WOW-ACCESS; uinc.dll; sysxxxx.exe whatever you want to call it

[Injury]

Just managed to get rid of one off a customer's PC that
nothing I used detected (on this PC Microsoft AntiSpyware
Beta, Spybot, Adaware, trojan hunter) Norton 2005 found
some files it detected as trojan.downloader but just
reported them as threats and didn't remove any files.
Some files I was able to remove manualls howver many
seemed to self delete as they weren't in the place where
Norton detected (checked for system and hidden files in
command prompt window).

Symptoms on this particular PC was a dos program box with
sysxxxx.exe running xxxx being what seems to be a random
number, these files were created in the C:\Windows
directory, deleting them solved nothing. The HP printer
would Form Feed until it was out of paper if it was left
on while one of these sysxxxx.exe programs were running
(all the programs appeared to do on the screen was scroll
real fast). It's activities also made the taskbar and the
desktop unusable for about 5-10 minutes in both normal
and safe mode. Using End Task on explorer.exe and
starting a New Task with it would bring the desktop back
to life. Safe Mode wasn't much help with the
desktop/taskbar problems as it still loaded there (though
I don't recall ever seeing a sysxxxx.exe try to run in
safe mode) Despite these pauses startup items (like a sql
server implementation on this PC) seemed to run fine
maybe appeared marginally slower to users.

Was able to find and get rid of it with a process
explorer that found hidden C:\Windows\Systems32\uinc.dll
being called. The actual registry entry I can't pull up
(as I'm not willing to unleash the thing on this PC
again) But it was called via a reference in
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServic
eObjectDelayLoad

Actually I should knock on wood, thought I had the
problem fixed the past 2 days, but after about an hour it
would come back. 3 hours and so far so good.

 

[Andre Da Costa]

Well, Microsoft AntiSpyware is not targetted at detecting viruses and
trojans, thats the job of your Antivirus utility. Restart your PC in safe
mode and do a full system scan:

On the Scan Page choose Scan Options > Full System Scan. Do this at
least two times until detects something. Also, before you restart in safe
mode, disable System Restore, some trojans and spyware programs are likely
to restore themselves with system snap shots:

Right click My Computer > Properties > System Restore, check the "Disable
System Restore" check box and restart in safe mode.

Restart in safe mode instructions:
www.microsoft.com/resources/documentation/
windows/xp/all/proddocs/en-us/boot_failsafe.mspx

 

[Ron Kinner]

Appreciate the heads up. Always interested in other
people's experiences with new spyware.

Next time you might try going to the cmd screen (Start,
Run,cmd,OK) and run:

dir /ah /ogd \windows\system32 >> c:\junk2.txt
dir /ah /ogd \windows >>c:\junk2.txt
dir /ah /ogd \ >>c:\junk2.txt
dir /ah /ogd \"program files" >>c:\junk2.txt

(replace Windows with Winnt for Win2K)

This sorts the hidden files in order of Last Modified with
the folders at the top of the list and puts the results in
a file C:\junk2.txt

Makes it easy to see which hidden files were added
recently.

If you leave off the /ah then it lists all files.

if you do

dir /ah /ogd /s \ >>C:\junk2.txt

then it lists all hidden files on the system but this gets
a big large.

You might also like to check out the autostart viewer at:

http://www.diamondcs.com.au/index.php?page=products

Some of their other programs can come in handy too.

Ron Kinner