nipi

I got infected with a malicious executable, "GXHO.exe".
My anti virus didn't say anything about it, then this happened:
First my anti spyware warned me that it's being put with the start up,
so i rejected, and opened task manager to close it and didn't find it,
so i assumed it's not running. I went to its folder to delete it, but
it wouldn't delete because it's in use. A while passed and my firewall
asked me whether i allow SMTP access to GXHO.exe, of course i said no,
and checked the task manager again, found nothing!
I was wondering how can i close it, then i chose to restart the
computer hoping it won't start, but it did.
My only way to get rid of it was to activate the proactive defence of
kaspersky, which warned me when this process is trying to launch, and i
clicked terminate, and then could delete it.
So is it possible that a process doesn't appear at all in task manager?

ted zieglar

It's absolutely possible. One of the many tricks performed by malware is
the ability to rename itself and even to adopt the name of a legitimate
process.

Malware is getting more and more sophisticated. Don't think for a minute
that you can eliminate it by terminating its process in Task Manager.

---
Ted Zieglar
"Backup is a computer user's best friend."

nipi

I had it in mind that the process might be using a legitimate process name,
as i had seen something like that before, when a malware was using named,
svchost.exe but it was running under my username not SYSTEM account which
made me suspicious. But this one wasn't using this trick, it simply didn't
appear at all.

malke

Rootkit.

http://www.google.com/search?hl=en&l...it&btnG=Search

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

david

Hi Nipi - I suggest you try the trial version of PREVX1 -
www.prevx.com/default.asp - it did a top job for me - and explains the number
of varieties of the virus concerned ... Cheers ... David

tomas 111

Don't worry.

It was nothing

i was "inflected" by gxho.exe but i removed it in 5''

First of all it is not trojan, virus etc....

It is a small programm which comes from www.serials.ws

The problem is that it is hidden. You can just make it visible b
Ctrl+Alt+Shift+H.

Then go to C:Windows>Sys and just delete the file.

You are done.

So dont panic everyone...

--
Tomas 11
-----------------------------------------------------------------------
Tomas 111's Profile: http://forums.techarena.in/member.php?userid=2000
View this thread: http://forums.techarena.in/showthread.php?t=63855

http://forums.techarena.i

malke

I'm glad you got it sorted, but I can't imagine why you'd think that
anyone would panic about your problems. After all, *you're* the one
downloading cracks from a Windows machine, not me.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

tomas 111

Excuse me "God",

But i think that this threat was opened because someone had a problem

And that guy just asked for help.

If you dont accept relevant replies then what is the meaning of keepin
the threat alive??

the guy was reither nervous and noone had a clue about what i
gxho.exe.

Sorry for posting here. Sorry for the help which i provided.

It was my mistake and i wont do it again.

P.S. I suggest u to calm. Not everyone is your enemy around here. Peac
my friend

--
Tomas 11
-----------------------------------------------------------------------
Tomas 111's Profile: http://forums.techarena.in/member.php?userid=2000
View this thread: http://forums.techarena.in/showthread.php?t=63855

http://forums.techarena.i

nipi

Thank you for the information.
My "panic" was not because of the threat this process causes as much as
the threat of the existence of a process (and probably more than one)
which doesn't appear in the task manager. I only detected this one
because it tried to access the internet, so in case there is another
hidden one on my computer or anyone else's, and it doesn't access the
internet, then it's hard to know about it.
When i found the c:\windows\sys, i didn't delete it i just moved its
location to insure it won't run again, and I used windows live safety
scanner online to get a second opinion (as kaspersky didn't detect it),
and the scanner found it and said it's a keylogger.
Now if you are saying it shows with a hot key, then it's a controllable
program for spying like 007 spy software, but it's pre-configured in a
bad way.
So, the original problem remains, possibility of running processes,
which don't appear in task manager.