[RESOLVED]- Rjump issue

system · 2007-06-13T14:36:33.000Z

I think this one: O4 - HKLM..\Run: [RavAV] C:\WINDOWS\RavMonE.exe is connected to Rjump

These need further investigation:
C:\Program Files\Gemplus\GemSafe Libraries User\BIN\GCardSrvNT.exe
C:\Program Files\Gemplus\GAC\GACService.exe
C:\Program Files\Gemplus\GemSafe Libraries User\BIN\GCardSrv.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM..\Run: [GACService] C:\Program Files\Gemplus\GAC\GACService.exe
DPF: {0470E62C-C97E-4317-81E5-0774D8CBF7B7} (EndPointScan Class) - http://www.endpointscan.com/EndPointScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xqehkl.nhs.uk
O17 - HKLM\Software..\Telephony: DomainName = xqehkl.nhs.uk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xqehkl.nhs.uk
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: GemSAFE Card Server - Gemplus - C:\Program Files\Gemplus\GemSafe Libraries User\BIN\GCardSrvNT.exe

DavidR · 2007-06-13T15:02:59.000Z

I suspect that QEHNick is aware of this 04 entry as he has intimate knowledge of the RavMonE.exe file (see Reply #17).

QEHNick’s problem is that although the file is detected by avast signatures on an on-demand scan, it isn’t detected with the on-access scan and avast allows it to execute.

The 022 entries are fine, they appear on the latest Trend Micro HijackThis v2.0.0 (BETA) version but not on HJT 1.99.1, when they first appeared on my first use of the 2.0 version I checked them out fully.

system · 2007-06-13T18:21:48.000Z

Spyros post:27:

I think this one: O4 - HKLM..\Run: [RavAV] C:\WINDOWS\RavMonE.exe is connected to Rjump

For sure that’s where ravmone.exe is loading. The problem is I was half expecting to see something stealthy here (or see no entry at all) to explain the avast! behavior, but it’s just out in the open running as a start up.

If you fix this line in HJT

O4 - HKLM..\Run: [RavAV] C:\WINDOWS\RavMonE.exe

and delete these files

C:\WINDOWS\RavMonE.exe

C:\WINDOWS\ADOBER.EXE (if present)

you will clean the individual computer, but the scanning mystery will remain and you will still need to prevent potential reinfection through the LAN or via USB drives.

Do you recognize the domain in these lines

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xqehkl.nhs.uk
O17 - HKLM\Software..\Telephony: DomainName = xqehkl.nhs.uk
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xqehkl.nhs.uk

EDIT: Had you already killed the ravmone.exe process before you ran HJT? Or was ravmone.exe runnng when you generated the log?

system · 2007-06-14T08:15:34.000Z

The domains are legit.

Ravmone wasn’t running, I was just too lazy to remove the reg entry.

We now have disabled auto-run on all PC’s on the network. I’m running daily on-demand scans to try to keep it clean.

Still the mystery remains.

system · 2007-06-14T11:41:32.000Z

QEHNick post:30:

Still the mystery remains.

I don’t have a solution to that but the following may help clean this:

On an infected computer download SDFix and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press “Enter”.
Choose your usual account.

In Safe Mode, double click SDFix.exe and install to the default location by clicking Install. The SDFix Folder will be extracted to %systemdrive% \ (Drive that contains the Windows directory - typically ‘C:\SDFix’) Open the SDFix folder in Safe Mode then double click the RunThis.bat file to start the fixtool. Type Y to begin the script.

It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log.

system · 2007-06-14T11:49:36.000Z

Thanks for the tips.

Hopefully I’ll hear something from the Avast! chaps.

I’ll keep you all posted.

system · 2007-06-14T12:03:06.000Z

Have you looked for adober.exe?

You probably already know this but its likely a copy of ravmone.exe is present in c:\windows\adober.exe. If this is the reality of your situtation and avast! does not see it then there may be a rootkit hiding the copy rather than the primary file. SDFix should clean it.

Also remember that this is very capable of stealing information so you should be taking steps to protect sensitive data.

system · 2007-06-14T13:24:19.000Z

There are no occurances of Adober.exe
However the most recent “scan on demand” has netted somehting interesting.

See the screenshot HERE

There are other variants of the trz##.tmp file, mostly with a different number.

Odd that Avast! detects Ravmone.exe as a trojan and the trz##.tmp as RJUMP.

system · 2007-06-14T13:40:15.000Z

Ah!

Now we’re getting somewhere. That trz##.tmp file is still sitting on a cleaned PC although with a different name.
So now I had better check some of these PC’s for rootkits.
edit seems that it’s not a root kit. The PC I had looked at had simply been reinfected by the users USB Device.

I have infected a PC several times (on purpose) but it has not once been infected with the trz##.tmp part of the virus. I wonder why.

