How do I remove Trojan from system? (W2K)

[cyberserious]

According to my Norton, my computer became infected with a Trojan Horse, possibly 2 Trojans this afternoon, and I cannot figure out how to get rid of it. It infected 8 important Windows files. All 8 infected files are in C:\WINNT\System32\. Norton AntiVirus was unable to repair them. I have a good firewall, so that should keep any intruders out until I get it fixed. My Norton Internet Security, or NIS also had this to say:

You were last attacked on: 11/27/02 4:50PM
Recent Intrusion Attempts: 103
Recent Attempted Hackers: 1
Most Frequent Attacker: 147.208.171.140

Port scan by 147.208.171.140, blocked by 30 minutes

I will probably need to replace each of these 8 files with new clean files, but I'm not sure where or how to get the latest copies from microsoft.com, or how to extract them off my original Windows 2000 CD. If I extract them off my Windows CD, then they will won't be current.

Here's the details report from Norton AV:


*****************************************
Scan Results
******************************************



Summary: Infected files found
Items scanned: C:
File type: Program files only
Other settings: Compressed files scanned
Scan time: 21 minutes 57 seconds


Master
Action Files boot records Boot records
------------------------------------------------------------


Scanned: 58,116 1 1
Infected: 8 0 0
Repaired: 0 0 0
Quarantined: 7
Deleted: 0



Name: C:\WINNT\system32\explore.EXE
Virus name: Trojan Horse
Status: Quarantined


Name: C:\WINNT\system32\explorer.exe
Virus name: IRC Trojan
Status: Not quarantined


Name: C:\WINNT\system32\STDE9\explore.EXE
Virus name: Trojan Horse
Status: Quarantined


Name: C:\WINNT\system32\STDE9\explorer.exe
Virus name: IRC Trojan
Status: Quarantined


Name: C:\WINNT\system32\STDE9\svchost32.exe
Virus name: Trojan Horse
Status: Quarantined


Name: C:\WINNT\system32\STDE9\v32driver.bat
Virus name: Trojan Horse
Status: Quarantined


Name: C:\WINNT\system32\svchost32.exe
Virus name: Trojan Horse
Status: Quarantined


Name: C:\WINNT\system32\v32driver.bat
Virus name: Trojan Horse
Status: Quarantined

BTW, does Symantec no longer have a free support discussion forum? I searched their site and ended up here.
Fred

[TonyKlein]

None of them are Windows files, akthough they're craftily named ALMOST exactly like them

Svchost32.exe is no Windows file. The real deal is Svchost.exe

Explorer.exe of course does exist, but the one NAV caught was in a STDE9 directory.

And so on.

Higlight all files in the Quarantine cConsole, and hit "remove".

They will be deleted, and you'll be absolutely fine.

Cheers, Tony

[cyberserious]

Tony,
I thought maybe explore.exe was Windows Explorer, or would that be explorer.exe? I know that Iexplore.exe is MSIE.

So none of my 8 infected files are essential files for sure? Is it possible that the Trojan created them? They might be essential files for some software I have installed, if not Windows.

[Nana]

CyberSerious,

I'm was doing some WinGuides thread readings when I saw your post. I'm sure you've already noticed this, but just in case. . .

Norton found 8 infected files, but only quatantined 7.
Here's the one that isn't quarantined:
Name: C:\WINNT\system32\explorer.exe
Virus name: IRC Trojan
Status: Not quarantined

I don't know where explorer.exe normally resides in W2K. On my WinMe system, it's in C:\Windows. I don't know if this unquarantined file makes a difference to Tony's instructions or to your end result, sorry.

Nana /images/forums/icons/smile.gif

[cyberserious]

Tony,
The system won't let me quarantine or delete that one remaining file C:\WINNT\system32\explorer.exe

I rescanned it, Norton found it again to be infected with a Trojan, and when I attempted to quarantine it, I got this message:

Unable to quarantine the file C:\WINNT\system32\explorer.exe Make sure the file is not write protected or currently in use.

When I launch this file, it turned out to be my Windows Explorer, which may explain why it cannot be moved or deleted. I could simply download a new copy of this file from Microsoft but I don't know where to look.

[TonyKlein]

It's a trojan alright, as it's located in your System32 directory.

The real Explorer.exe is in C:\Windows or Winnt, depending on your operating system, and NOT in any subdirectory thereof.

It's quite a common way for trojans/worms to infect your system.

