« previous next »
Pages: [1] 2   Go Down

Author Topic: spyware/trojan x.exe DRIVING ME CRAZY !!!!  (Read 10432 times)

0 Members and 2 Guests are viewing this topic.

grizz

  • Guest
spyware/trojan x.exe DRIVING ME CRAZY !!!!
« on: March 06, 2009, 07:27:59 AM »
Hey guys I am after some help with dealing with a problem Im having. This problem comes under the name of 'x.exe' and is found in the directory C:\windows\system32\x.exe , I would get this detected by avast about every 10 to 15 minutes or so, always send it to chest and 10 or so mins later its back... :S Ive tried doing a full avast scan several times with no luck, tried spybot scan, adaware, and have also just finished reformatting my hard drive for the 2nd time and thought I had finally cleared it because nothing happened for about a day or two then it was back :( I am out of things to do, tried searching google for help with it but cant really find any information.

I believe it is a similar thing to this post I found http://forum.avast.com/index.php?topic=40551.0 except the problem I am having has only been 'x.exe' (so far) none of the others...
Also believe its similar to http://forum.avast.com/index.php?topic=40611.0

Any help would be greatly appreciated because I have no idea what to do next !
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67183
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #1 on: March 06, 2009, 01:28:57 PM »
Does the general cleaning procedure help?

1. Clean your temporary files.
2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
3. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
4. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
5. Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
6. Disable System Restore and then reenable it again.
7. Immunize your system with SpywareBlaster.
8. Check if you have insecure applications with Secunia Software Inspector.
Logged
The best things in life are free.

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #2 on: March 22, 2009, 12:58:45 AM »
Hi sorry about late reply been away. Ok tried everything you listed still no luck. It seems the occurance of x.exe getting detected by avast has slowed down a bit but its still definately there.
Logged

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #3 on: March 22, 2009, 12:59:10 AM »
Hijack This Log

MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MpcStar\mpcstar.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D619F1A7-5293-48DE-9D6E-C6CBFE144489}: NameServer = 202.27.158.40,202.27.156.72
O20 - AppInit_DLLs: prio.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

--
End of file - 5679 bytes
Logged

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34065
  • malware fighter
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #4 on: March 22, 2009, 01:07:52 AM »
Hi grizz,

You have no active firewall running there apparently, this is endangering your online activities.
In your case this is the malware entry: C:\Program Files\MpcStar\mpcstar.exe

For successful remove of MPCSTAR.EXE , following the instruction:
1. Temporarily Disable System Restore .

2. Update the virus definitions. Reboot computer in SafeMode, delete the infected files according the detail above, run a whole scan, or use the free DrCureIt from here: http://www.freedrweb.com/download+cureit/

3.Please download ATF Cleaner from here: http://www.atribune.org/ccount/click.php?id=1
, delete all your IE temp files.

That is all,

polonus
« Last Edit: March 22, 2009, 01:10:58 AM by polonus »
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #5 on: March 23, 2009, 04:40:12 AM »
Hi, no MPCstar is my video player i had it open at the time I did the log...
Logged

CharleyO

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #6 on: March 23, 2009, 07:19:00 AM »
***

Please run HJT again without any programs running other than what is running at normal start-up. Also be sure no windows are open. In other words, do nothing after start-up other than run HJT.


***
Logged

YoKenny

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #7 on: March 23, 2009, 09:25:35 AM »
Quote from: CharleyO on March 23, 2009, 07:19:00 AM
***

Please run HJT again without any programs running other than what is running at normal start-up. Also be sure no windows are open. In other words, do nothing after start-up other than run HJT.
Post a complete HijackThis log starting at the top.
Logged

CharleyO

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #8 on: March 23, 2009, 10:42:17 AM »
***

Quote from: YoKenny on March 23, 2009, 09:25:35 AM
Quote from: CharleyO on March 23, 2009, 07:19:00 AM
***

Please run HJT again without any programs running other than what is running at normal start-up. Also be sure no windows are open. In other words, do nothing after start-up other than run HJT.
Post a complete HijackThis log starting at the top.

Yes, that too. Thanks, Yokenny.


***
Logged

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #9 on: March 24, 2009, 08:24:45 AM »
sorry my mistake.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:22:25 PM, on 3/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D619F1A7-5293-48DE-9D6E-C6CBFE144489}: NameServer = 202.27.158.40,202.27.156.72
O20 - AppInit_DLLs: prio.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Windows Telephony (WindowsTelephony) - Unknown owner - C:\WINDOWS\system\svhost.exe

--
End of file - 5676 bytes
Logged

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #10 on: March 24, 2009, 08:26:46 AM »
restarted my computer and did HJT scan.
about a minute after the HJT scan avast detected x.exe
Logged

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #11 on: March 24, 2009, 08:52:17 AM »
File name: C:\WINDOWS\system32\x.exe
Malware name: Win32:Rootkit-gen [Rtk]
Malware type: Rootkit
VPS version: 090323-0, 03/23/2009

(from avast when x.exe detected)
Logged

CharleyO

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #12 on: March 25, 2009, 04:45:22 AM »
***

An analysis of your HJT log shows the following :

We didn't detect any active process of a firewall on your system. Reasons maybe:
(1.) You are using the windows firewall or a hardware firewall.
(2.) You are using a firewall of an unknown vendor.
(3.) You are using a firewall, but for unknown reasons it is disabled
(4.) You don't use any firewall at all.
We recommend you to use a firewall.

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
Belongs to a Windows Live Messenger addon but has no file association.
http://www.systemlookup.com/CLSID/54865-wlchtc_dll.html

O17 - HKLM\System\CCS\Services\Tcpip\..\{D619F1A7-5293-48DE-9D6E-C6CBFE144489}: NameServer = 202.27.158.40,202.27.156.72
Do you know the IP or Domain '202.27.158.40,202.27.156.72'? If not, fix this entry.
This could be your ISP but you should check.

O23 - Service: Windows Telephony (WindowsTelephony) - Unknown owner - C:\WINDOWS\system\svhost.exe
This entry is very BAD and must be fixed. For information, please check the links below.

http://www.auditmypc.com/process/svhost.asp

http://www.threatexpert.com/files/svhost.exe.html

http://www.prevx.com/filenames/1454723166925220265-X1/SVHOST.EXE.html


***
Logged

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #13 on: March 25, 2009, 06:56:58 AM »
I dont use any firewall at all :S just use avast. What can you recommend?

Am i meant to fix the svchost.exe with HJT? Cause did the fix option and doing more scans it shows it still there... :S

/edit - pretty much as soon as i read what you said about svchost.exe avast detected it, hows that for weird haha , quarantine it?
« Last Edit: March 25, 2009, 07:19:15 AM by grizz »
Logged

grizz

  • Guest
Re: spyware/trojan x.exe DRIVING ME CRAZY !!!!
« Reply #14 on: March 25, 2009, 07:15:21 AM »


installed the scanner you linked to, it found a few problems but hve to pay to clean them D:
Logged
Pages: [1] 2   Go Up
« previous next »