I have a virus that you may find interesting and NIS doesn't see it as anything

This exe seems to be created by Java somehow.

Originally it was being put in:

C:\Users\Steven\AppData\Roaming\Microsoft\Crypto

And the file was RAVCl64-86.exe and was eating up half of our processors (machine is Win7-64 with core-i7 and 8GB RAM)

 

We got rid of it through massive pain in the rear, and now its popping up again in:

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates

Now the exe in question is MSDT.EXE and completely takes over all 4+4 processors.

I have set the affinity to just CPU 0 and set its priority down but that CPU is pegged.

 

Norton Internet Security (latest app and defs) does not see it as anything bad.

I have attached a screenshot of the files it makes (it is a .jpg file renamed to .txt)

 

The acieclx.vbs file contains the following code:

 

Set objSh = CreateObject("WScript.Shell")
objSh.Run "C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\atieclx.exe", 0

 

The others are .exes and files I can't open with text editor.

If I end the process tree of msdt.exe, within 5 minutes, its back and has all 4+4 processors pegged.

Can anyone help???

Thanks,

Rob

 

 

 

Hi,

 

You could submit it for analysis here  -  https://submit.symantec.com/websubmit/retail.cgi

Or let Quads play with it here.  He likes murdering malware.

 

http://qmalwareremoval.freeforums.net/board/2/malware-removal-protected

 

 

So this thread also knows.

 

 


Won't be touching your system.

You are playing with files (text editor etc) and getting rid of whatever, even though it may be legit.

Good Luck with what you are doing,  maybe it will in the end teach people not to play with programs, systems and text editors etc. with what you don't understand and leave alone.

For Instance  2 things

a) If the files are bad,  playing with them by text editor or other programs if the user does not know what they are doing could mean you are starting the process off again by doing procedures wrong.

b) "If I end the process tree of msdt.exe, within 5 minutes, its back and has all 4+4 processors pegged."  did you even look up the file name for msdt.exe and location for at least a face value of what is the file??


You don't need my help to do to the system what you are doing,  I also will not be a a part of it.

Good Luck

Quads


 

 

Quads

 

Fully aware of how to run an .exe

Only opening the text files with a text editor.

"The others are .exes and files I can't open with text editor." was stating the obvious "So this thread also knows"

 

Is that how you get so many posts? by touting the obvious?

I'm not looking for YOUR help, obviously, but someone from Norton / Symantec, maybe.

 

 

"a) If the files are bad,  playing with them by text editor or other programs if the user does not know what they are doing could mean you are starting the process off again by doing procedures wrong.  "

 

****Come on.  Seriously****

b) "If I end the process tree of msdt.exe, within 5 minutes, its back and has all 4+4 processors pegged."  did you even look up the file name for msdt.exe and location for at least a face value of what is the file??

 

Go ahead, scan YOUR system for msdt.exe  (you'll find a bunch).

This particular one was running out of:

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\

which happens to correspond with the path in the vbscript file.

 

 

 

 

"The acieclx.vbs file contains the following code:

 

Set objSh = CreateObject("WScript.Shell")
objSh.Run "C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\atieclx.exe", 0

 

The others are .exes and files I can't open with text editor."

 

With me what I say is final for myself.   I will not be touching your system.   I laearned not to touch those systems the hard way also.

 

"Is that how you get so many posts? by touting the obvious?"  due to the fact removing malware and fixing Windows can take a few messages back and forth.  

 

"Go ahead, scan YOUR system for msdt.exe  (you'll find a bunch)."   I don't need to as I know how to get around a system, know where is what, test malware and so don't need to scan my system when someone asks me to.

 

 

I am actually going to remove your other thread as your thread is here.

 

Good Luck

 

Quads

 

First of all let me apologize to you for jumping on your post. 

 

I though you were some random person flaming me (didn't realize I had just posted to YOUR site).

Anyway, I'm a programmer as well, so know about text files and executables, etc and it just hit my hot-button, I guess.


The .vbs file is a text script that I never "ran" I only opened it via a text editor.

 

As far as the actual filename, the first time we ran into this it was called RAVCl64-86.exe and was running from

C:\Users\Steven\AppData\Roaming\Microsoft\Crypto

 

Now its being called msdt.exe and being run from:

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates

 

I was hoping to peak the interest of some of the people who really get into the diagnosing what's going on here.

