Norman false positive?

While running norman virus control AND norman firewall, this worm kreept in:

C:\winnt\system32\splvs.exe

Worm: W32/SDBot.IL

SDBOT!? is this a false positive? Here is the HT log:


Logfile of HijackThis v1.97.7
Scan saved at 11:15:56, on 6-2-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\WINNT\SYSTEM32\DNTUS26.EXE
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Winamp\Winampa.exe
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\winnt\system32\system32bak\temp\FireDaemon.EXE
C:\winnt\system32\system32bak\temp\FireDaemon.EXE
C:\winnt\system32\system32bak\temp\G6FTPSrv.exe
C:\winnt\system32\system32bak\temp\ssvchost.exe
C:\Program Files\Norman\NPF\NPFSVICE.EXE
C:\Norman\Nvc\BIN\Zanda.exe
C:\WINNT\SYSTEM32\zss.exe
C:\WINNT\system32\bgdw.exe
C:\WINNT\SYSTEM32\vdars.exe
C:\WINNT\SYSTEM32\sks.exe
C:\WINNT\system32\splvs.exe
C:\WINNT\SYSTEM32\efzx.exe
C:\WINNT\system32\GT.exe
C:\WINNT\SYSTEM32\rwvws.exe
C:\WINNT\system32\fyycqe.exe
C:\WINNT\system32\syscfgx32.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\SYSTEM32\sdks.exe
C:\WINNT\system32\ICfsn.exe
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\RUNDLL32.EXE
C:\WINNT\system32\regsvc.exe
C:\PROGRA~1\MAILWA~2\MAILWA~1.EXE
C:\WINNT\system32\MSTask.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINNT\system32\stisvc.exe
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\Program Files\Norman\NPF\NPFMSG.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\United Devices\UD.EXE
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\Program Files\SpywareGuard\sgbhp.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\Program Files\United Devices\ud_1396140.exe
C:\Program Files\United Devices\ud_1396140_0.dir\ud_ligfit_Release.exe
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Adressen] C:\Documents and Settings\Ester van der Meer\Mijn documenten\adressen.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [gqegbvqvc] C:\WINNT\SYSTEM32\zss.exe
O4 - HKLM\..\Run: [Ssdqwa] bgdw.exe
O4 - HKLM\..\Run: [vaxxa] C:\WINNT\SYSTEM32\vdars.exe
O4 - HKLM\..\Run: [Microsoft Netview] gesfm32.exe
O4 - HKLM\..\Run: [Microsoft Windows System Kernel Initializer] SysInt32.exe
O4 - HKLM\..\Run: [Microsoft Windows] mstask0.exe
O4 - HKLM\..\Run: [Window manager] C:\WINNT\SYSTEM32\sks.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] splvs.exe
O4 - HKLM\..\Run: [Microsoft Internet] spolws.exe
O4 - HKLM\..\Run: [WinManage] C:\WINNT\SYSTEM32\efzx.exe
O4 - HKLM\..\Run: [WinBool] GT.exe
O4 - HKLM\..\Run: [dacqe] C:\WINNT\SYSTEM32\rwvws.exe
O4 - HKLM\..\Run: [fgqer] fyycqe.exe
O4 - HKLM\..\Run: [syscfgx32] syscfgx32.exe
O4 - HKLM\..\Run: [kkk] C:\WINNT\SYSTEM32\sdks.exe
O4 - HKLM\..\Run: [ICeon] ICfsn.exe
O4 - HKLM\..\RunServices: [Ssdqwa] bgdw.exe
O4 - HKLM\..\RunServices: [Microsoft Netview] gesfm32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows System Kernel Initializer] SysInt32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows] mstask0.exe
O4 - HKLM\..\RunServices: [Microsoft Internet Explorer] splvs.exe
O4 - HKLM\..\RunServices: [Microsoft Internet] spolws.exe
O4 - HKLM\..\RunServices: [WinBool] GT.exe
O4 - HKLM\..\RunServices: [syscfgx32] syscfgx32.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MailWasher] C:\PROGRA~1\MAILWA~2\MAILWA~1.EXE
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NPF Messenger.lnk = C:\Program Files\Norman\NPF\NPFMSG.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37414.4596990741
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E91EA01-BECD-42CA-BECC-B12372063911}: NameServer = 194.109.104.104 194.109.6.66
O17 - HKLM\System\CS1\Services\Tcpip\..\{2E91EA01-BECD-42CA-BECC-B12372063911}: NameServer = 194.109.104.104 194.109.6.66

