Boris Posted January 29, 2005 Report Share Posted January 29, 2005 A TD-S scan identified this file as Riskware.Tool.Destart !Scan Control Dumped @ 21:49:33 29-01-05Positive identification: Riskware.Tool.Destart File: c:\windows\system32\tools\restart.exeAny idea what it is ?See attached. Quote Link to comment Share on other sites More sharing options...
Boris Posted January 29, 2005 Author Report Share Posted January 29, 2005 Not picked up by any of these - a-squared, The Cleaner, Trojan Hunter, Ad-Aware, Spybot Quote Link to comment Share on other sites More sharing options...
-pops- Posted January 29, 2005 Report Share Posted January 29, 2005 ?What is a conuter? (Description on the graphics) :( Quote Link to comment Share on other sites More sharing options...
nellie2 Posted January 30, 2005 Report Share Posted January 30, 2005 From what I have been able to glean it sounds a bit dodgy, I'm surprised A squared didn't pick it up though. Upload the file here and see what comes back. Quote Link to comment Share on other sites More sharing options...
LineOFire Posted January 30, 2005 Report Share Posted January 30, 2005 http://virusscan.jotti.org/That's a great site to upload files to too.That System32\Tools directory is not default for Windows. What else is in that directory?Would you mind zipping up a copy of the file and sending it to me? Quote Link to comment Share on other sites More sharing options...
Boris Posted January 30, 2005 Author Report Share Posted January 30, 2005 From what I have been able to glean it sounds a bit dodgy, I'm surprised A squared didn't pick it up though. Upload the file here and see what comes back.The Results :- Quote Link to comment Share on other sites More sharing options...
Boris Posted January 30, 2005 Author Report Share Posted January 30, 2005 http://virusscan.jotti.org/That System32\Tools directory is not default for Windows. What else is in that directory?Here you go :-The Readme.txt contains the followingAC2K.exe => Auto Click For Windows 2000AC98.exe => Auto Click For Windows 98 / SE / MEACL98.exe => Auto Click Install Lan Driver For Windows 98 / SEACLME.exe => Auto Click Install Lan Driver For Windows MEALL.exe => Auto Click Install for AC2K, AC98, ACL98, ACLME, SoundDrv.AutoClick.exe => Not UserChange.exe => First Run Change Windows Source Path -> [WINDIR]\Devices Second Run Resume Windwos Source PathCheckPath.exe => Then AutoSetup For HDD Install, Run ChankPath.EXE Search Windows Source Files. Windows Source Files find => Run Auto Click Mode. Wndoows Source Files not find => Not Run Auto Click Mode.Counter.exe => Counter Second to Restart.DeleteFile.exe => InstallShiled INI Files Set DeleteFiles = Enable Run DeleteFiels.EXE Delete FileDelT2Dv.exe => Delete Folder [WINDIR]\Temp_2 & [WINDIR]\Devices.DelT2.exe => Delete Folder [WINDIR]\Temp_2.DelDv.exe => Delete Folder [WINDIR]\Devices.DelTools.exe => Delete Folder [WINSYSDIR]\Tools.LostRun.exe => Then AutoSetup For HDD Install, Lost Run Fils is Delete Files [WINDIR]\Temp_2 Temp Files.RegClean.exe => Clean Registry Editor [HKEY_CURRENT_USER] AutoSetup\AutoClick Set Value: 1. All : 0 2. Lan : 0 3. Sound : 0 Path : Windows\StartupRegexe.exe => Set Registry Editor [HKEY_LOCAL_MACHINE] Software\Microsoft\Windows\CurrentVersion\RunServices Set Value: Execute : All Path and Execute(Regexe.exe) Auto Click Install Driver for Windows 98 / SE / ME.Restart.exe => Restart Windows.RunAP.exe => Run C-Media 9738 AP.RunRegexe.exe => Run C-Media 9738 AP.SD9738.exe => CMI9738 Sound Codec Driver For All OS.SDW98ME.exe => CMI8738 Sound Driver For Windows 98 / SE / ME.SDW98ME_LPC.exe=> CMI8738 Sound Driver For Windows 98 / SE / ME for ITE LPC.SoundDrv.exe => Auto Click CMI8738 Sound Driver For Windows 2000.It may be something I installed to try out ? Quote Link to comment Share on other sites More sharing options...
Boris Posted January 30, 2005 Author Report Share Posted January 30, 2005 Would you mind zipping up a copy of the file and sending it to me?On its way :) Quote Link to comment Share on other sites More sharing options...
LineOFire Posted January 30, 2005 Report Share Posted January 30, 2005 Yeah, the file had no malicious code in it after a quick scan of it. The screenshots pretty much confirm that it is a valid file. But from which application?! :shocking: *Duh-duh-duh* Quote Link to comment Share on other sites More sharing options...
Boris Posted January 30, 2005 Author Report Share Posted January 30, 2005 Possible Trojan ???? Quote Link to comment Share on other sites More sharing options...
LineOFire Posted February 1, 2005 Report Share Posted February 1, 2005 I really don't think it's a trojan. There was nothing malicious in it's code and all the scanners just say it's a risky file because of the nature of the program. Quote Link to comment Share on other sites More sharing options...
Boris Posted February 1, 2005 Author Report Share Posted February 1, 2005 all the scanners just say it's a risky file because of the nature of the program.Whatever it is ! :lol: :lol: :lol: Quote Link to comment Share on other sites More sharing options...
LineOFire Posted February 1, 2005 Report Share Posted February 1, 2005 Well, it is a restart utility. Just think what evil can be done with it! :lol: Quote Link to comment Share on other sites More sharing options...
Boris Posted February 3, 2005 Author Report Share Posted February 3, 2005 I shall have to ........startre-thinking about it ? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.