Cable Company Threatening Disconnection!

Bubba Bob · January 31, 2006

UPDATED:!!

A few minutes after I posted this the sorry SOBS disconnected me! I called them back and they want me to take my computers to a shop (out of the damn question $$$) My "network usage" is 0% ALL THE TIME!

I have ONE hour timer on my modem. HELP

Hey Guys,

Last week end my cable modem was dissabled by my cable company (Cebridge) because they claim I have some sort of Malware "Spamming the network".

After running scans with Avast and Norton, both my computer came up clean. I have NO visible signs of malware!

Anyway, I came home today to find a message of my answering machine with them threatening to disconnect me If i dont clean my computers!

Computer ONE (Note: I have Avast installed and running usually, but due to a conflict form zone alarm I shut it down today)

Also, should I be worried by "Win Logon"?

ALso, again :rolleyes: I remember after I ran the scans I ran HJT from a temp location, If anythig needs fixin ill move HJT to the correct place.

Logfile of HijackThis v1.99.1

Scan saved at 4:29:51 PM, on 1/31/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

k:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\svchost.exe

K:\Program Files\Logitech\iTouch\iTouch.exe

K:\All Programs\Mozilla\firefox.exe

C:\WINDOWS\system32\taskmgr.exe

C:\DOCUME~1\Admin\LOCALS~1\Temp\Rar$EX00.828\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - K:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O4 - HKLM\..\Run: [zBrowser Launcher] k:\Program Files\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [avast!] k:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Zone Labs Client] k:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKCU\..\Run: [skype] "K:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - Startup: Trillian.lnk = K:\Program Files\Trillian Pro\trillian.exe

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {55F2FE00-C6E1-11D4-84BC-009027889212} - http://www.seagate.com/support/disc/asp/dw...in/npdscwiz.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1136216580406

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1136216572296

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - k:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: avast! Antivirus - Unknown owner - k:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Web Scanner - Unknown owner - k:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Computer TWO

Logfile of HijackThis v1.99.1

Scan saved at 4:33:01 PM, on 1/31/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\igfxtray.exe

C:\WINDOWS\System32\hkcmd.exe

E:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Messenger\msmsgs.exe

e:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

e:\Program Files\Alwil Software\Avast4\ashServ.exe

e:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\DOCUME~1\Lori\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] E:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [MPFTray] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

O4 - HKLM\..\Run: [avast!] e:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...83/mcinsctl.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,20/mcgdmgr.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - e:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - e:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Web Scanner - Unknown owner - e:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

Edited January 31, 2006 by Bubba Bob

Besttechie · January 31, 2006

Hey Bubba Bob,

Both PC's look clean, so that's good. However, to make sure you have nothing hidding or anything, we're going to do a few things.

First off, on Computer One - close all windows except HJT and have it fix the following:

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

Then on Computer Two - close all windows except HJT and have it fix the following:

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

Please go HERE to run Panda's ActiveScan

Once you are on the Panda site click the Scan your PC button
A new window will open...click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Click the big Scan Now button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

Also for your next post:

Please download Rootkit Revealer (link is at the very bottom of the page)

Unzip it to your desktop.
Open the rootkitrevealer folder and double-click rootkitrevealer.exe
Click the Scan button (bottom right)
It may take a while to scan (don't do anything while it's running)
When it's done, go up to File > Save. Choose to save it to your desktop.
Open rootkitrevealer.txt on your desktop and copy the entire contents and paste them here

Good luck! :thumbsup:

B

Bubba Bob · January 31, 2006

Thanks B

I dont have time for the Panda scan (In half an hour they will disconnect me again), however, I ran it last week after the first time i was idsconnected and it came up clean.

Anyway, computer #2 came up clean with Root Revealer.

Computer 1 has several hundered entries, but gives me an error every time I try to save it.

ANy suggestions?

Edited January 31, 2006 by Bubba Bob

Besttechie · January 31, 2006

What's the error?

Try saving it in a different location...

B

Bubba Bob · January 31, 2006

"Rootkit detection utility has encountered a problem and needs to close. We are sorry for the inconvenience."

