What data is being sent and how to stop this?  I share my results and tips with you.

The Pattern

Any time I opened a browser, either Firefox or IE (Internet Explorer), within seconds my computer attempted to connected to the mystery server.

SmartSniff tells me what my computer is doing online.

My computer attempted to get something, shown above.  Luckily, most of the time, the mystery server was offline (I guess) because I got a 404 error returned.  What is that string of characters that my computer is sending to the mystery server? Is it code being sent to a hacker, disguised as a GET request, which he can translate into something meaningful?  I don’t know, but I don’t like it, so we’re going to get this hack off my computer.

Above, we see that the mystery server is a nginx type.

The Code’s Hiding Place

I found the code making these unwanted internet connections in a file located in:

C:\Users\{your name}\AppData\Local\Temp\winbdm.dll

The code contained part of the URL request to the mystery server:

GET /mon/?d=cid=

Hacker IP’s and Location

When I looked inside the file:  winbdm.dll, I saw two IP addresses:

89.149.228.199:81 – The first time I did an IP lookup, I was told this IP is in Germany.  But the last time I checked, I’m told it’s in Russia.  Doing a trace, I see the last known stop before data gets to the final destination is:

213.59.3.102
rt-comm.ru
Moscow, 48
Russian Federation

The other IP shown in the winbdm.dll file is 95.168.185.16:81 (Hong Kong?)

The mystery IP is associated with malware, according to this source.

More searching online told me that this code is a trojan and might steal data.

A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)  Source

Another website said that this trojan…

Attempts to modify the hosts file. This could be used to map hostnames different IP addresses redirecting traffic to an alternate location.  Source

Delete the Code?

Of course, it’s not simple enough to just delete the file.  Microsoft’s Vista said I did not have permission to delete this file from my own machine!

Failed Attempts to Remove Trojan

I ran a scan using Vista’s Windows Defender.  Worthless.

Vista Finds Nothing - Let's Trojan Stay

Next, I download and install Comodo, and let it scan the computer.  It finds the file!

Comodo correctly spotted winbdm.dll, but Comodo can’t remove it.

Comodo also says it does not recognize a couple harmless programs I’ve been using for years:  Puretext and RemindMe.  I’m not deleting those.

I uninstall Comodo.  Side note:  Days later I noticed an unsolicited connection from my machine going to crl.usertrust.com.  I checked that I had uninstalled Comodo and it does not show up under my install programs, so why is my computer still connecting to Comodo without my consent?

The Solution

Download and run Kaspersky.  I installed Kaspersky but did not register it or enter my email address.  No need to do that for a single use.  Like Comodo, Kaspersky found the trojan, but unlike Comodo, Kaspersky also offered to remove it and fix the problem.

Side note…After Kaspersky fixed this problem, I shut Kaspersky down and verified it did not show up as a process running in my task manager.  I wanted to see if Kaspersky would try to make any internet connections even though it was no longer visibly running on my machine.  I was surprised to see a tiny amount of data sent to a Russian server…

When I looked up the IP my computer was connecting to without my consent, I found that IP 81.176.230.28 is in the Russian Federation and is run by an ISP named “KASPERSKY LABS”.  Hhhmm.  I don’t like the idea of any data being sent to Kaspersky when the program was supposed to be closed.  But, they did help me out, free of charge, so I can’t complain too much, and I can’t show that they did anything to harm my machine or my privacy with just 150 Bytes of data being sent without my consent.

Conclusion

Kaspersky successfully removed the trojan.  The winbdm.dll file is gone.  My computer no longer attempts to make a hosts2-ns connection to 89.149.228.199.

Open Question

How do we fight this?  Does the FBI do anything to protect us?  How about Microsoft?  Anyone responsible for keeping our computers safe?

I decided to write an email (in Russian) to the last known hop that connects to the hacker’s server.

If you would also like to write an email:  info@rtcomm.ru  Source

The company I emailed, rtcomm, claims to fight hackers, so we’ll see if they take this seriously. I will update this page based on their response or lack of response.

Here is my email to them:  Russian Email

-

Edit Dec-9-2010:  Two weeks have passed.  No Response from rtcomm.  That makes it appear they don’t take internet security as seriously as they advertise.  Disappointing.

Radica U-Create, by Mattel

The machine by itself is harmless, but when I installed the optional software that came with it, I had trouble.

First of all, the program was worthless to me and I wanted to uninstall it after I realized it was nothing we wanted on our computer.

My anti-virus program, Comodo, has been telling me that ucreate.exe was doing suspicious things on my computer.

Comodo shows activity on my computer even AFTER I uninstalled the program. (Click for bigger view.)

I tried to manually delete the files but they wouldn’t go away.  I got an “access denied” and “permission required” error.

I tried many tricks, using CMD, the command line tool, etc.  Here is what finally worked on my Vista machine:

Reboot into safe mode.  To do that:  Restart computer.  After you see the motherboard’s BIOS messages, press and hold F8 on the keyboard.  Windows asks what kind of safe mode you want.  I selected safe mode with command line.

Navigated to the folder using this command:

cd  C:\Program Files (x86)\Radica\UCreate\Music\

Delete UCreate.exe: 

del UCreate.exe

I still could not delete the folders, though, even in safe mode.  Rebooted the computer again, this time into regular mode.  Once in normal Vista running mode, I again tried deleting the folders using Explorer and that finally worked, too.  No more files or Radica folder on my computer.  It’s gone!

We can still play music on the machine, but I will not connect it to my computer again.  I thought I should put some notes online in case you have this problem as well.

After doing some maintenance work on the inside of my computer, I turned it back on and got the very unhelpful message from Vista:

BOOTMGR is missing

Press Ctrl+Alt+Del to restart

Well, when I pressed the keys to restart, the error comes right back.  It’s an endless loop.  What the heck does this message mean anyway?  I found the problem and was able to fix it.  Read on for the solution.

Now there could be many causes of this error.  It could be corrupt files on your Vista installation.  I first reached for the Vista DVD and rebooted the computer and ran the repair tool from the DVD.  But the repair utility could not find my Vista installation.  The repair program offered no other helpful information.

Before this problem surfaced, I had opened the computer for an unrelated issue.

My computer had been overheating so I got into the case and removed the dust bunnies from the CPU heat sink.  That solved the overheating issue but then the computer would no longer boot up Vista.

The problem:  the hard drive SATA cable came unplugged!

Buried behind cables is a hard drive.

Anyone else notice how flimsy the connection is between a SATA connector and a hard drive?  These connectors pop out of my hard drives way too easily.  Just a small bump on one of the cables and the hard drive is no longer connected to the motherboard.

The solution to this problem was simply to reconnect the SATA cable.

After powering the computer back up, Vista loaded up just fine.

Another BOOTMGR problem

Hours later, the problem resurfaced.  I was running the Abit uGuru program to monitor the temperature of my CPU.  When I closed uGuru, Vista gave me the blue screen of death.  That was strange, especially since the CPU temp was normal.  When I rebooted the computer, the BOOTMGR is missing error came back.  I was disheartened by that but quickly fixed it.

I opened the case back up and disconnected my RAID drives by pulling the SATA connectors out of them.  Rebooted the computer.  The error was again gone and Vista loaded up, however I was missing my RAID drives.

Turned off the computer and reconnected the SATA cables to the RAID hard drives.  Powered up the computer.  Vista loaded up fine with no errors and the RAID storage was back.  All problems were resolved.

I made this fix a couple days ago and have had no more problems.  All of the BOOTMGR errors for me appear to be related to the SATA connections between the motherboard and hard drives.  Now that the connections are good, the computer is running well.

Conclusion

If you have the missing BOOTMGR message and you recently did some work inside your computer case, you might check that your hard drive is still connected to the motherboard.

Added Sep-2-2008

Vista says: The backup did not complete successfully.  The latest backup set can not be found.

Here’s a way to make Vista start over.

Edited Jan-23-2009

Added Aug-01-2008

how can you restore it to an older saved state?

Added Jul-02-2008

This article might help you find your saved games in Vista’s Virtualstore. Read

Edited Jul-30-2008

When I ordered a Drobo unit from BuyDig.com, I was encouraged by a $50 cash rebate. But is the rebate a real deal?
Drobo rebate.

Some router configuration tips: D-Link DI-LB604 Dual-WAN Load Balancing router

Updated Jun-18-2008

Want to know how to set up your router for surfing secure websites and sending SMTP email? Tips

How to save audio in audacity for use in Hammer (the Half Life 2 map editor)

Added Feb-26-2008

This tutorial is for map designers, using Hammer. I show the simple, but necessary step to convert audio to work in speakers, using Audacity, a free audio editing tool. Tutorial.

How to reinstall Juice Podcast Receiver

Added Feb-21-2008

Getting an error with your Juice Podcast Receiver like the one below?

It might be time for a reinstall. Here’s how I did it without losing my settings. Tutorial

Nvu Tutorials

Online videos showing how to do a few things in Nvu, like how to resize tables.

Has your doctor been good to you?

Visit DoctorScorecard.com and share the experiences you have had with doctors, good or bad. Does your doctor meet your medical needs? Give your doctor a score! See what other people have said about their doctors.

DoctorScorecard

What’s the best-tasting tomato? Some people say it’s the Cherokee Purple.