Worms Win32.Alcan.D, Win32.Alcan.F, Trojans & more! :(

[Misty]

Help; I am normally a Mac user.  I have Virtual PC running Windows 2000 Professional on my Mac and I downloaded some zip files and stupidly opened them, and now I am infected.  I began noticing pop-ups, and my computer slowed down; so I began to try to sort through it.

Anyway I am so glad you guys are here! I did some reading on this forum, and I hope I've done a few things right to prepare.

I did an online virus scan with ETrust Antivirus webscanner http://www3.ca.com/securityadvisor/virusinfo/scan.aspx  (I tried Kaspersky but it took too long-12 hrs and it was only 72% done!) and it said I had WormsWin.32.AlcanF and Worm Win.32.AlcanD.  It talks about them here http://www3.ca.com/securityadvisor/virusin...s.aspx?ID=43266 and here:  http://www3.ca.com/securityadvisor/virusin...s.aspx?ID=47335  It also said I had a third Backdoor IRC Trojan; I forgot the name of it. But, although it would find the files, it wouldn't delete them!  I forced it to delete some of them, then I manually went in and removed the others, and tried to remove some registry entries; evidently not enough, because upon reboot it was all still there.

At least some of the infected files are in two invisible folders:  C:\Program Files\winupdates (contains three-four infected files; a.tmp , a.zip which contains a movie.exe inside it, and winupdates.exe ), and this one is also invisible and all files infected:  C:\Program Files\MsUpdates\ (contains three-four more infected files; a.tmp, a.zip and MSUpdate.exe - the a.zip file has a movie.exe file inside of it as I found when I moved it to the Mac desktop), and C:\xz.exe - those were from the ETrust online scan.  I may have more; I am unsure as the online scan seemed faulty.  I pulled the a.tmp file over to my Mac desktop and it opens as a "text" file (not really; looks more like a script of some sort) and makes reference to MSVBVM60.DLL.  Other dlls it references are kernel32.dll, advapi32.dll, bszip.dll, wininet.dll, VBA6.DLL and there is a reference to a well-known website, imdb.com and a command about msupdate.azip.

I went into C:\WINNT\system32\ and deleted the following which the worm had created itself -- and now they are back again. I only knew they were bad by reading about them at this link; apparently they hijack my system.  

%System%\cmd.com
%System%\netstat.com
%System%\ping.com
%System%\regedit.com
%System%\taskkill.com
%System%\tasklist.com
%System%\tracert.com

But when I rebooted, everything came back!  I looked at the Properties of the above files and all of them are set to execute c:\system root\system32\AUTOEXEC.NT and c:\system root\system32\CONFIG.NT.

There is a suspicious looking folder (key date: Jan 6 2006) under C:\WINNT\system32\ called apptmgmt with a very suspicious-looking folder in it called S-1-5-21-52315564-243925014-1286765776-500

I had a dialer I think I got rid of, Bullseye Network, but I'm not sure. I doubt it! At one point I had a file called MC-110-12-000014.EXE and I manually deleted it but don't think I got rid of all the references. Then I have a persistent file called xz.exe that keeps showing up on reboot even though I deleted it and related files.

Also it has definitely hijacked my taskmanager. I cannot get to it; meaning I get a message when I attempt to run it from the Start/Run menu that "Another program is currently using this file." And when I attempt online virus scans it quits IE Explorer on me. I also am suspicious because I have three different Task manager files! I have C:\WINNT\TASKMAN.EXE 35 KB, and C:\WINNT\system32\taskman.exe 35KB and C:\WINNT\system32\TASKMGR.EXE 86 KB.

Kaspersky's partial scan didn't like my svchost.exe file; but I thought that it was supposed to be there in Windows 2000 in the system32 folder; what I am confused about is that from the Hijack This log it looks like there may be two of them running. I am also suspicious because my system32 folder was "hidden" from me and I don't know when that happened. There is both a "System32" and a "system32" folder listed in Hijack This log, but I can only see the system32 folder (lowercase) when I enable seeing system folders.

I read a bit around here, and I have ready in case you ask me to have them Evido's Security/Malware Suite ready to install; I will go ahead and download it and wait to hear from you for further instructions before installing. The Hijack this log below is before I downloaded Evido. I also have Windows Cleanup 4.0 but haven't run it yet (some of my games use Download folders as a default); I also downloaded pzpnetwork.zip and BFU.zip, unzipped them and put their contents in a folder called BFU. In case you ask me to have them. But I'm not going to do anything as I've been reading more and you give very custom answers to each problem. I got some ideas from this thread even though it isn't mine; it seemed to have some good places to start!

Connectix is the name of the company that made Virtual PC, so I believe/hope those log entries (the ones specific to Connectix) are okay.

I have been fighting this for a few days. Any help would be appreciated! I am worn out. I am very afraid it has been logging my passwords, etc. and sending to unknown websites. http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/unsure.gif\' class=\'bbc_emoticon\' alt=\':unsure:\' />  Thanks in advance!


