Win XP Home Pro (legit software).
Single User with Cable High Speed
--------------------------
----------
--------
I have been plagued with remote attacks since I bought this newly built computer from the store. Formatting; including low level reformat, resetting cmos jumper, and removing all components has been done by 6 different people but to no avail. It seems like I am being compromised when I do my windows update; sometimes right away and other times I haven't noticed the problems for a week. I do not use Internet Explorer. I install anti-virus programs prior to accessing the internet for updates. I have tried every anti-virus, spyware, firewall, registry check and they are great for a few days (if even)
and then they become disable. Oh and just to show you how desperate I am for help, I purchased most of that software! LOL Install logs look like I am installing fake updates so perhaps a browser hijack?
A couple of the problems I experience: Loss of Local Admin priviledges and eventually a complete D.O.S. (by NT AUTHORITY\NetworkService?)
.
Registry continues to change with added users and SID's.
My C: drive shows up as a file folder and no longer a system one.
Despite disabling remote/terminal apps from services.msc my registry
and logs become filled apps that appear to be remote access apps.
3 times now I have lost access to my CD-rom and DVD drives. I have CD-Rom this time but DVD and Floppy won't work.
Packet sending logs with reference to streaming.
Although my RUN ----> services.msc show apps as disabled, a ms-dos prompt shows them running with demand starts.
It's like I don't have access to my real C: drive if that makes any sense. I can't explain it any other way than to say that I feel like I only have access to and see a fake drive.
This is the same with anti-virus programs. They look llike they are doing their job but it appears they have been come compromised. Most of the time I am unable to access online scanners.
Weird things like this showed up today. Maybe it's normal?
PSEnumVariant
Inprocserver32
INTRO.EXE-00DE6C1B.pf
I installed Nortons 2005 and it worked long enough for it to detect
Spyware.WinKeyG
Hacktool.XScan
Bloodhound.Exploit.6 (Norton's stopped working shortly after this)
Firefox had a virus detected so I'm using Netscape for the immediate time. I dont' know if this is normal but my Netscape opened up to this url:
http://home.netscape.com/main3.adp|http://browser.netscape.com/ns8/security/trust_partners.jsp|http://browser.netscape.com/ns8/security/trust_partners.jsp|
http://browser.netscape.com/ns8/security/trust_partners.jsp|http://browser.netscape.com/ns8/security/trust_partners.jsp----------------- HIJACKTHIS log --------------------------
--
Logfile of HijackThis v1.99.1
Scan saved at 5:49:12 AM, on 6/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.e
xe
C:\WINDOWS\system32\csrss.
exe
C:\WINDOWS\system32\winlog
on.exe
C:\WINDOWS\system32\servic
es.exe
C:\WINDOWS\system32\lsass.
exe
C:\WINDOWS\system32\svchos
t.exe
C:\WINDOWS\system32\svchos
t.exe
C:\WINDOWS\System32\svchos
t.exe
C:\WINDOWS\system32\svchos
t.exe
C:\WINDOWS\system32\svchos
t.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spools
v.exe
C:\WINDOWS\System32\svchos
t.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex
e
C:\WINDOWS\system32\MsPMSP
Sv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.ex
e
C:\Program Files\Greatis\RegRunSuite\
RegRunCent
er.exe
C:\Program Files\Greatis\RegRunSuite\
WatchDog.e
xe
C:\WINDOWS\system32\wuaucl
t.exe
C:\WINDOWS\system32\wpabal
n.exe
C:\WINDOWS\system32\notepa
d.exe
C:\Program Files\Greatis\RegRunSuite\
fileext.ex
e
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\NOTEPA
D.EXE
C:\WINDOWS\system32\notepa
d.exe
C:\WINDOWS\system32\notepa
d.exe
C:\WINDOWS\system32\svchos
t.exe
E:\CTRun\demo32.exe
E:\CTRun\CTLaunch.exe
E:\Audio\SETUP\SETUP.EXE
C:\PROGRA~1\COMMON~1\INSTA
L~1\Engine
\6\INTEL3~
1\IKernel.
exe
C:\WINDOWS\system32\NOTEPA
D.EXE
C:\Program Files\Netscape\Netscape\Ne
tscp.exe
C:\WINDOWS\system32\notepa
d.exe
C:\Program Files\Netscape\Netscape Browser\netscape.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccLgView.exe
C:\Program Files\Greatis\RegRunSuite\
regrun2.ex
e
C:\WINDOWS\system32\wuaucl
t.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\NOTEPA
D.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Angela\LOCALS~
1\Temp\Rar
$EX00.797\
HijackThis
.exe
R1 - HKCU\Software\Microsoft\In
ternet Explorer\Main,Search Bar =
http://ie.search.msn.com/{
sub_rfc176
6}/srchass
t/srchasst
.htm
R1 - HKCU\Software\Microsoft\In
ternet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearchR0 - HKCU\Software\Microsoft\In
ternet Explorer\Main,Start Page =
http://www.msn.com/R1 - HKLM\Software\Microsoft\In
ternet Explorer\Main,Default_Page
_URL
=
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhomeR1 - HKLM\Software\Microsoft\In
ternet Explorer\Main,Search Bar =
http://ie.search.msn.com/{
sub_rfc176
6}/srchass
t/srchasst
.htm
R1 - HKLM\Software\Microsoft\In
ternet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearchR0 - HKLM\Software\Microsoft\In
ternet Explorer\Main,Start Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhomeR3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup
.homepage"
,
"
http://www.google.ca/"); (C:\Documents and Settings\Angela\Applicatio
n
Data\Mozilla\Profiles\defa
ult\6u4ypl
t1.slt\pre
fs.js)
N3 - Netscape 7: user_pref("browser.search.
defaulteng
ine",
"
http://www.google.com/");
(C:\Documents and Settings\Angela\Applicatio
n
Data\Mozilla\Profiles\defa
ult\6u4ypl
t1.slt\pre
fs.js)
O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe
O4 - HKLM\..\Run: [@RegRunOnSecure]
C:\PROGRA~1\Greatis\REGRUN
~1\OnSecur
e.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN
~1\regrun2
.exe /c 1
O4 - HKCU\..\Run: [HijackThis startup scan] C:\DOCUME~1\Angela\LOCALS~
1\Temp\Rar
$EX00.750\
HijackThis
.exe /startupscan
O6 - HKCU\Software\Policies\Mic
rosoft\Int
ernet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Mic
rosoft\Int
ernet Explorer\Control Panel present
O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape
Browser\PLUGINS\npTrident.
dll
O15 - Trusted Zone:
http://free.aol.comO15 - Trusted Zone:
http://*.windowsupdate.microsoft.comO15 - Trusted Zone:
http://*.windowsupdate.comO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner -
C:\WINDOWS\system32\CTSvcC
DA.EXE (file missing)
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co.,
Ltd. - C:\WINDOWS\system32\DVDRAM
SV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program
Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec
Corporation - C:\PROGRA~1\COMMON~1\Syman
tec Shared\Script Blocking\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.ex
e
O23 - Service: VJQT - Unknown owner -
C:\DOCUME~1\Angela\LOCALS~
1\Temp\VJQ
T.exe (file missing)
--------------------- END ------------------
Thank you,
Angela
I gave this a difficult rating because I have taken this computer to different computer stores and they have not discovered the problem.