PDA

View Full Version : malware removal help



ltavr
2008-05-31, 04:43
Hi guys,

Hi guys,

A friend of mine told me about your forum after a couple of days trying to solve this without success.

I have this OVH server that runs Windows 2003 Server SP1. I never felt the need to install any AV software in my previous servers. i usually only install Spybot to remove minor common nuisances and I also rely on Windows Firewall.

I don't usually browse the net through the server and I'm not downloading or executing applications directly downloaded from the net without first checking them on my home PC. This time I did that mistake... and I'm paying big time.

My server is a total mess. I can't even access the net cause a lot of applications including IE and Firefox don't open. IE opens but closes immediatelly after that without even showing the home page. I'm used to Bulletproof FTP server ( "Access violation at address 003DFFFB. Read of address 003DFFFB" ) and FlashFXP but I doesn't work also so I can't send anything from my home PC.

Fortunatelly, Hijackthis manages to run ( I sent it to my Server before BulletProof stopped working ). This is the current log it gives me:

Logfile of HijackThis v1.99.1
Scan saved at 12:59:32 PM, on 5/30/2008
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\copssh\bin\cygrunsrv.exe
C:\Program Files\copssh\bin\sshd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\rdpclip.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://google.com/
O2 - BHO: (no name) - {06E12C36-760F-4D92-8509-5E5DBF12C423} - C:\WINDOWS\system32\fccCRjhH.dll
O2 - BHO: {f3ded546-772b-ec4b-6044-ea44dc881fe3} - {3ef188cd-44ae-4406-b4ce-b277645ded3f} - C:\WINDOWS\system32\kcmybybx.dll
O2 - BHO: (no name) - {B41CF27D-01D0-4A5C-98BA-4A58A28C3E37} - C:\WINDOWS\system32\vtUnnkkK.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [f873e32b] rundll32.exe "C:\WINDOWS\system32\pteyaevj.dll",b
O4 - HKLM\..\Run: [BMfb40d0b7] Rundll32.exe "C:\WINDOWS\system32\yquoossm.dll",s
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1149752800553
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A2BDFF3-C114-4C4E-B7B0-7426644239A8}: NameServer = 10.48.100.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{8802DDAB-18B4-412C-9395-A22DD8F74F0B}: NameServer = 10.48.100.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1F056F8-2F80-4496-B66D-6348B45BFAFF}: NameServer = 10.48.100.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{C686F0B6-F4C8-4BA4-8DC1-97EC2058202B}: NameServer = 10.48.100.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA8ED4EC-0D15-4DED-8C33-73E10268CE1B}: NameServer = 10.48.100.2
O20 - Winlogon Notify: fccCRjhH - C:\WINDOWS\SYSTEM32\fccCRjhH.dll
O23 - Service: Openssh SSHD (copSSHD) - Unknown owner - C:\Program Files\copssh\bin\cygrunsrv.exe


I have this server for 4 days now... I never got to use it. OVH doesn't seem to provide any assistance in a situation like this. I already contacted them 2 days ago.

I know it was my fault... I had a leaseweb server and I never had any problems cause I never downloaded anything and then opened it on the server. It was so stupid...

I spent the last couple of days googling like crazy to try and fix this but I simply don't have the skills to do it. I know this is my first post here and I wouldn't immediatelly ask for something if I wasn't desperate.

Many thanks in advance for any help you might give me on this.

Cheers.


[I]Edit. Topic: http://forum.hijackthis.de/showthread.php?t=31045

Blade81
2008-05-31, 20:30
Hi

A couple of questions if you don't mind. Is this server only in your personal use and is OVH some server renting company? Do you have physical access to that server?

Blade81
2008-06-06, 09:37
Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.