSKNF501.sys in the driver list when
it's running, and mine of course isn't.) It does show a couple things that
look funny to me.
Watchdog.sys
dump_atapi.sys
wim_ilib.sys

The latter 2 show no code size, and no version information, like all the
other drivers.
 
Z

Zvi Netiv

jeffc said:
abcde.exe does not run. The error message pops up too fast, but I think
it's the one that says I don't have authority.

Did you run the entire command line as above, or just ran abcde.exe with no
arguments? If the latter, then please run the complete command, as asked, look
for the file c:\junk.txt, and report back here with the results and the content
of the text file, if created.

Zvi
 
Z

Zvi Netiv

jeffc said:
More details - I have 2 computers at home - the main, infected one, call it
A, and my older one, call it B. Both are connected to the internet through
a router (which I had hoped would act as a decent firewall.)

This new info changes everything! What took you so long to tell us this?
Additional info required:

Are both computers (call them W98 and XP, A and B are meaningless) connected to
the router via network adapter, or else? If the previous, then it should take
just minutes to establish a connection between the two PC.
A is XP, B is
98. I cannot access this newsgroup on A. All other newsgroups work fine,
but when I attempt to go to alt.comp.anti-virus from A, Outlook Express
quits. From A, I can access the sites that I removed from my hosts file,
but that's not good enough. For example, if I go to Google and search on
"virus", IE quits. It works for all other normal searches. I also can not
get to the Kaspersky site, but I can get to the Symantec site. I have no CD
burner on B.

Do you have a CD burner on your XP machine?
Everything I download to B must be transferred to A by
diskette. I do not have a network "installed" or "working" (I don't know
how the computers might communicate by default, but there is no
communication I'm aware of. I am not interested in getting networking
between them at this time, especially since I think that could very well
make this problem worse.)

Quite the contrary! Connecting the two is the way to resolve the problems
(plural, since you are apparently dealing with more than one), especially if one
of the malware that is fooling you is a root-kit.
All messages to this newsgroup come from B, or
from my work computer (where I am now.)

Does your boss know, or are you your own employer? ;-)

Zvi
 
J

jeffc

Zvi Netiv said:
Did you run the entire command line as above, or just ran abcde.exe with no
arguments? If the latter, then please run the complete command, as asked, look
for the file c:\junk.txt, and report back here with the results and the content
of the text file, if created.

It will not run period. It will not run without parameters, and it will not
run exactly as above.
 
J

jeffc

Zvi Netiv said:
This new info changes everything! What took you so long to tell us this?
Additional info required:

Are both computers (call them W98 and XP, A and B are meaningless) connected to
the router via network adapter, or else?

What other way is there than a network adapter? XP is infected, 98 is not.
If the previous, then it should take
just minutes to establish a connection between the two PC.

I tried briefly months ago, but couldn't figure out how to connect XP to 98
with the info I used from various web sites. I'll be happy to try again.
Do you have a CD burner on your XP machine?

Yes.
 
J

jeffc

jeffc said:
The virus (or whatever) kept replacing the hosts file. I made it read only
and I haven't seen it change in awhile - could be just a coincidence.

When the file is set to Read Only, it does not get overwritten. When I
remove Read Only, the following changes are written:

127.19.93.47 www.symantec.com
127.202.121.230 securityresponse.symantec.com
127.41.171.46 symantec.com
127.69.249.0 www.mcafee.com
127.192.212.169 mcafee.com
127.99.73.96 us.mcafee.com
127.42.10.3 www.sophos.com
127.176.122.93 sophos.com
127.87.164.92 www.viruslist.com
127.22.67.73 viruslist.com
127.63.209.203 f-secure.com
127.249.203.166 www.f-secure.com
127.20.178.139 kaspersky.com
127.145.102.29 www.avp.com
127.113.118.109 www.kaspersky.com
127.145.44.107 avp.com
127.251.77.89 www.networkassociates.com
127.124.181.255 networkassociates.com
127.50.79.220 www.ca.com
127.57.107.10 ca.com
127.99.168.237 my-etrust.com
127.187.32.28 www.my-etrust.com
127.1.171.100 secure.nai.com
127.226.244.178 nai.com
127.195.150.231 www.nai.com
127.226.175.64 trendmicro.com
127.94.48.51 www.trendmicro.com
127.200.23.150 housecall.trendmicro.com
127.187.135.7 www.pandasoftware.com
127.249.240.181 www.bitdefender.com
127.240.118.38 www.ravantivirus.com
127.201.155.111 www3.ca.com
127.102.194.27 v4.windowsupdate.microsoft.com
127.113.162.99 v5.windowsupdate.microsoft.com
127.244.228.213 v5windowsupdate.microsoft.nsatc.net
127.10.132.56 windowsupdate.microsoft.com
127.221.228.41 www.windowsupdate.com
127.101.161.37 windowsupdate.com
 
D

David H. Lipman

Can you load File and Print shares and access the Registry Remotely ?