The fact that you can remove it, means it's "in use" by Windows, and you either need to remove it in Safe mode, and then delete a pertaining startup entry, or the other way around.

Nothing to worry about. We see things like this every day.

I think it would be best to see your Startups in order to see where this one is starting up from.

Please do this:

Go to <a target="_blank" href=http://www.spywareinfo.com/downloads.html>http://www.spywareinfo.com/downloads.html</a> , and download 'Startuplist' (in the "Startup Program Management" section).

Unzip, doubleclick it, and it will generate a text file that will list all running processes, all applications that are loaded automatically when you start Windows, and more.

Go to Edit &gt; select all, copy it and please post the contents here.

Once we've seen that, the rest will be a synch.

Gotta go now, but I'll be back later today (these time zones, ya know... )

Cheers, Tony

[cyberserious]

Tony,
This morning (EST - Florida Time) an hour after startup after the computer was off overnight, Norton Antivirus was able to successfully quarantine the remaining infected file C:\WINNT\system32\explorer.exe automatically. All 8 items are now in my Norton Quarantined folder. If any of these files are critical software files, I guess I might have to reinstall the affected applications later, as needed.
Thanks,
Fred

[TonyKlein]

Fred,

I'm not too sure you heard anything of what I've explained to you.

NONE of these files are Windows files OR belong to applications you have installed, ALL of them belong to the trojan that infected you, and ALL of them can be deleted.

Cheers, Tony

[cyberserious]

Tony,
Yes, I understand now what you meant. Those files were put there by the Trojan, so removing them is fine. I guess then how they work is some viruses or Trojans install their own files that disguise themselves as legitimate Windows files. It looks like I cleaned my system of this virus.

This is the first time I have ever been infected with a trojan, and it came as a complete surprise to me. I assumed NIS and NAV would have prevented this in the first place, but I'm glad Norton did it's job and picked up on it right away.

I do use WinMX and Grokster (clean version) and I do get quite a bit of junk email spam. I have had to run AdAware a few times in the past to remove Gator, Cydoor and Aurete from my system. I wonder if any of these could have been the source of the trojan.

Thanks,
Fred

[TonyKlein]

Hi Fred,

That's exactly what happens, and it often does confuse people unaware of the ways trojans sometimes use to "disguise" themselves.

And no, this trojan and the spyware you had Ad-Aware remove aren't related .

Anyhow, it appears that your antivirus did what it's paid to do, and caught the little b*gger! ;)

Happy surfing!

Cheers, Tony

[cyberserious]

Tony,
I ran the startuplist program and it produced some interesting results. It appears I may have a lot of unnecessary background programs running that are wasting processing & memory, that I could permanently disable from my startup, but the problem is I don't know how. I'm sure it must be a simple thing to do though if I knew how.


StartupList report, 11/28/2002, 1:25:29 PM

StartupList version: 1.35.0
Started from : C:\Documents and Settings\Administrator\My Documents\software\StartupList.EXE
Detected: Windows 2000 SP3 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
=================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\AnyPoint\APSERVER.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\NAVNT\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\PROGRA~1\NAVNT\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\iVasion\WinPoET\WrOS.EXE
C:\WINNT\system32\svchost.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Intel\AnyPoint\iss_srvr.exe
C:\Program Files\NAVNT\navapw32.exe
C:\Program Files\Intel\AnyPoint\DShmap.exe
C:\PROGRA~1\NAVNT\alertsvc.exe
C:\PROGRA~1\Intel\AnyPoint\contctrl.exe
C:\Program Files\Qualcomm\Eudora\Eudora.exe
C:\Documents and Settings\Administrator\My Documents\software\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02. EXE
Internet Sharing Server.lnk = C:\Program Files\Intel\AnyPoint\iss_srvr.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
Norton AntiVirus AutoProtect.lnk = C:\Program Files\NAVNT\navapw32.exe
Sharing and Mapping Software.lnk = C:\Program Files\Intel\AnyPoint\DShmap.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Synchronization Manager = mobsync.exe /logon
NPS Event Checker = C:\PROGRA~1\NAVNT\npscheck.exe
NAV DefAlert = C:\PROGRA~1\NAVNT\defalert.exe
iamapp = C:\Program Files\Norton Internet Security\IAMAPP.EXE
WinampAgent = "C:\Program Files\Winamp\Winampa.exe"
NeroCheck = C:\WINNT\system32\NeroCheck.exe
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
WinPoET = C:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
explore = C:\WINNT\System32\explore.exe

