[al.motion]

i Ran a scan from http://virusscan.jotti.org/ on the file C:\WINNT\system32\jpsup.exe and here are the results


File: jpsup.exe
Status: INFECTED/MALWARE
MD5 a515537b7ae8f06cd84c6ad229f0941a
Packers detected: UPX, PE_PATCH


AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found Backdoor.SDBot.852A4434
ClamAV Found nothing
Dr.Web Found Win32.IRC.Bot.based
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found Backdoor.Win32.SdBot.gen
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found Backdoor.xBot.1 (paranoid heuristics) (probable variant)

[Advertisements]

Hi,

Thanx for scanning the file at Jotti.

Delete the file - C:\WINNT\system32\jpsup.exe.


Reboot the PC.

Let me know if the random file still makes an appearance.

[tampabelle]

Hi,

Thanx for scanning the file at Jotti.

Delete the file - C:\WINNT\system32\jpsup.exe.


Reboot the PC.

Let me know if the random file still makes an appearance.

[al.motion]

I deleted the file, run the online Kaspersky scanner which showed that my system was clean and rebooted ... Ah but alas there was the exe again, so i did some googling and found out that this exe is actually coming from my Trend Micro antivirus software (how ironic) ... Anyway it is harmless ... see the excerpt below from a blogger ... Hey thanks a million for all your time and help .. I will donate to this cause



Earlier this week one of my coworkers told me that he’d gotten some sort of virus or spyware that neither the virus scanner nor AdAware was able to detect.
He’d stumbled across the parasite by accident while using the task manager to monitor the memory and CPU usage of a service he was debugging. The parasite was an executable running as the SYSTEM account with a different name for the executable after every reboot.
To be on the safe side, I opened my task manager and found a process with a similar name and the exact same size running as the SYSTEM account.
The actual executable was located in the Windows\temp directory and had a cute little puppy as its icon. I made a copy of the file, before I killed the process.
Viruses often have messages hidden within them, so I opened the file in a hex viewer to take a closer look at it. I was both relived and surprised of what I found.
The file had a reference to a debug symbol database file named OfcDog.pdg (D:\OfficeScan\src\Client\OfcDog\Release\OfcDog.pdb). Trend Micro OfficeScan is the virus scanner we use so this file was probably not hostile. Just to be sure I located OfcDog.exe and it was a verbatim copy of the shady executable I had running on my computer.
I reckon that the reason for renaming the process on every reboot is to make it harder for hostile code, such as a virus, to kill the process. However, when having an executable that does such a thing it should be easy to understand what it is. If the developers at Trend Micro had used the same icon for this file as tray icon, I would have recognized it immediately. Having a cute puppy as an icon might seem like a fun idea since the file has “dog” in its name, but when used with applications that appear to be shady in the first place, it only makes users more suspicious.
The morale of the story is that one should always use icons that make sense to the user. An icon should be a picture or symbol that is universally recognized to be representative of something. Using something different only causes iconfusion.

[tampabelle]

Thats great !!!!!!!

I was on what it was.

[tampabelle]

do you have any issues with your PC ???

[al.motion]

My PC is running smoothly, no issues ... Thanx

[tampabelle]

hi,


CONGRATULATIONS !!!!!!!!!!! Your PC is clean now



I would recommend the following steps to keep your PC clean (especially Step 1 to install critical Windows patches including Service Pack 2 or SP2 if not already installed and Step 8 now that your PC is clean) -

PREVENTIVE MEASURES FOR FUTURE

Operating System
1. Keep the Windows and Internet Explorer updated with the latest fixes. These fixes are available free from Microsoft. Click on Tools in the IE menu bar and then on Windows update. You can also use the following links

Windows security and critical updates
Internet Explorer security and critical updates

Also ensure that automatic updates are enabled for faster updation of the system.
(Right click on My Computer on your desktop, properties and Automatic Updates tab.


Anti-Virus Software
2. Keep your Anti-virus program updated with the latest definitions. Some of the common anti-virus programs in use are :

Norton Anti-Virus
McAfee Anti-Virus
AVG Anti-Virus --- freeware
Avast Home Edition --- freeware

Use only one anti-virus program as multiple such programs can create conflicts between themselves and severely hamper the performance of your PC.


Firewall
3. You should also have a good firewall. Here are 3 free ones available for personal use:
Sygate Personal Firewall, Kerio Personal Firewall, ZoneAlarm


Internet Browsers
4. Have robust explorer settings. It is preferable to use an internet browser other that IE as most of the malware is targetted at IE. In case you prefer to use IE, then download a list of innocent looking but harmful websites from IE-Spyad and install it on ur PC. IE-SPYAD puts over 5000 sites in your internet explorer's restricted zone, so you'll be protected when you visit innocent-looking sites that aren't really innocent at all.

Some alternate browsers I suggest are Firefox Mozilla Browser and Opera

Ensure that Security level, irrespective of whichever browser you use, is set at Medium or higher, restrict the usage of cookies and activeX components.


Spyware Protection
5. Have a wall of protection against spyware / adware by installing SpywareBlaster and SpywareGuard.

SpywareBlaster and SpywareGuard are by JavaCool and both are free programs.
SpywareBlaster will prevent spyware from being installed and consumes no system resources.
SpywareGuard offers realtime protection from spyware installation and browser hijack attempts. Both have free ongoing updates.


Spyware Removers
6. Install programs for scanning for malware and uninstalling them. Two of the best programs, both are freeware, are :

Spybot Search & Destroy - A powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

AdAware SE Personal Edition - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.


Regular Maintenance of PC
7. Finally, invest some time for regular maintenance of your PC. Delete the temporary Internet files, temporary files, cookies etc. Click on Start button, Programs, Accessories, System Tools and run the program Disk Cleanup. Follow the instructions.

An alternate freeware software which can be used is CleanUp.

Keep your Registry clean. My favourite software is Registry First Aid. This is not a freeware but a trial version can be downloaded.


System Restore Points
8. Since your PC is currently clean, create a system restore point. A system restore would enable you to revert to the settings on the PC when the restore point was created. It is also a good idea to flush all earlier system restore points which may be containing infected files.

A. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

B. Restart your computer.

C. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.

System Restore will now be active again.


Go ahead and enjoy a clean PC !!!!!!!!!!!!!