Tracking down Data Execution

Posted by Agnel Kurian on Super User See other posts from Super User or by Agnel Kurian
Published on 2009-09-30T04:21:19Z Indexed on 2010/03/16 12:06 UTC
Read the original article Hit count: 283

Filed under:

virus

|

malware

I have some malware infecting one of our machines at home. It first showed up as winulty.exe. After investigating, I am of the opinion that winulty.exe itself is an uninfected file but is being modified after it has loaded into memory. Turning on Data Execution Prevention for all processes and services has confirmed this to be true.

How do I track down the process responsible for this? I've used File Monitor from sysinternals.com to monitor winulty.exe and see this being accessed by the svchost.exe instance hosting most of the system services and also by dfrgntfs.exe. How do I know which service or which DLL has been infected?

© Super User or respective owner

Related posts about virus

virus behaviour but couldn't find any virus on windows7

as seen on Super User - Search for 'Super User'
Hi Friends, I found strange virus like behaviour on my pc running windows 7. I'm not able to type properly with my keyboard. Some times it won't respond, and some other times it adds characters indefinitely to the typing area. When i click on desktop it creates new folders. When press ctrl+N on a… >>> More
virus behaviour but couldn't find any virus on windows7

as seen on Super User - Search for 'Super User'
Hi Friends, I found strange virus like behaviour on my pc running windows 7. I'm not able to type properly with my keyboard. Some times it won't respond, and some other times it adds characters indefinitely to the typing area. When i click on desktop it creates new folders. When press ctrl+N on a… >>> More
How to know if your computer is hit by a dnschanger virus?

as seen on Super User - Search for 'Super User'
The Federal Bureau of Investigation (FBI) is on the final stage of its Operation Ghost Click, which strikes against the menace of the DNSChanger virus and trojan. Infected PCs running the DNSChanger malware at unawares are in the danger of going offline on this coming Monday (July 9) when… >>> More
AVG Anti-Virus Plus Firewall

as seen on Internet.com - Search for 'Internet.com'
AVG's real-time <a href = "http://www.winplanet.com/file/13384.htm">Anti-Virus scanner</a> paired with a powerful firewall for added security >>> More
AVG Anti-Virus Pro

as seen on Internet.com - Search for 'Internet.com'
Comprehensive, award-winning antivirus and antispyware protection for your PC >>> More

Related posts about malware

Open dns still detects malware activity after having scanned and removed malware

as seen on Super User - Search for 'Super User'
I'm using open dns to block unwanted sites. Everytime I go to the dashboard I always see this malware activity in all of the networks that I have in open dns. What do I do?I'm using avast free, spybot, and sas. And used them all to full scan the system. And they have removed the malware. But I still… >>> More
HTG Explains: Do Non-Windows Platforms Like Mac, Android, iOS, and Linux Get Viruses?

as seen on How to geek - Search for 'How to geek'
Viruses and other types of malware seem largely confined to Windows in the real world. Even on a Windows 8 PC, you can still get infected with malware. But how vulnerable are other operating systems to malware? When we say “viruses,” we’re actually talking about malware in general… >>> More
How to Use An Antivirus Boot Disc or USB Drive to Ensure Your Computer is Clean

as seen on How to geek - Search for 'How to geek'
If your computer is infected with malware, running an antivirus within Windows may not be enough to remove it. If your computer has a rootkit, the malware may be able to hide itself from your antivirus software. This is where bootable antivirus solutions come in. They can clean malware from outside… >>> More
Not All “Viruses” Are Viruses: 10 Malware Terms Explained

as seen on How to geek - Search for 'How to geek'
Most people seem to call every type of malware a “virus”, but that isn’t technically accurate. You’ve probably heard of many more terms beyond virus: malware, worm, Trojan, rootkit, keylogger, spyware, and more. But what do all these terms mean? These terms aren’t just… >>> More
Keep Malware Off Your PC With Sandboxie

as seen on Internet.com - Search for 'Internet.com'
Malware can infect your PC from anywhere on the Web. Sandboxie, a free application, blocks it. >>> More