Anyway, sorry for jumping on you (and I would still REALLY appreciate anyone who can look into this).

I'm considering just blowing away the whole machine with a clean Windows install but there are some apps on it that I would have a tough time running down my install disks and licenses, and the "detective" in me just wants to get some idea of what kind of jerk would write an app like this (and what is it doing with my cpu cycles)?  If its doing math to find extra-terrestrials, I might kick in a few cycles for free.  :)

Thanks again for getting back to me.

Rob

 

 

 

Hi robsin12:

 

I did a quick check at www.file.net and all three files you mentioned could be legitimate system files:

 

RAVCpl64.exe - Realtek HD Audio Manager

msdt.exe - Microsoft Diagnotics Troubleshooting Wizard

aticlxx.exe - AMD External Events Client Module

 

It's always possible that malware could be camouflaging itself as one of these files, so if they're still on your system then you can submit them to VirusTotal for analysis.  If you suspect you are infected with malware then you can register with any of the recommended malware removal sites suggested here by delphinium - with the obvious exception of Quad's QmalwareRemoval site.

 

If you've already removed any of these files off your system without confirming that you were actually infected with malware then I wouldn't be surprised if you've corrupted at least one of your hardware drivers.

------------
MS Windows Vista Home Premium 32-bit SP2 * Firefox 26.0 * IE 9.0 * NIS 2013 v. 20.4.0.40
HP Pavilion dv6835ca, Intel Core2Duo CPU T5550 @ 1.83 GHz, 3.0 GB RAM, NVIDIA GeForce 8400M GS

Hi, robsin12. If you DO decide you need malware help, try one of the forums listed below.

 

 http://www.bleepingcomputer.com/

http://www.geekstogo.com/forum/
http://www.cybertechhelp.com/forums/
http://forums.whatthetech.com/

 

We have made progress.  Norton Internet Security is now blocking the file from running.

However, SOMETHING is still creating the .vbs script that it puts in:

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates

 

containing:

 

Set objSh = CreateObject("WScript.Shell")
objSh.Run "C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\atieclx.exe", 0

 

But the .exe is no longer there.  Shortly after the pop-up says "Can't find program..." I get a norton pop-up saying

Protected from "Trojan.something or other"  (Can't remember).

 

Then I went to the registry and blew away 2 keys that had:

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\atieclx.exe

and 2 keys that had:

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\msdt.exe

 

But that didn't help. 

I will post a bunch of the Norton-generated text files and more info this afternoon.

 

(By the way, I'm VERY close to doing a clean re-install and just going to get Windows 8.1) but will keep trying on this for another week, I think.

Thanks for all the help and suggestions.

Oh, and also thanks to Imacri for the link to VirusTotal.  I did submit BOTH my problem .exe's there and the BOTH were recognized as viruses.  I will post that info as well.

 

Hi again, robsin12. If you DO go down the route of updating to Windows 8.1, this may sound obvious, but I suggest you make sure that

 

you are fully updated both with Windows Updates and Norton Live Updates before you update your browsers, as there have been

 

some compatibilty problems in the past, with the toolbars.

Another data point.  Since the new account seemed to have no troubles, I blew away the login that was giving us trouble.  Created a second new account.

So now i have 2 accounts with everything working fine.  I.e., the virus did not make its attempt to run and norton did not have to block it.

 

Then I left the machine up (with the new account logged in) for about 2 hours.  Came back to check on it and we couldn't get out on the internet (which was one of the problems before).  The cpu cycle stealer isn't running though.

 

Rebooted and logged in to that same account...and still no internet.

Rebooted and logged in to the other account and we have connectivity fine.

 

So, I'm going to leave this unaffected account up for a few hours and see if its connectivity goes away.

If so, I'm just going to blow away the whole machine.

This has been a massive waste of time and effort, but it has been interesting.

Will keep you all posted.

 

 

Also F4E, I'm going to do a clean install of win8.1 x64.

Were you talking about doing a windows "upgrade" and having browser issues? or for a clean install, as well?

Thanks,

Rob

 

Hi, robsin12. I called it an *update* to Win 8.1 rather than an *upgrade* !, because I haven't heard that many people who have been full of praise for Windows 8.1 !

 

There were and still may be some incompatibilities with Windows 8.1 and The Norton Toolbar, which is why I suggested you update everything, to  hopefully ensure compatibility.

 

Good luck. :smileyhappy: