Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Rhinorhino on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
What the heck is windowx.exe? 3
- Thread starter Chambers
- Start date
-
2
- #2
Congratulations,
You have a yet to be reported malware.
Unless you are using Wine or other Linux emulators, kill the process in Task Manager.
Start, Search, windowx*.*
rename any entries you find.
Do steps #1 - #4 here, but If it is brand new they may not see it: faq608-4650
Use Panda, Trend Micro and Symantec as choices.
Then post a Hijack This log here. Instructions are in the FAQ above.
You have a yet to be reported malware.
Unless you are using Wine or other Linux emulators, kill the process in Task Manager.
Start, Search, windowx*.*
rename any entries you find.
Do steps #1 - #4 here, but If it is brand new they may not see it: faq608-4650
Use Panda, Trend Micro and Symantec as choices.
Then post a Hijack This log here. Instructions are in the FAQ above.
![[pc3]](/data/assets/smilies/pc3.gif "[pc3] [pc3]")
Here's a lead (maybe) —
Look at the "fine print"
Editor and Composer Download Arachnophilia 5.2, build 1902 (06/29/2003) (Java) Windowx Exe
May not be of much help though - a Java search turned up a zero.
Are you dual processing with Linux? Just a thought.
By the way - that site evidently deals with spider fear. Something I haven't the slightest interst in. NO FEAR!
- Thread starter
- #4
Ran through all the steps and nothing was picked up; Here's the log file, thanks for the help!!
Logfile of HijackThis v1.97.7
Scan saved at 3:14:14 PM, on 1/13/2004
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Documents and Settings\chuck\Desktop\New Folder\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.10.0.15:8080
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [xkstartup] RunDll32 insxk50c.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\RunServices: [Time Manager] WindowX.exe
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
Logfile of HijackThis v1.97.7
Scan saved at 3:14:14 PM, on 1/13/2004
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\wanmpsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Documents and Settings\chuck\Desktop\New Folder\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.10.0.15:8080
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [xkstartup] RunDll32 insxk50c.dll,SetUsbPrinterPort
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\RunServices: [Time Manager] WindowX.exe
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
- Thread starter
- #5
-
1
- #6
Hmmm...I smell somehting stinky.
This entry:
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
...seems to be tied to this site:
And if you read their "End User License Agreement" -- while they state "ALL APPLICATIONS ARE SPYWARE FREE,"
it declares in the paragraph preceeding this note that: "ALL OF OUR APPLICATIONS COME WITH THE MYWEBSEARCH™ BROWSER PLUGIN"
I'm not pointing fingers or anything........
.....nor can I put together windowx.exe and Cursor Mania, but...
"'Tis an ill wind that blows no minds." - Malaclypse the Younger
This entry:
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
...seems to be tied to this site:
And if you read their "End User License Agreement" -- while they state "ALL APPLICATIONS ARE SPYWARE FREE,"
it declares in the paragraph preceeding this note that: "ALL OF OUR APPLICATIONS COME WITH THE MYWEBSEARCH™ BROWSER PLUGIN"
I'm not pointing fingers or anything........
.....nor can I put together windowx.exe and Cursor Mania, but...
"'Tis an ill wind that blows no minds." - Malaclypse the Younger
- Thread starter
- #8
Chambers,
No, No. Not your fault one bit...I was a bit careless, is all.
My pride is now bruised....I haven't picked up anything like that in a long time. Oh well...reset the timer.
"'Tis an ill wind that blows no minds." - Malaclypse the Younger
No, No. Not your fault one bit...I was a bit careless, is all.
My pride is now bruised....I haven't picked up anything like that in a long time. Oh well...reset the timer.
"'Tis an ill wind that blows no minds." - Malaclypse the Younger
Did you, to your knowledge, install this Cursor Mania product? If so, you might consider removing it and see if the mystery file goes with it.
I didn't find such a file on my machine, once infected. Rather, I saw a mwoemon show up in my Task Manager. It was quite easy to get rid of the pest, just removed everything via Control Panel > Add/remove programs
"'Tis an ill wind that blows no minds." - Malaclypse the Younger
I didn't find such a file on my machine, once infected. Rather, I saw a mwoemon show up in my Task Manager. It was quite easy to get rid of the pest, just removed everything via Control Panel > Add/remove programs
"'Tis an ill wind that blows no minds." - Malaclypse the Younger
carr,
If it makes you feel any better, I screwed my main machine trying last week to answer a Hijack log in the Browser forum.
The security guys who do this (bravely and seemingly like a real job) re-image their machines several times a day.
I am neither that brave, nor willing to give up a "real" job to look and explore Hijack posts. Plus, my eyes could not stand the strain of these listings.
Hence, faq608-4650
But, on point, have Hijack remove this entry:
O4 - HKLM\..\RunServices: [Time Manager] WindowX.exe
Reboot into Safe Mode.
Start, Search, windowx.exe
rename the file.
Reboot into normal mode.
If it makes you feel any better, I screwed my main machine trying last week to answer a Hijack log in the Browser forum.
The security guys who do this (bravely and seemingly like a real job) re-image their machines several times a day.
I am neither that brave, nor willing to give up a "real" job to look and explore Hijack posts. Plus, my eyes could not stand the strain of these listings.
Hence, faq608-4650
But, on point, have Hijack remove this entry:
O4 - HKLM\..\RunServices: [Time Manager] WindowX.exe
Reboot into Safe Mode.
Start, Search, windowx.exe
rename the file.
Reboot into normal mode.
- Thread starter
- #13
Chambers,
Check that incompatability issue thoroughly. I have yet to see one that cannot be overcome other than some VPN software, where updates are promised.
Check with the vendors. This is a very fluid situation and what may have been impossible last week is promised by end 1st quarter 2004. And ask twice, the first respondent should not be viewed as authoratative.
Check that incompatability issue thoroughly. I have yet to see one that cannot be overcome other than some VPN software, where updates are promised.
Check with the vendors. This is a very fluid situation and what may have been impossible last week is promised by end 1st quarter 2004. And ask twice, the first respondent should not be viewed as authoratative.
- Thread starter
- #16
- Status
Similar threads
- Locked
- Question