Go Back   Computer Forums > General Computing > Cyber Safety and Computer Security
Click Here to Login
Join Computer forums Today


Reply
 
Thread Tools Search this Thread Display Modes
 
Old 03-07-2007, 01:57 AM   #1
Solid State Member
 
Join Date: Mar 2007
Posts: 7
Default Random .exes appaearing, related problems

Hey. I was pointed to a thread on this forum a few weeks ago and bookmarked it for future use. I have a problem which I hope you guys could suggest solutions to.

My OS is Win 2k Pro, I use ZoneAlarm as my firewall, McAfee for anti-virus, and have Spybot installed. In the last week or so I've noticed, twice, that my computer has restarted itself when I wasn't around to see it. I wasn't sure how or why, until it happened until tonight, when I saw a message box claiming that something was wrong with services.exe and a restart would be forced in 60 seconds.

Before this, I've been seeing popups from McAfee claiming to have found trojans and/or worms (can't remember if it was one or the other or both) in various .exe files. Several times these were found simply in C:\, other times they were found in internet cache folders. Some did not have any names at all. These popups usually came 2-5 at a time, then stopped and would appear again later. I've run two full virus scans this week, and both turned up empty.

In addition to this, I've seen two strange .exes try to gain internet access: "symmec" and "netbeans." I denied both of these, of course. And finally, I noticed a process called zlclint.exe (as opposed to zlclient.exe, which seems to be the ZoneAlarm program).

So tonight after the forced restart, I started in safe mode and went searching for all of these strange .exes. Starting with zlclint, I found it in system32 as well as in two different internet cache folders. I found several tiny exes in the C:\, with names such as "m", "U", or "m1s." Then I ran a search on all .exes in my internet cache folders, and found a few more... but my mistake there was to only search my own user's folder. Next, I did a search on the whole "documents and settings" folder, and found several more, including both "symmec" and "netbeans." All of these exes I found were deleted. After this, I did a search for any exes created within the last seven days (a trait they all shared), and found nothing besides what I'd personally downloaded.

I was satisfied with that and restarted in normal mode... so far I've not seen anything out of the ordinary. But I thought I would ask here to see if the users of this forum knew what this oddity is, and if there are any additional steps I should take (I am not going to reformat this drive, though).

Thanks in advance.
__________________

nomad312 is offline   Reply With Quote
Old 03-08-2007, 11:35 AM   #2
The Candyman
 
~mr mixx~'s Avatar
 
Join Date: Jun 2004
Location: USA
Posts: 11,312
Default Re: Random .exes appaearing, related problems

Having multiple .exe programs running that you did not give permission to can be a bad thing, unless you know what they are and what their doing.

here are some things you can do for now..


1) click start / run / type "msconfig" without the quotes/ then enter

2) click the startup tab, now go through there and uncheck the programs you think are suspicious. if you uncheck one that the OS needs to run at startup it will check itself back automatically at bootup.
__________________

__________________
" Let the music move you "
~mr mixx~ is offline   Reply With Quote
Old 03-08-2007, 01:24 PM   #3
Solid State Member
 
Join Date: Mar 2007
Posts: 7
Default Re: Random .exes appaearing, related problems

Quote:
Originally Posted by ~mr mixx~
Having multiple .exe programs running that you did not give permission to can be a bad thing, unless you know what they are and what their doing.

here are some things you can do for now..


1) click start / run / type "msconfig" without the quotes/ then enter

2) click the startup tab, now go through there and uncheck the programs you think are suspicious. if you uncheck one that the OS needs to run at startup it will check itself back automatically at bootup.
You're the second person who's referred me to "msconfig" now. But I apparently don't have this program, as it tells me it can't be found. Is that an XP only thing? Because I'm using 2k pro.

Also, I'm not sure these things appear at startup. One interesting thing that I discovered yesterday is that there are only problems when I turn off ZoneAlarm. I've had to do that to use a certain program yesterday (I'm certain it's not causing the problems, though... just something else getting through while ZA was down). Something seems to be creating and running these exes, or downloading them, while ZA is down... and I wish I knew what that thing was so I could kill the root of the problem instead.

