"Exim.exe" E-Mail Tracking

Hello. I am new here and I came here because I recently had my Yahoo email and Hotmails hacked into. I know a little about computers but hacking I do not know and I HATE the people who do this. Anyhow, I found out my emails were hacked into using an email forwarding application called "exim.exe". With it also is something called "ymsgr_tray.exe". This application was put into my C:\Widows\system32 by an outside party from another country. I have tried to remove it but I can not. Can anyone tell me how to remove this and all tracing of it? And also to prevent any type pf hacking in the future? I have Zone Alarm Pro but will this secure and stop all kinds of hacking? Thank you ever so kindly.

PrincessCherokee :confused:

Do you have any antivirus software? If you don't, try downloading AVG Free Version from Grisoft.com, update it, and run a full system scan and see if it catches it.

Regards,
Xierox

P.S. And "ymsgr_tray.exe" is Yahoo Messenger. Not sure about the other one, though. I'll Google it and see what I turn up.

Hello thanks for replying. I have Norton Antivirus but it did not catch it. I did once recieve a strange message from Norton but it failed to "prevent" the hacking from happening. So basically you are saying to run this antivirus software and it should catch it?

Is "exim.exe" showing up in your task manager ? If it is, try ending the process and then removing the file.... it may just be in use, and thats why you can't delete it !

No, no. AVG just produces a free antivirus that's pretty good and if you didn't have any at all, I wanted you to get it and scan. But since you have Norton AV (And it IS updated, right?) you should be fine. What was the strange message you received from Norton?

Regards,
Xierox

/edit - What makes you think "exim.exe" is the source of this attack? Where did you get your information?

Well I have heard of exim.exe and as far as I know it is just a SMTP protocol for the most part. I mean it just like a mail-forwarder. I am not sure what you mean by it being hacked.

As far as ymsgr_tray.exe that is your yahoo messanger.

- Militant Eidolon

Hello, yes I know it is a mail forwarder but the application was put onto my system (linked) by an outside source. While I was talking to this person on Yahoo, they somehow linked and hacked into Yahoo and put it on my computer. They had all my emails and everything. Exim is is not in my systems tray. I checked. When I did a search, it only showed up in my C:\Windows\system32 So I just want it completely removed and not to happen again, but it is not alowing me to do so. HELP!?? :-/ But again I thank you all for helping me out.

To xierox,

Hello there. Well the strange message I recived (I have the French Version) I saw in the corner it was trying to send a "message". I had never seen this before so I knew my system had been hacked into. Then I got a message something like "the message could not be sent..." with an unknown email I had never seen and the words "Perfect Key Logger" included with this phony email address. I know what the Perfect Keylogger is. I asume the person made up a phony email address and tried to have my emails forwared to him. This is my assumption. Seems like Yahoo and Hotmail are not really safe.

What exactly happens when you try to remove it and how are you trying to remove it? Are you just trying to delete it or are you using a program?

Xierox

Well it is not listen in my "Add/remove" programs list. It is ONLY in windows\system32. so I go there and I try to delete it and it is telling me that the access is denied and make sure the appication is not in use.

try an online scanner like www.http://housecall.trendmicro.com/
also get a firewall, for free one's try www.zonelabs.com.
one more note, even if you have norton installed i prefer you do an online scan i trust it more.
get you windows machine patched up.

If there is a program to delete it, can you tell me what it is? I will try the AVG you recommended. Thank you.

AVG probably won't do anything for you since you have Norton so it's most likely a waste of time. Have you tried booting up in Safe Mode and then tried deleting the file?

Xierox

Thak you ByTeWrangler:-)

I have used them before and I did not think about that. Thanks for reminding me of HouseCall!!! :-)

I would reboot the system into SafeMode (reboot the computer and press F8 then select SafeMode).

Once in safemode I would run nortons and do a complete system scan. Then I would rename that file exim.exe to exim.bak while you are in safe mode. It might also be a good idea to get either spybot or adaware and do a check for any malware that could be lurking on the box.

