W32.spybot.worm in XP Home - wupdate.exe - removal

paulbasel,
> and the blasted creature is still shows up as a running process and
> some of the registry settings have been reestablished.

Not after all the solutions you have tried , did you scan for virus again and see what the anti-virus reports

You may want to run stinger from here : http://vil.nai.com/vil/stinger/

and this online virus scanner

http://security.symantec.com/

paulbasel,

Please see the following links.

W32.Spybot.Worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

Spyware Removal:
http://www.fixyourwindows.com/windowsxpsolutions.htm

Startup and Temporary Files Cleanup:
http://www.fixyourwindows.com/optimizewindows.htm

Online Virus Scans:
http://www.symantec.com/securitycheck
http://housecall.trendmicro.com/housecall/start_corp.asp
http://www.bitdefender.com/scan/licence.php
      
Online Security Scans:
http://www.sygatetech.com
http://www.symantec.com/securitycheck

Hope this helps!

Hello paulbasel =)

Can u plzz Download HijackThis from here, run it and Post the Log File here:
http://www.spychecker.com/download/download_hijackthis.html

So that i can check if there are some other nasty things which are invoking this behaviour ??

To Sunray 2003

The startup tab reveals two instances of wupdate at location:

HKLM\software\microsoft\windows\currentversion\run
HKCU\software\microsoft\windows\currentversion\run

However, in the Command column of the Starup tab it only shows the executable, wupdate.exe with no path whatsoever. I redid a search of the entire harddisk for this file and the search found nothing.

In addition, there is another executable, carpserv.exe, on my friend's XP Home machine (the one I am debugging) that is not on my Startup tab list on my XP Pro machine. A quick google found nothing untoward regarding this executable, but I didn't do an extensive search.

When I connect to the internet from his machine (56K modem), ZoneAlarm shows that wupdate tries to connect as well. After denying this attempt and closing the connection, another program tries to open the connection. One time it displayed "labs.centorium" or something like that, I didn't write down the name. This morning it tried to connect again and the network connection dialog displayed "pyk.attaq.net" which Sam Spade shows as 80.53.99.162 which resolves to sql.taboo-inc.com which then resolves to an error. Obviously, the DNS is hijacked.

So, to summarize, the registry entries shown above, I have removed several times and they reappear after rebooting. The wupdate executable doesn't appear on the machine as far as I can tell. What is causing the registry entries to reestablish themselves?

I have run Norton Anti-virus on his machine, I ran TrojanHunter, and also TrendMicro's SysClean and all come up clean. The critter(s) is obviously still there, otherwise there would be no attempt to connect to the internet.

Paul

To SheharyaarSaahil

Here's the log file from HijackThis:

Logfile of HijackThis v1.97.7
Scan saved at 10:16:50, on 08.07.2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Programme\Apoint2K\Apoint.exe
C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\WINDOWS\System32\carpserv.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wupdate.exe
C:\Programme\Apoint2K\Apntex.exe
C:\Dokumente und Einstellungen\Brauchli Peter\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blick.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://internet.sunrise.ch/de/hom/default.asp
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtaET2S.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Microsoft Windows Update] wupdate.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] wupdate.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - HKCU\..\Run: [Microsoft Windows Update] wupdate.exe
O14 - IERESET.INF: START_PAGE_URL=http://internet.sunrise.ch/de/hom/default.asp
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37858.0357638889

Let me know if you see anything suspicious, except for the wupdate.exe which reestablishes itself after being deleted from the registry.

Paul

To sunray 2003

I ran Stinger and Norton online and they both came up with nothing, but the spybot or trojan or whatever it is, is still there, trying to connect each time I open an internet connection.

