Only 3G gets affected by "Mass mailer"

S

Sl33py

Well-Known Member
Joined
Mar 11, 2009
Messages
262
Reaction score
0
Location
East London
Hi
My client complained that his 3G card data gets used very fast. He had no antivirus on so I sold him ESET and scanned his PC, found one infection.
I also used, Spybot, malwarebytes and Trojan Remover.

Trojan remover picked up a hidden service in the registry that was calling for a file called llwewti.sys. I can’t delete the registry link or file.
I can’t submit it for analyse either, it is locked. Malwarebytes file assassin could not even delete it.

If it is connected to my network it does not use a lot of data, as soon as you connect it to Vodacom it starts using a lot of data. Below is my TCP connections.
Look at service.exe 616 it looks to me like it mass mails?
Have scanned with Eset in safe mode as well..

svchost.exe:864 TCP WinVistaUser-PC:epmap WinVistaUser-PC:0 LISTENING
wininit.exe:532 TCP WinVistaUser-PC:1025 WinVistaUser-PC:0 LISTENING
svchost.exe:1020 TCP WinVistaUser-PC:1026 WinVistaUser-PC:0 LISTENING
svchost.exe:1088 TCP WinVistaUser-PC:1027 WinVistaUser-PC:0 LISTENING
lsass.exe:632 TCP WinVistaUser-PC:1028 WinVistaUser-PC:0 LISTENING
services.exe:616 TCP WinVistaUser-PC:1029 WinVistaUser-PC:0 LISTENING
System:4 TCP WinVistaUser-PC:microsoft-ds WinVistaUser-PC:0 LISTENING
System:4 TCP WinVistaUser-PC:5357 WinVistaUser-PC:0 LISTENING
System:4 TCP 41.2.137.119:netbios-ssn WinVistaUser-PC:0 LISTENING
services.exe:616 TCP 41.2.137.119:2355 80.237.177.85:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2361 64.199.246.125:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2387 203.130.232.200:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2417 90.183.38.65:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2421 89.111.88.229:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2450 69.59.189.80:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2461 64.206.141.186:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2467 69.2.125.19:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2485 204.232.236.128:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2486 216.163.188.57:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2501 74.6.140.31:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2502 70.88.157.145:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2503 62.128.193.140:smtp SYN_SENT
services.exe:616 TCP 41.2.137.119:2481 219.106.241.174:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2483 32.104.18.86:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2484 s5a1.psmtp.com:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2487 63.118.134.194:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2488 220.241.182.51:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2474 130.56.66.57:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2475 208.65.145.13:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2476 194.116.198.11:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2477 68.1.17.3:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2478 mail.global.frontbridge.com:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2470 72.167.238.201:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2473 212.50.160.72:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2454 114.255.115.132:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:ms-theater 64.18.4.13:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2451 67.222.141.190:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2452 209.151.238.179:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2443 216.237.12.147:smtp ESTABLISHED
 
services.exe:616 TCP 41.2.137.119:2432 202.79.217.55:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2423 62.29.136.90:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2418 195.28.226.107:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2388 24.40.8.248:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2389 24.40.8.248:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2367 203.31.252.2:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2369 193.252.22.143:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2356 61.117.194.11:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2322 eforwardct.name-services.com:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2154 208.80.152.2:http ESTABLISHED
services.exe:616 TCP 41.2.137.119:2314 63.106.106.22:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2335 66.234.224.22:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2411 193.252.22.143:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2419 ib1.charter.net:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2445 72.89.171.188:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2447 209.150.232.5:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2469 mail.global.frontbridge.com:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2479 69.36.34.214:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2480 150.101.122.62:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2482 207.126.154.10:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2489 220.241.182.51:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2490 85.158.139.35:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2491 210.3.11.228:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2492 193.194.133.18:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2493 213.189.198.3:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2494 85.207.60.10:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2495 162.39.147.49:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2496 mail.global.frontbridge.com:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2497 206.54.145.17:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2498 74.125.79.114:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2499 vw-in-f27.1e100.net:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2500 87.236.241.64:smtp ESTABLISHED
services.exe:616 TCP 41.2.137.119:2471 193.43.191.3:smtp FIN_WAIT1
services.exe:616 TCP 41.2.137.119:2377 208.87.233.190:smtp FIN_WAIT1
services.exe:616 TCP 41.2.137.119:2435 80.77.37.218:smtp FIN_WAIT1
services.exe:616 TCP 41.2.137.119:2466 64.74.112.200:smtp FIN_WAIT1
services.exe:616 TCP 41.2.137.119:2449 208.110.200.9:smtp FIN_WAIT1
services.exe:616 TCP 41.2.137.119:2246 p2.nsm.ctmail.com:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2143 200.63.80.15:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2144 218.102.23.150:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2145 218.102.23.150:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2107 168.95.5.71:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2095 168.95.5.29:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2138 198.153.162.20:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2097 168.95.5.33:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2130 208.84.66.219:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2120 124.105.18.84:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2111 168.95.6.133:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2105 168.95.5.68:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2114 168.95.6.133:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2112 168.95.6.133:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2113 168.95.6.133:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2096 168.95.5.31:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2110 168.95.6.133:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:mzap 168.95.5.7:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2094 168.95.5.23:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2104 168.95.5.59:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2098 168.95.5.36:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2099 168.95.5.39:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2108 168.95.5.72:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2092 168.95.5.17:smtp FIN_WAIT1
services.exe:616 TCP winvistauser-pc:2042 216.163.188.54:smtp FIN_WAIT1
services.exe:616 TCP 41.2.137.119:2463 64.12.137.207:smtp CLOSE_WAIT
 
plugged his drive into my PC NOD then picked the file up as win32/bubnix.ab trojan, at least I know what I am dealing with the trojan creates a random *.sys file and thats why I could not find out what it was.
 
yes i did, after the trojan file was removed I coulld remove the link from the registry and it was all gone..
Thanks
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X