xp++Wootbot+AgentKG+SDBot+bcmsmmsg

[CanadianTek]

Give you the long and the short here..

Im STUMPED..
4 profiles in xp.. all cleaned while disconnected from the net..
USED Stinger, AVG7, Ad-aware SE, SpyBot1.3.1.tx, Bazooka, SpywareBlaster, SpywareGuard - PLUS - final sweep with SpySweeper

ALL came back CLEAN, clean, clean, clean.. ;) lot of time spent getting it here but clean

Connected to the net.. INSTANTLY.. hd light starts flickering.. - i put a block on ALL internet traffic using.. Zone Alarm..

I then jumped into msconfig.. and found a mysterious NEW entry..

bcmsmmsg.exe now there.. was not there before..

immediately tells me. - something subversive.. has eluded all above previous cleanings and scans..

i do a search on the hd and there are 7 files on the system that start with bcmsm

the newest being bcmsmmsg.exe-061d0722.pf has Feb 21/2005 creation date
but bcmsmmsg.exe found in the C:\windows folder has 8/29/04 creation date
as does
bcmsmu.exe
bcmsm.sys
bcmsmd2k.exe
bcmsm168.dll
and
bcmsmi32.dll

frustrated.. i went back on the net and tried TrendMicro

It immediately scanned active memory and found one called WootBot

as the scan proceeded

Worm SDBot.apc - not cleanable
found in c:\recyclers\s-1-5-21-1454471165-220523388-725345543-1006\DC4.exe

VBS StartPage.N - cleaned
found in c:\backups\back-up-20030213 (<< assumes a back up made by spybot?)

Trojan Agent KG - not cleanable
found in c:\windows\system32\addmp32.dll

Trojan Downloader N - not cleanable
found in c:\windows\system32\fag.exe

Worm SDBOT.AKJ - not cleanable
C:\windows\system32\p6.exe

Trojan Agent KG - not cleanable
found in c:\windows\n_akqoux.log (or n_gkquox.log or n_gkqoux.log hard to read)

Trojan Middadle - not cleanable
C:\windows\t.exe.bak

Trojan Downloader N - not cleanable
found in c:\nabei.exe

Trojan Downloader N - not cleanable
found in c:\nabeix.exe

VBS StartPage.N - cleaned
found in c:\ntdetect.hta

Trojan Downloader N - not cleanable
found in c:\winsysx.exe

Trend Micro Housecall then gave me the option to delete,

I deleted them

I went into the file structure via Windows Explorer.. could not find any of the files.. and YES the trash basket was empty. Maybe Trend Micro did the Job.. or maybe it just got rid of the symptoms and the problem is still in the system??

I went into the registry.. and BCMSM ... and another register called BCMDM show up as modem drivers?

But no signs of DC4.exe

So i installed HIJACK THIS 1.99.1

I can see some obvious things that need removed.. - I SWEAR - i had already removed them.. 2 or 3 days ago.. prior to connecting to the net


Logfile of HijackThis v1.99.1
Scan saved at 9:38:06 AM, on 2/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\TEKS2G~1\AVGANT~1\avgamsvr.exe
C:\TEKS2G~1\AVGANT~1\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\Program Files\QuickTime\qttask.exe
C:\TEKS2G~1\AVGANT~1\avgcc.exe
C:\TEKS2G~1\AVGANT~1\avgemc.exe
C:\Teks2Go Utilities\ZoneAlarm\zlclient.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\explorer.exe
C:\Teks2Go Utilities\HijackThis1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Teks2Go Utilities\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\TEKS2G~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7A03F6DD-E52F-A3BE-859F-29E1E782ADF8} - (no file)
O2 - BHO: (no name) - {E4F1ABCC-5B84-51FB-58BD-3365C85657A9} - (no file)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\TEKS2G~1\AVGANT~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\TEKS2G~1\AVGANT~1\avgemc.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Teks2Go Utilities\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/c ... /jt0_x.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/ ... 1/chat.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/ ... acscom.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://zone.msn.com/binGame/ZAxRcMgr.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZI ... b32846.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/defaul ... uncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/isan/defaul ... der_v6.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\TEKS2G~1\AVGANT~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\TEKS2G~1\AVGANT~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: taevuhodzfoi (judxnaik5) - Unknown owner - C:\WINDOWS\System32\zxjifcgr5.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Win32 Usb Driver - Unknown owner - C:\WINDOWS\System32\svhosint32.exe" -netsvcs (file missing)

I would probably remove these lines.. (as some of them, i had removed before, but they seem to come back, including the 2 blank lines in the 02 BHO section)

not sure about this one ??
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

the rest.. i would remove..

