i have 10PCs in lan network with XP Sp2, all pcs break in 20min when i verefied i found
files that download it self in internet temporary folder called (http60.191.239.191pic21.cab) i scanned with multiple antivirus but nothing, and this is the Hijackthis log file
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\JetAudio\JetAudio.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
O1 – Hosts: 127.1 localhost
O1 – Hosts: 127.1 fffff8888fsgfbghj88.cn
O1 – Hosts: 127.1 61.134.37.12
O1 – Hosts: 127.1 ko.ssa387.cn
O1 – Hosts: 127.1 www.ndxrr.cn
O1 – Hosts: 127.1 12345.ssa387.cn
O1 – Hosts: 127.1 lihai88.com
O1 – Hosts: 127.1 wwwwhf.cn
O1 – Hosts: 127.1 a89369093.sq.u9idc.com
O1 – Hosts: 127.1 www.mmd178.cn
O1 – Hosts: 127.1 www.178mmd.cn
O1 – Hosts: 127.1 www.wenzhuoyyy.cn
O1 – Hosts: 127.1 tw.lovechina.tw.cn
O1 – Hosts: 127.1 222.189.238.151
O1 – Hosts: 127.1 222.179.185.78
O1 – Hosts: 127.1 www.wq9q.cn
O1 – Hosts: 127.1 593ffcey.cn
O1 – Hosts: 127.1 set.yay520.cn
O1 – Hosts: 127.1 tenmoc999.cn
O1 – Hosts: 127.1 lihai88.com
O1 – Hosts: 127.1 121.kcuf-01.com
O1 – Hosts: 127.1 www.ew1q.cn
O1 – Hosts: 127.1 www.b3sk.cn
O1 – Hosts: 127.1 up.bizmd.cn
O1 – Hosts: 127.1 www.ms2a.cn
O1 – Hosts: 127.1 www.wo9188.cn
O1 – Hosts: 127.1 www.fgetchr.cn
O1 – Hosts: 127.1 www.e6zx.cn
O1 – Hosts: 127.1 hai067.com
O1 – Hosts: 127.1 hai088.com
O1 – Hosts: 127.1 778899.jd8j.cn
O1 – Hosts: 127.1 sql.78-11.net
O1 – Hosts: 127.1 www.bbbirdy.com
O1 – Hosts: 127.1 www.s1na1.com.cn
O1 – Hosts: 127.1 www.dianyinjzd.cn
O1 – Hosts: 127.1 www.dj5201314dj.com
O1 – Hosts: 127.1 max-2.cn
O1 – Hosts: 127.1 a.asp-o.cn
O1 – Hosts: 127.1 b.asp-o.cn
O1 – Hosts: 127.1 c.asp-o.cn
O1 – Hosts: 127.1 x.kprobb.cn
O1 – Hosts: 127.1 js.php-k.cn
O1 – Hosts: 127.1 max-1.cn
O1 – Hosts: 127.1 max-3.cn
O1 – Hosts: 127.1 max-4.cn
O1 – Hosts: 127.1 max-5.cn
O1 – Hosts: 127.1 max-6.cn
O1 – Hosts: 127.1 max-7.cn
O1 – Hosts: 127.1 max-8.cn
O1 – Hosts: 127.1 max-9.cn
O1 – Hosts: 127.1 max-10.cn
O1 – Hosts: 127.1 max-11.cn
O1 – Hosts: 127.1 max-12.cn
O1 – Hosts: 127.1 twocannon250.com.cn
O1 – Hosts: 127.1 www.133mm.cn
O1 – Hosts: 127.1 www.51vmm.cn
O1 – Hosts: 127.1 www.7mmoo.cn
O1 – Hosts: 127.1 www.99mmm.org.cn
O1 – Hosts: 127.1 www.hdec.cn
O1 – Hosts: 127.1 www.picc18.com
O1 – Hosts: 127.1 www.kissdh.com
O1 – Hosts: 127.1 www.x7v.cn
O1 – Hosts: 127.1 biqulu.cn
O1 – Hosts: 127.1 2008.qq2006.com.cn
O1 – Hosts: 127.1 giaitrisex.com
O1 – Hosts: 127.1 www.giaitrisex.com
O1 – Hosts: 127.1 www.giaitrituoitre.net
O1 – Hosts: 127.1 mekiep.com
O1 – Hosts: 127.1 www.1sex1day.com
O1 – Hosts: 127.1 a.9ymm.com
O1 – Hosts: 127.1 bobo.7wyt.com
O1 – Hosts: 127.1 www.591caobi.cn
O2 – BHO: IDM Helper – {0055C089-8582-441B-A0BF-17B458C2A3A8} – C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 – BHO: Yahoo! Companion BHO – {02478D38-C3F9-4efb-9B51-7695ECA05670} – C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.d ll
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O2 – BHO: ThunderAdvise – {97421D0D-E07F-40DF-8F07-99597B9585AD} – C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 – BHO: Web assistant – {9ECB9560-04F9-4bbc-943D-298DDF1699E1} – C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 – BHO: NAV Helper – {BDF3E430-B101-42AD-A544-FADC6B084872} – C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 – Toolbar: &Yahoo! Companion – {EF99BD32-C1FB-11D2-892F-0090271D4F88} – C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.d ll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 – Toolbar: Web assistant – {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} – C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O4 – HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 – HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 – HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 – HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 – HKLM\..\Run: [HBService32] System.exe
