msm.exe & ssocks5.dll

[Simon McDonald]

Does anyone have any information of the above two files? The msm.exe process
starts whenever I start explorer or IE, and does not shut down. It was only
created a couple of days ago, along with the ssocks5.dll and a file called
regsocks5.exe. All files sit in the windows\system folder (not system32) -
all have same creation date and time. In the vent log, within a couple of
minutes of this time, there is a reported attempt to overwrite wmplayer.exe!

I've checked a couple of virus info sites, run adaware and spybot and
nothing shows up.

msm.exe NEVER showed up in task manager before - I am a tad suspicious of
it - can any shed any light on the matter.

Thanks

Simon

 

[dana]

You are smart! The first one is a Trojan (thank you, Google):

Hello Sean,
Experience noticed Norton is not so good when Trojan's are found.
Because this type of virus include two parts: The "spread" and the "worm"
I suggest you try the program Trojan Remover 4.90 to eradicate your virus,
this program use two scan to detect trojan's and destroy them.
This is a freeware for one month....
Download it at:
http://www.simplysup.com/tremover/details.html

 

[dana]

More bad news. Your computer has been turned into a hacker's server:

Once Backdoor.Graybird.E is installed, it waits for commands from the remote
client. These commands allow the Trojan's creator to perform any of the
following actions:
a.. Deliver system and network information to the Trojan's creator,
including the login names and cached network passwords.
b.. Install an FTP server, allowing the Trojan's creator to use the
compromised computer as a temporary storage device.
c.. Open or close the CD-ROM drive and perform other annoying actions.
d.. Download and execute files.
e.. Install a Socks5 proxy server.