Member Avatar for gmurphy

New to this.

Problem, cpu chewed up by the above. Before I found the file it was killing all spyware and antivirus software. After stopping the task, Norton comes up clean, every spyware, adware, trogen killer comes up clean. I have run norton on the network comes up clean.

Symantec had instructions to remove (), wstart32 from reg, and stop the task. Which I did. I found these two files hidden in sys32. I saved a copy to disk and deleted them. Machine seems to run fine now. My concern is, is the infecting file is still hiding? Also, running netstat, there seems to be some ports that are listening ie. 42555, 34012, microsoft-ds, 1029. Anyone have any suggestions?

  • 2 Contributors
  • 2 Replies
  • 129 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gmurphy

Dani AI

Generated

Good first steps — checking active network activity and using a process viewer are exactly the right direction (as recommended). Deleting an obvious executable does not guarantee full removal: persistent components can hide as scheduled tasks, services/drivers, alternate startup entries, kernel-mode rootkits, or replaced system files. The goal now is to confirm there are no remaining persistence points and to verify the machine from a clean environment.

Use tools that enumerate every startup location and map network sockets to owning processes. The Sysinternals suite is especially useful: run Autoruns to list every startup point, Process Explorer to inspect parent/child relationships and loaded modules, and TCPView to see which process owns a connection. For hidden kernel components use a dedicated rootkit scanner or an offline rescue environment (boot a clean rescue ISO and scan before Windows starts). Relevant downloads: Autoruns, Process Explorer, TCPView, and for submitting or checking suspicious binaries use VirusTotal.

Practical checklist: disconnect the machine from the network while investigating; boot to Safe Mode or from rescue media to run offline scans; review Scheduled Tasks and Services for unexpected entries; examine nonstandard drivers; run a rootkit detector; reset network components (winsock) if the stack looks altered; update Windows and AV signatures; and change credentials that may have been exposed. If any suspicious component reappears after reboot or refuses removal, assume compromise of system integrity and reimage from known-good media.

Recommended Answers

All 2 Replies

Member Avatar for TallCool1

Some of those are suspicious. I Googled each one using "port xxx" (in quotes), where xxx was the port number. I'll leave this as an exercise for you, but do it soon (hint).

I would also run something like PrcView or CodeStuff Starter to see what threads and processes are running.

Member Avatar for gmurphy

Thanks,
googled the ports, one was suspicious. after i stop the wstart32.exe, the suspicious activity is stopped. I also installed PrcView. Same tasks running in taskmgr. I was hoping to get an answer regarding spyware or a virus hidden and if deleting the key in the reg and the file itself will keep it from comming back?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.