Here is my Hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 3:29:55 AM, on 1/9/2006
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\CNTX\VPCSRVC.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\VPCMap.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.exe
C:\WINNT\CNTX\VPCUSrvc.exe
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\MsUpdate\MsUpdate.exe
C:\WINNT\System32\scvhost.exe
C:\HJT\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VPCUserServices] C:\WINNT\CNTX\VPCUSrvc.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [MsUpdate] C:\Program Files\MsUpdate\MsUpdate.exe /auto
O4 - HKLM\..\Run: [ms-update] scvhost.exe
O4 - HKLM\..\RunServices: [ms-update] scvhost.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kav...can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1136184893562
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O23 - Service: Virtual PC Services Application (1-vpcsrvc) - Connectix - C:\WINNT\CNTX\VPCSRVC.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Virtual PC Shared Folder Mapper (VPCMap) - Connectix - C:\WINNT\System32\VPCMap.exe

[guestolo]

Hi Misty, can you do the following please

You already have some of the tools required

==Download and then Install
Ewido anti-malware 3.5

When installing, under "Additional Options" Uncheck "Install background guard" and "Install scan via context menu".

From the main ewido screen, click on Update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful")
Close out Ewido for now, we'll need it later
If for some reason the Updater won't work can you manually download the
Updates from this link after you have Ewido installed
http://www.ewido.net/en/download/updates/

Please  save these instructions to a Notepad file and save it to your Desktop for reference
or Print them out!

RESTART your Computer into SAFE MODE
You can do this by tapping the F8 key as the system is restarting, just before Windows loads
Choose Safe mode from the startup menu and hit Enter

Once in safe mode
Open the BFU folder
Double click to run BFU.exe
Use the "Open Script file" button (the folder icon next to Scriptfile to execute)
Navigate to p2pnetwork.bfu in the BFU folder
Right click p2pnetwork.bfu and choose Select
In Brute Force Uninstaller select Execute
Let it finish then Exit

==Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

    * Empty Recycle Bins
    * Delete Cookies
    * Delete Prefetch files
    * Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.
When it's done, decline to log off or restart the computer

==Open Ewido Security Suite
Click on the Scanner button on the left menu
Select Complete System Scan
*If Ewido finds something it will prompt you with "Infected Object found"
Ensure the following are Selected
  *1. Perform Action = Remove
  *2. Create Encrypted Backup in Quarantine (Recommended)
  *3. Perform action with all infections
 
  Then click OK
When Ewido has finished it's scan click the "Save Report" button
Save the report to desktop
Exit Ewido
NOTE: When Ewido is running, don't open any other Windows

RESTART your computer  back to Normal mode

Back in Windows
Can I see the following

1. Post the report you saved earlier with Ewidos
2. Post a new log from Hijackthis

[Misty]

Hi and thanks!  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\'\' />  You make this all seem so much easier than the days of hell I just went through. http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'\' />

I can run task manager again! http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/biggrin.gif\' class=\'bbc_emoticon\' alt=\'\' /> Boy was my system ever hijacked! http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/tongue.gif\' class=\'bbc_emoticon\' alt=\'\' />  

Ewido and that P2P script together found some really nasty stuff!   http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/ph34r.gif\' class=\'bbc_emoticon\' alt=\':ph34r:\' />

Here are the logs you requested:  I hope they look cleaner but I still have some doubts about a couple of files!  

Logfile of HijackThis v1.99.1
Scan saved at 2:41:08 AM, on 1/10/2006
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\CNTX\VPCSRVC.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\VPCMap.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\Explorer.exe
C:\WINNT\CNTX\VPCUSrvc.exe
C:\HJT\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [VPCUserServices] C:\WINNT\CNTX\VPCUSrvc.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1136184893562
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O23 - Service: Virtual PC Services Application (1-vpcsrvc) - Connectix - C:\WINNT\CNTX\VPCSRVC.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: Virtual PC Shared Folder Mapper (VPCMap) - Connectix - C:\WINNT\System32\VPCMap.exe

Ewido's file:


 ewido anti-malware - Scan report

 + Created on:         12:54:54 AM, 1/10/2006
 + Report-Checksum:      85212752

 + Scan result:

   HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Spyware.Alexa : Cleaned with backup
   C:\WINNT\system32\exdl.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINNT\system32\exul.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINNT\system32\javexulm.vxd -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINNT\system32\bbchk.exe -> Spyware.BargainBuddy : Cleaned with backup
   C:\WINNT\system32\mqexdlm.srg -> Spyware.BargainBuddy : Cleaned with backup
   C:\Program Files\Common Files\Windows\services32.exe -> Spyware.Maxifiles : Cleaned with backup


 ::Report End

~~~

I followed your careful instructions; and no more trojans!  The P2P script blased xz.exe.  Plus Ewido found spyware. http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'\' />

Several suspicious folders remain: the earlier-mentioned C:\WINNT\system32\ called apptmgmt with a folder in it called S-1-5-21-52315564-243925014-1286765776-500   Two folders remain that were there prior to the scans and running Ewido, etc. (before we began repairing my system, it replicated itself when I tried to manually delete it):  C:\FOUND.000 and C:\FOUND.001 which claim to contain "file fragments."  However no mention was made about them in the scans as far as them being infected. Can I just get rid of them including their registry entries?  Also, can I delete that "radio" key coming up in Hijack this? (03)  Is it spyware related?

Ewido is great.  It says my RealTime Protection is inactive; can I activate it safely?  

Thanks again! http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'\' />