Miscreant hiding techniques: Would the real explorer.exe please stand up? And the relevance of 1979 when doing searches . . .

OdeToCode Links For Jan 16

OdeToCode Links — Mon, 17 Jan 2005 05:58:00 GMT

re: Miscreant hiding techniques: Would the real explorer.exe please stand up? And the relevance of 1979 when doing searches . . .

slink — Thu, 20 Jan 2005 02:09:00 GMT

We have about 5 systems with the explorer.exe (along with some other files) that have the pre-1980 date. It appears that it may be causing our backup problems, but I'm even more concerned about the systems having been comprimised. Any suggestions on how to proceed in fixing this or tracking down the cause? All the systems in question are W2K3 server.

re: Miscreant hiding techniques: Would the real explorer.exe please stand up? And the relevance of 1979 when doing searches . . .

And Clover — Wed, 26 Jan 2005 14:06:00 GMT

This is the adware PurityScan/NRnd, controlled by clickspring.net. You should also find a BHO in a randomly-named DLL in System32.

It doesn't always go for explorer.exe/??plorer.exe, though that name does seem to be quite common. Others I've seen are logonui.exe/l?gonui.exe and svchost.exe/??chost.exe. I suspect it picks a .exe name with one of the spoofable characters out of System32 at random.

re: Miscreant hiding techniques: Would the real explorer.exe please stand up? And the relevance of 1979 when doing searches . . .

bbe — Mon, 07 Feb 2005 14:13:00 GMT

Do you have link for this "renamer" tool ? I've seen plenty of spyware using this technique for awhile now. I guess the kiddies have picked up on it. Thanks.

re: Miscreant hiding techniques: Would the real explorer.exe please stand up? And the relevance of 1979 when doing searches . . .

Robert Hensing — Mon, 07 Feb 2005 19:09:00 GMT

It's not a public tool that is available for download - but I believe if you open up a support case for a problem that requires its use you can get a copy from the support professional. If you referrence these articles you will probably get it. I'll see if there is a reason we can't get this posted on download.microsoft.com and see if we can make that happen.

315226 How to Remove Files with Reserved Names in Windows XP
http://support.microsoft.com/?id=315226

315688 How to Locate and Correct Disk Space Problems on NTFS Volumes in Windows
http://support.microsoft.com/?id=315688

303079 How to Locate and Correct Disk Space Problems on NTFS Volumes
http://support.microsoft.com/?id=303079

re: Miscreant hiding techniques: Would the real explorer.exe please stand up? And the relevance of 1979 when doing searches . . .

bbe — Tue, 08 Feb 2005 05:36:00 GMT

That's what I figured. I'll keep a eye out to see if it's ever posted. Thanks for the links. I didn't know you could remove the ??filename files the same way as dos devices. That's good, makes remove easy.