Removed quote tags - Pieter

 

Hi Fraha,

Some very strange stuff in there.
Could you make me a zip file containing:
C:\WINNT\SYSTEM32\zss.exe
bgdw.exe
C:\WINNT\SYSTEM32\vdars.exe
C:\WINNT\SYSTEM32\sks.exe
spolws.exe
C:\WINNT\SYSTEM32\efzx.exe
GT.exe
C:\WINNT\SYSTEM32\rwvws.exe
fyycqe.exe
C:\WINNT\SYSTEM32\sdks.exe
ICfsn.exe
bgdw.exe
gesfm32.exe
SysInt32.exe
mstask0.exe
splvs.exe
spolws.exe
GT.exe
syscfgx32.exe
and send that to the address in my profile.

Then check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

O4 - HKLM\..\Run: [gqegbvqvc] C:\WINNT\SYSTEM32\zss.exe
O4 - HKLM\..\Run: [Ssdqwa] bgdw.exe
O4 - HKLM\..\Run: [vaxxa] C:\WINNT\SYSTEM32\vdars.exe
O4 - HKLM\..\Run: [Microsoft Netview] gesfm32.exe
O4 - HKLM\..\Run: [Microsoft Windows System Kernel Initializer] SysInt32.exe
O4 - HKLM\..\Run: [Microsoft Windows] mstask0.exe
O4 - HKLM\..\Run: [Window manager] C:\WINNT\SYSTEM32\sks.exe

O4 - HKLM\..\Run: [Microsoft Internet Explorer] splvs.exe
O4 - HKLM\..\Run: [Microsoft Internet] spolws.exe
O4 - HKLM\..\Run: [WinManage] C:\WINNT\SYSTEM32\efzx.exe
O4 - HKLM\..\Run: [WinBool] GT.exe
O4 - HKLM\..\Run: [dacqe] C:\WINNT\SYSTEM32\rwvws.exe
O4 - HKLM\..\Run: [fgqer] fyycqe.exe
O4 - HKLM\..\Run: [syscfgx32] syscfgx32.exe
O4 - HKLM\..\Run: [kkk] C:\WINNT\SYSTEM32\sdks.exe
O4 - HKLM\..\Run: [ICeon] ICfsn.exe
O4 - HKLM\..\RunServices: [Ssdqwa] bgdw.exe
O4 - HKLM\..\RunServices: [Microsoft Netview] gesfm32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows System Kernel Initializer] SysInt32.exe
O4 - HKLM\..\RunServices: [Microsoft Windows] mstask0.exe
O4 - HKLM\..\RunServices: [Microsoft Internet Explorer] splvs.exe
O4 - HKLM\..\RunServices: [Microsoft Internet] spolws.exe
O4 - HKLM\..\RunServices: [WinBool] GT.exe
O4 - HKLM\..\RunServices: [syscfgx32] syscfgx32.exe

Then reboot and post a new log.

Regards,

Pieter

 

Norman false positive

Dear Peter,

herewith I send you my new HT log

Logfile of HijackThis v1.97.7
Scan saved at 13:39:13, on 6-2-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\Program Files\Winamp\Winampa.exe
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\WINNT\system32\internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\RUNDLL32.EXE
C:\WINNT\SYSTEM32\DNTUS26.EXE
C:\PROGRA~1\MAILWA~2\MAILWA~1.EXE
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norman\NPF\NPFMSG.EXE
C:\winnt\system32\system32bak\temp\FireDaemon.EXE
C:\winnt\system32\system32bak\temp\FireDaemon.EXE
C:\Palm\HOTSYNC.EXE
C:\winnt\system32\system32bak\temp\G6FTPSrv.exe
C:\winnt\system32\system32bak\temp\ssvchost.exe
C:\Program Files\Norman\NPF\NPFSVICE.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Norman\Nvc\BIN\Zanda.exe
C:\Program Files\United Devices\UD.EXE
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\United Devices\ud_1396140.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\United Devices\ud_1396140_0.dir\ud_ligfit_Release.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Adressen] C:\Documents and Settings\Ester van der Meer\Mijn documenten\adressen.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MailWasher] C:\PROGRA~1\MAILWA~2\MAILWA~1.EXE
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NPF Messenger.lnk = C:\Program Files\Norman\NPF\NPFMSG.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37414.4596990741
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E91EA01-BECD-42CA-BECC-B12372063911}: NameServer = 194.109.104.104 194.109.6.66
O17 - HKLM\System\CS1\Services\Tcpip\..\{2E91EA01-BECD-42CA-BECC-B12372063911}: NameServer = 194.109.104.104 194.109.6.66

The zip-file you've asked for, I've send it to you by email.

