My PC has somehow picked up a virus, which has been sending out tonnes of spam for some time
I am so careful, virus-scanning all downloads, keeping Windows up-to-date etc., I’m the first person friends and family turn to when they get their PCs in a mess, and in nearly a decade online I’ve never previously had so much as a spyware infection, let alone a spambot!
This has really shocked me and I have no idea how it got onto my PC, still less how to track it down and remove it. (I only know it’s here because the Avast On-Access Scanner window was showing a new outgoing message every few seconds (under ‘Last scanned’) with awful Subjects like “Important security information for your bank account” and so forth.)
Since discovering it I have been blocking traffic carefully so I’m no longer spamming, and have tried System Restore to one and two months ago but it didn’t work, so then I disabled System Restore in case the virus was hiding in the restore files.
A Thorough Scan with Avast didn’t find anything, and nor has Kaspersky’s Online Scanner. Windows Defender also failed to find anything, as did Spybot - Search and Destroy.
Finally, through a complicated chain of investigation I have determined the following:
The process making the connections to send the spam is svchost.exe.
It tries to connect from ports in the 3000 range on my PC to HTTP ports on a range of remote servers such as stormpay.com, leapcash.com and missoula.servershost.net. I guess these are compromised web servers or something.
If I disable the “DCOM Server Process Launcher” (path: “C:\WINDOWS\system32\svchost -k DcomLaunch”) in the Windows Services list, on the next reboot the connection attempts are no longer made. This is an important system service, though, so I can’t just leave this disabled to work around the problem!
Can anyone help me identify what’s behind this problem, why Avast (and other scanners) are not picking up on it, and most importantly what I can do to stop this happening and thoroughly clean my computer of this malware?
Maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
There didn’t look anything amiss in it, and no-one replied, so I guess it didn’t reveal anything, but you’re welcome to have a look and see if you can see anything of course!
I’ve just tried F-Secure Blacklight and it failed to find anything wrong at all.
I’m running ComboFix but it has been going for much longer than the ‘10 minutes’ it says it should take and it doesn’t show any progress bar or anything so it’s hard to know when it will finish, if ever! Hopefully it being so slow is a sign it is finding something!
Do you know where it will save a log of its findings or anything? I saved it to and ran it from my desktop - will the log appear there?
Hmm, does anyone know how long should I leave it running without it saying anything before I decide it’s hung or something? ??? It’s been going for a good half-hour or more now.
That file is digitally signed by Microsoft and dated 2004 so unfortunately I don’t think it’s at fault, but I can’t find anything out about it on the internet - the only Google result for rasrad32.dll is my Hijack This forum post!
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
OK, I’ve tried closing ComboFix and starting it again - I assume that’s what you were suggesting I should do. It’s running at the moment so I’m going to leave it going and come back when it’s finished. In the meantime here’s my Hijack This log again - I just ran it again to get an up-to-date one.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:52, on 2007-08-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Can I hitch onto this thread and try out a new programe. It doesn’t make any changes to the system it is purely analysis only
Please download http://www.runscanner.net/download.aspx and install
When the first page comes up select Beginner Mode
On the next page select Save a binary .Run file (optional)
Then click Start full computer scan at the bottom
At this time Runscanner.exe may request access to the Internet please allow it to do so
It will then run for 2 or 3 minutes
On completion it will ask for a location to save the file and a name
It will do this for both the .run file and the log
Call the file test and save to your desktop
You will see the .run file on your desktop Please zip that file by right clicking and selecting send to Zip file
Then upload that as an attachment to your next post.
Along with the Log file produced
I can’t actually see any Attachment option on this forum - am I overlooking a button somewhere?
I’ll paste the log in in the meantime:
Runscanner logfile http://www.runscanner.net
000 General info
Computer name : BITOCLASS
Type of scan : Full scan
RunScanner Version : 1.0.1.0
Creation time : 2007-08-19 15:21:27
User rights : Administrator
OS : Microsoft Windows XP
OS Build : 2600
OS SP : Service Pack 2
User Language : English (United Kingdom)
IE version : 7.0.5730.11
Windows folder : C:\WINDOWS
Hosts file location : %SystemRoot%\System32\drivers\etc
Hosts <> 127.0.0.1 : 3
I did a google search on that file and the only hit that it returns is your topic in spywareinfo and that because it is in your HJT log, so if it were an MS signed file I would have thought there would be some hits on google. What does it say in the file properties about what it is/does ?
It may be worthwhile scanning it:
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently 30 different scanners.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive.
Wow, those sites are brilliant - I will use those whenever I have any suspicions in future, what a great idea they are - thanks!
I’m afraid that both those sites found nothing wrong with rasrad32.dll so it looks like it’s probably OK.
In my Googling I found rasrad.dll came up a bit so maybe this is just a 32-bit update which no-one uses any more or something. Not that I even understood exactly what it was anyway!
45 minutes and counting with CombiFix now, and still no sign of it using any CPU or seeming to do anything
Nothing shows up as definitely bad and I think I can account for the blue things so I’m not sure if this is going to help But if you can see anything for me to look at further please let me know!
I can find no info on this at all including the Microsoft dll list which in itself is suspicious. If combofix is not running then you could try winpfind
This is a deep analaysis tool
Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
[*]Close ALL OTHER PROGRAMS.
[*]Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
[*]Under Additional Scans click the checkboxes in front of the following items to select them:
[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in. If, after posting, the last line is not < End of Report > then the log is too big to fit into a single post and you will need to split it into multiple posts.
Ah OK - you’re probably not missing much there then because I haven’t yet re-enabled that Service so the virus isn’t actually doing anything at the moment, so I don’t think its process is running.
I have to go out for a few hours now but I am going to leave this WinPFind3U running while I’m out (with everything else shut), since ComboFix still hadn’t done anything over an hour after I started it.
I’ll post my log when I get home later. Thanks very much for your help!
(P.S. As you will see, in this text file I have censored three of the items in my Hosts file, as they reveal personal information I’d rather keep out of a forum - there’s nothing suspicious about them, I promise!)
Last night I shut down just about every little running thing (including system tray stuff) on my PC and tried running ComboFix again. I didn’t so much as hover over the window once it was running, let alone clicking it. This morning it has once again not finished running and does not appear to be doing anything.
There is a folder in my C drive that it has created called ComboFix. It contains 90 objects, of which 18 have modified dates/times of last night when I started running it, and one has a modified time of two minutes later. That last file is called WowErr.cf and contains the following text:
Completed Stage_7
Can anyone tell me why this ComboFix process never finishes, or what Stage 7 is that could make it stall, or anything else helpful? Would it be useful for me to post the contents of any of these other files that were modified when I started running it?
Go to Start then click Run. 2) Type msconfig. 3) When System Configuration Utility window appear click on Services tab. 4) Check “Hide All Microsoft Services” box. 5) Kill all non-Microsoft services process then run ComboFix or Runscanner.
I’m a bit confused - when I run ComboFix.exe I get a Command Prompt window called AutoScan, which has a blue background. It says “Please wait” for a few seconds, then the following:
Scanning for infected files . . .
This typically doesn’t take more than 10 minutes
Scan times for badly infected machines may easily double
ComboFix has changed your clock settings.
Do not change it back. It shall be restored later
Then nothing else happens.
At what point should I be typing 1? I’m not prompted to type 1. Am I running the wrong thing? Should I be running something out of the ComboFix folder rather than the ComboFix.exe file that I downloaded?
Sorry if I appear stupid but I’m a bit confused by this software as it never gets past the above text!
