Are these Trojans?

I'm running XP Pro SP2 and use AVG free, Spybot, Ad-Aware SE and a-squared

2 new processes have appeared yesterday and are both loaded by registry at 
startup as:-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LangSupportEx"="mspmspv.exe"
"IPConfig"="svcxnw32.exe"

and:-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LangSupportEx"="mspmspv.exe"
"IPConfig"="svcxnw32.exe"

Both files are located in C:\WINDOWS\system32\
Properties:-
mspmspv.exe 18.5 KB (18,976 bytes) 30 December 2004, 11:26:14
svcxnw32.exe 18.5 KB (18,976 bytes) 30 December 2004, 18:28:59

According to netstat, the processes are established to the following 
addresses using TCP:-

mspmspv.exe:-
17-112.202-68.se.rr.com [68.202.112.17] on port 6667

svcxnw32.exe:-
astound-64-83-195-190.mn.astound.net: [64.83.195.190] on port 6667

I have scanned using all the installed malware/virus scanners mentioned 
above but they are not detected. I've also tried a web search but so far no 
luck.

Does anyone have any info about these? They look like Trojans to me. How did 
they get in?

Martyn 

This post suggests it's a new trojan:
 http://www.**--****.com/ 
(Google groups, news.admin.net-abuse.sightings)

Do you have any of the other files they mention?

mspmspv.exe is associated with that "Santa like you've never seen him 
before" newsgroup posts. However, check your spelling as MsPMSPSv.exe 
(extra "S") is a legitimate Windows Media Player file.

Port 6667 is used by IRC, a popular way for worms/viruses to receive 
updated instructions.

If it were me, I'd submit those two files to my AV vendor and disconnect 
the computer from the internet. Then start manually removing files and 
see how far I can get.

Lance
*****

MartynB thought carefully and wrote on 12/31/2004 7:03 AM:

1)    Download the following two items...

        Trend Sysclean Package
          http://www.**--****.com/ 

         Latest Trend signature files.
          http://www.**--****.com/ 

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download SYSCLEAN.COM and place it in that directory.
Download the signature files (pattern files) by obtaining the ZIP file.
For example;  lpt325.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

2)     If you are using WinME or WinXP, disable System Restore
         http://www.**--****.com/ 
3)     Reboot your PC into Safe Mode and shutdown as many applications as possible
4)     Using the Trend Sysclean utility, perform a Full Scan of your platform and
        clean/delete any infectors found
5)     Restart your PC and perform a "final" Full Scan of your platform
6)     If you are using WinME or WinXP, Re-enable System Restore and re-apply any
        System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
7)     Reboot your PC.
8)     If you are using WinME or WinXP, create a new Restore point


* * *  Please report back your results  * * *



-- 
Dave








| I'm running XP Pro SP2 and use AVG free, Spybot, Ad-Aware SE and a-squared
|
| 2 new processes have appeared yesterday and are both loaded by registry at
| startup as:-
|
| [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
| "LangSupportEx"="mspmspv.exe"
| "IPConfig"="svcxnw32.exe"
|
| and:-
|
| [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
| "LangSupportEx"="mspmspv.exe"
| "IPConfig"="svcxnw32.exe"
|
| Both files are located in C:\WINDOWS\system32\
| Properties:-
| mspmspv.exe 18.5 KB (18,976 bytes) 30 December 2004, 11:26:14
| svcxnw32.exe 18.5 KB (18,976 bytes) 30 December 2004, 18:28:59
|
| According to netstat, the processes are established to the following
| addresses using TCP:-
|
| mspmspv.exe:-
| 17-112.202-68.se.rr.com [68.202.112.17] on port 6667
|
| svcxnw32.exe:-
| astound-64-83-195-190.mn.astound.net: [64.83.195.190] on port 6667
|
| I have scanned using all the installed malware/virus scanners mentioned
| above but they are not detected. I've also tried a web search but so far no
| luck.
|
| Does anyone have any info about these? They look like Trojans to me. How did
| they get in?
|
| Martyn
|
|

Martyn,  I got the svcxnw32.exe yesterday with a timestamp pretty close
to what you have.  I've been debugging this for the past 3 hours.  It
must be new because there isn't much info on it.  I consider my
machines reasonably secure so I'm confused as to how I got this as
well...

I also have mspmspv.exe which is the exact same size and also has a
timestamp of a few hours earlier yesterday...  both files are the same
size as yours.

mspmspv.exe showed up yesterday morning when the machine was first
booted up.  From the history of files created, it doesn't look like
anything was done beforehand.
Something tells me that we ought to figure this out before midnight

OfficeOSA.exe and MicrosoftOffice.ht are possibly involved as well

Ok, I remember opening a JPG of some redneck with a shotgun from
USENET.  This must have exploited a buffer overflow in Outlook Express.





a-squared
registry at
mentioned
far no
How did 

McAfee defined that hosted page as having the "Exploit-HelpZonePass" which probably  then
installed the malware.

