 |
Spyware Warrior
Help with Spyware, Hijacking & Other Internet Nuisances
|
| View previous topic :: View next topic |
| Author |
Message |
Capt. YeDi
Junior Member
Joined: 20 Jul 2004
Last Visit: 26 Nov 2004
Posts: 14
Location: Michigan
|
 Posted: Sun Sep 19, 2004 1:42 pm Post subject: Another exe file ! |
 |
|
Hey guys!
My CPU levels are up to MAX. I checked my Task Manager and this program dumprep.txt is raising my CPU levels up to 99% !
I made it a txt file and here's the script:
MZ @ !L!This program cannot be run in DOS mode.
$ +ӯyxӯyxӯyx)9xѯyx exدyxӯxxyx)`xԯyxD<xүyx dxѯyx)DxүyxRichӯyx PE L m= 0 P " P @ P X .text V `.data t 0 @ .rsrc @ @ @m=( (m=3 (m=@ (m=M msvcrt.dll ADVAPI32.dll KERNEL32.dll NTDLL.DLL MwwGw`www awXw=w9wwwwhwwwwwLwwkwwww#.wwLww2w`w w >26hJyz {iz{`=>D?=> m= t ReportEREventDW ReportFaultFromQueue S O F T W A R E \ M i c r o s o f t \ P C H e a l t h \ E r r o r R e p o r t i n g \ K e r n e l F a u l t s K e r n e l F a u l t C h e c k G l o b a l \ 0 C A D F D 6 7 A F 6 2 4 9 6 d B 3 4 2 6 4 F 0 0 0 F 5 6 2 4 A S O F T W A R E \ M i c r o s o f t \ P C H e a l t h \ E r r o r R e p o r t i n g \ U s e r F a u l t s U s e r F a u l t C h e c k G l o b a l \ 4 F C C 0 D E F E 2 2 C 4 f 1 3 8 F B 9 D 5 A F 2 5 F D 9 3 9 8 S O F T W A R E \ M i c r o s o f t \ P C H e a l t h \ E r r o r R e p o r t i n g \ S h u t d o w n E v e n t s S h u t d o w n E v e n t C h e c k G l o b a l \ 2 3 8 F A D 3 1 0 9 D 3 4 7 3 a B 4 7 6 4 B 2 0 B 3 7 3 1 8 4 0 S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n . h d m p . m d m p D o R e p o r t S h o w U I S o f t w a r e \ M i c r o s o f t \ P C H e a l t h \ E r r o r R e p o r t i n g ReportHang CreateMinidumpW 0 - K G 0 - U G 0 - S G \ f a u l t r e p . d l l ! ! NB10 m= dumprep.pdb 3@ jh ^ ux u Yue 6 e}M Ëe3MutEVuW W \Ghh S uf!Vh\ W Wx 3e UQQV39uut9u u
jW| SW= EVVVVEEPu Vu ;t;u ;t!u u׃}uu P| 0EPh? Vh h uE@40 u_[9u^t u D$uX L$ t$ɃQP\ D$uX t$j PT j\h
3uuu܉u؉uԉuЉủuȉuĉuuuuE } 9ut3W ;o @E 0 u90 t t E t E9uu 9u3 EPh Vh h ; j[]EPEPVVh u= ;tu ]EPEPVVht uu u; 3G9}t9ut }t}9}t9ut}]0 Vh @ EɁW M\ } u}܉u}h PD E;t = EPh? V 0 h ӉE;u^VVEPEPEPVVVVVVu E;u:9ut59ut0EWVEPE;t9uu%9uu u uPuuV M[ E90 tWVuzE;tӉEЍEEEȉE̋EĉEuuЍEPVEPuVu E;t= u= uDu uEPh? Vh h ӉE;`E0 u I}90 t!}uuuuUjW| u
VuuUEH Wt95H0 t9ut9u%uu E;tt 90 95H0 u33@ËeM39utuL uP 9ut u 9ut Vu)9ut Vu& Ul$
MPtVEX3h E@ EDETELEHE\l h h j^9ux }x S]|Ws YE<3 t}x; CEl Eh E` Ed f9- fQd t DtH 9}`H }H > }\ 4 Ed3FE`EhEl t4= E\ ׃EdFE`EhEl4׃EdFE`EhElxEHEd f@f=T YY f=t f=S f=s f=M t
f=m El;Ex u<j h d ETw EdFE`4EhEl%W Y> jj j ELP` PWuT< 3WWWjuL ; EXT Eh;Ex EdFE`4EhEl׃EdFE`EhEl4YY|Dž El;Ex EdFE`Eh4ElYDž e tgt
tHHW }\ M fAf=G E\ t
f=g % fKt$fkt fUtfut EP jEP aeP [9}l }\ EdFE`4EhElE\ ;}lYE8~!EdF4E`EhElj h ED}xEdFE`EhEl;}\ h P$ hd P YYj j P( #ǾW ( E\H H H uPS$ h Pj , f@f=K t f=k tf=U t
f=u thT hD h4 P YYjY3}E(PEP3PPPPPPQPED 0 u,5P u(oEH#xWh$ St #x?uXuHu<%h St #xuDj u8u<ЉE@tS4 }T t uTP _[39uLt uLP 9uDt uDP 9uX^tt9EXt uX8 E@pj(h n 3Wp f8MZu H<ȁ9PE uA= t = t}' v39 ytv39 E}j Y
h0
l0
d0
`0 p0 x 9=P0 u h" YM h h 8 \0 EEP5X0 EPEPEP Eh h E܋
uuuk0u9}uV -E MPQ YYËeuȃ} uV M: h" d Pd% D$l$l$+SVWEePEEEËMd
Y_^[Q= să PQL$ - = s+ȋą@P% % h h
YY3% % # $ ,# % H# H' b% v% P% @% 0% "% & & & & v& d& V& D& & $& & % % % % % % & & ' $' 4' 2& % % % % $ $ $ $ $ $ $ t$ l$ b$ T$ L$ B$ :$ 0$ &$ $ $ $ -wcsncat 'wcscmp /wcsncpy ,wcslen %wcscat s_wtol _c_exit _exit N _XcptFilter _cexit exit __winitenv __wgetmainargs :_initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type msvcrt.dll _except_handler3 _controlfp RegCloseKey RegOpenKeyExW RegEnumValueW RegDeleteValueW RegQueryInfoKeyW RegQueryValueExW ADVAPI32.dll } DeleteFileW SetLastError HeapAlloc GetProcessHeap HeapFree / CloseHandle ReleaseMutex aGetLastError sWaitForSingleObject lOpenMutexW GetProcAddress SUnmapViewOfFile FreeLibrary c CreateProcessW mGetModuleFileNameW <LoadLibraryExW GetSystemDirectoryW eOpenEventW PMapViewOfFile DuplicateHandle 4GetCurrentProcess mOpenProcess +SetUnhandledExceptionFilter SetErrorMode nGetModuleHandleA KERNEL32.dll H 0 , 0 H `@ 4 V S _ V E R S I O N _ I N F O R(
