Split from old: "ANTS 3.0 Update Thread" (re: netsetup.exe)

Discussion in 'other security issues & news' started by egore, Feb 16, 2005.

Thread Status:
Not open for further replies.
  1. egore

    egore Registered Member

    Joined:
    Feb 16, 2005
    Posts:
    1
    I have doubts about the file C:\WINDOWS\system32\netsetup.exe
    Earlier today, while I was reaching into services manager to restart my web server, I found all the way at the bottom of the list a service named 'Wsks2hi'.
    This instantly aruose suspicion so I opened the service properties and saw that the path to the executable is C:\WINDOWS\system32\netsetup.exe.
    Did a search for this name and came across this forum, so I decided to add a post.
    Did a virus scan with Norton and he didn't report anything.
    I will now do a scan with Ants to see what happens. Regardless of results, I will proceed to destroy this file and the service, since the name 'Wsks2hi' (no results on google for this name) looks like it is either:
    a) some kind of installation/update that did not finish installing properly or something went wrong so the name of the installed service endead up in 'Wsks2hi' instead of its properr name (I don't buy this, but still)
    b) a randomly generated name of a trojan service

    By the way, this service is configured to run under a Local Account '' (blank field - no name), so possibly it never ran, but I can't find anything in the Event Viewer.
     
  2. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Re: Split from old: "ANTS 3.0 Update Thread"

    egore,

    Your post was split off of the original thread that you replied to because that thread was over 2 1/2 years old, and ANTS is no longer being developed. So it is best to address this as a new topic to see what help people can offer.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.