system
June 22, 2009, 3:20am
1
cbl.abuseat.org lists our IP as the following…
"ATTENTION: At the time of detection, this IP was infected with, or NATting for a computer infected with a high volume spam sending trojan - it is participating or facilitating a botnet sending spam or spreading virus/spam trojans.
ATTENTION: If you simply repeatedly remove this IP address from the CBL without correcting the problem, the CBL WILL eventually stop letting you delist it and you will have to contact us directly.
This is the donbot spamBOT"
This computer is an IBM Windows XP Professional with SP3.
I ran a scan with avast, SUPERAntiSpyware, Malwarebytes’ Anti-Malware, and none of them found anything.
HijackThis log to follow.
system
June 22, 2009, 3:21am
2
Here’s the HijackThis log…
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
Part two is next…
system
June 22, 2009, 3:21am
3
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1244618445312 http://www.trendmicro.com/spyware-scan/as4web.cab
–
system
June 22, 2009, 5:48am
4
Your HJT log is clean.
What is your ISP?
You’ll need to alert your ISP that the Donbot Spambot is infecting your IP.
system
June 22, 2009, 5:56am
5
Thanks!
It’s VMMicro Net.vmmicro.net
Would I send them an email?
And just a minute ago while I was running a full scan, avast! went off saying Win32:Oficla-FWP [Trj] was found in C:\Documents and Settings\Winuser\My Documents\My Virtual Machines\New Virtual Machine\New Virtual Machine Hard Disk.vhd
Tarq57
June 22, 2009, 6:02am
6
Could it be that a range of IP’s, including yours, is being blocked?
Regarding the file found, “Win32:Oficla-FWP”, can you locate it and upload it to http://www.virustotal.com/ for an online scan, please.
system
June 22, 2009, 6:07am
7
I wouldn’t doubt it one bit.
I’ll go do that right now, and yes, I was using MS Virtual PC
system
June 22, 2009, 6:15am
8
You’ll need to install and run avast! inside your virtual PC.
system
June 22, 2009, 6:22am
9
Whoops…
system
June 22, 2009, 6:28am
10
And avast! just detected “C:\Documents and Settings\Winuser\My Documents\My Virtual Machines\New Virtual Machine 1\New Virtual Machine 1 Hard Disk.vhd” as being infected with “Win32:Agent-AEKI [Trj]”
EDIT:
I don’t care if I have to delete these Virtual Machines, I don’t use them anymore.
system
June 22, 2009, 7:15am
11
Aha! I think I found the spambot,
Malwarebytes’ Anti-Malware 1.38
6/22/2009 3:11:14 AM
Scan type: Full Scan (A:|C:|E:|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Tarq57
June 22, 2009, 10:13am
12
Could be for real, but somewhat likely to be a FP. Some info about the file (many google hits) here , here , and here , for a few research possibilities.
One very good way to find out what is accessing the internet is to have a two way firewall. Is one installed on your PC, or are you using the Windows Firewall?
system
June 22, 2009, 10:51am
13
http://www.prevx.com/filenames/X3408823122509516126-X1/HMEO%2FDMLOAD.SY_.html
Your files infected look like that. So its a part of Microsoft maybe its a false positive. But a quite strange that Avast! Detect some trojan… Maybe dmload.sys is infected ?
system
June 22, 2009, 2:18pm
14
Curse my rushed mood last night, I deleted it, will I have to redownload it somehow? ???
system
June 22, 2009, 7:12pm
15
How did you delete it ? You seem to have something going on, maybe its not a FP
You also have a suspicious HJT entry O23 - Service: PLSRemote Service (PLSRemoteSvc) - Unknown owner - C:\WINDOWS\SYSTEM32\PLSRemote.exe
Go to VT and upload PLSRemote.exe http://www.virustotal.com/
system
June 22, 2009, 7:21pm
16
You can restore it with Recuva . (Disable avast! before running this program)
Hi Winter_Nights,
PLSRemote.exe is a remote administration program that allows you to remotely monitor and control your computer. This program may also be installed by various trojan for malicious purposes. It is recommended that you remove it if you don’t want to remotely control your computer.
Next, click Start > Run > services.msc. Search for a service called PLSRemote Service (PLSRemoteSvc). When found, right click on it and select Properties. Then change the startup type to Disabled.
Open HijackThis, click Do a system scan only and place a check next to the following lines if present:
O23 - Service: PLSRemote Service (PLSRemoteSvc) - Unknown owner -
polonus
system
June 22, 2009, 10:50pm
18
Thanks guys, I really appreciate this. ;D
Here’s the VirusTotal results for PLSRemote.exe: http://www.virustotal.com/analisis/05880d0edad3e4dceb5161f9277116de6c2e68194f97b03029080364593d2e51-1245710769
I’m setting up Recuva right now, and once I get the file back I will send it to VirusTotal.
And I deleted the file with Malwarebytes’, avast! didn’t detect it.
DavidR
June 22, 2009, 11:34pm
19
When you delete (correct term in MBAM is Remove) a file in MBAM it also places a copy in the Quarantine area, check the Quarantine tab in the MBAM settings.
This may save you some drama.
system
June 22, 2009, 11:36pm
20
Thanks, but I checked and it wasn’t there, next time I need to think before I perform an action.