A
anthony dilwoth
I recently noticed a lot of funny things running in Task
Manager. After
Googling, it was apparent that my machine had been
infected with something.
Basically, what happens is that programs are inserted in
my Startup
list in MSCONFIG.
When I run Task Manager, I can see new ones each day and
even several
times during the day.
These files are almost always in C:\Windows and
C:\Windows\System32.
They cannot be deleted because the attribute is set to
read-only.
The attrib command can not change the attribute so they
can not
be deleted. Instead, I rename them from Filename.EXE to
Filename.not.
It is necessary to run MSCONFIG frequently to uncheck the
items
which have miraculously appeared in the StartUp list.
The programs which invade my machine have names like
d3jg, javayi32,
ntoo, mskm, syslo, winno32, netkf32 and so on, all with
an .EXE
extension.
These invaders are all of certain sizes. For example, in
the C:\Windows
directory, there are thirteen programs having the size
16,384. Running
File-Compare (FC) indicates that the files are identical.
So, there
are about six or seven programs which get reinstalled
numerous times
with different file names. I have about 80 of them so far.
These programs do not appear to do anything, they just sit
there.
Doing what?
I upgraded to the latest McAfee Firewell, ran all the
spybot stuff
I have, ran the awful McAfee FreeScan, downloaded
Antispyware
from Microsoft (which found eight things the others didn't
find).
And the problem has still not gone away.
After running Antispyware for the first time, I ran it
again about
an hour later and it found another 'threat' which was not
there
an hour earlier. Looks like the Firewall is useless, no?
So, what is happening?
First idea: the Firewall does not prevent some machine
from
putting stuff on my machine and modifying the StartUp list
in MSCONFIG.
Second idea: lurking somewhere on my machine is a program
which
periodically runs itself, sees if the programs which it had
previously installed were still there, and, if not,
reinstalls
them with different names.
Some of the programs and their size follow: (If you have
any
of these you are infected.)
16,384 d3jg
17,183 javayi32
16,384 ntoo
17,183 mskm
17,183 syslo
17,183 sdkvb
16,384 atlxk32
17,183 winno32
17,201 msrn
17,018 javaai
16,384 netkf32
16,384 appcv32
16,384 javans
16,384 apilc
66,560 tyxcl
16,384 APIAH32
66,560 uvdfeu
16,384 MFCMM32
16,384 javalc
16,384 addil32
16,384 crvt32
16,384 ntuj
On the second day after installing Antispyware, I got a
message from it
saying that something wanted to add ntuj.exe to my StartUp
List. I
told it not to allow it, but it got installed anyway. So
much for
Antispyware! Furthermore, Antispyware should have told me
the name
of the program which wanted to add ntuj so that I could
find it and
perhaps kill it.
7:49am Friday: Antispyware (ASW) just told me that
something wanted
to install itself in the Startup List. I told it to
block, but it
got installed anyway.
8:04am Windows Firewall (not McAfee) told me that my
machine
was being invaded. It did not allow me an option to block
it. So,
there were two new programs in the Startup List: ntyq and
atplv32.
9:26am Message from ASW about SYSFS. Told it to block but
it didn't.
and on and on. . . .
Manager. After
Googling, it was apparent that my machine had been
infected with something.
Basically, what happens is that programs are inserted in
my Startup
list in MSCONFIG.
When I run Task Manager, I can see new ones each day and
even several
times during the day.
These files are almost always in C:\Windows and
C:\Windows\System32.
They cannot be deleted because the attribute is set to
read-only.
The attrib command can not change the attribute so they
can not
be deleted. Instead, I rename them from Filename.EXE to
Filename.not.
It is necessary to run MSCONFIG frequently to uncheck the
items
which have miraculously appeared in the StartUp list.
The programs which invade my machine have names like
d3jg, javayi32,
ntoo, mskm, syslo, winno32, netkf32 and so on, all with
an .EXE
extension.
These invaders are all of certain sizes. For example, in
the C:\Windows
directory, there are thirteen programs having the size
16,384. Running
File-Compare (FC) indicates that the files are identical.
So, there
are about six or seven programs which get reinstalled
numerous times
with different file names. I have about 80 of them so far.
These programs do not appear to do anything, they just sit
there.
Doing what?
I upgraded to the latest McAfee Firewell, ran all the
spybot stuff
I have, ran the awful McAfee FreeScan, downloaded
Antispyware
from Microsoft (which found eight things the others didn't
find).
And the problem has still not gone away.
After running Antispyware for the first time, I ran it
again about
an hour later and it found another 'threat' which was not
there
an hour earlier. Looks like the Firewall is useless, no?
So, what is happening?
First idea: the Firewall does not prevent some machine
from
putting stuff on my machine and modifying the StartUp list
in MSCONFIG.
Second idea: lurking somewhere on my machine is a program
which
periodically runs itself, sees if the programs which it had
previously installed were still there, and, if not,
reinstalls
them with different names.
Some of the programs and their size follow: (If you have
any
of these you are infected.)
16,384 d3jg
17,183 javayi32
16,384 ntoo
17,183 mskm
17,183 syslo
17,183 sdkvb
16,384 atlxk32
17,183 winno32
17,201 msrn
17,018 javaai
16,384 netkf32
16,384 appcv32
16,384 javans
16,384 apilc
66,560 tyxcl
16,384 APIAH32
66,560 uvdfeu
16,384 MFCMM32
16,384 javalc
16,384 addil32
16,384 crvt32
16,384 ntuj
On the second day after installing Antispyware, I got a
message from it
saying that something wanted to add ntuj.exe to my StartUp
List. I
told it not to allow it, but it got installed anyway. So
much for
Antispyware! Furthermore, Antispyware should have told me
the name
of the program which wanted to add ntuj so that I could
find it and
perhaps kill it.
7:49am Friday: Antispyware (ASW) just told me that
something wanted
to install itself in the Startup List. I told it to
block, but it
got installed anyway.
8:04am Windows Firewall (not McAfee) told me that my
machine
was being invaded. It did not allow me an option to block
it. So,
there were two new programs in the Startup List: ntyq and
atplv32.
9:26am Message from ASW about SYSFS. Told it to block but
it didn't.
and on and on. . . .