winn.exe & system32.exe - unfamiliar start up programs

[Guest]

I just recently reinstalled Windows XP (with SP2) to clear out some of the
accummulated garbage. However, I noticed a couple of new start up programs
in the Task Manager that I had not seen before (previous installation
included SP2).

While I have not noticed any problems of these two programs (see below), I
am a bit worried since I have not loaded the indicated program (using Zone
Alarm instead)

Does anyone recognize it, know if it are malicious and if so, how to
eradicate it from my system? I used Startup Control Panel 2.8 by Mike Lin
(SCP) to find most of the details below.

winn.exe
name - Sygate Personal Firewall
path - winn.exe
notes - SCP found one copy in each of HKEY_LOCAL_MACHINE (all users) [HKLM]
and HKEY_CURRENT_USER [HKCU]; winn.exe located in C:\Windows\system32 as a
Read-Only, Hidden & System file

services32.exe
name - Sygate Personal Firewall
path - services32.exe
notes - SCP found one copy in HKEY_CURRENT_USER [HKCU]; system32.exe
location could not be determined

 

[Will Denny]

Hi

system32.exe is part of a Worm:

http://securityresponse.symantec.com/avcenter/venc/data/w32.kwbot.f.worm.html

as is winn.exe:

http://securityresponse.symantec.com/avcenter/venc/data/snob.ircworm.html

--


Will Denny
MS-MVP Windows Shell/User
Please reply to the News Groups

 

[Guest]

Hi

system32.exe is part of a Worm:
http://securityresponse.symantec.com/avcenter/venc/data/w32.kwbot.f.worm.html

as is winn.exe:
http://securityresponse.symantec.com/avcenter/venc/data/snob.ircworm.html

Thanks. Really weird since my security suite went on almost immediately
after I reinstalled Win XP (even before SP2). Running virus check right now
but it appears to have missed them (I shut them down before running scan).
Looks like I might need a new & better AV program. Any suggestions?

 

[Will Denny]

Thanks. Really weird since my security suite went on almost immediately
after I reinstalled Win XP (even before SP2). Running virus check right
now
but it appears to have missed them (I shut them down before running scan).
Looks like I might need a new & better AV program. Any suggestions?

Hi

I'm can't see which AV program you are using now. Try either of the
following:

Pay for - Panda: http://www.pandasoftware.com/home/default.asp - you can
try an online scan there as well
Free - AVG: http://free.grisoft.com/freeweb.php/doc/2/

--


Will Denny
MS-MVP Windows Shell/User
Please reply to the News Groups

 

[Guest]

Hi

I'm can't see which AV program you are using now. Try either of the
following:

Pay for - Panda: http://www.pandasoftware.com/home/default.asp - you can
try an online scan there as well
Free - AVG: http://free.grisoft.com/freeweb.php/doc/2/

Was using Zone Labs AV but did not detect any viruses after repeated scans.
Borrowed my step-dad's Norton 2002 (with current definitions) and it did not
detect either. Did detect 'system32,1.exe' (W32.Spybot.Worm). I am running
Norton's online scanner to see if it will pick up winn or system32.

If not, I will give AVG a try (already downloaded copy to desktop, just need
to install)