DCOM EXPLOIT PLEASE HELP

Status
Not open for further replies.
S

stalin

Journeyman
Longtime back I had problem with DCOM Exploit I just want to know how to remove DCOM Exploit from My computer. I have installed Fresh OS so i dont think I got any virus now.
 
OP
N

naveenpoddar

Journeyman
I scan my computer using both the removal tool but no worm was detected.

I enable normal bootup startup as you stated.

Logfile of HijackThis v1.99.0
Scan saved at 5:54:30 PM, on 5/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program File\DU Meter\DUMeter.exe
C:\Program File\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\Program File\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program File\Alwil Software\Avast4\ashServ.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\System32\wdfmgr.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\Program File\Alwil Software\Avast4\ashMaiSv.exe
C:\Program File\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DU Meter] C:\Program File\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program File\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program File\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [blah service] IEXPLORER.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\RunServices: [blah service] IEXPLORER.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{03AEF64F-E089-474D-B278-047551EE7581}: NameServer = 61.1.96.69 61.1.96.71
O17 - HKLM\System\CS1\Services\Tcpip\..\{03AEF64F-E089-474D-B278-047551EE7581}: NameServer = 61.1.96.69 61.1.96.71
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program File\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program File\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program File\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program File\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs LLC - C:\WINNT\system32\ZONELABS\vsmon.exe
 
S

stalin

Journeyman
Try this buddy download and find it out

*www.ewido.net/en/download/

wheather this could find you hidden Trojan in your machine
 
S

stalin

Journeyman
Go here and run online scans, allow them to delete whatever they find:

*housecall.trendmicro.com/housecall/start_corp.asp
*www3.ca.com/securityadvisor/virusinfo/scan.aspx

Note any thing that can't be fixed
Reboot when done. Rescan with HJT and post a new log here.
 
swatkat

swatkat

Technomancer
Boot in safe mode and run HijackThis. Click "Do a System scan only". Then put a checkmark against these entries:-
O4 - HKLM\..\Run: [blah service] IEXPLORER.exe
O4 - HKLM\..\RunServices: [blah service] IEXPLORER.exe

Then close all other open programs and click "Fix Checked" in HiajckThis.
Exit from HijackThis, and delete this file (Use the "Search" of Windows to locate the file):-
IEXPLORER.exe

Reboot to Normal Mode, and run HijackThis and post a new log. You are using an older version of HijackThis, download latest version, and post it's log.
*www.merijn.org/files/hijackthis.zip
 
OP
N

naveenpoddar

Journeyman
@swatkat: As you told i installed the newer version of hijackthis, but in safe mode hijack this do not show any iexplorer.exe entries. I dont how it has been removed from there. i followed what stalin advice but the scanner he stated didnt show any infected file.

But in Zonealarm the number instrusion blocked is still increasing inspite it has reached 1836 while 149 of those has been stated as high-rated.

I have also deleted the IExplorer.exe file which was found under spybot folder.

But now also i dont think my pc is fully cleaned there some worm present.
Please tell how i can stop this intrusions.
 
OP
N

naveenpoddar

Journeyman
Logfile of HijackThis v1.99.1
Scan saved at 8:31:33 PM, on 5/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program File\Alwil Software\Avast4\aswUpdSv.exe
C:\Program File\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\System32\wdfmgr.exe
C:\WINNT\system32\ZONELABS\vsmon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program File\DU Meter\DUMeter.exe
C:\Program File\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINNT\system32\ctfmon.exe
C:\Program File\Alwil Software\Avast4\ashMaiSv.exe
C:\Program File\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\System32\alg.exe
C:\WINNT\system32\wuauclt.exe
C:\HijackThis\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DU Meter] C:\Program File\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program File\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - *a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program File\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program File\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program File\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program File\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINNT\system32\ZONELABS\vsmon.exe
 
swatkat

swatkat

Technomancer
Log looks clean. And the the number of intrusion prvention shown by ZA is normal, there will be many Port scanning or Worm intrusion attempts when you are connected to Internet. ZA blocks it all, no need to worry about it. Do you have any problems with Net speed or Avast?
 
OP
N

naveenpoddar

Journeyman
No. The Net Speed is fine. Avast is also not showing any warnings.

I am only worried about this zone alarm blocks Becoz of this I disable my Lan that connects my another pc which is free of worm but uses the net connection from this computer. Can i enable it now.
 
swatkat

swatkat

Technomancer
ZA is showing the number of intrusion attempts that it has blocked, this does not mean that your PC is infected. You can enable the LAN.
 
Status
Not open for further replies.
Top Bottom