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[&gt;{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = "C:\WINNT\System32\shmgrate.exe" OCInstallUserConfigIE

[&gt;{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = "C:\WINNT\System32\shmgrate.exe" OCInstallUserConfigOE

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{6A5110B5-E14B-4268-A065-EF89FF33C325}] *
StubPath = regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\System32\ie4uinit.exe

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = %SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINNT\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINNT\Explorer\Explorer.exe: not present
C:\WINNT\System\Explorer.exe: not present
C:\WINNT\System32\Explorer.exe: not present
C:\WINNT\Command\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[{018B7EC3-EECA-11D3-8E71-0000E82C6C0D}]
CODEBASE = http://www.greatplugin.com/diallerfiles/005006.exe

[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINNT\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[Symantec AntiVirus scanner]
InProcServer32 = C:\WINNT\Downloaded Program Files\avsniff.dll
CODEBASE = http://security2.norton.com/SSC/SharedContent/vc/bin/AvSniff.cab

[RdxIE Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\RdxIE.dll
CODEBASE = http://207.188.25.43/10a255a00f62ac47e700/netzip/RdxIE.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a1540.g.akamai.net/7/1540/52/20020713/qtinstall.info.apple.com/samantha/us/win/QuickTimeInstaller.exe

[Pixami-PhotoWorks Upload UI Control]
InProcServer32 = C:\WINNT\DOWNLO~1\PIXAMI~2.OCX
CODEBASE = http://services.photoworks.com/pixami/PixamiSFWUploader.cab

[{8522F9B3-38C5-4AA4-AE40-7401F1BBC851}]
CODEBASE = http://66.28.45.60/FreeMP3.exe

[InstallShield International Setup Player]
InProcServer32 = c:\winnt\DOWNLO~1\isetup.dll
CODEBASE = http://www.installengine.com/engine/isetup.cab

[Update Class]
InProcServer32 = C:\WINNT\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37587.5719212963

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINNT\Downloaded Program Files\rufsi.dll
CODEBASE = http://security2.norton.com/SSC/SharedContent/sc/bin/cabsa.cab

[Crystal Report Smart Viewer 7]
InProcServer32 = C:\WINNT\Downloaded Program Files\CRViewer.dll
CODEBASE = http://crystalweb1.clerk.co.brevard.fl.us/viewer/activeXViewer/activexviewer.cab

[CV3 Class]
InProcServer32 = C:\WINNT\System32\wuv3is.dll
CODEBASE = http://windowsupdate.microsoft.com/R911/V31Controls/x86/nt5/en/actsetup.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINNT\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

--------------------------------------------------
End of report, 8,405 bytes
Report generated in 0.380 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

[TonyKlein]

Thanks for that list.

And there's your trojan startup:

explore = C:\WINNT\System32\explore.exe

In Windows 98, ME, and XP there is the Msconfig uitility which makes viewing and editing the startups a synch.

Windows 95 and 2000 unfortunately don't have it, but you can download and install it:

Pacman's List of Startup Applications (http://www2.whidbey.net/djdenham/Msconfig.htm>http://www2.whidbey.net/djdenham/Msconfig.htm</a>

Once) to determine what should stay and what can go.

Be sure to start by unchecking this Explore.exe

In case of doubt, don't hesitate to ask.

After unchecking the superfluous, click OK, close Msconfig, and reboot.

Now you'll be able to have Norton delete it.


Cheers, Tony

[mysterywolf]

did you spot this ? and do you expect greatplugin (whatever that is) to be dialling out for you with what looks like a connection/ phone no. all of its own?


from your listing....

[{018B7EC3-EECA-11D3-8E71-0000E82C6C0D}]
CODEBASE = http://www.greatplugin.com/diallerfiles/005006.exe


you might be aware but i thought i should point it out.

[mysterywolf]

ps in my opinion if norton firewall was useless it would be an improvemnent. I believe it is worse than that! much worse. and the tech support site is dangerous I find.

just my personal opinion. but i paid good money for their products when i could have shared my computer to the whole world and been no worse off data wise but still had the cash!

[cyberserious]

Mysterywolf,
I looked into this link http://www.greatplugin.com and it turned out to be a URL to a [censored] site!

I'm not into [censored], but I am a member of a couple different Adult personals sites, such as adultfriendfinder.com. It seems these [censored] sites really pull out all the Stops to force people onto their sites. There ought to be laws against some of their practices.

