Adblock breaks this site

Backdoor Trojan'd!

Discussion in 'Archives' started by once was nooby, Mar 29, 2008.

Thread Tools

Thread Tools

  • Thread ID:
  1. once was nooby

    once was nooby Active Member

    Joined:
    Jul 22, 2006
    Posts:
    226
    Referrals:
    0
    Sythe Gold:
    0
    Backdoor Trojan'd!
    i need help ive got these 4 processes running that are trojans.

    they are:

    -Routing.exe -Indt2.exe( i think its Indt2.sys) -Andt.sys -Perfs.exe.

    I use Xoftspy for scanning my computer and in the past 3 years it has helped me get rid of 85% of my problems.

    i spent like 3 mins google'ing stuff about and it pissed me off with the bullshit solutions such as REFORMATING, WTF??.

    i know theres alot of smart people here on sythe so im sure somebody can help.

    heres my Hijack This log:

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 2:49:21 PM, on 3/30/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
    C:\WINDOWS\system32\perfs.exe
    C:\WINDOWS\system32\routing.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\MouseFix.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Documents and Settings\Owner\My Documents\_aoy_\Software\HiJackThis_v2.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.1.25.0\GoogleUpdate.exe" /lang en
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
    O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\Owner\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: perfmons Service (perfmons) - Unknown owner - C:\WINDOWS\system32\perfs.exe
    O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

    --
    End of file - 5295 bytes

    As you can see some of my listed infections ARE NOT RUNNING during this scan, not sure why. and something i get random sounds on my computer, apparently perfs.exe is doing it!

    i need help please
     
    once was nooby, Mar 29, 2008
    #1
  2. wtp

    wtp Grand Master
    Banned

    Joined:
    Nov 25, 2005
    Posts:
    2,455
    Referrals:
    2
    Sythe Gold:
    0
    Backdoor Trojan'd!
    hmm sorry to hear that.

    Try to see if you can find a antivirus you haven't used yet. Like Avast, AVG, ad aware, or spybot

    If the virus is still unable to be deleted then you should reformat your computer
     
    wtp, Mar 30, 2008
    #2
  3. once was nooby

    once was nooby Active Member

    Joined:
    Jul 22, 2006
    Posts:
    226
    Referrals:
    0
    Sythe Gold:
    0
    Backdoor Trojan'd!
    i tried latest spybot S&D , didnt help and im not going to reformat over these
     
    once was nooby, Mar 30, 2008
    #3
  4. Verts

    Verts bleep bloop
    Crabby Retired Administrator

    Joined:
    Aug 23, 2007
    Posts:
    5,420
    Referrals:
    8
    Sythe Gold:
    32
    Discord Unique ID:
    265793039971123200
    Discord Username:
    verts#0001
    Lumpy Space Princess Le Pokémon Trainer Two Factor Authentication User
    Backdoor Trojan'd!
    HijackThis has told you the location of the files, so go delete the executables...
     
    Verts, Mar 30, 2008
    #4
  5. Nullware

    Nullware Guru

    Joined:
    Jan 30, 2007
    Posts:
    1,761
    Referrals:
    4
    Sythe Gold:
    0
    Backdoor Trojan'd!
    Do this and if it gives you messages about not being able to delete processes that are actively running, try to stop the processes and then delete them.

    If that fails:
    1) Write down on paper the paths to the problem files.
    2) Make a DOS boot disk.(click here for instructions)
    3) Restart your computer using the boot disk to get into DOS rather than starting Windows thus the malicious processes will not have started.
    4) Delete the problematic files from inside DOS.

    If you do end up having to do the second one, it will require learning some basic DOS commands which isn't that difficult really. Just do a search and read a bit of some tutorials, also add me on MSN if you'd like anything clarified.
     
    Nullware, Mar 30, 2008
    #5
  6. once was nooby

    once was nooby Active Member

    Joined:
    Jul 22, 2006
    Posts:
    226
    Referrals:
    0
    Sythe Gold:
    0
    Backdoor Trojan'd!
    Wow thanks nullware, i havent tried that yet cause i cant stay on for long ill try soon.
     
    once was nooby, Mar 31, 2008
    #6
  7. Larry

    Larry Forum Addict

    Joined:
    Feb 2, 2007
    Posts:
    267
    Referrals:
    2
    Sythe Gold:
    5
    Backdoor Trojan'd!
    IMHO, deleting these files wouldn't help a lot as :
    1- they are only the visible part of the iceberg, there is something else behind that will reinject them.
    2- Your pc might not be able to start work again.

    My advice is : look for any rootkits first (go to microsoft.com and type in the search area "rootkitrevealer" and click on first result download and run a scan with that, you can post the scan log if you wish).

    This will show you the "hidden" part of the iceberg and will help find the pest roots.
     
    Larry, Mar 31, 2008
    #7
  8. 1337Neo

    1337Neo Guru
    Banned

    Joined:
    Nov 5, 2007
    Posts:
    1,337
    Referrals:
    0
    Sythe Gold:
    0
    Backdoor Trojan'd!
    I got a suggestion.

    Go to search and search the Processes that are Running.

    And delete the File's that might work give it a try Man.
     
    1337Neo, Mar 31, 2008
    #8
  9. once was nooby

    once was nooby Active Member

    Joined:
    Jul 22, 2006
    Posts:
    226
    Referrals:
    0
    Sythe Gold:
    0
    Backdoor Trojan'd!
    i did i deleted the name of the processes from System32 and they are back after a re boot, ill try wat larry said soon
     
    once was nooby, Apr 1, 2008
    #9
< +++++Rate my str pure+++++ | check this out! >


 
 
Adblock breaks this site