My Virus has been located

Discussion in 'Technical' started by melbo, Aug 26, 2005.

  1. melbo

    melbo Hunter Gatherer Administrator Founding Member

    Leox B. Worm found because he created a process called sychost.exe.

    Here is a list of other 'artificial process' and the tell tale signs: Sorry for the mess!!

    Much easier to read here:
    another list of not necessary sytem startup process' :

    Startup Name Process Name Details
    X Windows SP2 Update Sp2update.exe "Added by the WOOTBOT.BS
    X Windows SP2 Version Load wuauclt32.exe "Added by the GAOBOT.CX
    X Windows SP4 directCC.exe "Added by the W32/RBOT-ACX
    X Windows SpoolaPrint Service spoolasrv.exe "Added by the W32/Sdbot-AYD
    X Windows Spooler SPOOLSRV.EXE "Added as a result of the SPYBOT.P VIRUS!"
    X Windows Spooler Services spool.exe "Added by the W32/AGOBOT-AMO
    X Windows SpoolPrint Service spoolersrv.exe "Added by the W32/Sdbot-ZT
    X Windows spoolservr Service spoolservr.exe "Added by the W32/Sdbot-AAN
    X Windows Spoolsre Service spoolsre.exe "Added by the W32/Sdbot-AAE
    X windows spoolsrv service spoolssv.exe "Added by the W32/Sdbot-AWV
    X Windows Spoolsrv Service spoolmsv.exe "Added by the W32/Sdbot-ZS
    X Windows Spoolsurf Service spoolsurf.exe "Added by the W32/SDBOT-ZZ
    X Windows SpooltPrint Service spooltsrv.exe "Added by the W32/SDBOT-AYE
    X Windows Spoolvvv Service spoolvvv.exe "Added by the W32/SDBOT-AAW
    X Windows sq Drivers winmsn32.exe "Added by the W32/Rbot-ADI
    X Windows Sql Service For Windows 32 Bit winsql32.exe "Added by the W32/FORBOT-FC
    X Windows SSL File winssv.exe "Added by the WOOTBOT.CA
    X Windows Stand Sound Drivers Sounddrv.exe "Added by the W32/SDBOT-XF
    X Windows Standard Securty (Random 3-letter filename) "Added by the W32/Rbot-ALF
    X Windows Start Server 2000 traficy.exe "Added by the W32/Rbot-AHM
    X Windows Startup winsta~1.exe "Go-Hip
    X Windows Startup Wdrun32.exe "Added by the GAOBOT.AO
    X Windows Startup services21.exe "Added by the W32/Agobot-MX
    X Windows Startup winstartup.exe "Go-Hip
    X Windows Startup 32 Bits sysrun32.exe DarkSun trojan variant
    X Windows Streams Server localsrv.exe "Added by the SDBOT.LN
    X Windows Subsys winload.exe "Added by the NETSPREE.C
    X Windows SyncroAd SyncroAd.exe "Windupdates
    X WINDOWS SYSTEM nec.exe "Added by the W32/Mytob-L
    X WINDOWS SYSTEM xxx.exe "Added by the W32.Mytob.CZ
    X Windows System WINSYS.exe "Added by the W32/Mytob-M
    X WINDOWS SYSTEM beta.exe "Added by the W32.Mytob.DF
    X WINDOWS SYSTEM test.exe "Added by the W32.Mytob.DJ
    X WINDOWS SYSTEM test2.exe "Added by the W32.Mytob.DJ
    X WINDOWS SYSTEM test3.exe "Added by the W32.Mytob.DV
    X WINDOWS SYSTEM skybot.exe "Added by the W32/Mytob-CX
    X WINDOWS SYSTEM winsys33.exe "Added by the W32.Mytob.EK
    X WINDOWS SYSTEM msdev32.exe "Added by the W32.Mytob.EH
    X WINDOWS SYSTEM dcomuser.exe "Added by the W32.Mytob.EO
    X WINDOWS SYSTEM winligon.exe "Added by the W32.Mytob.EP
    X WINDOWS SYSTEM winvnc.exe "Added by the W32.Mytob.EU
    X WINDOWS SYSTEM win.exe.exe "Added by the W32.Mytob.FA
    X Windows System nibie.exe "Added by the W32.Mytob.FO
    X WINDOWS SYSTEM nec.exe "Added by the W32/Mytob-BH
    X WINDOWS SYSTEM ninfoie.exe "Added by the W32/Mytob-EP
    X WINDOWS SYSTEM skybotx.exe "Added by the W32.Mytob.FT
    X WINDOWS SYSTEM smoc.exe "Added by the W32.MYTOB.FU
    X WINDOWS SYSTEM winxpserv.exe "Added by the W32/Mytob-BQ
    X WINDOWS SYSTEM smsc.exe "Added by the W32/MYTOB-BR
    X WINDOWS SYSTEM winmon.exe "Added by the W32.Mytob.GB
    X WINDOWS SYSTEM lf66prc.exe "Added by the W32.Mytob.GC
    X WINDOWS SYSTEM nibie.exe "Added by the W32/Mytob-BY
    X WINDOWS SYSTEM skybotx.exe "Added by the W32/Mytob-BY