Ive tried several places.

Besttechie · January 31, 2006

Ok, let's try something else...

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download AproposFix from here:

http://swandog46.geekstogo.com/aproposfix.exe

Save it to your desktop but do NOT run it yet.

Then please reboot your computer in Safe Mode by doing the following:

1) Restart your computer

2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.

3) Instead of Windows loading as normal, a menu should appear

4) Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder.

Also, Download and run F-Secure Blacklight: http://www.f-secure.com/blacklight/try.shtml

Run the program, accept statement>next>click> scan>next. If any items are detected have blacklite rename them except for "wbemtest.exe". Do not rename "wbemtest.exe" its a windows file. If there are any other files you THINK may be valid don't rename them. Help is available HERE

The tool will ask if you want to reboot (restart) choose yes.

please post

the contents of report.txt (it should open; If it does not open or you close it..find a copy in c:\fixwareout folder.)
a new HijackThis log
log from blacklight; log will be named fsbl-<date/time>.log eg. fsbl-20051213134642.log.

Good luck! :thumbsup:

B

jwbirdsong · February 1, 2006

You've got a bunch of poeple pulling for you in this race Bubba_Bob

...good luck

Edited February 1, 2006 by jwbirdsong

Bubba Bob · February 1, 2006

Thanks B.

While Im doing all that, Ive got a question.

I called teh cable comp again, and this time they told me to run AVG. (poor guy never heard of Avast) So, ive run AVG and one computer came up with "Java/OPenstream".

Ya know anything about that?

Besttechie · February 1, 2006

Does it give like a filename and a location of the file? If so, can you post that information? Thanks.

B

Bubba Bob · February 1, 2006

THe file is in the Java folder in my "Aplication Data".

Besttechie · February 1, 2006

Sounds like the Java ByteVerify virus, it's not at all that harmful and easy to remove. Also, for more info on it ... http://www3.ca.com/securityadvisor/virusin...s.aspx?id=36725 <-- looks like they also have some kind of removal procedure/tool - I'd use their removal procedure/tool to make sure AVG is not pulling a false positive.

B

Bubba Bob · February 1, 2006

Ok, Ill do that. THanks B.

EDIT: Oops, forgot to post the other results. Here is the Blbeta results:

01/31/06 18:29:37 [info]: BlackLight Engine 1.0.30 initialized

01/31/06 18:29:37 [info]: OS: 5.1 build 2600 (Service Pack 2)

01/31/06 18:29:37 [Note]: 7019 4

01/31/06 18:29:37 [Note]: 7005 0

01/31/06 18:29:40 [Note]: 7006 0

01/31/06 18:29:40 [Note]: 7011 1884

01/31/06 18:29:41 [Note]: FSRAW library version 1.7.1014

01/31/06 18:29:56 [info]: Hidden file: C:\WINDOWS\system32\drivers\i386p.sys

01/31/06 18:29:56 [Note]: 7002 0

01/31/06 18:29:56 [Note]: 7003 1

01/31/06 18:29:56 [Note]: 10002 1

01/31/06 18:29:59 [info]: Hidden file: C:\WINDOWS\system32\msctl32.dll

01/31/06 18:29:59 [Note]: 10002 1

01/31/06 18:30:30 [Note]: 7007 0

_______________________________________________________________________

Heres the Apropsfix results.

Log of AproposFix v1.1

************

Running from directory:

C:\Documents and Settings\Admin\Desktop\aproposfix

************

Registry entries found:

************

No service found!

Removing hidden folder:

No folder found!

Deleting files:

Backing up files:

Done!

Removing registry entries:

REGEDIT4

Done!

Finished!

_________________________________________________________

New HJT Log.

Logfile of HijackThis v1.99.1

Scan saved at 6:21:15 PM, on 1/31/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

K:\Program Files\Logitech\iTouch\iTouch.exe

k:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

K:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

K:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

K:\Program Files\Skype\Phone\Skype.exe

k:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\HPZipm12.exe

K:\Program Files\PRTG Traffic Grapher\PRTG Traffic Grapher.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

K:\All Programs\Mozilla\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\HijackThis.exe