Suspicious Files

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I just discovered some files which I never noticed before. I submitted them
to VirusTotal but the scans did not find anything.
I also performed a scan with HijackThis v1.99.1 and had the log file
submitted and analyzed. The result of the log file was okay.
Anyway, since I am pretty sure for not having downloaded these files I am
worried that they may be anything but harmless.
I kindly request your request your expert opinion as how to handle these
files viz "SecTaskMan" in Documents and Settings, "XoftSpy" and
"InstallShieldInformation" both in Program Files.
 
From: "Kayman" <[email protected]>

| I just discovered some files which I never noticed before. I submitted them
| to VirusTotal but the scans did not find anything.
| I also performed a scan with HijackThis v1.99.1 and had the log file
| submitted and analyzed. The result of the log file was okay.
| Anyway, since I am pretty sure for not having downloaded these files I am
| worried that they may be anything but harmless.
| I kindly request your request your expert opinion as how to handle these
| files viz "SecTaskMan" in Documents and Settings, "XoftSpy" and
| "InstallShieldInformation" both in Program Files.
|


Xoftspy is a Rogue anti spyware application
http://www.spywarewarrior.com/rogue_anti-spyware.htm#xos_note

If it is listed on Spyware Warrior, the software should not be used.

SecTaskMan in Google searches finds that this could be adware/spyware or an RBot worm.

Remove both. Manually or via "Add/Remove programs". You may load in Sagfe Mode and
manually remove folders and you may have to use legitimate anti spyware applications (those
NOT listed as Rogues on Spyware Warrior).

Since you are constantly having problems with malware, I think it is time you learn how to
use a News Reader to access UseNet News Groups.

The ones you need to access are...

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus
alt.privacy.spyware

Using a News Reader to access News Groups is the preferred and impressively *better* way to
access News Groups.

The following URL will take your default News Reader (most likley Outlook Express) to the
Microsoft Virus/Security News Group.

news://msnews.microsoft.com/microsoft.public.security.virus


The following URL will take your default News Reader anti spyware News Group

news://aioe.cjb.net/alt.privacy.spyware

The following URL will take your default News Reader anti virus News Group

news://aioe.cjb.net/alt.comp.anti-virus


Note that Microsoft hosts its own News Server; news://msnews.microsoft.com
However, the News Groups that start with 'alt' (the ALTernate hierarchy) are purely public
UseNet News Groups and require a public or private News Server. As a subscriber to Verizon,
I can get to the alt.comp.virus and the alt.privacy.spyware News Groups via a Verizon
provided News Server news.verizon.net but it is ONLY available to Verizon subscribers.
That is why I posted a publicly availble, yey very limited News Server; aioe.cjb.net so
you can access them.

Because I use a News Reader and access News Groups properly (not using a web Browser front
end) I can tell that you are posting from Thailand. You would haver to contact your ISP,
Loxley Information Company Ltd., to find out if they offer a News Server for your use like
Verizon does for its subscribers. If they don't you can continue using;
news://aioe.cjb.net [ http://news.aioe.org/en/ ] or find another free or pay service
(some only have a one time initial setup fee, others a monthly subscription).
 
Kayman said:
I just discovered some files which I never noticed before. I
submitted them to VirusTotal but the scans did not find
anything.
I also performed a scan with HijackThis v1.99.1 and had the
log file submitted and analyzed. The result of the log file
was okay.
Anyway, since I am pretty sure for not having downloaded
these files I am worried that they may be anything but
harmless.
I kindly request your request your expert opinion as how to
handle these files viz "SecTaskMan" in Documents and
Settings, "XoftSpy" and "InstallShieldInformation" both in
Program Files.
Click to expand...

#1. Security Task Manager is a third party program that creates
a folder in the following location:

C:\Documents and Settings\All Users\Application Data\SecTaskMan

If it doesn't sound familiar, here's more info on that program:

Security Task Manger
http://www.neuber.com/taskmanager/index.html

Check in Control Panel -> Add/Remove Programs to see if you can
uninstall it from there. If not, simply delete the folder.

#3. The following is a legitimate hidden folder:
C:\Program Files\InstallShield Installation Information
It contains files related to many of the applications installed
on your computer.

I'd be suspicious if you found a folder with a similar name
such as
"InstallShieldInformation".

Make sure your antivirus program is up-to-date and run a scan.
You should also run a scan with AdAware and Spybot S & D.

AdAware
http://www.spychecker.com/program/adaware.html

Spybot S & D
http://www.spychecker.com/program/spybot.html

You might also consider running some of the online virus
scanners:

http://housecall.trendmicro.com/

http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

http://us.mcafee.com/root/mfs/default.asp?WWW_URL=www.mcafee.com/myapps/mfs/default.asp

Good luck

Nepatsfan
 
Thanks for response Nepatsfan.