Dave





|
| | > > >
| > > > abcde /e c:\junk.txt
| "hkey_local_machine\software\microsoft\windows\currentversion\run"
| > >
| > > abcde.exe does not run. The error message pops up too fast, but I think
| > > it's the one that says I don't have authority.
| >
| > Did you run the entire command line as above, or just ran abcde.exe with
| no
| > arguments? If the latter, then please run the complete command, as asked,
| look
| > for the file c:\junk.txt, and report back here with the results and the
| content
| > of the text file, if created.
|
| It will not run period. It will not run without parameters, and it will not
| run exactly as above.
|
|
 
Z

Zvi Netiv

Please try to not break lines of quoted text and keep the format readable in
your replies. Thanks.
What other way is there than a network adapter? XP is infected, 98 is not.

USB, and plugging the connector to the computer in use, for example. From your
reply I understand that your computers are actually interconnected through hub.
I tried briefly months ago, but couldn't figure out how to connect XP to 98
with the info I used from various web sites. I'll be happy to try again.

Should be straightforward.

On your XP machine: Specify a unique name to your workgroup (right-click
MyComputer, properties, computer name). The same workgroup name should be used
on your Win 98 PC. Still on the XP, the following components should be
installed and enabled, under "properties" of your 'local area network'
connection (open network connections, in control panel): Client for Microsoft
networks, and File & printer sharing for MS networks. Other components function
properly since you can connect to the web.

On your W98 PC, open 'Network' in control panel, verify the name of the computer
and of the workgroup (under the 'identification' tab). The computer name should
differ from that of the XP, and the workgroup name should be the same as on the
other PC. Check for the presence of the following components under the
configuration tab, or add the necessary one if not installed: Client for
Microsoft networks, and file and printer sharing for MS networks. The other
components required are installed since you connect to the web.

Let's review now the properties of your TCP/IP protocol, on W98: IP selection
should be automatic. WINS should be set to 'use DHCP'. Gateway should specify
the default (set correctly since you connect to the web). DNS should be
enabled, with the name of the W98 computer as 'host'. Lastly, in 'bindings'
both client for MS networks and File sharing should be enabled.

You'll need your Windows setup CDs for setting the above. After restarting both
computers, you should be able to access the other PC under "network
neighborhood", on either PC.

In order to clean the XP machine from W98, you will need to provide full-access
sharing to all drives on the XP. This condition is vulnerable. Although the
router provides firewalling, you should take precautions to avoid further damage
to that already incurred. Use a strong password when sharing (a random
combination of eight to ten alphanumerics and special characters), and
disconnect the line going to the phone or cable connection when working on the
XP from W98. When done with the cleaning, cancel the sharing of the XP drives
and disable (don't uninstall) file sharing on both machines (clear the service
under LAN properties on the XP, and unbind it from the TCP/IP protocol on the
W98 PC).

The general plan for cleaning is this: First, run initial cleaning of the XP
drive(s) from remote (W98). You can use Sysclean and Stinger for the purpose.
As whatever spoofs XP isn't active on the W98 machine, then there is a fair
chance that the cleaner will find what you can't see from XP, locally, due to
malware spoofing and stealthing. Pay special attention to files that the
cleaner cannot delete on the XP. These could be what initializes the worm /
root-kit on the XP and the reason it/they can't be deleted is that they are in
use! Rename these files from remote, and restart XP. See if spoofing stopped
by running REGEDIT.

Someone suggested here remote registry administration. Forget it with your
setup. If you don't know how to establish a network between two PCs then
installing remote registry to your two PCs isn't for you. Moreover, there is no
way you can administer the XP registry from Win 98, or vice versa. These are
two different registry categories which are mutually incompatible.

After you completed initial cleaning from remote, cleanup XP once more by
running Sysclean / Stinger, this time locally. Cleaning from remote does not
revert registry changes on the target machine, only when done from its local OS.

Lastly, read www.invircible.com/item/53 to learn about some of the principles
involved.

Good luck, Zvi
 
D

David H. Lipman

I mentioned Remote Registry.

And your right, if understanding Networking is a problem, Remote Registry Administration
would require the stack to be running correctly and a user account bet setup on the NT based
OS, etc...

It still is a good idea for those who know how to do it, don't you think Zvi ?

