Spyware Hidden Process?

[jeremy.mitchell]

Hello!
I am on a spyware hunting mission. I currently run two spyware programs
(including the new MS one), and I am still getting unrelated popunders
like mad. I look through my process list to find the program that is
doing this, and all of my processes look legitimate. So, I wrote a
small .NET app to enumerate all of the currently running processes
along with the location of the exe. To my surprise, there is a process
listed there that is NOT in my process list by the name of knkygn.exe.

I am pretty sure that this is my offending process. The other VERY odd
thing, is that when I go the the path to try to delete this program, it
is not there. I have turned off any option that hides hidden and system
files. Any ideas? This is the sneakiest thing I have ever run across,
and was wondering if you guys had some tricks to dispose of this one.

 

[jeremy.mitchell]

One more odd thing. When I run msconfig to see all of the startup
programs, I see an entry for
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\knkygn.exe. When I uncheck this entry, don't
restart the computer, and restart msconfig, it is checked back again.
There is something that is watching this to make sure it doesn't get
unchecked.

 

[David H. Lipman]

1) Download the following item...

Adaware SE
http://www.lavasoftusa.com/

2) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
3) Reboot your PC into Safe Mode
4) Using Adaware SE, perform a Full Scan of your platform and clean/delete
any parasites found.
5) Restart your PC and perform a "final" Full Scan of your platform using Adaware
6) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
7) Reboot your PC.
8) Create a new Restore point

* * * Please report back your results * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html




| Hello!
| I am on a spyware hunting mission. I currently run two spyware programs
| (including the new MS one), and I am still getting unrelated popunders
| like mad. I look through my process list to find the program that is
| doing this, and all of my processes look legitimate. So, I wrote a
| small .NET app to enumerate all of the currently running processes
| along with the location of the exe. To my surprise, there is a process
| listed there that is NOT in my process list by the name of knkygn.exe.
|
| I am pretty sure that this is my offending process. The other VERY odd
| thing, is that when I go the the path to try to delete this program, it
| is not there. I have turned off any option that hides hidden and system
| files. Any ideas? This is the sneakiest thing I have ever run across,
| and was wondering if you guys had some tricks to dispose of this one.
|

 

[Laurel]

I had this experience. I'd been using Adaware (but not in safe mode). Then
Dell, my vendor, recommended CounterSpy. I've been running that, and things
have certainly simmered down. But then I discovered that McAfee's settings
had been set (at some point, dunno how I did it... or IF I did it???) so
that automatic updates weren't running. When I ran them, it found several
"infected" files. One of them had something to do with "downloads."
Sorry - don't remember the name, but it believe it was a "downloader" of
some sort.

Anyhoo, this suggests to me that some popup stuff might not be caused by the
kind of malware that the Anti-Spy programs find, but by viruses that a
program like VirusScan finds.

Not that I really, truly understand the difference.

 

[jeremy.mitchell]

I had been using Adaware, but not in safe mode. I hacked my way through
it by modifiying my program to find that strange process and kill it. I
have not experienced any of the odd popunders since then. Also, after I
removed the entry from the msconfig, it did not come back. If this
happens again, I will try the above procedure, cause I'd like to not
have to write a program to get rid of it every time it happens.

 

[Malke]

One more odd thing. When I run msconfig to see all of the startup
programs, I see an entry for
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\knkygn.exe. When I uncheck this entry, don't
restart the computer, and restart msconfig, it is checked back again.
There is something that is watching this to make sure it doesn't get
unchecked.

This is common, Jeremy. There is some executable on the system that is
morphing its name and restarting when you delete the one you find.
David Lipman gave you good advice. Here are my malware removal steps,
which add a few things. Between the two posts, you should be able to
clean your machine. Please note that it is crucial that you use updated
tools and do all scans in Safe Mode. In some instances - not that
common, thank goodness - you will have to go outside the os to remove
malware if the malware runs in Safe Mode. Try the remedies you've been
given first, though.

1) Scan in Safe Mode with current version (not earlier than 2004)
antivirus using updated definitions.

Before you remove malware, get LSPFix (or WinSockFix for XP which you
can get from MajorGeeks) - see links below.