Regards,
Esmee

 

Hi Esmee,

Welcome at Wilders.
I'll have a look at your collection when I get home.

Your log looks clean now.

I will let you know as soon as I can if you can delete all those files, but I think that will be the case, unless you are having problems now.

Regards,

Pieter

 

Dear Pieter,

I've tried to send you the files by e-mail, but........Outlook Express keeps saying it's sending, but it's not!!
Outlook Express freezes and even when I boot my pc, it still keeps saying it's sending the files.

Further more I get a pop-up from Norman, that the files cannot be send because these are infected.

What to do next?

Regards,
Esmee

 

Hello Esmee and Pieter

The zipfile with the ordered files are send to Pieter's email address at wilders.org.

Keep us updated both about how things go!

Here's the latest HT-log:

Logfile of HijackThis v1.97.7
Scan saved at 19:43:39, on 6-2-2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\Program Files\Winamp\Winampa.exe
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\WINNT\system32\ICfsn.exe
C:\WINNT\SYSTEM32\DNTUS26.EXE
C:\WINNT\system32\internat.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\RUNDLL32.EXE
C:\PROGRA~1\MAILWA~2\MAILWA~1.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\winnt\system32\system32bak\temp\FireDaemon.EXE
C:\winnt\system32\system32bak\temp\FireDaemon.EXE
C:\winnt\system32\system32bak\temp\G6FTPSrv.exe
C:\winnt\system32\system32bak\temp\ssvchost.exe
C:\Norman\Nvc\BIN\Zanda.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\United Devices\UD.EXE
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\WINNT\system32\stisvc.exe
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\United Devices\ud_1396140.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\United Devices\ud_1396140_0.dir\ud_ligfit_Release.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINNT\system32\GT.exe
C:\Program Files\Norman\NPF\npfmsg.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.nl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
Koppelingen
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection -
{4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program
Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program
Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -
C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Adressen] C:\Documents and Settings\Ester van der
Meer\Mijn documenten\adressen.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [anvshell] anvshell.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LWBMOUSE] C:\Program Files\Browser Mouse\Browser
Mouse\1.0\lwbwheel.exe
O4 - HKLM\..\Run: [ICeon] ICfsn.exe
O4 - HKLM\..\Run: [Microsoft Internet] spolws.exe
O4 - HKLM\..\RunServices: [Microsoft Internet] spolws.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe"
/background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\WINNT\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MailWasher] C:\PROGRA~1\MAILWA~2\MAILWA~1.EXE
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat
6.0\Distillr\acrotray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O4 - Global Startup: NPF Messenger.lnk = C:\Program
Files\Norman\NPF\NPFMSG.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37414.4596990741
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
http://fdl.msn.com/public/chat/msnchat45.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{2E91EA01-BECD-42CA-BECC-B12372063911}:
NameServer = 194.109.104.104 194.109.6.66
O17 -
HKLM\System\CS1\Services\Tcpip\..\{2E91EA01-BECD-42CA-BECC-B12372063911}:
NameServer = 194.109.104.104 194.109.6.66

 

Hi Fraha and Esmee,

Sofar the files have not arrived.

Regards,

Pieter

 

ok, so my provider is to strict about virusses? or are you on that side? ;-)

I'll try via another host. Please respond with a direct email if you get them. Thanks

Frans

 

I'm on the side that likes his malware to arrive.

I will let you know when I get them.

The torture chamber is all ready for them.

Regards,

Pieter

 

question:

Is it possible for a virusfilter, to scan WITHIN a ZIPfile and check the code even if they are *.xex in stead of *.exe files?

Should I send them pwd protected maybe?

Do you know?

Frans

 

Hi Fraha,

They certianly can and most probably will scan in zip files.

Password protected should work.

A scanner that gets fooled by changing the extension isn't worth the download it came in.

Regards,

Pieter

 

Hi Fraha,

Certainly no false positive:

syscfgx32.exe Packed: ASPack
syscfgx32.exe Infected: Backdoor.IRCBot.gen

GT.exe Packed: Morphine
GT.exe Packed: UPX
GT.exe Infected: Backdoor.IRCBot.gen

sdks.exe Packed: ASPack
sdks.exe Infected: TrojanProxy.Win32.Excelone

mstask.exe Ok <= I will doublecheck that

I sent you an email regarding the other files.
Please have a lok. I can only get these 4 out.

Regards,

Pieter