Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

peerbot worm

Started by menehune25 , Oct 18 2006 12:59 PM

  • Please log in to reply

#1
menehune25
Posted 18 October 2006 - 12:59 PM

menehune25

    Member

  • Member
  • PipPip
  • 21 posts
I ran a scan on spysweeper and Peerbot worm/trojan showed up. so i deleted it and when i ran a scan again, it showed up again. Can you please help me out thanks.
  • 0

Advertisements

#2
menehune25
Posted 18 October 2006 - 01:08 PM

menehune25

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
here is my hijt log:

Logfile of HijackThis v1.99.1
Scan saved at 12:07:56 PM, on 10/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Updater.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Documents and Settings\amanansala\My Documents\HijackThis[1]\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityrespo...er/fix_homepage
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [YOP] "C:\PROGRA~1\Yahoo!\YOP\yop.exe" /autostart
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Install Pending Files.LNK = C:\Program Files\SIFXINST\SIFXINST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.costcopho...stcoActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1132765335513
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = local.blackcompeanhall.com
O17 - HKLM\Software\..\Telephony: DomainName = local.blackcompeanhall.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  • 0

#3
Metallica
Posted 26 October 2006 - 03:27 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Can you let me know where spysweeper finds this?

Full path and name of the file identified as Peerbot.

The reason I'm asking is that I don't see anything strange in your log and SpySweeper has had some false alarms on this detection before.

Regards,
  • 0

#4
menehune25
Posted 26 October 2006 - 02:16 PM

menehune25

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
Thanks for helping me out. Here is my spysweeper session log:

1:13 PM: Removal process completed. Elapsed time 00:00:15
1:13 PM: Quarantining All Traces: specificclick.com cookie
1:13 PM: Quarantining All Traces: 2o7.net cookie
1:13 PM: Quarantining All Traces: peerbot
1:12 PM: Removal process initiated
12:32 PM: Traces Found: 3
12:32 PM: Quick Sweep has completed. Elapsed time 00:15:28
12:32 PM: File Sweep Complete, Elapsed Time: 00:03:27
12:32 PM: HKU\S-1-5-21-702860073-1056937797-1574746817-1234\Software\Microsoft\Windows\CurrentVersion\Run || ctfmon.exe (ID = 0)
12:32 PM: Found Trojan Horse: peerbot
12:28 PM: Starting File Sweep
12:28 PM: Warning: ExplorerProtocolHandlers: invalidFile [rdpclip]
12:28 PM: Warning: CheckForServicesLists(): File Access Error[C:\WINDOWS\system32\svchost ]
12:28 PM: Warning: CheckForServicesLists(): File Access Error[C:\WINDOWS\system32\svchost ]
12:28 PM: Warning: CheckForServicesLists(): File Access Error[C:\WINDOWS\system32\drivers\mr97310v.sys]
12:28 PM: Warning: CheckForServicesLists(): File Access Error[C:\WINDOWS\system32\svchost ]
12:27 PM: Warning: ShellExtensions: invalidFile [deskpan.dll]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Warning: ExplorerProtocolHandlers: invalidFile [About:Home]
12:27 PM: Cookie Sweep Complete, Elapsed Time: 00:00:02
Trace marked as Always Remove
12:27 PM: c:\documents and settings\amanansala\cookies\[email protected][2].txt (ID = 3400)
12:27 PM: Threat marked as Always Remove
12:27 PM: Found Spy Cookie: specificclick.com cookie
Trace marked as Always Remove
12:27 PM: c:\documents and settings\amanansala\cookies\amanansala@2o7[1].txt (ID = 1957)
12:27 PM: Threat marked as Always Remove
12:27 PM: Found Spy Cookie: 2o7.net cookie
12:27 PM: Starting Cookie Sweep
12:27 PM: Registry Sweep Complete, Elapsed Time:00:00:48
12:26 PM: Starting Registry Sweep
12:26 PM: Memory Sweep Complete, Elapsed Time: 00:07:18
12:18 PM: Starting Memory Sweep
12:16 PM: Start Quick Sweep
12:16 PM: Sweep initiated using definitions version 783
12:16 PM: Spy Sweeper 5.2.3.2120 started
12:16 PM: | Start of Session, Thursday, October 26, 2006 |
********
  • 0

#5
Metallica
Posted 27 October 2006 - 12:29 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
That certainly looks like a false alarm.

Let's get a second opinion.

First download AVG Anti-Spyware from HERE and save that file to your desktop.
This is a 30 day trial of the program
  • Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
  • On the main screen select the icon "Update" then select the "Update now" link.
    • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
  • Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
  • AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all actions"
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
  • Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.
Regards,
  • 0

#6
menehune25
Posted 27 October 2006 - 11:46 AM

menehune25

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
If this is a false alarm, is there any way i can stop it from coming up on spysweeper? If so can you show me or tell me how to do it? Thanks

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:31:18 AM 10/27/2006

+ Scan result:



C:\Documents and Settings\amanansala\Cookies\amanansala@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\amanansala\Cookies\amanansala@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\amanansala\Cookies\[email protected][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Documents and Settings\amanansala\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\amanansala\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\amanansala\Cookies\[email protected][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\amanansala\Cookies\[email protected][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Documents and Settings\amanansala\Cookies\[email protected][2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Documents and Settings\amanansala\Cookies\[email protected][2].txt -> TrackingCookie.Pointroll : Cleaned.
C:\Documents and Settings\amanansala\Cookies\amanansala@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\amanansala\Cookies\amanansala@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.


::Report end
  • 0

#7
Metallica
Posted 29 October 2006 - 01:50 PM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
The only way to accomplish that would be to make the developers of SpySweeper aware of the problem.

Contact information can be found here:
http://www.webroot.c.../contactus.html

I would also like you to have a look at:
http://privacy.getne...browsing/tools/

Read the information where it concerns the browser(s) you use to avoid third party cookies getting on your computer.

Regards,
  • 0

#8
menehune25
Posted 30 October 2006 - 11:01 AM

menehune25

    Member

  • Topic Starter
  • Member
  • PipPip
  • 21 posts
Thank you for all your help.
  • 0

#9
Metallica
Posted 30 October 2006 - 12:40 PM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
My pleasure. :whistling:

Please do have a look at my site about removing and preventing spyware.

Regards,
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP