• Welcome to Valhalla Legends Archive.
 

What process is this?

Started by OuTLawZGoSu, January 02, 2004, 09:52 AM

Previous topic - Next topic

OuTLawZGoSu

What are these programs used for?

dllhost.exe
csrss.exe
lsass.exe
smss.exe
rundll32.exe

I've ot a feeeling that i got a shitload of backdoors. I've got a bunch of processes opening with "NETWORK SERVICE" lable. If you know a good trojan scanner, let me know.

Thx

iago

Those are all windows programs.  Although any of them *can* be a virus/trojan, as long as the virus names itself after that process.

To scan, use http://housecall.trendmicro.com
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


OuTLawZGoSu

Quote from: iago on January 02, 2004, 10:11 AM
Those are all windows programs.  Although any of them *can* be a virus/trojan, as long as the virus names itself after that process.

To scan, use http://housecall.trendmicro.com

Well, after dllhost.exe opens, a process called Msdtc.exe opens. I end it's process after it starts. Then I end dllhost. Thx for the site.

Stealth

Both of those are potentially valid Windows processes.
- Stealth
Author of StealthBot

OuTLawZGoSu

What about LOCOMS~.exe

That opens time to time.
Got HouseCall scanning comp righ now.

iago

I've never heard of that one
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


OuTLawZGoSu

Quote from: iago on January 02, 2004, 01:36 PM
I've never heard of that one

Aight, prolly a trojan then. But, I scanned my comp with HouseCall from their website and it didn't find anything. Weird :/

iago

It might be spyware or something.  Look for "Spybot Search & Destroy" (NOT Spyhunter!)
This'll make an interesting test for broken AV:
QuoteX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*


Mesiah / haiseM

LUCOMSERVER.EXE is part of norton anti virus, at least thats what ive always been under the impression, do you have norton anti virus? if you do, im pretty sure it belongs to norton, if not, it may be *possible* spyware.
]HighBrow Innovations
Coming soon...

AIM Online Status: 

Stealth

- Stealth
Author of StealthBot

OuTLawZGoSu

Ye I got Norton Antivirus.

Mesiah / haiseM

]HighBrow Innovations
Coming soon...

AIM Online Status: 

Adron