Member Avatar for billytkid

Hiya,

hope you can help with this one!

I've got a home network with a number of PC's and Mac's on it and one of the PC's started having trouble with the wireless after each reboot, in addition to this I noticed (after much looking) that the machine was trying unsuccessully to log on via http to my router.

The machine is 'protected' by Onecare and I ran I full scan from that, then removed onecare and did a full kaspersky scan, both came up negative with nothing found.

In the end I reinstalled Windows (sadly I coudnt do a format and clean install, but did install over the top of the old version), this sorted the wireless issue, however I've noticed that the log on attempts continue.

In addition to this another PC on the network (also runnning onecare for protection) is trying to log on to the router numerous times.

The router is a Speedtouch, both macines are running XP.

I have followed all requested instructions and have run ATF cleaner, windows removal tool, malwares (found nothing), ran EST online scanner (found Win32/Agent.OBH - report attached), I have tried to run DSS however it crashes at Examining Event Logs.

I would greatly appreciate if someone can have a look and let me know their thoughts on what this could be.

Many thanks

btk

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3353 (20080813)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=661d8fc7d2ce8e4fb963c2a105c6c49f
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-08-13 10:34:57
# local_time=2008-08-13 11:34:57 (+0000, GMT Standard Time)
# country="United Kingdom"
# osver=5.1.2600 NT Service Pack 3
# scanned=193819
# found=1
# scan_time=3155
C:\STOREDSTORED\rosetta stone\Rosetta.Stone.V3.Patch\Rosetta.Stone.V3.Patch.exe	Win32/Agent.OBH trojan	AFECB9656847144133E1D779CFBDA73D
Malwarebytes' Anti-Malware 1.24
Database version: 1050
Windows 5.1.2600 Service Pack 3

22:39:30 13/08/2008
mbam-log-8-13-2008 (22-39-30).txt

Scan type: Quick Scan
Objects scanned: 45142
Time elapsed: 9 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
Apple Mobile Device Support
Apple Software Update
ATI Display Driver
Bonjour
Conexant HDA D110 MDC V.92 Modem
ESET Online Scanner
GTOneCare
HijackThis 1.99.1
Hotfix for Windows XP (KB952287)
iTunes
LogMeIn
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Protection Service
Microsoft Windows Live OneCare Resources v2.5.2900.03
Microsoft Windows OneCare Live AntiSpyware and AntiVirus
Microsoft Windows OneCare Live v2.5.2900.03
Microsoft Windows OneCare Live v2.5.2900.03 Idcrl Install
PX Engine
QuickTime
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
SigmaTel Audio
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Windows Driver Package - Ricoh Company (rimsptsk) hdc  (11/14/2006 6.00.01.04)
Windows Internet Explorer 7
Windows Live OneCare
Windows XP Service Pack 3
  • 3 Contributors
  • 5 Replies
  • 252 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by notcoolzeus

Dani AI

Generated

Quick expert summary and an action path you can follow (addresses suggestions from , and ): this kind of repeated HTTP login traffic almost always comes from something running on the LAN trying automated logins or changing router settings (DNS, remote admin, port forwards). First priority is containment: physically disconnect the suspected machines from the network (unplug Ethernet or turn off Wi‑Fi) and do not reconnect them until you have identified and cleaned the cause. Before you reset the router, photograph or export the current settings (DNS, admin users, port‑forwarding) so you can compare afterwards; SpeedTouch devices use a built‑in web interface (default address commonly 192.168.1.254) — check the manual for model specifics. (scworld.com)

How to triage the infected PC(s) to find the culprit process: run a live mapping of sockets → PID → process. On Windows you can run:

netstat -ano | findstr ":80"
tasklist /FI "PID eq <PID>"

or use TCPView for a GUI view that shows which process owns each TCP/UDP endpoint. Also check persistence points (Autoruns, Scheduled Tasks, Run/RunOnce registry keys) and browser proxy settings — many downloaders alter proxies or scheduled tasks to persist. (learn.microsoft.com)

Cleaning: boot the affected PC from a current rescue/rescue‑disk and run a full offline scan (examples: Kaspersky Rescue Disk or Microsoft Defender Offline). If malware shows rootkit/backdoor behavior or you want full assurance, back up personal data, wipe the disk, delete all partitions and do a clean OS install from official media — an overlay install often leaves persistence behind. After reinstall, fully patch the system before reconnecting. (kaspersky.com)

Router hardening and return‑to‑service workflow: factory‑reset the router (after you documented settings), update the firmware, set a strong unique admin password, disable remote/web admin and WPS, confirm DNS servers are correct, and reconnect one cleaned machine first to verify no more login attempts. Follow general home‑router hardening guidance for these steps. If you see the login attempts resume from a cleaned machine, don’t reconnect other devices — the router itself may still be compromised. (ncsc.admin.ch)

Key links: TCPView (Microsoft Sysinternals), Kaspersky Rescue Disk, Microsoft Defender Offline, and a SpeedTouch manual are good starting points:

Cautions: don’t reuse backups or USB sticks from infected machines without scanning, and avoid restoring router configs that might reintroduce bad settings. If the situation looks like a large-scale router compromise (DNS changed for many devices), treat the router as compromised and replace or reflash it after reset. (scworld.com)

Recommended Answers

All 5 Replies

Member Avatar for steven woodman

You say and outside source is loging on to router or a pc inside you network.

Member Avatar for billytkid

Its the infected PC on the home LAN that is trying to access the router. Incidentally I also have another computer with the same behaviour so I'm guessing this something on both of them.

Thanks

Member Avatar for steven woodman

well, have you tried maually deleting the file/folder in safe mode?

Member Avatar for billytkid

I can delete the folder no probs, however wasnt sure if this was best to do first as it seems very strage that neither onecare nor caspersky can spot the virus. I wasnt sure if you guys on here like looking at new strains?

I'll delete in a mo and reboot if thats ok?

Member Avatar for notcoolzeus

Yup i got the same problem, my computer tries to login to the router via http using various user/passwords such as admin, motorola, badcred. It does this exactly every minute. Anti-virus finds nothing. Shrugs, FYI. Gonna wipe the hard drive and reinstall windows.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.