    X WINDOWS SYSTEM wdns33.exe "Added by the W32/Mytob-BY
    X WINDOWS SYSTEM winsvc32.exe "Added by the W32.MYTOB.HH
    X WINDOWS SYSTEM winNTsys32.exe "Added by the W32/MYTOB-DM
    X WINDOWS SYSTEM winaup.exe "Added by the W32/Mytob-DN
    X WINDOWS SYSTEM logic.exe "Added by the W32.MYTOB.IC
    X WINDOWS SYSTEM mtrnqs.exe "Added by the W32.MYTOB.IG
    X WINDOWS SYSTEM gothica.exe "Added by the MYTOB.HU
    X WINDOWS SYSTEM msnl.exe "Added by the W32.Mytob.IK
    X WINDOWS SYSTEM botzor.exe "Added by the W32/ZOTOB
    X WINDOWS SYSTEM per.exe "Added by the W32/ZOTOB.C
    X WINDOWS SYSTEM skybot.exe "Added by the MYTOB.JU
    X Windows System 32-Bat Service win32bat.exe "Added by the W32.Mytob.FI
    X Windows System Backup SysBackup.exe Unidentified malware
    X WINDOWS SYSTEM Cleaner h3.exe "Added by the W32.Mytob.EQ
    X WINDOWS SYSTEM CLEANER iexplore.exe "Added by the W32.Mytob.ET
    X Windows System Configuration SYSCFG16.EXE "BKDR_WISDOOR.Z
    X Windows System Configuration Winfrw.exe "Added by the BACKDOOR.SOLUFINA
    X Windows System Configuration Passcfg16.exe "Added by the DOMWIS-E
    X Windows System Configuration WINCFG32.EXE "Added by the W32/Agobot-TE
    X Windows System Configuration WinNeth.exe "Added by the W32/Rethe-A
    X Windows System Configuration wincfg.exe "Added by the AGOBOT.OP
    X WINDOWS SYSTEM Dns windsns.exe "Added by the W32.Mytob.EY
    X WINDOWS SYSTEM DNSPOOL hbmail.exe "Added by the W32.MYTOB.FW
    X Windows System File cmxp.exe "Added by the W32.Spybot.KHO
    X WINDOWS SYSTEM FILE winload.exe "Added by the MYTOB.DK
    X Windows System Gateway SPOOLER.EXE "Added by a variant of the WIN32.RBOT
    X Windows System Init winit32.exe "Added by a variant of the WIN32.RBOT
    X Windows System Manager winsystem.exe "Added as result of a W32/Rbot-AN
    X Windows System Manager sysconf.exe "Added by the W32.MYTOB.AL
    X Windows System Manager smsc.exe "Added by a variant of the WIN32.RBOT
    X Windows System Manager crssm.exe "Added by the W32/Rbot-AFH
    X Windows System Manager Loader smsls.exe "Added by the AGOBOT.TF
    X Windows System Manager Proc winsmc.exe "Added by the RBOT.JH
    X Windows System Manager Proc winsmc.exe "Added by the RBOT.JH
    X WINDOWS SYSTEM MEMORY LOADER memloader.exe "Added by the W32/MYTOB-IN
    X windows system notepad wnpsm.exe "Added by a variant of the AGOBOT/GAOBOT
    X Windows System Restore Configuration Sblhost.exe Added as a result of a variant of the SPYBOT.GEN VIRUS!
    X Windows System Restorer SystemRestorer.exe "Added as a result of the DULOAD.C VIRUS!"
    X Windows System Security winmp.exe "Added by the RBOT.IV
    X Windows System Security Monitor (4 random letters).exe "Added by the W32.Pinkton.A
    X Windows System Serivce winserv.exe "Added by a variant of the Win32.Rbot
    X windows system service winsock.exe "Added by the W32/RBOT-MR
    U Windows System Tray msni.exe "Iambigbrother monitoring software"
    X Windows System Tray swhost.exe Unidentified worm or trojan
    U Windows System Tray dlhost.exe "Related to IamBigBrother
    X Windows System32 windowsp.exe "Added by the MYTOB.GD
    X Windows System32 Kernel system32.exe "Added by the W32/SDBOT-AAT
    X Windows Systemnmg stagmr.exe "Added by the W32.MYTOB.S
    X Windows Sz Host winshvc.exe "Added by a variant of the W32/SDBOT
    X Windows Task Manager ACCOUNT_DETAILS.DOC.exe "Added as a result of the QUATERS.A VIRUS!"
    X Windows Task Manager taskmgn.exe "Unidentified malware
    X Windows Task Manager taskmrg.exe "Added by the W32.MYTOB.AV
    X Windows Task Manager taskgmr.exe "Added by the W32.Mytob.BJ
    X Windows Task Manager taskmg.exe "Browser hijacker - identified by DrWeb
    X Windows Task Manager Emulator kennewr.exe "Added by the W32/SPYBOT-FA
  2. RightHand

