mysterious winSVCservice.exe under Win2000 with virus like behavior

[Richard Chambers]

We appear to be having a problem with a process which shows up in the
task manager dialog as winSVCservice.exe. This process exhibits virus
like behavior in that it suddenly shows up on a particular machine.
Our other Windows 2000 machines do not have this process running.

We have found the executable image in C:\WINNT\System32. When we
delete it from the System32 folder and then reboot, the executable
image shows back up again.

The problem is that it hogs processor time and LAN access.

It appears to be using port 1251. When we do a netstat -a it looks
like it is using port 1251 and connecting to
216-55-161-30.dedicated.abac.net:7029

When we google for the executable image name, we get no hits.

 

[George Hester]

Looks like Klex or

http://www.sophos.com/virusinfo/analyses/w32sdboto.html

If it is returning then it is likely in dllcache or ServicePackFiles\i386. I am at Service Pack 3 and I do not have this file you mention. I go from winstrm.dll.mui to winTemp.aps. Look at the version tab of the file. See if there is one. See if there is a coppyright. See if it it starting from the Run keys in the registry. If so remove the entry back it up and see if there is any change in the valid use of the operating system. I always make a backup of the Run keys on first install and inspect them periodically.

 

[xzied]

our servers here seems to have the same problem too, it is detected as a
virus when we ran nai virusscan 7.0 with the latest DAT file as "morphine"
virus. we couldn't get anything using symantec 8.0. WHat you can do if if
you have virusscan 7.0 install it, coz the virus will reinfected itself
once we disable it. the process can only be killed if you restart your
server. Also if you search your register it seems to register itself for a
few entries, the big mystery is there's no information about this "virus"
on the Internet!

 

[xzied]

If you use Virusscan 7.0 with the lastest engine and dat file it will
detect it as virus called "morphine"