Found out that SecTaskMan is spyware related and XoftSpy got bad reviews in
Spywarewarrior website. So I just removed and deleted these 2 folders which
seemed to work without any complications.

After having a second look it turned out that the folder is named
InstallShield Installation Information and not what I had quoted in my
original post. Sorry about that, must be more careful in future.

Thanks again.
 
I subscribed to microsoft.public.security.virus, alt.com.anti-virus and
alt.privacy.spyware.

I succesfully removed/deleted SecTaskMan and XoftSpy folders from their
respective location. However they were not present in the "Add/Remove
Programs" window which probably was a good thing.

I ran a scans in safe mode with Ad-Aware and Spybot S&D - no findings.

With respect to my previous post concerning Generic.CA-tr, I never received
a result from McAfee for checking the submitted WordWeb password protected
zip file. And since I did not not get a response from you I just
removed/deleted the entire W/Web program. I only hope this did the trick!

I wish to post a last request on this Newsgroup before swapping to the other
Outlook Express based newsgroups.

I am unable scanning with either application located in folder C:\AV-CLS
after rebooting my computer. The "download indicator" which is monitoring the
progress of the downloading operation for each scanning engine (Sophos, Trend
and McAfee) shows that each download was successful. In fact I am able to
scan right after completion of downloading still on-line. But once rebooted
and accessing the start window for the 3 scanners and pressing the respective
key for Sophos or Trend a message pops up "Pattern File not found. Computer
shuts down to obtain Pattern File in normal mode". Pressing the key for
McAfee an error message will display "c:\AV-CLS\Mcafee\update.ini not opened
for READ, error code: [1]
My FireWall(s) were definitely disabled.
I removed and downloaded AV-CLS several times but no luck. There are
probably some settings within my computer which may have to be adjusted.
Could you kindly advise or direct my to the right person to look into this
problem.

David H. Lipman said:
From: "Kayman" <[email protected]>

| I just discovered some files which I never noticed before. I submitted them
| to VirusTotal but the scans did not find anything.
| I also performed a scan with HijackThis v1.99.1 and had the log file
| submitted and analyzed. The result of the log file was okay.
| Anyway, since I am pretty sure for not having downloaded these files I am
| worried that they may be anything but harmless.
| I kindly request your request your expert opinion as how to handle these
| files viz "SecTaskMan" in Documents and Settings, "XoftSpy" and
| "InstallShieldInformation" both in Program Files.
|


Xoftspy is a Rogue anti spyware application
http://www.spywarewarrior.com/rogue_anti-spyware.htm#xos_note

If it is listed on Spyware Warrior, the software should not be used.

SecTaskMan in Google searches finds that this could be adware/spyware or an RBot worm.

Remove both. Manually or via "Add/Remove programs". You may load in Sagfe Mode and
manually remove folders and you may have to use legitimate anti spyware applications (those
NOT listed as Rogues on Spyware Warrior).

Since you are constantly having problems with malware, I think it is time you learn how to
use a News Reader to access UseNet News Groups.

The ones you need to access are...

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus
alt.privacy.spyware

Using a News Reader to access News Groups is the preferred and impressively *better* way to
access News Groups.

The following URL will take your default News Reader (most likley Outlook Express) to the
Microsoft Virus/Security News Group.

news://msnews.microsoft.com/microsoft.public.security.virus


The following URL will take your default News Reader anti spyware News Group

news://aioe.cjb.net/alt.privacy.spyware

The following URL will take your default News Reader anti virus News Group

news://aioe.cjb.net/alt.comp.anti-virus


Note that Microsoft hosts its own News Server; news://msnews.microsoft.com
However, the News Groups that start with 'alt' (the ALTernate hierarchy) are purely public
UseNet News Groups and require a public or private News Server. As a subscriber to Verizon,
I can get to the alt.comp.virus and the alt.privacy.spyware News Groups via a Verizon
provided News Server news.verizon.net but it is ONLY available to Verizon subscribers.
That is why I posted a publicly availble, yey very limited News Server; aioe.cjb.net so
you can access them.

Because I use a News Reader and access News Groups properly (not using a web Browser front
end) I can tell that you are posting from Thailand. You would haver to contact your ISP,
Loxley Information Company Ltd., to find out if they offer a News Server for your use like
Verizon does for its subscribers. If they don't you can continue using;
news://aioe.cjb.net [ http://news.aioe.org/en/ ] or find another free or pay service
(some only have a one time initial setup fee, others a monthly subscription).
Click to expand...
 
From: "Kayman" <[email protected]>

| I subscribed to microsoft.public.security.virus, alt.com.anti-virus and
| alt.privacy.spyware.
|
| I succesfully removed/deleted SecTaskMan and XoftSpy folders from their
| respective location. However they were not present in the "Add/Remove
| Programs" window which probably was a good thing.
|
| I ran a scans in safe mode with Ad-Aware and Spybot S&D - no findings.
|
| With respect to my previous post concerning Generic.CA-tr, I never received
| a result from McAfee for checking the submitted WordWeb password protected
| zip file. And since I did not not get a response from you I just
| removed/deleted the entire W/Web program. I only hope this did the trick!
|
| I wish to post a last request on this Newsgroup before swapping to the other
| Outlook Express based newsgroups.
|
| I am unable scanning with either application located in folder C:\AV-CLS
| after rebooting my computer. The "download indicator" which is monitoring the
| progress of the downloading operation for each scanning engine (Sophos, Trend
| and McAfee) shows that each download was successful. In fact I am able to
| scan right after completion of downloading still on-line. But once rebooted
| and accessing the start window for the 3 scanners and pressing the respective
| key for Sophos or Trend a message pops up "Pattern File not found. Computer
| shuts down to obtain Pattern File in normal mode". Pressing the key for
| McAfee an error message will display "c:\AV-CLS\Mcafee\update.ini not opened
| for READ, error code: [1]
| My FireWall(s) were definitely disabled.
| I removed and downloaded AV-CLS several times but no luck. There are
| probably some settings within my computer which may have to be adjusted.
| Could you kindly advise or direct my to the right person to look into this
| problem.
|

Kayman:

I don't know why you still have problems with the McAfee Moule. However, I know why you got
"...Trend a message pops up "Pattern File not found". Trend Micro changed the URL that
pointed to the Pattern Files and I had to re-program the scripts for that new URL. The
Multi_AV.exe file has been updated and when you run and extract the files it should fix the
Trend Micro problem.

http://www.ik-cs.com/programs/virtools/Multi_AV.exe
 
Okay David, I am going to remove/delete the entire AV-CLS folder and
re-download with the firewall disabled.
The "Pattern File not Found" message also popped up when I hit the key for
accessing Sophos.
Would you please recommend a newsgroup which advises on non-virus related
issues such as I am experiencing? (McAfee v4.40.0 is such an efficient tool!).
Please note that I never had a problem with the "stand-alone" version which
I already deleted since the virus data file can not be updated anymore.

David H. Lipman said:
From: "Kayman" <[email protected]>

| I subscribed to microsoft.public.security.virus, alt.com.anti-virus and
| alt.privacy.spyware.
|
| I succesfully removed/deleted SecTaskMan and XoftSpy folders from their
| respective location. However they were not present in the "Add/Remove
| Programs" window which probably was a good thing.
|
| I ran a scans in safe mode with Ad-Aware and Spybot S&D - no findings.
|
| With respect to my previous post concerning Generic.CA-tr, I never received
| a result from McAfee for checking the submitted WordWeb password protected
| zip file. And since I did not not get a response from you I just
| removed/deleted the entire W/Web program. I only hope this did the trick!
|
| I wish to post a last request on this Newsgroup before swapping to the other
| Outlook Express based newsgroups.
|
| I am unable scanning with either application located in folder C:\AV-CLS
| after rebooting my computer. The "download indicator" which is monitoring the
| progress of the downloading operation for each scanning engine (Sophos, Trend
| and McAfee) shows that each download was successful. In fact I am able to
| scan right after completion of downloading still on-line. But once rebooted
| and accessing the start window for the 3 scanners and pressing the respective
| key for Sophos or Trend a message pops up "Pattern File not found. Computer
| shuts down to obtain Pattern File in normal mode". Pressing the key for
| McAfee an error message will display "c:\AV-CLS\Mcafee\update.ini not opened
| for READ, error code: [1]
| My FireWall(s) were definitely disabled.
| I removed and downloaded AV-CLS several times but no luck. There are
| probably some settings within my computer which may have to be adjusted.
| Could you kindly advise or direct my to the right person to look into this
| problem.
|

Kayman:

I don't know why you still have problems with the McAfee Moule. However, I know why you got
"...Trend a message pops up "Pattern File not found". Trend Micro changed the URL that
pointed to the Pattern Files and I had to re-program the scripts for that new URL. The
Multi_AV.exe file has been updated and when you run and extract the files it should fix the
Trend Micro problem.

http://www.ik-cs.com/programs/virtools/Multi_AV.exe
Click to expand...
 