    RightHand Been There, Done That RIP 4/15/21 Moderator Moderator Emeritus Founding Member

    Great list melbo. Thanks
  3. ghrit

    ghrit Bad company Administrator Founding Member

    What is the fix?
  4. melbo

    melbo Hunter Gatherer Administrator Founding Member

    It seems that after trying 5 of my old faithful's: Norton AV, McAffee, Zone Alarm, Ad-Aware, Bit defender. I used QUigs "Second Opinion" above. Found and disinfected 4 Virus' though it locked before I could get the report to see the names. I'm assessing Damage now.
  5. melbo

    melbo Hunter Gatherer Administrator Founding Member

    This system has just whipped up to around 10X faster than it was yesterday.

    I found a ne , yes another, scanner that found around 14 pieces of malware on my system. All undetected by AdAware and SpyBot and the rest.

    Not sure how I found it but You can download for free and they will remove 3 bad apples and then just show you the rest... I bucked up the $39 and am sailing right along... on this system, I have 3 more to tackle as we were all networked.

    But, I can cancel my Tuesday tech girl....So I saved in the long run.

    I was a Norton Internet Security and AV guy for, OH, since around '89 when Peter had a small DOS program called PCTools... I decided to give ZoneAlarm, (Pay version) a whirl the last time my Virus Definition subscription was up. The firewall seems ok but the virus action doesn't hold up. I just relieved myself of 4 with Quig's freebie.

    Oh, link to True Sword.
survivalmonkey SSL seal warrant canary