Pinch.exe virus/trojan

[bts07]

I have been fighting a virus now for 2 weeks and I can't seem to get rid of it.  It creates a file in Windows\temp called pinch.exe and then I also find 2 files in the Windows folder called SMTPScaner.exe and SSSS.exe.  When this happens the internet goes down because so much traffic is hitting the firewall that the cache fills up and nothing else can get out.  It also un-installs the antivirus program when it hits.  Once I delete all of these files and reboot the server, everything is fine and I can reinstall AVG antivirus and check the system and I can find no traces of any trojans or anything suspcious in the temp folders or the registry.  I can't figure out how this is getting into the system or how to permanently remove it. I have tried several antivirus and antispyware programs but it still comes back.  It is good for about 3 days and then the files are back again.  I would appreciate any input and advice I could get on this.  THX.

[Bobby]

hello there,
what security software have you tried already? do they picked up any parasites? if so, could you name them? i assume you antivirus and antispyware couldn't delete all the malicious files and that's the reason this infection keeps coming back.

[bts07]

I have tried SPybot, Superantispyware, AVG, Ewido, Trend Micro House call, Trend Micro Sysclean.  I have searched the registry and I found Mirabilis which I read somewhere is related to ICQ which the SMTPscaner.exe trys to use so I deleted that also but I still can't stop it.  It comes back every time.  I have deleted temp files, temporary internet files.  Searched all drives for anythinf suspicious.  I just can't find where this thing is coming from.

[Bobby]

as far as i know mirabilis is not related to any security threats :roll: if your security software delete the threats but they keep coming back i think there's a certain software on your computer that reinstalls the files. it might be a software that you take as legitimate; do you use a commercial search engine? or fileshare software? or maybe you regularly visit certain websites like free mp3s,free screensavers and similar stuff? because, you know, those websites can easily put some malicious files onto your machine.
the other idea that comes to my head suggest you to download updates fr your security programs and then try to run a scan again. if they still won't be able to help you, try spyware doctor.

[bts07]

This is a file server and is not used to surf the net at all.  I have scanned all machines on the network and have not found the problem on any other systems.  When it came in the last time was Sunday morning and no other computers were even turned on in the network so it's not coming through the network either.  Network is firewalled also.  I have thought of trying Spydoctor.  My other option has been to totally reload the server.  I really don't want to do that if possible.

Thx.

[junior08jr8]

Hi bts07.  Welcome to the 2-Spyware.com forums!

Download the HijackThis program, run a scan and post your log here.

[bts07]

Here is the log from Highjackthis.  Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:10:25 PM, on 8/14/2007
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP2 (6.00.3790.3959)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\msdtc.exe
C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe
C:\PROGRA~1\APC\POWERC~1\server\PBESER~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgrN.exe
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
F:\Highjack this\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\dell\homepage\dellhome.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1588211331-1166803636-3734409672-1008\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'QBDataServiceUser')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O14 - IERESET.INF: START_PAGE_URL=C:\dell\homepage\dellhome.htm
O15 - ESC Trusted Zone: http://www.adobe.com
O15 - ESC Trusted Zone: http://www.cnet.com
O15 - ESC Trusted Zone: http://support.dell.com
O15 - ESC Trusted Zone: http://support.ap.dell.com
O15 - ESC Trusted Zone: http://support.euro.dell.com
O15 - ESC Trusted Zone: http://www.dell.com
O15 - ESC Trusted Zone: http://www.ap.dell.com
O15 - ESC Trusted Zone: http://www.euro.dell.com
O15 - ESC Trusted Zone: http://www.pctools.com
O15 - ESC Trusted Zone: http://www.quickbooks.com
O15 - ESC Trusted Zone: http://www.trendsecure.com
O15 - ESC Trusted Zone: http://seer.support.veritas.com
O15 - ESC Trusted Zone: http://support.veritas.com
O15 - ESC Trusted Zone: http://*.windowsupdate.com
O15 - ESC Trusted Zone: http://support.dell.com (HKLM)
O15 - ESC Trusted Zone: http://support.ap.dell.com (HKLM)
O15 - ESC Trusted Zone: http://support.euro.dell.com (HKLM)
O15 - ESC Trusted Zone: http://www.dell.com (HKLM)
O15 - ESC Trusted Zone: http://www.ap.dell.com (HKLM)
O15 - ESC Trusted Zone: http://www.euro.dell.com (HKLM)
O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM)
O15 - ESC Trusted IP range: http://192.168.1.253
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://dell.webex.com/client/v_mywebex-t20/support/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA8604EC-BB37-44CD-AF4D-9444A7FC2A5F}: NameServer = 205.152.37.23,205.152.132.23
O23 - Service: APC PBE Agent (APCPBEAgent) - APC - C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe
O23 - Service: APC PBE Server (APCPBEServer) - APC - C:\PROGRA~1\APC\POWERC~1\server\PBESER~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: QuickBooksDB - Intuit, Inc. - C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgrN.exe
O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

--
End of file - 5555 bytes

[junior08jr8]

Hi bts07

Your log doesn't reveal any real sign of infection.
What was the problem you are having?

[bts07]

Yes, I know.  I keep running scans but find nothing.  But about every 3-5 days the files are back and here is what happens.

"I have been fighting a virus now for 2 weeks and I can't seem to get rid of it. It creates a file in Windows\temp called pinch.exe and then I also find 2 files in the Windows folder called SMTPScaner.exe and SSSS.exe. When this happens the internet goes down because so much traffic is hitting the firewall that the cache fills up and nothing else can get out. It also un-installs the antivirus program when it hits. Once I delete all of these files and reboot the server, everything is fine and I can reinstall AVG antivirus and check the system and I can find no traces of any trojans or anything suspcious in the temp folders or the registry. I can't figure out how this is getting into the system or how to permanently remove it. I have tried several antivirus and antispyware programs but it still comes back. It is good for about 3 days and then the files are back again. I would appreciate any input and advice I could get on this. THX."

Nothing I have used to scan it with has found anything.

[junior08jr8]

Hi bts7

Try downloading smitrem and run it in safe mode, click RunThis.exe

Restart your computer normally and download CCleaner, do a complete removal of all Logs,cookies,Temps, and do a registry scan and fix them.

When you do get this trojan back, analyze it and post it here, for I will take a close look at it.