O4 – HKLM\..\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”
O4 – HKLM\..\Run: [3PMmUpdate] rundll32 “C:\WINDOWS\Update.dll”,Main
O4 – HKLM\..\Run: [WinSysW] C:\WINDOWS\985244L.exe
O4 – HKCU\..\Run: [DAEMON Tools Lite] “C:\Program Files\DAEMON Tools Lite\daemon.exe”
O4 – HKCU\..\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
O4 – HKCU\..\Run: [VgaNurb] C:\DOCUME~1\Hashem\APPLIC~1\BLEHSK~1\MagsSect.exe
O4 – HKCU\..\Run: [msnmsgr] “C:\Program Files\MSN Messenger\msnmsgr.exe” /background
O4 – HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User ‘SYSTEM’)
O4 – HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User ‘Default user’)
O8 – Extra context menu item: Download all links with IDM – C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 – Extra context menu item: Download FLV video content with IDM – C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 – Extra context menu item: Download with IDM – C:\Program Files\Internet Download Manager\IEExt.htm
O8 – Extra context menu item: ?????? ?????? – C:\WINDOWS\ww80.html
O9 – Extra button: ?????? – {46012075-ED62-464b-9554-AD0BEC35D1EC} – http://ww80.com (file missing)
O9 – Extra button: (no name) – {46012076-ED62-464b-9554-AD0BEC35D1EC} – C:\WINDOWS\system32\shdocvw.dll
O9 – Extra button: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 – Extra ‘Tools’ menuitem: Yahoo! Messenger – {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} – C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) – http://go.microsoft.com/fwlink/?linkid=39204
O20 – AppInit_DLLs: HBmhly.dll,HBSO2.dll,HBFY.dll,HBKDXY.dll,HBZHUXIAN .dll,HBBO.dll,HBCHIBI.dll,HBQQ
SG.dll,HBQQFFO.dll,HBZG.dll
O21 – SSODL: sysocmgr – {DA1DE019-A6A8-ED40-4B87-248B2A93DE99} – C:\WINDOWS\sysocmgr.dll (file missing)
O21 – SSODL: ThunderAdvise – {97421D0D-E07F-40DF-8F07-99597B9585AD} – C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O21 – SSODL: msnmsg – {DA191DE0-AA86-4ED0-4B87-293D48B2AE99} – C:\Program Files\Messenger\msgmr.dll (file missing)
O23 – Service: Symantec Event Manager (ccEvtMgr) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 – Service: Symantec Network Proxy (ccProxy) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 – Service: Symantec Password Validation (ccPwdSvc) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 – Service: Symantec Settings Manager (ccSetMgr) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 – Service: Norton AntiVirus Auto Protect Service (navapsvc) – Symantec Corporation – C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 – Service: SAVScan – Symantec Corporation – C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 – Service: ScriptBlocking Service (SBService) – Symantec Corporation – C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 – Service: Symantec Network Drivers Service (SNDSrvc) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 – Service: SymWMI Service (SymWSC) – Symantec Corporation – C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