Dave
BTW: Why are people having problems pronouncing your name, Zion Vuv Yuud ? { LOL }




|
| > > Are both computers (call them W98 and XP, A and B are meaningless)
| > connected to
| > > the router via network adapter, or else?
|
| Please try to not break lines of quoted text and keep the format readable in
| your replies. Thanks.
|
| > What other way is there than a network adapter? XP is infected, 98 is not.
|
| USB, and plugging the connector to the computer in use, for example. From your
| reply I understand that your computers are actually interconnected through hub.
|
| > > If the previous, then it should take
| > > just minutes to establish a connection between the two PC.
| >
| > I tried briefly months ago, but couldn't figure out how to connect XP to 98
| > with the info I used from various web sites. I'll be happy to try again.
|
| Should be straightforward.
|
| On your XP machine: Specify a unique name to your workgroup (right-click
| MyComputer, properties, computer name). The same workgroup name should be used
| on your Win 98 PC. Still on the XP, the following components should be
| installed and enabled, under "properties" of your 'local area network'
| connection (open network connections, in control panel): Client for Microsoft
| networks, and File & printer sharing for MS networks. Other components function
| properly since you can connect to the web.
|
| On your W98 PC, open 'Network' in control panel, verify the name of the computer
| and of the workgroup (under the 'identification' tab). The computer name should
| differ from that of the XP, and the workgroup name should be the same as on the
| other PC. Check for the presence of the following components under the
| configuration tab, or add the necessary one if not installed: Client for
| Microsoft networks, and file and printer sharing for MS networks. The other
| components required are installed since you connect to the web.
|
| Let's review now the properties of your TCP/IP protocol, on W98: IP selection
| should be automatic. WINS should be set to 'use DHCP'. Gateway should specify
| the default (set correctly since you connect to the web). DNS should be
| enabled, with the name of the W98 computer as 'host'. Lastly, in 'bindings'
| both client for MS networks and File sharing should be enabled.
|
| You'll need your Windows setup CDs for setting the above. After restarting both
| computers, you should be able to access the other PC under "network
| neighborhood", on either PC.
|
| In order to clean the XP machine from W98, you will need to provide full-access
| sharing to all drives on the XP. This condition is vulnerable. Although the
| router provides firewalling, you should take precautions to avoid further damage
| to that already incurred. Use a strong password when sharing (a random
| combination of eight to ten alphanumerics and special characters), and
| disconnect the line going to the phone or cable connection when working on the
| XP from W98. When done with the cleaning, cancel the sharing of the XP drives
| and disable (don't uninstall) file sharing on both machines (clear the service
| under LAN properties on the XP, and unbind it from the TCP/IP protocol on the
| W98 PC).
|
| The general plan for cleaning is this: First, run initial cleaning of the XP
| drive(s) from remote (W98). You can use Sysclean and Stinger for the purpose.
| As whatever spoofs XP isn't active on the W98 machine, then there is a fair
| chance that the cleaner will find what you can't see from XP, locally, due to
| malware spoofing and stealthing. Pay special attention to files that the
| cleaner cannot delete on the XP. These could be what initializes the worm /
| root-kit on the XP and the reason it/they can't be deleted is that they are in
| use! Rename these files from remote, and restart XP. See if spoofing stopped
| by running REGEDIT.
|
| Someone suggested here remote registry administration. Forget it with your
| setup. If you don't know how to establish a network between two PCs then
| installing remote registry to your two PCs isn't for you. Moreover, there is no
| way you can administer the XP registry from Win 98, or vice versa. These are
| two different registry categories which are mutually incompatible.
|
| After you completed initial cleaning from remote, cleanup XP once more by
| running Sysclean / Stinger, this time locally. Cleaning from remote does not
| revert registry changes on the target machine, only when done from its local OS.
|
| Lastly, read www.invircible.com/item/53 to learn about some of the principles
| involved.
|
| Good luck, Zvi
| --
| NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
| InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
 
Z

Zvi Netiv

David H. Lipman said:
I mentioned Remote Registry.

And your right, if understanding Networking is a problem, Remote Registry Administration
would require the stack to be running correctly and a user account bet setup on the NT based
OS, etc...

It still is a good idea for those who know how to do it, don't you think Zvi ?

Excellent idea, where applicable. Unfortunately it isn't practical in many
cases, as in this one, where the remote and local systems are incompatible for
remote registry administration to work.

Regards, Zvi
 
J

jeffc

Zvi Netiv said:
not.

USB, and plugging the connector to the computer in use, for example. From your
reply I understand that your computers are actually interconnected through
hub.

My understanding is that there's a difference between a router and a hub,
and as I said they are connected through a router.
again.

Should be straightforward.

I've had already done most of the stuff you mentioned, but last time I got
stuck somewhere and couldn't get it working. Will try again tonight and
hopefully I'll see where I went wrong. By the way, right now I am most
suspicious of 2 files that I mentioned in a previous message.
dump_atapi.sys
dump_WMILIB.sys
(spelling might not be right on the second one - going from memory)
When running TaskInfo, I can see a list of loaded drivers. These 2 look
suspicious because unlike all the rest there is no code size or version
information listed. Also, when I look for these files, I can't find them.
At the command line I enter
dir dump_atapi.sys /s

The command line window immediately aborts or exits without showing any
results. I can search on all other files I've tried this past week, but
this one specifically crashes.
 
