Harlan Carvey wrote:
Well, actually I discovered it, using autoruns from sysinternals.The fact that there's a copy of this Explorer.exe in System32 may be an issue.
Was there an application running? Was there a Registry entry related to this file? If so, which one? How about another autostart location?
What do you mean by "I believe take precedence over the real explorer.exe"? how so?
The registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
had simply the value "Explorer.exe" and autoruns showed as the image path: "c:\windows\system32\explorer.exe"
Autoruns also showed the icon of the file and it was the wrong icon, it had the icon of internet explorer not explorer.
This led me to search for the real explorer.exe and google confirmed that the right location is c:\windows.
Once deleted the fake explorer.exe from system32 autoruns showed the right image path and the right icon.
Today I sent it to kaspersky lab and they said it's a simple trojan-downloader.
I think that the fake explorer.exe call the real one after having downloaded his trojan.
The problem now is that the file it downloads is no more avalaible (it was at "http://www.getupdate.com/TestDownload.exe";) and I can't tell if I have downloaded it and in such case what does it do...
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