O2 - BHO: (no name) - {7A03F6DD-E52F-A3BE-859F-29E1E782ADF8} - (no file)
O2 - BHO: (no name) - {E4F1ABCC-5B84-51FB-58BD-3365C85657A9} - (no file)


O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe


O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246



O23 - Service: taevuhodzfoi (judxnaik5) - Unknown owner - C:\WINDOWS\System32\zxjifcgr5.exe (file missing)

O23 - Service: Win32 Usb Driver - Unknown owner - C:\WINDOWS\System32\svhosint32.exe" -netsvcs (file missing)


I HAVE NOT REMOVED THEM THIS TIME - in case there is something i have missed in my analysis, or a SPECIFIC ORDER that they should be removed by... the system remains disconnected from the net..

Awaiting to be blessed by your intelligence..once again..

[PCguy]

BCMSMMsg.exe is a vital component of the BCM voice modem drivers. This process is needed to ensure that your BCM modem works properly.

So no need to freak out.

I would have HiJackThis fix the following:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {7A03F6DD-E52F-A3BE-859F-29E1E782ADF8} - (no file)
O2 - BHO: (no name) - {E4F1ABCC-5B84-51FB-58BD-3365C85657A9} - (no file)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O23 - Service: taevuhodzfoi (judxnaik5) - Unknown owner - C:\WINDOWS\System32\zxjifcgr5.exe (file missing)
O23 - Service: Win32 Usb Driver - Unknown owner - C:\WINDOWS\System32\svhosint32.exe" -netsvcs (file missing)

Delete all temp files and reboot. Let us know if its all good.

[CanadianTek]

Hey PCGuy..

followed your advice, thanx for the heads up on the modem driver/voice mail stuff.

upon removal of all that you said,

I had gone into all 4 profiles again.. and gutted temps and temp internet.. - swear i had done it before..

then to be on the safe side, went into safe mode, gutted temp and temp internet AND windows temp

exited, rebooted..

and only those 2 lines.. in the 02 remained..

O2 - BHO: (no name) - {7A03F6DD-E52F-A3BE-859F-29E1E782ADF8} - (no file)
O2 - BHO: (no name) - {E4F1ABCC-5B84-51FB-58BD-3365C85657A9} - (no file)

in hijack this


so.. i did a regedit to see if i could find that value.. - found a few things.. maybe it will mean something to you..

so i did a search on this string {7A03F6DD-E52F-A3BE-859F-29E1E782ADF8}
and surprisingly.. beneath it.. i found {E4F1ABCC-5B84-51FB-58BD-3365C85657A9}

at each of the 3 locations..

HKCU\software\microsoft\windows\current version\ext\stats\{7A03F6DD-E52F-A3BE-859F-29E1E782ADF8}

now .. underneath both is iexplore

on the right hand side of the screen when you look at either of these.. you get

default <no set value>
count regDWORD 0x0000000a (10)
time regBinary d5 07 02 00 03 00 17 00 10 00 20 00 31 00 4b 03
type regDWORD 0x00000003 (3)

the other two places these two appeared

{7A03F6DD-E52F-A3BE-859F-29E1E782ADF8}
{E4F1ABCC-5B84-51FB-58BD-3365C85657A9}

HK_users\s-1-5-21-1454471165-220523388-72534543-1004\software\microsoft\windows\current version\ext\stats\{7A03F6DD-E52F-A3BE-859F-29E1E782ADF8}

HK_users\s-1-5-21-1454471165-220523388-72534543-1004\software\microsoft\windows\current version\ext\stats\{E4F1ABCC-5B84-51FB-58BD-3365C85657A9}

and

HKLM\software\microsoft\windows\current version\explorere\browser helper object\{7A03F6DD-E52F-A3BE-859F-29E1E782ADF8}

HKLM\software\microsoft\windows\current version\explorere\browser helper object\{E4F1ABCC-5B84-51FB-58BD-3365C85657A9}
however on this last one, when i highlight it.. it gives a pop-up with a red circle "X" in it saying.. Can't Open! .... ... Error while opening key

so .. not too sure if i should be deleting these 6 entires.. i know whenever i have gotten that error message.. that 1 link may not be deleteable.

thnx, let me know..

CT

[PCguy]

[CanadianTek]

About 2 hours prior to you contacting me the second time..

I went in and tried to delete all 6 of the entries.. not knowing which one was feeding the "creation" of that HIJACK THIS.. entry..

when i got to the one that could not be deleted, i did add myself in with full rights.. then was able to delete that entry..

oddly when i went to delete the 6th one.. even though it would let me view it before.. it tooo was now coming up with .. Error messages.. so again.. i added myself to have the proper permissions.. and was able to remove it too..

on reboot.. - no more rogue msconfig entries.. no more rogue hjt lines.. - and more importantly.. - no more pop-ups, spies.. or mysterious hd activities.. when connected to the net..

if it is worth anything.. prior to contacting you.. i had already cleaned 2664 spies and 912 viruses.. - but if i had told you up front.. it may have caused even the gutsiest of techies.. to run.. screaming from the room :S

again .. many thanx.. - and be sure to follow up with an email.. re: - what i had sent to you via email.. ? re: pctechforums / support

thanx again..
ct

[PCguy]

I'm glad you got it sorted. I never run from a problem. I can handle even the toughest of problems.

BTW, I have seen worse on a PC and had to clean it.