Still doesn’t answer why Avast! doesn’t detect “on access”.

system · 2007-06-14T15:03:27.000Z

na the lab people dont respond…the only way ur sure that wat u mailed them has been noticed is they include it in the future updates… and the response is very slow…if the malware is of no serious threat…

system · 2007-06-14T20:18:11.000Z

sasin44 post:36:

na the lab people dont respond…the only way ur sure that wat u mailed them has been noticed is they include it in the future updates… and the response is very slow…if the malware is of no serious threat…

QEHNick post:23:

Ondrej dropped me a line this morning for some more info, what a hero he is!

In this case they did …

@QEHNick

This has downloader capability and may be responsible for the trz##.tmp files. There are several tools we could run against it but I still recommend SDFix first.

Is there any chance of keeping those USB drives away from the PCs for now? They will just continually re-infect them (if I’m not mistaken files transfers from an infected USB drive carries some risk even with autorun turned off).

QEHNick post:35:

Still doesn’t answer why Avast! doesn’t detect “on access”.

No, it doesn’t. Nor does it make sense to allow the infection to continue while a solution to the scanning dilemma is being worked on.

It looks like you’ve had this problem since at least 22 March and, while I have every confidence if the ability of the analysts to solve the scanning dilemma, a two pronged approach seems logical.

Lisandro · 2007-06-14T21:26:25.000Z

QEHNick post:35:

Still doesn’t answer why Avast! doesn’t detect “on access”.

Please, team, drop a line about this… I’m curious too…

system · 2007-06-15T03:23:44.000Z

Tech post:38:

Please, team, drop a line about this… I’m curious too…

A little feedback would be nice …

system · 2007-06-15T07:50:38.000Z

I’m aware of RJUMP connecting to sites to download other malware. Luckily our Webfilter software (websense) blocks all attempts by any malware at connecting to these sites. So at least that avenue is closed to it.
All in all, it causes little impact on our systems, however, it is still an unwanted process.

system · 2007-06-15T11:54:13.000Z

QEHNick post:40:

Luckily our Webfilter software (websense) blocks all attempts by any malware at connecting to these sites. So at least that avenue is closed to it.

The presence of the infected *.tmp files implies otherwise but you’re certainly free to wait if you prefer.

Lisandro · 2007-06-15T12:06:07.000Z

QEHNick post:40:

Luckily our Webfilter software (websense) blocks all attempts by any malware at connecting to these sites.

Are you using it at home or at your office?
Does it work well and worth what you’ve payed for it?
Did you test other content filtering applications? Can you compare them?

Oh, maybe we’re hijacking the thread ;D

system · 2007-06-15T13:16:56.000Z

Tech post:42:

QEHNick post:40:

Luckily our Webfilter software (websense) blocks all attempts by any malware at connecting to these sites.

Are you using it at home or at your office?
Does it work well and worth what you’ve payed for it?
Did you test other content filtering applications? Can you compare them?

Oh, maybe we’re hijacking the thread ;D

Lets put it this way, after using Avast! at home, I sought out Avast! for our corporate network (1500+ machines) and it blew our previous AVS out of the water as regards to performance and cost.
I’ve had exemplary support from Ondrej and his team as well as support from a UK distributor (AVOSEC), I have no complaints about the product at all. Little mysteries like this are fuel for guys like Onrej. He thrives on it.

And yes, since it’s not causing any major problems, I’m happy to wait for the Avast! guys to come up with any ideas. Running rootKit discovery tools on tens of infected PC’s could take forever around here.

Lisandro · 2007-06-15T13:52:51.000Z

My curiosity was about the web filtering products and not about avast 8)

Tech post:42:

QEHNick post:40:

Luckily our Webfilter software (websense) blocks all attempts by any malware at connecting to these sites.

Are you using it at home or at your office?
Does it work well and worth what you’ve payed for it?
Did you test other content filtering applications? Can you compare them?

system · 2007-06-15T14:07:06.000Z

Tech post:44:

My curiosity was about the web filtering products and not about avast 8)

Tech post:42:

QEHNick post:40:

Luckily our Webfilter software (websense) blocks all attempts by any malware at connecting to these sites.

Are you using it at home or at your office?
Does it work well and worth what you’ve payed for it?
Did you test other content filtering applications? Can you compare them?

To quote a famous yellow skinned balding father of 2.

“DOH”

Websense is used at work, It does a very good job. Better than our old webfilter. Cheaper too. Anything I source these days has to fulfill those criteria. Better faster, cheaper; well not so much the faster, this is the NHS!

Lisandro · 2007-06-15T17:24:55.000Z

QEHNick post:45:

To quote a famous yellow skinned balding father of 2.

Who is it?

QEHNick post:45:

“DOH”

??? I’m not English-native… ???

QEHNick post:45:

NHS!

??? I’m not English-native… I’m not following you. Sorry.

Announcements