Is process "15dee891.exe" a virus?

[tt]

Anyone know about the process called "15dee891.exe" ? I've got a red
window pop-up during starting up Win2K, it displays a warning about my
internet security and ask if I want to download a fix! Through the
task manager, I find its executable named " 15dee891.exe", but
searching through the Win Registry, it only appears on the LOCAL
MACHINE/../runonce directory, and can not find it's actual file
anywhere in my computer local drive.

I use the tlist.exe but there is no additional infor about this
process, as well nothing find on Google searching.
Another thing is that it seems only run once a day but not everytime I
restart the Win2k.

Any help is appreciated.

Thanks
t.t

 

[David H. Lipman]

From: "tt" <[email protected]>

| Anyone know about the process called "15dee891.exe" ? I've got a red
| window pop-up during starting up Win2K, it displays a warning about my
| internet security and ask if I want to download a fix! Through the
| task manager, I find its executable named " 15dee891.exe", but
| searching through the Win Registry, it only appears on the LOCAL
| MACHINE/../runonce directory, and can not find it's actual file
| anywhere in my computer local drive.
|
| I use the tlist.exe but there is no additional infor about this
| process, as well nothing find on Google searching.
| Another thing is that it seems only run once a day but not everytime I
| restart the Win2k.
|
| Any help is appreciated.
|
| Thanks
| t.t

A name such as that is a good indicator that it is possibly malware. It could be a virus or
it could be non-viral malware associated with adware/spyware.

Please submit a sample of "15dee891.exe" Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against 18 different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all paricipating vendors.

When you get the report, please post back the exact reults.

Based upon those results, appropriate software and/or instructions can be provided to you.

 

[tt]

Thanks David,

Here is the report from the Virus Total after analyzing the
15dee891.exe file:

This is a report processed by VirusTotal on 09/04/2005 at 03:16:02
(CET) after scanning the file "15dee891.exe" file.
Antivirus Version Update Result
AntiVir 6.31.1.0 09.02.2005 TR/Proxy.Agent.DF.4
Avast 4.6.695.0 09.02.2005 Win32:Trojan-gen. {Other}
AVG 718 08.31.2005 Proxy.19.BJ
Avira 6.31.1.0 09.02.2005 TR/Proxy.Agent.DF.4
BitDefender 7.0 09.02.2005 Trojan.Proxy.Agent.DF
CAT-QuickHeal 8.00 09.03.2005 TrojanProxy.Agent.df
ClamAV devel-20050725 09.04.2005 Trojan.Clicker.Small-79
DrWeb 4.32b 09.02.2005 Trojan.Proxy.69
eTrust-Iris 7.1.194.0 09.02.2005 no virus found
eTrust-Vet 11.9.1.0 09.02.2005 no virus found
Fortinet 2.41.0.0 09.03.2005 suspicious
F-Prot 3.16c 09.02.2005 no virus found
Ikarus 0.2.59.0 09.02.2005 no virus found
Kaspersky 4.0.2.24 09.04.2005 Trojan-Proxy.Win32.Agent.df
McAfee 4573 09.02.2005 Generic.f
NOD32v2 1.1208 09.02.2005 Win32/TrojanProxy.Agent.NAK
Norman 5.70.10 09.02.2005 W32/Agent.DHD
Panda 8.02.00 09.03.2005 Trj/Agent.HZ
Sophos 3.97.0 09.03.2005 no virus found
Symantec 8.0 09.03.2005 Download.Trojan
TheHacker 5.8.2.099 09.02.2005 no virus found
VBA32 3.10.4 09.03.2005 Trojan-Proxy.Win32.Agent.df



VirusTotal is a free service offered by Hispasec Sistemas. There are
no guarantees about the availability and continuity of this service.
Although the detection rate afforded by the use of multiple antivirus
engines is far superior to that offered by just one product, these
results DO NOT guarantee the harmlessness of a file. Currently, there
is not any solution that offers a 100% effectiveness rate for
detecting viruses and malware.> Go to: Home Contact En espanol
--------------------------------------------------------------------------------
www.virustotal.com :: @ Hispasec Sistemas 2004 :: e-mail
(e-mail address removed)


Regards,

t.t

 

[David H. Lipman]

From: "tt" <[email protected]>

| Thanks David,
|
| Here is the report from the Virus Total after analyzing the
| 15dee891.exe file:
|
| This is a report processed by VirusTotal on 09/04/2005 at 03:16:02
| (CET) after scanning the file "15dee891.exe" file.
| Antivirus Version Update Result
| AntiVir 6.31.1.0 09.02.2005 TR/Proxy.Agent.DF.4
| Avast 4.6.695.0 09.02.2005 Win32:Trojan-gen. {Other}
| AVG 718 08.31.2005 Proxy.19.BJ
| Avira 6.31.1.0 09.02.2005 TR/Proxy.Agent.DF.4
| BitDefender 7.0 09.02.2005 Trojan.Proxy.Agent.DF
| CAT-QuickHeal 8.00 09.03.2005 TrojanProxy.Agent.df
| ClamAV devel-20050725 09.04.2005 Trojan.Clicker.Small-79
| DrWeb 4.32b 09.02.2005 Trojan.Proxy.69
| eTrust-Iris 7.1.194.0 09.02.2005 no virus found
| eTrust-Vet 11.9.1.0 09.02.2005 no virus found
| Fortinet 2.41.0.0 09.03.2005 suspicious
| F-Prot 3.16c 09.02.2005 no virus found
| Ikarus 0.2.59.0 09.02.2005 no virus found
| Kaspersky 4.0.2.24 09.04.2005 Trojan-Proxy.Win32.Agent.df
| McAfee 4573 09.02.2005 Generic.f
| NOD32v2 1.1208 09.02.2005 Win32/TrojanProxy.Agent.NAK
| Norman 5.70.10 09.02.2005 W32/Agent.DHD
| Panda 8.02.00 09.03.2005 Trj/Agent.HZ
| Sophos 3.97.0 09.03.2005 no virus found
| Symantec 8.0 09.03.2005 Download.Trojan
| TheHacker 5.8.2.099 09.02.2005 no virus found
| VBA32 3.10.4 09.03.2005 Trojan-Proxy.Win32.Agent.df


The majority seem to call it a Trojan Proxy. This could mean that your PC is being used as
a "proxy server" for nefarious reasons such as a spam zombie.

You can use the following tool to scan the computer which has "On Demand" scanners for;
McAfee, Sophos and Trend Micro.

You should start with the McAfee module since the above report shows it is recognized by it.


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter {
http://kixtart.org Kixtart is CareWare } three batch files, five Kixtart scripts, one Link
(.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will
simplify the process of using; Sophos, Trend and McAfee Anti Virus Command Line Scanners to
remove viruses, Trojans and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode. This
way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Exit the menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

* * * Please report back your results * * *