Paul

O4 - HKLM\..\Run: [Microsoft Windows Update] wupdate.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] wupdate.exe
O4 - HKCU\..\Run: [Microsoft Windows Update] wupdate.exe
=============================================
we can give this a try,,,, Turn Off System Restore

goto Start>Run>msconfig>Startup
uncheck the entry for microsoft Windows Update
then uncheck it in Services section !!!

after that Fix the above three entries in Hijakchtis,,,,,and follow these instructions:

1. Restart ur System
2. Boot into safemode and Login as Administrator
3. Run the AntiVirus tool and delete all viruses it found
4. Run the Spyware Removal tools and delete everything they detect
5. Then goto C:\Documents and Settings\ur usernmae\Local Settings\Temp and delete all files present here
6. Goto C:\Documents and Settings\ur usernmae\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
7. Goto C:\Documents and Settings\ur usernmae\Cookies, and delete all cookies present here.
8. Search for the file wupdate.exe on ur hard drive, and delete it\them.
9. Reboot back in Normal Mode and check if problems are gone
10. If yes then u can turn On the System Restore !!!!

Hello SheharyaarSaahil

I followed your instructions:

Turned off System Restore
Unchecked the 3 instances of wupdate.exe (in the Startup tab)
Could not find any instances of this executable running in Services
Booted into Safe Mode
Ran Trend Micro Sysclean with the latest pattern file (found no viruses)
Ran AdAware 6.0 with latest pattern file (found no spyware)
Dumped the contents of user's temp folder, all temp internet files, cookies, plus more.
Searched for wupdate.exe on the hard drive (didn't find anything)
Returned to Normal Mode

And the creature is still there, happily running in Processes. I connected to the Internet with IE and sure enough, wupdate.exe wanted to connect. ZoneAlarm stated that it was a program from labs.dextorion.com. It seems to change names every once and a while. A google of this name revealed nothing, of course.

Any other ideas. I'm at the end of my rope on this one.

Paul

strange indeed :-o

Im sure its not running in safemode, is it ??
and do u have any other user on the system, if yes then check there,
or else create a new user and check if its running there also.... ?

I went into the registry in safemode and there was an instance of it running in:
HKLM>Software>Microsoft>Windows>CurrentVersion>RunServices. It was not present in Run or RunOnce or any other location.

Could it be that I overlooked it in the Running Processes in msconfig? I'm under a handicap since this OS is in German and I can't always decipher the description of the running processes. My German's OK, but the technical terms stump me sometimes. I'll have another look and then also consider creating a new user and see if it's running there as well.

Paul

paulbasel ,

I posted before.
You probably should try it   :)

To sp 100

Sorry I didn't get back to you, but it's difficult to work with so many suggestions at one time. Every online virus, trojan, spyware scanner that you have suggested has come up with the same conclusion, i.e., that the system is clean.

It isn't of course, because the executable continues to try to connect to the Internet. It is probably hidden in some other file that is yet to be identified. But anyhow, thanks for the suggestions.

Paul

To SheharyaarSaahil

I went through the procedure again and I only saw two instances of wupdate.exe (before there were 3) in the Startup tab and none (that I recognized) in the Running Processes. I unclicked those two instances, rebooted into Safemode.

I then checked the registry before running the Antivirus tools. Sure enough, there was a registry entry in HKLM>Software>Microsoft>Windows>CurrentVersion>RunServices (as I mentioned in my above post). I deleted that entry and found no others.

I ran the Antivirus and Spyware tools. Then before rebooting, I checked the msconfig once more. There in the Startup tab was another wupdate.exe instance. I unchecked it, checked the registry again (nothing there) and re-ran the Antivirus and Spyware tools, then rebooted.

It is still there!!! I mean how could it be, unless the executable is masquerading as a dll or exe file under another name.

I then created a new user with administrator authority. The executable wupdate.exe was in the running processes. I deleted that account and created another one without administrator authority - it was running there also.

What do we do now? I know that I have done everything according to the "book". I know my way around the registry, msconfig, and how to update and run anti-virus and anti-spyware programs and I have never, ever seen anything like this creature before.

Paul :-(

do u have any Linmeimei.exe file on the hard drive ??

To SheharyaarSaahil

Great minds think alike. :-)  Already checked that one, it's not there.

Paul

then what else my friend....... =\

its running in normal mode, in safemode, in new user, everywhere >:(
coming back again and again and running happily everywhere :(

can u observe any unusaul things caused by running this unknown process ??
or it is just running and nothing else ??

I forgot to mention that on my last attempt to clean the machine, while in safemode, I found another file wserv32.exe, also known sometimes as w32.spybot.worm. It was in several places in the registry and also in the Windows/Prefetch directory. After deleting those entries as well as the ones from wupdate.exe, running all the tools, rebooting, wupdate was again a running process. Wserv32.exe never shows up as a running process and I cannot find it on the hard drive.

I also looked closely this time at the TrendMicro Sysclean log and found that while it declares that it has not found any viruses, trojans, etc., it shows several errors in the Windows/system32\config directory. The error code is -94 and the files it shows as errors include:

system.log
software.log
default.log
security
sam
sam.log
system
software
default

all of which are in the same directory mentioned above.

There were also errors reported in the user's documents and settings folder. Do you think any of these errors have anything to do with the antivirus tool not finding the creature?

As I said before, I cannot find any evidence of the executables on the harddisk.

Paul

As to your question about the behavior of the creature. It attempts to connect to the internet after the first dialup connection is made. ZoneAlarm reports that wupdate.exe is asking to connect to the Internet.

After closing the dialup connection, another message appears that states a "labs.dextoriion.com" is asking for permission to connect. Another time the same message popped up and stated that "pyk.attaq.net" was asking permission. I checked both DSNs and they lead ultimately to an unknown source, as one would suspect.

Paul

I reexamined the HijackThis log and saw that smss.exe is running. Some sites state that it is part of the Windows OS and is needed, while others claim that it can be spyware or a trojan. Any experience with this executable?

Paul

no its a common process,,,,,,, we all have this process running !!!

To SheharyaarSaahil

Yes, only TrendMicro is reporting those errors, no other tool shows any errors.

I have decided that the only thing to do at this stage is to reformat the harddrive of my friend's PC and reinstall the OS and apps. Fortunately, he is not a power user and it should not take long to reinstall everyything. I think it's best so I can rest easy at night and he can have a clean system. He got in trouble in the first place by not having a firewall installed. He thought that since he only has a dialup connection and very few email contacts that he didn't need one. I think he has learned his lesson.

I want to thank you for hanging in there with me even though we didn't solve the problem, but I'm not sure that it was solvable. I've decided that you earned the 500 points, if for no other reason than sheer tenacity. Thanks again.

Paul

hmmmmmmm....... it happens sometimes,,,, we come across with all types of problems here, and Daily !!!!
85% of them get solved by hook or by crook,,,,, but rest 15% dont leave the system at any cost,,,,, as they are in love with it :-S

but anywayz,,, ask ur friend to be more careful this time,,, now-a-days even those persons are not safe who are running Highly reputed antivirus and firewall softwares, and those who dont have any,,,,, well u can think =\

and btw thanx for the kind words and points =)

!! GOOD DAY !!

Okay, that 'solution' is no solution!  'reformat the hard drive??'  I don't think so.  I keep getting messages from my Symantec AntiVirus realtime protection that it finds the file bling.exe in the system folder of my XP machine.   It quarantines it, and I delete it, but it keeps coming back.  Symantec has no help to offer on this worm (which it identifies as w32.spybot.worm).

I have no idea on how to remove the worm that's depositing the file there.  Does anyone?

Thanks,
Kate

Kate

You are correct in stating that reformatting the hard drive is not a solution, and as it turned out I didn't do it, but only because there wasn't time before my friend left for his vacation home in Spain. However, before he left I made sure that the firewall on his laptop blocked the worm from accessing the outside world. While he was in Spain, he had a local consultant (who he calls the PC Doctor) look at his machine. Sure enough, the worm was still there, and this guy was able to remove it.

But how? I have no idea because as stated before, my friend has little knowledge of how computers work, and he doesn't know what this guy did. If I have a chance, I'll get the name and phone number of this guy and ask him what he used and then post the results here.

Paul