Thanks for the heads-up on this.
Fred

[cyberserious]

I agree that Symantec's support really sucks, actually it's no better than Micro$oft's. They used to offer free email support, but it appears they don't anymore. Actually Micro$oft used to have great Community support newsgroups, where I used to get great prompt free support, but that really went downhill 2 years ago. I can't even get a reply there anymore.

When it comes to Windows problems, I have gotten more great help here than anywhere else.
Fred

[TonyKlein]

Well spotted! (the ActiveX object). It needs to go as well.

About Norton, I used to be a fan myself an run NAV, NIS, and NSW.

BTW, I don't think the Norton Firewall/NIS is as bad as that.
Providing it's set up properly it's quite decent, in fact.

But it's an incredibly bloated application, and NIS 2002 (which I abandoned some time ago), had a tendency to 'unstealth' spontaneously, and to forget how to block ads and banners on a regular basis.

When NAV's e-mail scan finally forgot how to scan my e-mail, I decided it was time to move on...

[cyberserious]

Tony,
I download both your recommend programs and they really came in handy. It's nice to have Msconfig now. Out of all the running processes, I wonder which other items are ok to disable in addition to the explore.exe. I could free up a lot of wasted memory. I do have Adobe Acrobat Distiller but I don't think I need it running in the background. Also, I don't know why WinAmp, and Winzip has to load in startup either. It appears I might have startup links here to the trojan files I deleted too.

I don't know why Windows 2000 doesn't come with Msconfig.

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\AnyPoint\APSERVER.EXE
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\NAVNT\navapsvc.exe
C:\Program Files\Norton Internet Security\NISUM.EXE
C:\PROGRA~1\NAVNT\npssvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\iVasion\WinPoET\WrOS.EXE
C:\WINNT\system32\svchost.exe
C:\Program Files\Norton Internet Security\NISSERV.EXE
C:\Program Files\Norton Internet Security\IAMAPP.EXE
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\iVasion\WinPoET\WinPPPoverEthernet.exe
C:\Program Files\Norton Internet Security\ATRACK.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Intel\AnyPoint\iss_srvr.exe
C:\Program Files\NAVNT\navapw32.exe
C:\Program Files\Intel\AnyPoint\DShmap.exe
C:\PROGRA~1\NAVNT\alertsvc.exe
C:\PROGRA~1\Intel\AnyPoint\contctrl.exe
C:\Program Files\Qualcomm\Eudora\Eudora.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\My Documents\software\StartupList.exe

[TonyKlein]

Don't worry about the list of Running Processes that you posted.

Many of them are required by Windows, and should be left alone.

Stick to the Startup programs in Msconfig/Startup.

Winamp and WinZip don't need to load, as ought to be clear if you checked the link to Pacman's List that I posted.

Cheers, Tony

[mayton82]

Hey I dont know if any one has realized this but the norton firewall is nothing it has many holes in it. I would suggest upgrading to zone alarm and change your virus scanner to pc-cillin (by trendmicro) if norton didnt catch the virus. Try there free virus scanner called house call at http://housecall.trendmicro.com/ Good luck getting rid of the virus. If you know of someone with win 2k then you might want to copy the location of those files and if needed replace the files on your computer. Just a thought. Mayton82

[TonyKlein]

Just another thought:

There are many good antiviruses and firewalls available, and there's not really any one that can be considered superior to all others.

BTW, Norton Antivirus is considered to be superior to PC Cillin in Security circles, and there's not really anything wrong at all with Norton Firewall, provided it's properly configured.

And before being accused of bias, I'm not running any of those mentioned myself! /images/forums/icons/laugh.gif

[adg]

http://www.pcworld.com/downloads/file_description/0,fid,8171,00.asp

Allan
<a target="_blank" href=http://www.tweakdatabase.com/idealbb>tweakxp.com</a>

[Baldrick2]

I know this is an old link but as I was looking through trying to find some info on some thing which keeps trying to connect (and is stopped by ZAP) I saw this!

[{8522F9B3-38C5-4AA4-AE40-7401F1BBC851}]
CODEBASE = http://66.28.45.60/FreeMP3.exe

Also spyware or dialer of some desciption !(I think Cyberserious downlaods and installs too much from C2Media!!).

Just thought I would let you know incase someone has it, as it didn't get mentioned here....

Jase

Don't listen to me 'cos I'm stupid!!