BetaONE will rise again!

BetaONE will rise again! (http:\\b1.hcanet.com\forum/index.php)
-   Internet Security and Privacy (http:\\b1.hcanet.com\forum/forumdisplay.php?f=38)
-   -   Help needed urgent (http:\\b1.hcanet.com\forum/showthread.php?t=8410)

jtk 11th Jun 03 12:38 PM

I know i have posted before

What happens is every time i start or reboot it makes 2 new tmp files in winnt\system32 folder,
starting with sxexx.tmp the xx part is different, feks sxe12.tmp - sxe13.tmp these files are 940kb and 180 kb,
and they are in my zone alarm under programs with a ?.

Also these 2 files are in my task manager process useing 8mb of ram

Searching on the net for sxe it says it might be a trojan, i have scanned for trojans and virus useing NAV and Trojan Remover but no results,both with latest defs.

System cleaner and Micro trends system cleaner nothing helps.
My system is windows 2000 pro sp3.
jtk

PCTech 11th Jun 03 01:08 PM

me i dont like NAV. TrendMicro is good :) and my dad personally uses McAfee. To each his own I guess. I might would try to scan again, and make sure you have your hurestics on deep and all that cool stuff, scanning all files is a good start. If everything else fails a DOS scan with your rescue disks might help sinse its made at startup :) maybe by scanning in DOS you can find it before it creates the tmp files and fix it? Best of luck to you, Let us know what happens.

~pct

freezer121 11th Jun 03 02:29 PM

There is some info at _http://www.clarkson.edu/unixteam/hack-info.html that may help.

DoG 11th Jun 03 03:26 PM

It could be a trojan variant and the scanners are not picking it up, or it could be a new trojan and the scanners wont pick it up. Format and reinstall your OS

jtk 18th Jun 03 10:09 AM

Well at last i got rid of this pest, i dont know what it was??
remove by useing msconfig.exe, grab a copy from xp as not in win2k,
find services and look for unknown manufacturer,
mine were
removable storage manager
winsvr
uncheck these and then the sXe.tmp files are not made every time you reboot.jtk

billybob3 20th Jun 03 06:11 AM

That's wierd.


All times are GMT +1. The time now is 09:06 PM.

Powered by vBulletin® Version 3.6.5
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.