service.exe still polling

FrankA · June 14, 2009

First posted with detail here http://www.malwarebytes.org/forums/index.p...amp;#entry89701

First log from Malwarebytes

Malwarebytes' Anti-Malware 1.37

Database version: 2271

Windows 5.1.2600 Service Pack 2

13/06/2009 17:30:27

mbam-log-2009-06-13 (17-30-27).txt

Scan type: Quick Scan

Objects scanned: 99762

Time elapsed: 20 minute(s), 31 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\rock the murdoc.dat (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\Andrews\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully.

N.B. Murdoc.dat is probably something from a Gorillaz dvd screensaver that did not get deleted.

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:25:58, on 14/06/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Belkin Bulldog Plus\upsd.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Intel\Intel® Active Monitor\imontray.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe

C:\Program Files\Security Task Manager\SpyProtector.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Novosoft\Handy Backup\hbagent.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Belkin Bulldog Plus\MUPS.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

O2 - BHO: Adobe PDF Reader Link Helper - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [iMONTRAY] C:\Program Files\Intel\Intel® Active Monitor\imontray.exe

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [sonicFocus] "C:\Program Files\Sonic Focus\SFIGUI\SFIGUI.EXE" BOOT

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [spy Protector] C:\Program Files\Security Task Manager\SpyProtector.exe /autostart

O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [Handy Backup 4.0] "C:\Program Files\Novosoft\Handy Backup\hbagent.exe" -logon

O4 - HKCU\..\Run: [Handy Backup 6.0] "C:\Program Files\Novosoft\Handy Backup\hbagent.exe" -logon

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: Shortcut to Microsoft Outlook.lnk = ?

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HotSync Manager.lnk.disabled

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: MUPS.lnk = C:\Program Files\Belkin Bulldog Plus\MUPS.exe

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/adobe/MTSI...MetaStream3.cab

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200312...meInstaller.exe

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase1140.cab

O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) -

O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?316

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...030/mcfscan.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: Dc20xin - Intel Corporation - C:\WINDOWS\system32\drivers\a305.sys

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

O23 - Service: UPS - UPSentry Service (UPSentry_Smart) - Delta - C:\Program Files\Belkin Bulldog Plus\upsd.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--

End of file - 8978 bytes

Thanking you in anticipation

sjpritch25 · June 15, 2009

Welcome to malwarebytes

Download DDS and save it to your desktop from here or here or here

Disable any script blocker, and then double click dss.scr to run the tool.

When done, DDS will open two (2) logs:

DDS.txt
Attach.txt

Save both reports to your desktop
In your next reply, please attach both logs. Thanks

FrankA · June 15, 2009

Here they are.

Infection would have arrived 11/6/2009 at about 01:00 CET.

Also ran MS Rootkit revealer which came up clear.

Services exe process has given up on the MS/Google/Yahoo/AOL destinations and is now trying to access, for example:

208.109.238.10 secureserver.net

69.162.108.90 reverse.lstn.net

69.175.7.90 webhostingextreme.com

sjpritch25 · June 16, 2009

Please download the OTM.exe by OldTimer.

Save it to your desktop.
Please double-click OTM.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:processesexplorer.exe:filesc:\windows\system32\drivers\ppwyzc.sys:servicesmculbCotradpensbdScarksbmewdUppinoWpi480piwParcafrwfrvVolsentf:commands[emptytemp][start explorer]

Return to OTMoveIt3, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Click Ok to allow OTM reboot your machine.
After reboot, a log file will appear. Copy the contents to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

FrankA · June 16, 2009

New data

I have had Security Task Manager (Neuber software) running all day looking for what is trying to access the Net and network via sevices.exe, as well as getting scans of various files.

The daily avg run reported two viruses

Documents and settings\All Users\Application Data\SecTaskMan\_cdrbsdrv245434FF Virus found Lop

Documents and settings\All Users\Application Data\SecTaskMan\_hidusb20262580 Virus found Lop

As neither of these show up in the directory when I looked, I thought it possible that avg caught these things while they were active and being logged by Sec Task Mnger. avg is still running so it has not tried to quarantine yet.

sjpritch25 · June 16, 2009

i don't have an opinion on Security Task manager, but MS has a better program for examining tasks. AVG looks like a false positive.

Did you follow my instructions.

FrankA · June 16, 2009

Did you follow my instructions.

Was writing my post as you posted, then switched screen off and hit the sack. Have now followed your steps above...

Error: Unable to interpret <processes> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
========== FILES ==========
File/Folder c:\windows\system32\drivers\ppwyzc.sys not found.
========== SERVICES/DRIVERS ==========
Service\Driver mculb deleted successfully.
Service\Driver Cotradpensbd deleted successfully.
Service\Driver Scarksbmewd deleted successfully.
Service\Driver Uppino deleted successfully.
Service\Driver Wpi480piw deleted successfully.
Service\Driver Parcafrwfrv deleted successfully.
Service\Driver Volsentf deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Andrews\LOCALS~1\Temp\etilqs_dTm8q1sNcBVmqfgIJuCd scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Andrews\LOCALS~1\Temp\~DFA45E.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Documents and Settings\Andrews\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
User's Temporary Internet Files folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Network Service Temp folder emptied.
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Network Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\ZLT05434.TMP scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
OTM by OldTimer - Version 2.1.0.1 log created on 06162009_094528
Files moved on Reboot...
File C:\DOCUME~1\Andrews\LOCALS~1\Temp\etilqs_dTm8q1sNcBVmqfgIJuCd not found!
C:\DOCUME~1\Andrews\LOCALS~1\Temp\~DFA45E.tmp moved successfully.
File C:\WINDOWS\temp\ZLT05434.TMP not found!
C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Andrews\Local Settings\Application Data\Mozilla\Firefox\Profiles\f574xnw0.default\XUL.mfl moved successfully.
Registry entries deleted on Reboot...

I note a couple of items were not found. On checking Zone Alarm logs it is still calling services.exe. But since the reboot, it has gone back to the Google/yahoo/aol/microsoft targets that it tried the first couple of days. Yesterday it had switched to ISP targets.

Feels like progress, and I want say a big thank you for the efforts that you and others make to help us in cyber-world.

sjpritch25 · June 17, 2009

please post a fresh hIjackthis log. Thanks

FrankA · June 17, 2009

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:33:47, on 17/06/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Belkin Bulldog Plus\upsd.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Program Files\Intel\Intel® Active Monitor\imontray.exe

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\Program Files\Security Task Manager\SpyProtector.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Novosoft\Handy Backup\hbagent.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Belkin Bulldog Plus\MUPS.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\PROGRA~1\MI1933~1\Office\OUTLOOK.EXE

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.1.126/index.html