http://www.liutilities.com/products/wintaskspro/processlibrary/internat/

http://support.microsoft.com/default.aspx?scid=kb;en-us;245264

http://www.reger24.de/prozesse/internat.exe.html

loadwc.exe & internat.exe
http://www.annoyances.org/exec/forum/win95/t1019359467

internat.exe enable indicator on taskbar
http://www.annoyances.org/exec/forum/win98/t1015550905

http://www.sarc.com/avcenter/venc/data/pwsteal.netsnake.html

After the Trojan copies itself, it It adds the value

Internat.exe %windir%\internat.exe

to the registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

so that the Trojan runs when you start Windows.

When it runs at startup, it displays the message

Hello. I'm NetSnake.

http://www.infopackets.com/computer+questions/internat.exe+and+ptsnoop.exe+in+my+msconfig+startup+part+2.htm

From the Symantec website, I found that there is a trojan program file called internat.exe which maliciously steals passwords and sends them to the trojan creator.  However, I missed the part where the Symantec web site mentions that there is in fact a legitimate file called internat.exe which resides in the %windir%\system directory.

Basim from Iraq writes, "Internat.exe is there in *msconfig.exe* for bilingual machines. The blue small square in the system tray where you can change the language you type in email messages, couldn't be displayed without enabling internat.exe. This applies to bilingual Windows only."

And, to quote from the Symantec web site:

" Please note that there is a legitimate Windows application called %windir%\system\Internat.exe. The Trojan file (also known as internat.exe) is 82.5 KB in length and uses a zip file icon. The "real" Internat.exe is generally about 20 KB in length with a "?" icon.

NOTE: %windir% is a variable that denotes the folder in which Windows is installed. The normal installation folders are C:\Windows or C:\Winnt. "

So, what do you need to do to make sure that the Internat.exe -- if you have it on your system -- is not the trojan?

From my understanding, an infected system will display "Hello. I'm NetSnake." after a system reboot.  If you remember seeing a message like this, the trojan is installed on your system and you need to get rid of it.

It is not a virus or trojan. I have this file on my comp too. For more information visit the links given by CrazyOne.

Hi hmchi!

Thx for points!

internat.exe is installed with Windows and provides Microsoft's multi-lingual features in Windows.
This original program is important for the stable and secure Windows environment and should not be terminated.

internat.exe is also a process which is registered as the Win32.Lydra.a information stealing Trojan.
This Trojan allows attackers to access your computer, personal data and information.
The Trojan is a security risk and should be removed immediately.

If the file continues to return, than bets are that Windows is detecting it as a missing system file and pullign in from your cached cab files.

Sometimes it is hard to tell the difference between real system files, and cloned malicious programs with the same name.

I suggest you use your favorite Anti-Virus web site to search for information about the Win32.Lydra.a trojan and how to detect and remove it from your system.

I also recommend you do a google or yahoo search for file names in question to learn more about them.