Finally, I noted that two different worms/bots/etc were caught yesterday in such apps. One name contained "IRCgen," the other I believe was "rahack."
nomad312 is offline   Reply With Quote
Old 03-09-2007, 12:18 PM   #4
The Candyman
 
~mr mixx~'s Avatar
 
Join Date: Jun 2004
Location: USA
Posts: 11,312
Default Re: Random .exes appaearing, related problems

My opologies..when most member's create a thread with a certain problem, i assume they are using Windows xp as their OS. I believe if you do a scan on-line with house call, that is if you have a fast connection.

Also you may want to upgrade to windows xp, it will sovle alot of issues. Windows 2k is not as stable of an operating system as people think. although i know there are some who have slipped though the cracks of errors.
__________________
" Let the music move you "
~mr mixx~ is offline   Reply With Quote
Old 03-09-2007, 11:32 PM   #5
Solid State Member
 
Join Date: Mar 2007
Posts: 7
Default Re: Random .exes appaearing, related problems

Quote:
Originally Posted by ~mr mixx~
My opologies..when most member's create a thread with a certain problem, i assume they are using Windows xp as their OS.
Quote:
Originally Posted by ~mr mixx~
Also you may want to upgrade to windows xp, it will sovle alot of issues. Windows 2k is not as stable of an operating system as people think. although i know there are some who have slipped though the cracks of errors.
If I didn't already have XP on my laptop I might consider it, but I'm holding out with 2k on my desktop for as long as reasonably possible. I did find out that one can run msconfig.exe on a 2k machine, though there's supposed to be at least one process you should never disable in 2k lest you completely screw the OS (anyone know which one(s)?). Anyway, zlclint was among the processes and so I disabled it, but did that actually get rid of it? Seems to me that flipping an "enable" flag doesn't delete the app from wherever it's spawning on the HDD, nor from the registry (which I can only assume it's messed with - I'm not experienced with the registry).

Quote:
Originally Posted by ~mr mixx~
I believe if you do a scan on-line with house call, that is if you have a fast connection.
Fast... sort of. Reliable, no. Campus internet by Comcast. I can load pages and send IMs with no problems, but... let me put it this way, it was a miracle that I finally got Spybot's update to finish (and then it found nothing, too).
nomad312 is offline   Reply With Quote
Old 03-10-2007, 12:10 AM   #6
Golden Master
 
freestyler105's Avatar
 
Join Date: Sep 2006
Posts: 7,883
Default Re: Random .exes appaearing, related problems

zlclient was part of ZoneAlarm, you should re-enable it.

Post a HijackThis log here:
http://www.download.com/HijackThis/3...-10379544.html
__________________
C2D E6600 | 4GB DDR2-800 | 9800GTX+ | Asus P5B-E | 150GB Raptor | 320GB 7200.10 | 750W Xigmatek PSU
freestyler105 is offline   Reply With Quote
Old 03-10-2007, 05:10 AM   #7
Golden Master
 
Raffaz's Avatar
 
Join Date: Sep 2006
Posts: 6,798
Send a message via AIM to Raffaz Send a message via MSN to Raffaz Send a message via Yahoo to Raffaz
Default Re: Random .exes appaearing, related problems

You can use msconfig with windows 2000, all you need to do is run the XP version. Heres how.
http://www.techadvice.com/win2000/m/msconfig_w2k.htm
Raffaz is offline   Reply With Quote
Old 03-12-2007, 12:53 PM   #8
Solid State Member
 
Join Date: Mar 2007
Posts: 7
Default Re: Random .exes appaearing, related problems

Quote:
Originally Posted by freestyler105
zlclient was part of ZoneAlarm, you should re-enable it.

Post a HijackThis log here:
http://www.download.com/HijackThis/3...-10379544.html
zlcliEnt was, yes...
Quote:
And finally, I noticed a process called zlclint.exe (as opposed to zlclient.exe, which seems to be the ZoneAlarm program).
I've never used HijackThis, but I'll get around to it tonight (I'll have to download it on my laptop and bring it here since this building's crappy LAN can't hold the download link long enough).
__________________

nomad312 is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off



All times are GMT -5. The time now is 03:41 PM.


Powered by vBulletin® Version 3.8.8 Beta 4
Copyright ©2000 - 2017, vBulletin Solutions, Inc.
Search Engine Friendly URLs by vBSEO 3.6.0