Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Identifying a program:

Posted on 2006-06-22
10
Medium Priority
?
886 Views
Last Modified: 2013-12-04
I have a program which tried the following:

Read: \WINDOWS\Registration\R000000000008.clb
Read: \WINDOWS\WINHELP.INI
Write: \PIPE\lsarpc
Write: \DOCUME~1\User\LOCALS~1\Temp\ed64_appcompat.txt
Run: \WINDOWS\system32\dwwin.exe

And another which did similar though with an additional operation:

write: \DOCUME~1\User\LOCALS~1\Temp\920_appcompat.txt

Can anyone help me identify this program by what it accessed?
0
Comment
Question by:List244
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +1
10 Comments
 
LVL 5

Assisted Solution

by:mkdonohue
mkdonohue earned 600 total points
ID: 16962832
It's doubtful. The ddwin.exe is just the Microsoft Doctor Watson error reporting tool... Meaning the app crashed right after starting.
0
 
LVL 8

Author Comment

by:List244
ID: 16962863
I was thinking they were using DDWin for sending something outward.  That makes more sense (your reasoning).

Can you explain:
R000000000008.clb
\PIPE\lsarpc
and
\DOCUME~1\User\LOCALS~1\Temp\ed64_appcompat.txt

I assume the third is going to be program-specific, but maybe it is a common storage by a certain logging utility?
0
 
LVL 17

Assisted Solution

by:Eagle6990
Eagle6990 earned 600 total points
ID: 16962872
Have you checked those txt files? They might have more info.  As mentioned earlier, it shows that Dr. Watson ran after a crash and left a log file for you to help diagnose the problem.
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 32

Expert Comment

by:r-k
ID: 16962907
Did you recently install Vista?

Maybe if you look at the contents of those two txt files in the TEMP folder it'll give a better idea.
0
 
LVL 8

Author Comment

by:List244
ID: 16962965
The files were rejected, so there was nothing written.  The first file \WINDOWS\Registration\R000000000008.clb
seems to be some standard windows file, what it is, I do not know.

The WinHelp.ini does not exist on my computer, so nothing was read there.

And \PIPE\lsarpc I don't know what that does at all.

I do not have Vista, I run XP, this program that did these things is some sort of key-logger or other such program.
0
 
LVL 8

Author Comment

by:List244
ID: 16962984
As for Dr. Watson, the execution was not allowed, so there is no log file from that.
0
 
LVL 5

Expert Comment

by:mkdonohue
ID: 16963052
The .clb files are COM+ catalog files
0
 
LVL 32

Accepted Solution

by:
r-k earned 800 total points
ID: 16963070
I think the \registration folder is something added when you install the .net framework.

lsarpc probably stands for LSA Remote Procedure Call
LSA is the Windows subsystem that authenticates logins.

It's possibly a worm trying to login.

This page hints it might be Sasser variant:

 http://securityresponse.symantec.com/avcenter/venc/data/detecting.activity.that.may.be.due.to.lsass.worms.html
0
 
LVL 32

Assisted Solution

by:r-k
r-k earned 800 total points
ID: 16963078
If you suspect a keylogger then do a scan with RootkitRevealer:

 http://www.sysinternals.com/Utilities/RootkitRevealer.html
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The term "Bad USB" is a buzz word that is usually used when talking about attacks on computer systems that involve USB devices. In this article, I will show what possibilities modern windows systems (win8.x and win10) offer to fight these attacks wi…
Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
Have you created a query with information for a calendar? ... and then, abra-cadabra, the calendar is done?! I am going to show you how to make that happen. Visualize your data!  ... really see it To use the code to create a calendar from a q…
Please read the paragraph below before following the instructions in the video — there are important caveats in the paragraph that I did not mention in the video. If your PaperPort 12 or PaperPort 14 is failing to start, or crashing, or hanging, …
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question