[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

4.2

Continual Trojans, Denial of Service, Unauthorized Access on standalone XP Home SP2.

Asked by theAnginator in Anti-Virus Applications

Win XP Home Pro (legit software).
Single User with Cable High Speed
--------------------------------------------
I have been plagued with remote attacks since I bought this newly built computer from the store. Formatting; including low level reformat, resetting cmos jumper, and removing all components has been done by 6 different people but to no avail.  It seems like I am being  compromised when I do my windows update; sometimes right away and other times I haven't noticed the problems for a week. I do not use Internet Explorer.  I install anti-virus programs prior to accessing the internet for updates. I have tried every anti-virus, spyware, firewall, registry check and they are great for a few days (if even)
and then they become disable. Oh and just to show you how desperate I am for help, I purchased most of that software! LOL  Install logs look like I am installing fake updates so perhaps a browser hijack?

A couple of the problems I experience: Loss of Local Admin priviledges and eventually a complete D.O.S. (by NT AUTHORITY\NetworkService?).
Registry continues to change with added users and SID's.
My C: drive shows up as a file folder and no longer a system one.
Despite disabling remote/terminal apps from services.msc my registry
and logs become filled apps that appear to be remote access apps.
3 times now I have lost access to my CD-rom and DVD drives. I have CD-Rom this time but DVD and Floppy won't work.
Packet sending logs with reference to streaming.
Although my RUN ----> services.msc show apps as disabled, a ms-dos prompt shows them running with demand starts.  


It's like I don't have access to my real C: drive if that makes any sense.  I can't explain it any other way than to say that I feel like I only have access to and see a fake drive.
This is the same with anti-virus programs. They look llike they are doing their job but it appears they have been come compromised. Most of the time I am unable to access online scanners.

Weird things like this showed up today. Maybe it's normal?
PSEnumVariant
Inprocserver32
INTRO.EXE-00DE6C1B.pf

I installed Nortons 2005 and it worked long enough for it to detect

Spyware.WinKeyG
Hacktool.XScan
Bloodhound.Exploit.6 (Norton's stopped working shortly after this)

Firefox had a virus detected so I'm using Netscape for the immediate time. I dont' know if this is normal but my Netscape opened up to this url:

http://home.netscape.com/main3.adp|http://browser.netscape.com/ns8/security/trust_partners.jsp|http://browser.netscape.com/ns8/security/tr
ust_partners.jsp|http://browser.netscape.com/ns8/security/trust_partners.jsp|http://browser.netscape.com/ns8/security/trust_partners.jsp

-----------------  HIJACKTHIS log ----------------------------
Logfile of HijackThis v1.99.1
Scan saved at 5:49:12 AM, on 6/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Greatis\RegRunSuite\RegRunCenter.exe
C:\Program Files\Greatis\RegRunSuite\WatchDog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Greatis\RegRunSuite\fileext.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\svchost.exe
E:\CTRun\demo32.exe
E:\CTRun\CTLaunch.exe
E:\Audio\SETUP\SETUP.EXE
C:\PROGRA~1\COMMON~1\INSTAL~1\Engine\6\INTEL3~1\IKernel.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Netscape\Netscape Browser\netscape.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\ccLgView.exe
C:\Program Files\Greatis\RegRunSuite\regrun2.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Angela\LOCALS~1\Temp\Rar$EX00.797\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL
= http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ie.search.msn.com/{sub_rfc1766}/srchasst/srchasst.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

R3 - Default URLSearchHook is missing

N3 - Netscape 7: user_pref("browser.startup.homepage",
"http://www.google.ca/"); (C:\Documents and Settings\Angela\Application
Data\Mozilla\Profiles\default\6u4yplt1.slt\prefs.js)

N3 - Netscape 7: user_pref("browser.search.defaultengine",
"http://www.google.com/"); (C:\Documents and Settings\Angela\Application
Data\Mozilla\Profiles\default\6u4yplt1.slt\prefs.js)

O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe

O4 - HKLM\..\Run: [@RegRunOnSecure]
C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"

O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\regrun2.exe /c 1

O4 - HKCU\..\Run: [HijackThis startup scan] C:\DOCUME~1\Angela\LOCALS~1\Temp\Rar$EX00.750\HijackThis.exe /startupscan

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O12 - Plugin for .xml: C:\Program Files\Netscape\Netscape
Browser\PLUGINS\npTrident.dll

O15 - Trusted Zone: http://free.aol.com

O15 - Trusted Zone: http://*.windowsupdate.microsoft.com

O15 - Trusted Zone: http://*.windowsupdate.com

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Unknown owner -
C:\WINDOWS\system32\CTSvcCDA.EXE (file missing)

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co.,
Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) -
Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program
Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec
Corporation - C:\PROGRA~1\COMMON~1\Symantec Shared\Script Blocking\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec
Corporation - C:\Program Files\Common Files\Symantec
Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: VJQT - Unknown owner -
C:\DOCUME~1\Angela\LOCALS~1\Temp\VJQT.exe (file missing)

--------------------- END ------------------

Thank you,

Angela

I gave this a difficult rating because I have taken this computer to different computer stores and they have not discovered the problem.




 
Related Solutions
Keywords: Continual Trojans, Denial of Service,…
 
Loading Advertisement...
 
[+][-]06/08/05 07:19 AM, ID: 14170971Accepted Solution

View this solution now by starting your 30-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

About this solution

Zone: Anti-Virus Applications
Sign Up Now!
Solution Provided By: richrumble
Participating Experts: 3
Solution Grade: A
 
[+][-]06/04/05 09:34 AM, ID: 14145970Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/04/05 09:38 AM, ID: 14145980Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/04/05 09:41 AM, ID: 14145994Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/04/05 09:41 AM, ID: 14145998Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/04/05 08:04 PM, ID: 14147462Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/04/05 11:00 PM, ID: 14147693Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/05/05 06:20 AM, ID: 14148384Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/05/05 07:09 AM, ID: 14148543Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/05/05 08:01 AM, ID: 14148741Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/05/05 09:35 PM, ID: 14150809Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/07/05 05:00 AM, ID: 14160845Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/07/05 02:06 PM, ID: 14165982Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/07/05 02:21 PM, ID: 14166104Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/07/05 02:28 PM, ID: 14166155Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/07/05 05:53 PM, ID: 14167269Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/07/05 06:04 PM, ID: 14167317Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/07/05 06:31 PM, ID: 14167396Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/07/05 06:45 PM, ID: 14167471Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/07/05 06:53 PM, ID: 14167511Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/07/05 07:33 PM, ID: 14167639Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/07/05 07:35 PM, ID: 14167644Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/08/05 09:44 AM, ID: 14172360Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/08/05 09:54 AM, ID: 14172447Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/12/05 03:18 PM, ID: 14199035Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/12/05 03:33 PM, ID: 14199062Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]06/22/05 03:00 PM, ID: 14279940Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/22/05 07:39 PM, ID: 14281103Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]06/22/05 07:46 PM, ID: 14281128Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
 
Loading Advertisement...
20091111-EE-VQP-92