Z

Zvi Netiv

jeffc said:

I asked you before to not break lines of quoted text. Either increase the right
margins or your news editor or edit your posts to show properly. You posting
habits reflect your attitude toward whom should read them! Thanks.
My understanding is that there's a difference between a router and a hub,
and as I said they are connected through a router.

Depending on the model, your router could have a switch/hub as back end. This
would probably be the case if the router has several RJ-45 connectors for
fan-out. See the router documentation, or check on the web by its model.
I've had already done most of the stuff you mentioned, but last time I got
stuck somewhere and couldn't get it working. Will try again tonight and
hopefully I'll see where I went wrong. By the way, right now I am most
suspicious of 2 files that I mentioned in a previous message.
dump_atapi.sys
dump_WMILIB.sys
(spelling might not be right on the second one - going from memory)
When running TaskInfo, I can see a list of loaded drivers. These 2 look
suspicious because unlike all the rest there is no code size or version
information listed. Also, when I look for these files, I can't find them.
At the command line I enter
dir dump_atapi.sys /s

Stop speculating and get your XP and W98 connected. The above files are legit
and aren't the problem.
The command line window immediately aborts or exits without showing any
results. I can search on all other files I've tried this past week, but
this one specifically crashes.

Stop wasting everyone's time on wild guessing. If there is a root kit active on
your XP then everything you do on it isn't worth the keystrokes as what you are
looking for is stealthed. Get the two PC connected and get on with the job.

Zvi
 
J

jeffc

Zvi Netiv said:
Stop wasting everyone's time on wild guessing. If there is a root kit active on
your XP then everything you do on it isn't worth the keystrokes as what you are
looking for is stealthed. Get the two PC connected and get on with the
job.

While you might think this is wasting time and "wild guessing", I don't. If
you do, just pass over it. I find it interesting that of all the files I
can search for, this one specifically, and as far as I know uniquely,
crashes the "dir" command. It is exactly this same "wild guessing" that led
another poster to refer me to my hosts file when I reported which web sites
would crash Internet Explorer, and sure enough he was right - my hosts file
was compromised.
 
J

jeffc

Zvi Netiv said:
Are both computers (call them W98 and XP, A and B are meaningless) connected to
the router via network adapter, or else? If the previous, then it should take
just minutes to establish a connection between the two PC.

OK I've connected the 2 computers on the network according to your
instructions (my server is no longer showing the message you sent, but I
looked it up in the Google archives) Each computer recognizes the other by
name. I've shared my C drive from XP, with write access. The problem is I
can't actually look at it from Win98 - get error message "No permission to
access resource". Don't know what I'm missing....
 
Z

Zvi Netiv

jeffc said:

Set your news editor margin to wrap at 80 characters!
While you might think this is wasting time and "wild guessing", I don't. If
you do, just pass over it. I find it interesting that of all the files I
can search for, this one specifically, and as far as I know uniquely,
crashes the "dir" command. It is exactly this same "wild guessing" that led
another poster to refer me to my hosts file when I reported which web sites
would crash Internet Explorer, and sure enough he was right - my hosts file
was compromised.

That trivial discovery (of the modified hosts file) contributed nothing to
solving your problem. You'll understand why when we are finished with this
thread.

Your unmethodological modus operandi is why you aren't making progress, after
nine days of exchanges and 75 posts in the thread.

Regards, Zvi
 
J

jeffc

Zvi Netiv said:
Set your news editor margin to wrap at 80 characters!

It is! I don't usually use this computer and I don't know what the problem is.
Sorry don't have time to figure this out now.
 
J

jeffc

Zvi Netiv said:
That trivial discovery (of the modified hosts file) contributed nothing to
solving your problem. You'll understand why when we are finished with this
thread.

Your unmethodological modus operandi is why you aren't making progress, after
nine days of exchanges and 75 posts in the thread.

You are not the only one giving me advice, and this newsgroup is not my only
source of information. Until I actually solve this, I won't know which advice
was right or wrong. When I post info, you ask either
 
G

Gabriele Neukam

On that special day, jeffc, ([email protected]) said...
Each computer recognizes the other by
name. I've shared my C drive from XP, with write access. The problem is I
can't actually look at it from Win98 - get error message "No permission to
access resource". Don't know what I'm missing....

You need an account on your XP machine, that does have the same account
name and password, as on your Win98 machine, to have XP allow your
connection to access XP remotely.


Gabriele Neukam

(e-mail address removed)
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top