Any knowledge of Spyware from No-IP.com?

[rhettl]

I have recently installed the DUC client from No-IP.com on my Win 2000 server. Since then I have had errors when connected to the Internet with a notice from the NTAUTHORITY telling me it is shutting down my system in 60 seconds! I checked my installed programs and I thought lets try remove this program - however I can't get it to uninstall. I get the following message:

The instruction at "0x0040346a" referenced memory at "0x00cecd4c". The memory could not be read.

Now I remember that message is similar to the one I get just before the message that shuts down my PC! Very annoying, and it leaves me suspicious of the Dynamic Update Client from No-IP.com. Anyone know of issues with this?

Thanks

 

[RDSKC]

finally, something I can respond to...

we use No-ip quite extensively for our clients who don't have a static ip, this make PCAnywhere support quick and painless. I'm guessing almost 30 clients so far... No known issues.

What you're describing sounds familiar, but i don't think it's related. I suggest posting a hi-jack this log....

rich@rdskc

 

[rhettl]

I am not familiar with the hi-jack log, but I found some references to this, downloaded it and after running it I get this feedback. Its good to hear your confidence in No-ip service, but I do have a problem with the installation and would like to uninstall it. However, for the log:


Logfile of HijackThis v1.99.1
Scan saved at 12:22:57 AM, on 22/7/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\spoolsv.exe
E:\WINNT\System32\msdtc.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\System32\llssrv.exe
E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\PROGRA~1\NAVNT\navapsvc.exe
E:\Program Files\Norton Internet Security Family Edition\NISUM.EXE
E:\PROGRA~1\NAVNT\npssvc.exe
E:\WINNT\System32\nvsvc32.exe
E:\WINNT\system32\regsvc.exe
E:\WINNT\system32\MSTask.exe
E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\Dfssvc.exe
E:\WINNT\System32\inetsrv\inetinfo.exe
E:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
E:\Program Files\Norton Internet Security Family Edition\NISSERV.EXE
E:\PROGRA~1\NAVNT\alertsvc.exe
E:\WINNT\System32\svchost.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
E:\Program Files\NAVNT\POPROXY.EXE
E:\Program Files\Analog Devices\SoundMAX\SMTray.exe
E:\Program Files\iTunes\iTunesHelper.exe
E:\Program Files\NAVNT\navapw32.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
E:\WINNT\system32\rundll32.exe
H:\W2K3Svr.Net\Microsoft Office\Office\OUTLOOK.EXE
E:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
E:\Program Files\Internet Explorer\iexplore.exe
E:\WINNT\system32\NOTEPAD.EXE
G:\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - H:\W2K3Svr.Net\FreshDevices\FreshDownload\fdcatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdaptecDirectCD] "E:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\Run: [NT Logging Service] syslog32.exe
O4 - HKLM\..\Run: [NPS Event Checker] E:\PROGRA~1\NAVNT\npscheck.exe
O4 - HKLM\..\Run: [NAV DefAlert] E:\PROGRA~1\NAVNT\defalert.exe
O4 - HKLM\..\Run: [Norton eMail Protect] E:\Program Files\NAVNT\POPROXY.EXE
O4 - HKLM\..\Run: [WINRUN] svchost32.exe
O4 - HKLM\..\Run: [smapp] E:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [iTunesHelper] E:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
O4 - HKLM\..\RunServices: [WINRUN] svchost32.exe
O4 - Startup: Norton AntiVirus AutoProtect.lnk = E:\Program Files\NAVNT\navapw32.exe
O4 - Startup: Microsoft Office.lnk = H:\W2K3Svr.Net\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Service Manager.lnk = E:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Startup: OpenOffice.org 1.1.2.lnk = E:\Program Files\OpenOffice.org1.1.2\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINNT\System32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINNT\web\related.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -

http://www.pandasoftware.com/activescan/as5/asinst.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = comshop.co.zw
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A253A10-3FD3-4AB2-9D6B-617A57757955}: NameServer = 196.44.176.1 196.44.176.4
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = comshop.co.zw
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = comshop.co.zw
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - E:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - E:\WINNT\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NAV Alert - Symantec Corporation - E:\PROGRA~1\NAVNT\alertsvc.exe
O23 - Service: NAV Auto-Protect - Symantec Corporation - E:\PROGRA~1\NAVNT\navapsvc.exe
O23 - Service: Norton Internet Security Family Edition Service (NISSERV) - Symantec Corporation - E:\Program Files\Norton Internet Security Family Edition\NISSERV.EXE
O23 - Service: NISUM - Symantec Corporation - E:\Program Files\Norton Internet Security Family Edition\NISUM.EXE
O23 - Service: Norton Program Scheduler - Symantec Corporation - E:\PROGRA~1\NAVNT\npssvc.exe
O23 - Service: NT login service (ntlogin32) - Unknown owner - E:\WINNT\system32\cool.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - E:\WINNT\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - E:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

 

[crow053]

according to this,

http://hijackthis.de/index.php

you have a few issues. This site is a good starter for your hijack this log