Solved Problem with genetic temp files

[Resolved] Problem with genetic temp files

Hi...I have problem with my computer.When I'm online,files are created by some kind of virus in my temp folder:

C:\Documents and Settings\Shone\Local Settings\Temp

Files are:BIT1E.tmp,BIT2CB.tmp,BIT4A9.tmp...

I delete them with Ace Utilities but they always return...

I also have TuneUp Utilities 2007 and RegistryBooster 2 and it can't fix them.

Also,I have NOD 32,Spybot S&D,Ad-Aware,SuperAntiSpyware Professional and Comodo firewall and they don't see anything.

I Went into Safe mode with command prompt and deleted files from that folder because Killbox couldn't delete them but they returned again.

Can U help me and tell me what to do? Thx...

------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 0:43:24, on 1.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Quick ShutDown\qsd.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Quick ShutDown.lnk = C:\Program Files\Quick ShutDown\qsd.exe
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

Welcome to WindowsBBS shone

Those file are created by a job using the BITS service, the same service used by Windows Update (among other legitimate uses, and sometimes rogue uses) to download files in the background using only the excess available bandwidth. Here's how to stop it.

Click Start>Run and type (or Copy then Paste) the following bolded command on the Run dialog line, then hit Enter.


sc stop BITS


That command stops the BITS service.

Now copy and paste the next bolded command (quotes included) on the Run dialog line and hit Enter.


"C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader "


That command opens the Downloader folder. Now delete the files qmgr0.dat and qmgr1.dat and close the Downloader folder.

Now restart the BITS service with the following bolded command on the Run line.


sc start BITS


The qmgr0 and qmgr1 files will be recreated when the BITS service starts, yet there will be no scheduled jobs (the schedule is in the qmgr? files).

Once you've done the above, please run an online virus scan as outlined below.

Do an online scan with Kaspersky WebScanner

Click Scan Now and accept the agreement. You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended (if available otherwise Standard)
  • Scan Options:
  • Scan Archives
    Scan Mail Bases
• Click OK
• Now under select a target to scan:
  • Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.

Post the Kaspersky log here.

 

Thanks noahdfear...What have I installed that automaticly started BITS service?

I have problems with Kaspersky when it scaned samples in wav format.I moved them to flash drive because scanner stucks on them.Finaly...

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, April 01, 2008 7:46:49 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 1/04/2008
Kaspersky Anti-Virus database records: 675957
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 112214
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 00:37:58

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\comodo\Firewall Pro\cfplogdb.sdb Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Shone\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\cert8.db Object is locked skipped
C:\Documents and Settings\Shone\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\Shone\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\history.dat Object is locked skipped
C:\Documents and Settings\Shone\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\key3.db Object is locked skipped
C:\Documents and Settings\Shone\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\parent.lock Object is locked skipped
C:\Documents and Settings\Shone\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Shone\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Shone\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Application Data\Mozilla\Firefox\Profiles\qgcbw6ux.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Temp\Perflib_Perfdata_86c.dat Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Temp\~DF6C7.tmp Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Temp\~ROMFN_00000828 Object is locked skipped
C:\Documents and Settings\Shone\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Shone\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Shone\ntuser.dat.LOG Object is locked skipped
C:\Program Files\ESET\cache\CACHE.NDB Object is locked skipped
C:\Program Files\ESET\logs\virlog.dat Object is locked skipped
C:\Program Files\ESET\logs\warnlog.dat Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{2D428590-A58E-4639-AEEF-71D565FB73D0}\RP135\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_770.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{2D428590-A58E-4639-AEEF-71D565FB73D0}\RP135\change.log Object is locked skipped

Scan process completed.

 

Possibilities....

Windows Update. The BITS service is required for Automatic Updates.

Download Manager. These apps use BITS to throttle the bandwidth used as well as enabling the ability to start and restart resumable downloads.

I would imagine many antivirus apps might use BITS for the automatic updating feature.


If those files were being created by any of the above, or some other legitimate application, the jobs will be recreated automatically the next time the app runs, so deleting the qmgr*.dat files is not a problem. Since nothing rogue appears in either of your logs, I'm leaning towards one of the above as the culprit behind the tmp files being created. Have a look in your Comodo interface to see if it shows connections made or applications granted access that might appear suspicious and let me know.

 

svchost.exe is always running in my firewall but I think it's not dangerous.I read about it and that is part of Windows.Do U think it can be infected?Can I stop that svchost from running on the internet and should I do that?

 

svchost.exe should not need internet access. Lets see what it's doing before we stop it. Download TCPView by Sysinternals, save it to the drive, extract the contents to it's own folder and run the Tcpview.exe file. Select any svchost process(es) shown (select multiple entries by holding Ctrl while clicking the entry), then right click and Copy. Paste those results back here in a reply. If you do not see svchost.exe listed, click Options>Show Unconnected Endpoints. The svchost processes should populate and show something similar to below, which is normal and no need to post.

Code:

  [U]Process[/U]	[U]Protocol[/U]  [U]Local Address[/U] [U]Remote Address[/U]	[U]State[/U]

svchost.exe:1988  UDP	0.0.0.0:3405		*:*		
svchost.exe:1988  UDP	0.0.0.0:4514		*:*		
svchost.exe:1988  UDP	0.0.0.0:1033		*:*		
svchost.exe:1988  UDP	0.0.0.0:1615		*:*		
svchost.exe:1448  UDP	192.168.0.2:123		*:*		
svchost.exe:1448  UDP	127.0.0.1:123		*:*

 

When U tell me how to stop making temporary files by itself,my logoff has turned off.That same logoff I didn't have untill I have installed
Net Framework long time ago.Then login and logoff started automaticly.Now,it shows only when I start Windows,and logoff is turned off,thank god.
Logoff has turned off when computer is idle,now it's gone.Maybe Net Framework started that temp files to be created.
------------------------------------------------
Here's what TCPView shows:

svchost.exe:1176 TCP pezos-2dd23bf58:epmap pezos-2dd23bf58:0 LISTENING
svchost.exe:1228 UDP pezos-2dd23bf58:1027 *:*
svchost.exe:1228 UDP pezos-2dd23bf58:ntp *:*
svchost.exe:1228 UDP pezos-2dd23bf58:ntp *:*
svchost.exe:1228 UDP pezos-2dd23bf58:1028 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1031 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1535 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1059 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1141 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1060 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1061 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1030 *:*
svchost.exe:1296 UDP pezos-2dd23bf58:1054 *:*

 

That TcpView output is normal. So is everything OK now?

 

Yes.Thanks a lot! ! !
U're real pro

 

Happy to help.

 

Hi...Again I have the same problem.

I follow your instructions again and it works for some time and then again somethings generates tmp files...
I aslo try first 2 steps:
- sc stop BITS

- "C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader "

without sc start BITS

and it works but only for some time...How to stop that because it also slow down my internet speed?

 

Is Windows Update set to download automatically?

If you want, stop the BITS service then attach the qmgr0.dat and qmgr1.dat files (check above posts for location of files) to an email and send to me. I can check them and possibly see what jobs are being run.

 

Automatic update is turned off.
I have just sent U that two files...

 

Nothing in the files you sent, and I mean nothing. They are empty. Are those bit???.tmp files still being created with the BITS service stopped?

 

Yes,BIT. temp files are still created.Maybe there was nothing yesterday because it started today to generate.When I stop them,those files are not created for few days.I'll send those files now again.

 

Those have a job for downloading Windows Live Messenger. Do you remember starting to download that but never finish?

 

No,I don't remember.I have Windows Live Messenger 8.1 and it works fine...