R(
? S t r i n g F i l e I n f o 0 4 0 9 0 4 B 0 L C o m p a n y N a m e M i c r o s o f t C o r p o r a t i o n , F i l e D e s c r i p t i o n W i n d o w s E r r o r R e p o r t i n g D u m p R e p o r t i n g T o o l d " F i l e V e r s i o n 5 . 1 . 2 6 0 0 . 1 1 0 6 ( x p s p 1 . 0 2 0 8 2 8 - 1 9 2 0 ) 8 I n t e r n a l N a m e D U M P R E P . E X E . L e g a l C o p y r i g h t M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . @ O r i g i n a l F i l e n a m e D U M P R E P . E X E j % P r o d u c t N a m e M i c r o s o f t W i n d o w s O p e r a t i n g S y s t e m @ P r o d u c t V e r s i o n 5 . 1 . 2 6 0 0 . 1 1 0 6 D V a r F i l e I n f o $ T r a n s l a t i o n
It sounds like a baddy to me.
I did an Hijack This! scan:
Logfile of HijackThis v1.97.7
Scan saved at 5:39:00 PM, on 9/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\PROGRA~1\Grisoft\AVGTCP~1\avgtcpsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\BullGuard\BullGuard Communicator\xcommsvr.exe
C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\bdss.exe
C:\Program Files\BullGuard\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Dilberttest3\Screen Saver\FWLink.exe
C:\WINDOWS\system32\dumprep.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Alex\My Documents\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.deltawarriors.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://rd.yahoo.com/customize/sbcydsl/defaults/su/*http://www.yahoo.com
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [tYWKD] C:\docume~1\alex\locals~1\temp\tYWKD.exe
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Dilberttest3 web link] "C:\Program Files\Dilberttest3\Screen Saver\FWLink.exe"
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [ClockSync] "C:\Program Files\ClockSync\Sync.exe" /q
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Hawo] C:\Documents and Settings\Alex\Application Data\loum.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Vijez] C:\WINDOWS\System32\rvyiqe.exe
O4 - HKCU\..\Run: [Desktop Weather 3] G:\PROGRA~1\THEWEA~1\THEWEA~1.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Dictionary - http://www.ezreference.com/_/ie-com-p3.htm
O8 - Extra context menu item: &Encyclopedia - http://www.ezreference.com/_/ie-com-e-p3.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: ICQ 4.0 (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Yahoo! Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=5d15351b96687ac90b54afcc18827f4e0c2e1af8d6b2139a6d78fa1ba96d9d848d38af6822d00ec9f99362db9dd3db34d4b55fa34a893c9a5b532161d5cd35:316ec1697e4766858480d3e80deecaa8
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095440083312
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://download.yahoo.com/dl/installs/ymail/ymmapi.dll
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/Sasser/20/SassCln.CAB
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.roings.com/cabs/budicon.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} - http://download.overpro.com/WildApp.cab
As you can see; it's in there.
The script sounds like a virus, it was doing some error reports on queue, and some other stuff. 
capt. yeDi. |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
smartBlue Style © 2002 Smartor
Powered by phpBB © 2001, 2002 phpBB Group
|