From: "Kayman" <[email protected]>

| Okay David, I am going to remove/delete the entire AV-CLS folder and
| re-download with the firewall disabled.
| The "Pattern File not Found" message also popped up when I hit the key for
| accessing Sophos.
| Would you please recommend a newsgroup which advises on non-virus related
| issues such as I am experiencing? (McAfee v4.40.0 is such an efficient tool!).
| Please note that I never had a problem with the "stand-alone" version which
| I already deleted since the virus data file can not be updated anymore.

Viruses:
alt.comp.virus
alt.comp.anti-virus
microsoft.public.security.virus

Non-viral malware
alt.privacy.spyware

You don't have to remove C:\AV-CLS Just run the latest version (v2.26) of Multi_AV.exe
which will overwrite the files with their respective new versions.

http://www.ik-cs.com/programs/virtools/Multi_AV.exe
 
Hi Dave:
I removed C:\AV-CLS already. Anyway, I again started from scratch and
downloaded C:\AV-CLS, after opening/closing zip and disabling firewall,
started downloading McAfee first, followed by Trend And Sophos.

McAfee, Wget ftp.nai.speedera.........Length 7,353,456 took about 28 mins
to download at 3.42 - 3.44Ks

Trend, Wget www.trendmicro.com/ftp/products/tsc/sysclean.......Length
3,423,308 took about 20 mins to download at 3.00 - 3.30Ks
Trend, Wget www.trendmicro.com/ftp/products/pattern\lpt.......Length
7,643,028 took about 35 mins to download at 3.60 - 3.65Ks

Sophos, Wget www.sophos.com/tools/sav32sfx.exe Length 7,486,008 took about
33 mins to download at 3.60 - 3.71Ks
Sophos, Wget www.sophos.com/downloads/idi/web_ides.exe.......Length 274,597
took about 3 mins to download ar 3.59Ks
Sophos, Wget www.sophos.com/tools/esdz.exe.......Length 7,369,105 took about
32 mins at 3.65Ks.

Performed clean boot and rebooted in normal mode.
McAfee:
c:\AV-CLS\McAfee\update.ini not opened for READ, error code [1]

Trend:
c:\AV-CLS\Trend\pattern.text not opened for READ, error code [0]

Sophos:
Working/Scanning (hooray), found a virus fragment 'w95/Sledge-A in file
c:\WINDOWS\system32\ActiveScan\pskavs.dll Removal successful.

Performed clean boot and rebooted in F8 safe mode.
McAfee: Same error message.

Trend: Same error message.

Sophos:
Sophos scan files were not found. The computer shuts down so you can obtain
files in normal mode.

Am I the only one having these kind if problems with AV-CSL?
Please help me!

As this is is a non-virus related issue please advise also if should visit
another newsgroup/forum.
 
From: "Kayman" <[email protected]>

| Hi Dave:
| I removed C:\AV-CLS already. Anyway, I again started from scratch and
| downloaded C:\AV-CLS, after opening/closing zip and disabling firewall,
| started downloading McAfee first, followed by Trend And Sophos.
|
| McAfee, Wget ftp.nai.speedera.........Length 7,353,456 took about 28 mins
| to download at 3.42 - 3.44Ks
|
| Trend, Wget www.trendmicro.com/ftp/products/tsc/sysclean.......Length
| 3,423,308 took about 20 mins to download at 3.00 - 3.30Ks
| Trend, Wget www.trendmicro.com/ftp/products/pattern\lpt.......Length
| 7,643,028 took about 35 mins to download at 3.60 - 3.65Ks
|
| Sophos, Wget www.sophos.com/tools/sav32sfx.exe Length 7,486,008 took about
| 33 mins to download at 3.60 - 3.71Ks
| Sophos, Wget www.sophos.com/downloads/idi/web_ides.exe.......Length 274,597
| took about 3 mins to download ar 3.59Ks
| Sophos, Wget www.sophos.com/tools/esdz.exe.......Length 7,369,105 took about
| 32 mins at 3.65Ks.
|
| Performed clean boot and rebooted in normal mode.
| McAfee:
| c:\AV-CLS\McAfee\update.ini not opened for READ, error code [1]
|
| Trend:
| c:\AV-CLS\Trend\pattern.text not opened for READ, error code [0]
|
| Sophos:
| Working/Scanning (hooray), found a virus fragment 'w95/Sledge-A in file
| c:\WINDOWS\system32\ActiveScan\pskavs.dll Removal successful.
|
| Performed clean boot and rebooted in F8 safe mode.
| McAfee: Same error message.
|
| Trend: Same error message.
|
| Sophos:
| Sophos scan files were not found. The computer shuts down so you can obtain
| files in normal mode.
|
| Am I the only one having these kind if problems with AV-CSL?
| Please help me!
|
| As this is is a non-virus related issue please advise also if should visit
| another newsgroup/forum.

You are the only one experiencing problems :-(
 
Back
Top