-- 
Dave








| Ok, I remember opening a JPG of some redneck with a shotgun from
| USENET.  This must have exploited a buffer overflow in Outlook Express.
|
|
|


| > I'm running XP Pro SP2 and use AVG free, Spybot, Ad-Aware SE and
| a-squared
| >
| > 2 new processes have appeared yesterday and are both loaded by
| registry at
| > startup as:-
| >
| > [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
| > "LangSupportEx"="mspmspv.exe"
| > "IPConfig"="svcxnw32.exe"
| >
| > and:-
| >
| > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
| > "LangSupportEx"="mspmspv.exe"
| > "IPConfig"="svcxnw32.exe"
| >
| > Both files are located in C:\WINDOWS\system32\
| > Properties:-
| > mspmspv.exe 18.5 KB (18,976 bytes) 30 December 2004, 11:26:14
| > svcxnw32.exe 18.5 KB (18,976 bytes) 30 December 2004, 18:28:59
| >
| > According to netstat, the processes are established to the following
| > addresses using TCP:-
| >
| > mspmspv.exe:-
| > 17-112.202-68.se.rr.com [68.202.112.17] on port 6667
| >
| > svcxnw32.exe:-
| > astound-64-83-195-190.mn.astound.net: [64.83.195.190] on port 6667
| >
| > I have scanned using all the installed malware/virus scanners
| mentioned
| > above but they are not detected. I've also tried a web search but so
| far no
| > luck.
| >
| > Does anyone have any info about these? They look like Trojans to me.
| How did
| > they get in?
| >
| > Martyn
|

Proch and Martyn

Good Call Proch.
Exactly when it came in. 
I also went to the same site to see what was happening after seeing
the warning on here.
I was also doing Microsoft updates at the time. After these were
finished I restarted the machine.

My NOD32 stopped it when I restarted my computer, xp.exe tried to
access a site off of the computer. Here is the log from the file.
Time	                                        Module	Object	Name
Virus	Action	User	Info
29/12/2004 17:26:37 PM	IMON	file
h:ttp://paddy.home.comcast.net/xp.exe 	probably unknown NewHeur_PE
virus	quarantined - connection terminated	TH03-NB003\jdbrown	

I terminated the link when it came up and removed the files from the
Startup folder. Those files were OfficeOSA.exe and MicrosoftOffice.hta
Submit them here for analysis
 http://www.**--****.com/ 


Here is a link for the exploit for anyone else who is reading.
 http://www.**--****.com/ {*filter*}hound.exploit.21.html
hth
John Brown
Bears are hibern8n but we wake up to help once in awhile.

Dave:

A question regarding Bitdefender. When I clicked on "agree" in 
 http://www.**--****.com/ ,
the file immediately began downloading directly into 
C:\WINDOWS\bdonlinescan\avxLive.exe, which is fine since I agreed to that. 
My problem is that if it's so easy for Bitdefender (who is a trustworthy 
company) to download a file to my PC, ANY unscrupulous site could do the 
same by just visiting their page. What about Microsoft security - shouldn't 
there be at least some sort of warning from the system that such a file 
transfer could be dangerous?

Martyn





Snip

Martyn:

Only WinXP SP2 will supply such a warning.  I hope you received my email reply.  It has
valuable information in it  ;-)

-- 
Dave








| Dave:
|
| A question regarding Bitdefender. When I clicked on "agree" in
|  http://www.**--****.com/ ,
| the file immediately began downloading directly into
| C:\WINDOWS\bdonlinescan\avxLive.exe, which is fine since I agreed to that.
| My problem is that if it's so easy for Bitdefender (who is a trustworthy
| company) to download a file to my PC, ANY unscrupulous site could do the
| same by just visiting their page. What about Microsoft security - shouldn't
| there be at least some sort of warning from the system that such a file
| transfer could be dangerous?
|
| Martyn
|




| > Martyn:
| >
| > Sounds like you are STILL infected.
| >
| > Obtain McAfee's virus and worm removal tool, Stinger:
| >  http://www.**--****.com/ 
| >
| > 1)     If you are using WinME or WinXP, disable System Restore
| >         http://www.**--****.com/ 
| > 2)     Reboot your PC into Safe Mode
| > 3)     Using McAfee Stinger, perform a Full Scan of your platform and
| > clean/delete any
| >         infectors found
| > 4)     Restart your PC and perform a "final" Full Scan of your platform
| > 5)     If you are using WinME or WinXP, Re-enable System Restore and
| > re-apply any
| >        System Restore preferences, (e.g. HD space to use suggested 400 ~
| > 600MB),
| > 6)     Reboot your PC.
| > 7)     If you are using WinME or WinXP, create a new Restore point
| >
| > You should also try some of the below online scanners.
| >
| > BitDefender:
| >  http://www.**--****.com/ 
| >
| > Computer Associates:
| >  http://www.**--****.com/ 
| >
| > DialogueScience:
| >  http://www.**--****.com/ 
| >
| > F-Secure:
| >  http://www.**--****.com/ 
| >
| > Freedom Online scanner:
| >  http://www.**--****.com/ 
| >
| > Panda:
| >  http://www.**--****.com/ 
| >
| > Symantec:
| >  http://www.**--****.com/ 
| >
| >
| > * * *  Please report back your results  * * *
| >
| >
| > -- 
| > Dave
| >
| Snip
|
|