Possible rootkit/trojan?

Discussion in 'other security issues & news' started by lynchknot, Mar 29, 2005.

Thread Status:
Not open for further replies.
  1. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    I set up PG for read permissions (for taskman) and disabled app control in outpost because it says taskman altered memory for explorer and Outpost denies access to network. but still - there's something funny going on. I have to use taskmanager to shut it down because when I click ok on the popup another pops up - endlessly. I think perhaps something to do with this blank spot - very suspicious
     

    Attached Files:

    Last edited by a moderator: Mar 30, 2005
  2. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi lynchknot,

    With the security apps you have running, I would suspect a bug in Security TaskManager. Does TaskInfo (or Process Explorer if you have it) show the same number of running processes and do they have the same blank line? If you can sort that display by PID, I would check your raw PG logs and and try to compare PIDs since your last boot.

    Nick
     
  3. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    TaskInfo does not show that blank (unnamed) app. That blank is exactly where Security task manager is getting hung up. Everytime it approaches that blank I receive a pop up.

    I have reinstalled STM several times.
     
  4. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Does TaskInfo show the same number of running processes as STM?

    Nick
     
  5. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    I can't tell STM stops and pops. I just downloaded Process explorer and it shows the same amount of processes as windows task manager with no blanks.Where do you find a count in TaskInfo?
     
  6. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    It shows in the System tab.

    Nick
     

    Attached Files:

  7. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    Thanks - all the same there too
     
  8. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Unless you see something unknown/strange in your PG logs, I would assume it's a STM bug.

    Nick
     
  9. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    You mean PG alerts? Too bad there's no STM board or help for trial users. I'm not going to buy this if it doesn't work.
     
  10. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    No, click View Logfiles in the Alerts tab and the folder with your logfiles will open. Double-click the most recent logfile and it should open in Notepad.

    Nick
     
  11. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    OK I see. I doubt I know enough to recognize anything suspicious there.
     
  12. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Next time you boot and after your system settles down, open the current PG log, and copy/paste/post the log entries for the current session. I'll take a look at it.

    Nick
     
    Last edited: Mar 29, 2005
  13. Pat_Burke

    Pat_Burke Guest

    Could it be a software conflict? It looks like you have a lot of different programs running, sooner or later there is bound to be conflicts between many different security programs all running together. I would try shutting down your apps one at a time to see if it's a software conflict.....just an idea.
     
  14. nick s

    nick s Registered Member

    Joined:
    Nov 20, 2002
    Posts:
    1,430
    Hi Pat_Burke,

    Could very well be the case. Too many overlapping functions can cause problems.

    Nick
     
  15. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    Well, I shut down what I thought could be preventing access for STM: process guard, Outpost's application control, and prevx - but still receive the error.
     
  16. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    upon reboot this morning I see this. SSM is, of course, System safety monitor which I have disabled due to problems at reboot. I'm wondering why, after BlackIce took a baseline that it does not recognize this dll.
     

    Attached Files:

    Last edited by a moderator: Mar 30, 2005
  17. lynchknot

    lynchknot Registered Member

    Joined:
    Jun 26, 2004
    Posts:
    904
    Location:
    SW WA
    Problem solved with Security Task Manager. I deleted a folder (STM) from "all users" application data - works now.
    Looks like I will have to purchase sTm because this is "killing" me!

    Screenshot:
     

    Attached Files:

    Last edited: Mar 30, 2005
Loading...
Thread Status:
Not open for further replies.