2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
programs are free, so use them both since they complement each other.
There is a new version of CWShredder from Intermute. I would not
install the other Intermute programs, however. Alternately, there are
CoolWebSearch malware removal steps at SilentRunners.

Be sure to update these programs before running, and it is a good idea
to do virus/spyware scans in Safe Mode. Make sure you are able to see
all hidden files and extensions (View tab in Folder Options).

If the malware remains even after you used Ad-aware and Spybot, you can
scan with HijackThis. HijackThis is an excellent tool to discover and
disable hijackers, but it requires expert skill. See below for
HijackThis links, including sites where you can post your HJT logs. A
combination of HijackThis and About:Buster works well in removing the
About:Blank homepage hijacker. Again, this is an expert tool and
novices should get help with it.

3) If you are running Windows ME or XP, you should disable/enable System
Restore after the system is clean because malware will be in the
Restore Points. With ME, you must disable System Restore completely.
With XP, you can delete all but the most recent (presumably clean)
System Restore point from the More Options section of Disk Cleanup
(Run>cleanmgr).

4) Make sure you've visited Windows Update and applied all security
patches. Do not install driver updates from Windows Update.

5) Run a firewall.

Links to help with malware:

Software/Methods:
http://www.safer-networking.org - Spybot Search & Destroy
http://www.lavasoftusa.com - Ad-aware
http://www.majorgeeks.com - good download site
http://www.intermute.com/spysubtract/cwshredder_download.html
http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
removing spyware
http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

HijackThis:
http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
Eshelman
http://aumha.net - forums
http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
forum
http://www.wilderssecurity.com/
http://forums.tomcoyote.org/

General:
http://aumha.net - look under "Security" for various forums
http://rgharper.mvps.org/cleanit.htm
http://mvps.org/winhelp2002/unwanted.htm
http://www.aumha.org/a/parasite.htm - The Parasite Fight
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Malke

 

[Yves Leclerc]

CounterSpy is made by Giant, who then sends it to Sumbelt. Giant was bought
by Microsoft, who now has AntiSpyware Beta 1 out.

 

[Laurel]

This sounds to me like CounterSpy is going to go away? No one left to write
updates under the CounterSpy name?

 

[Dan]

If Microsoft is smart then they will continue CounterSpy except now it will
belong to them.

: This sounds to me like CounterSpy is going to go away? No one left to
write
: updates under the CounterSpy name?
:
: : > CounterSpy is made by Giant, who then sends it to Sumbelt. Giant was
: bought
: > by Microsoft, who now has AntiSpyware Beta 1 out.
: >
: >
: > : > >I had this experience. I'd been using Adaware (but not in safe mode).
: > >Then
: > > Dell, my vendor, recommended CounterSpy. I've been running that, and
: > > things
: > > have certainly simmered down. But then I discovered that McAfee's
: > > settings
: > > had been set (at some point, dunno how I did it... or IF I did it???)
so
: > > that automatic updates weren't running. When I ran them, it found
: several
: > > "infected" files. One of them had something to do with "downloads."
: > > Sorry - don't remember the name, but it believe it was a "downloader"
of
: > > some sort.
: > >
: > > Anyhoo, this suggests to me that some popup stuff might not be caused
by
: > > the
: > > kind of malware that the Anti-Spy programs find, but by viruses that a
: > > program like VirusScan finds.
: > >
: > > Not that I really, truly understand the difference.
: > >
: > > : > >> Hello!
: > >> I am on a spyware hunting mission. I currently run two spyware
programs
: > >> (including the new MS one), and I am still getting unrelated popunders
: > >> like mad. I look through my process list to find the program that is
: > >> doing this, and all of my processes look legitimate. So, I wrote a
: > >> small .NET app to enumerate all of the currently running processes
: > >> along with the location of the exe. To my surprise, there is a process
: > >> listed there that is NOT in my process list by the name of knkygn.exe.
: > >>
: > >> I am pretty sure that this is my offending process. The other VERY odd
: > >> thing, is that when I go the the path to try to delete this program,
it
: > >> is not there. I have turned off any option that hides hidden and
system
: > >> files. Any ideas? This is the sneakiest thing I have ever run across,
: > >> and was wondering if you guys had some tricks to dispose of this one.
: > >>
: > >
: > >
: >
: >
:
: