Re: New virus causes symbol to appear in notification area of taskbar

From: Tom (n5gar_at_NOSPAMrass.org)
Date: 05/25/03 

Date: Sat, 24 May 2003 17:52:41 -0700

Tracy, Thanks for responding. In this case, web.exe
says " <no title> " So I have not been able to locate the
program yet.

I found the web.exe file and reported it to Norton Anti-
Virus. They replied that they have tested it and "web.exe
does not appear to contain malicious code." It seems it
is very difficult to get their attention. I am very
disappointed with Norton Anti Virus.

Here's what I told them:

Running the latest-updated NAV definitions on the entire
system yields nothing. No viruses are reported.

This program apparently changes the normal start page on a
browser to a foreign language ad page. I don't know what
other functions it performs. I know I never took any
action to download it or install it. It installed itself
on my PC without my knowledge or permission.

This program causes a program icon to appear in the
notification area of my taskbar (the right bottom corner).

This icon is a small blue question mark in a yellow
square. Unlike the other icons that are supposed to be
there, moving the pointer over this does not produce a
message. Right clicking on it produces the following
window:

    Show startpage
    Disconnect (grayed)
    Update
    Hide

Left clicking the icon does not produce a response.

I have discovered on closing various programs in Task
Manager that removing one with the name "web.exe"
temporarily removes the unwanted icon from the task bar.

This is shown in Task Manager to take 4048 k of memory
space.

I then searched my system and found two copies of "web.exe"

One was located at C:/windows/web.exe
The 2nd one was at C:/windows/System32/web.exe

Size of this file is listed as an 88 KB application.

Both instances of web.exe appear to be the same. I could
only send one of them, as you restrict virus reports to
one per day per person. (Please send instructions if you
need more.)

I find that even after the above were moved, the unwanted
program starts up anyway. So there is more to do. The
web.exe is listed again in the Task Manager.

Plus there may be another problem if web.exe is a real
file that was written over by the virus web.exe.

- - - After they responded the first time, I sent them
this: - - -

I can not be satisfied with a 'closing' of this
submission, Tracking # ------

Either the file I submitted, or another file that was
installed on my computer that I have not been able to
locate, generates the submitted file.

It is malicious because:

(1) Software was automatically installed on my computer
without my knowledge or permission, just because I
(inadvertently) visited a web page. No window appeared
asking me if I wanted to save a file or install a program
or file.

(2) It takes over certain additional functions of the
computer - - in addition to the unwanted install
function. It appears to re-assign the home page
designated for my browser. The new home page / opening
page is a foreign advertising page. It adds an unwanted
icon in the tray.

(3) My attempt to remove it, by using "end process" in
the Windows XP Task Manager does not end the process or
remove the program.

(4) There is no contact information included with the
malicious program. There is no way I can find to get any
information on this program or on how to remove it.

(5) The malicious program is capable of contacting the
Internet.

Please look at this and my initial report again.

- - -

filename: web.exe
    result: See the developer notes

  Developer notes:
  web.exe does not appear to contain malicious code.

>-----Original Message-----
>Another way to locate which program is doing this --
>(killing web.exe in the task manager could have also
>killed the process triggering the symbol). Open the
>taskbar properties and select hide inactive icons, then
>click customize. This dialog box lists all the icons
>that have been in your system tray and the "name" for the
>icon. (Some are a little roundabout or repetative -- ICQ
>has in our list right now, 1 for each "variety" and
>some, like the new message one for ICQ somply says "New
>message from #######". But you can use this to track
>down what program's doing it.
>
>Tracy
>
>>-----Original Message-----
>>I did a search and there's no "karen.exe" on my
>>system.
>>
>>This "web.exe" is enough.
>>
>>I don't want to tinker with the registry just yet,
>>until I get a response from the Anti-Virus people,
>>or I'd look for something similar to what is described
>>at http://sarc.com/avcenter/venc/data/w32.gokar.a@mm.html
>>
>>
>>Thanks
>>
>>>-----Original Message-----
>>>Tom,
>>>
>>>You might also want to check your Windows directory for
>a
>>file named
>>>"karen.exe". If you find it then you may be infected
>>with W32.Gokar.A
>>>Info:
>>http://sarc.com/avcenter/venc/data/w32.gokar.a@mm.html
>>>
>>>Regards,
>>>Patrick Hallihan
>>>MCSE,MCSA,MCDBA
>>>
>>>"Tom" <n5gar@NOSPAMrass.org> wrote in message
>>>news:02f601c31efc$ce7609e0$a301280a@phx.gbl...
>>>> Patrick, Thanks for responding.
>>>>
>>>> I think I've found it, but I'm not finished.
>>>> I discovered on closing various programs in Task
>>>> Manager that killing one with the name "web.exe"
>>>> kills the unwanted symbol in the task bar.
>>>>
>>>> This is shown in Task Manager to have 4048 k
>>>> of memory space.
>>>>
>>>> I then searched my system and found two copies of
>>>> "web.exe"
>>>>
>>>> One was located at C:/windows/web.exe
>>>> The 2nd one was at C:/windows/System32/web.exe
>>>>
>>>> Size of this file is listed as an 88 KB application.
>>>>
>>>> I have moved these elsewhere.
>>>>
>>>> I find that even after the above were moved, the
>>>> unwanted program starts up anyway. So there is
>>>> more to do. I assume I have moved the correct
>>>> files.
>>>>
>>
>>.
>>
>.
>

Relevant Pages