Good luck and keep us posted.

~Halv

Thank you Halv and everyone here. You guys are all so AWSOME!!! I will do what you said and definitely keep you posted on what worked. Thanks a million!!!! Update you soon.

PCherokee

Quote:

---

Then I would rename that file exim.exe to exim.bak while you are in safe mode.

---

If she wants to delete it , why rename it first, its not gonna be in use when she's in safe mode. Just delete the file while in safe mode !

Quote:

---

Originally posted here by ©opy®ight
If she wants to delete it , why rename it first, its not gonna be in use when she's in safe mode. Just delete the file while in safe mode !

---

To make sure it's not an important file, I believe.

Xierox

Well I did the online scan and it did not catch it. I pressed F8 to reboot in safe mode but not working (maybe because I have XP. andyone knows how to reboot in Safe mode with Windows XP??

renaming a file is always better than deleting if you are not sure if you may need it. better safe than sorry...

You use F8 to get into safe mode with windows xp, home or professional. You can also use F5 if you want. Reboot your system and while it is booting up keep tapping the F8 key and you should get a menu to choose safe mode and other booting options. I belive safe mode is the top choice. Use the arrow keys to move the selector to that choice and press Enter and off you go.

good luck

~Halv

Quote:

---

andyone knows how to reboot in Safe mode with Windows XP??

---

Simple :) I know halv poste how to do it too, these more detailed instructions

Windows XP

If Windows XP is the only operating system installed on your computer, booting into Safe Mode with these instructions.

* If the computer is running, shut down Windows, and then turn off the power
* Wait 30 seconds, and then turn the computer on.
* Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
* Ensure that the Safe mode option is selected.
* Press Enter. The computer then begins to start in Safe mode.
* When you are finished with all troubleshooting, close all programs and restart the computer as you normally would.

To use the System Configuration Utility method

* Close all open programs.
* Click Start, Run and type MSCONFIG in the box and click OK
* The System Configuration Utility appears, On the BOOT.INI tab, Check the "/SAFEBOOT" option, and then click OK and Restart your computer when prompted.
* The computer restarts in Safe mode.
* Perform the troubleshooting steps for which you are using Safe Mode.
When you are finished with troubleshooting in Safe mode, open MSCONFIG again, on the BOOT.INI tab, uncheck "/SAFEBOOT" and click OK to restart your computer

http://www.pchell.com/support/safemode.shtml

Try reading this if Exim is on a Windows based system http://pigtail.net/LRP/cygwin-exim.html should tel you what to look for and what needs to be removed. Nifty little hack you got where did you get it?

When you start Windows it'll say something like "F8 - Boot Menu" or something like that. It's not always F8. Sometime's it's different depending upon your BIOS (I think it's the BIOS, anyways...). For example, my Dell computer that I'm running now makes me press F12 to access my Boot Menu, however, it's generally F8. So basically you need to find which key your computer needs you to press and you're good to go! Let us know if you get it!

Regards,
Xierox

hey pale moon you may have something there.

do a 'find files' for cygwin1.dll. if you find it chances are there is a downloader (trojan dropper) that downloaded and installed all this and more on your computer. this really sounds like a case for the authorities. too bad you've been messing around with the files.

if a person did this to you then you can bet he took full advantage. if it were a worm the evil server would be shut down by the police before the perps got all the infected computers addresses. but it sounds like this guy 'got' you up close and personal. you probably have at least a back door, a zombie for DDoS and maybe a rootkit installed(very hard for the average person to detect)in addition to the rouge smtp server. it would be prudent to format and reinstall your os, unless you plan on taking it to the police.

Try booting into SAFE mode and deleting the unwanted exe.

princesscheroke the reason NAV or AVG do not detect exim.exe as a virus/trojan is because it is not. its just an smtp server placed there for illegal purposes. AV programs do not recognize ligitimate programs as viruses. so netcat which is mearly a network tool will also go undetected even in listening mode as would, ftp, vnc or radmin to name a few. these services can be hidden from the task manager (and the systray) very easily. there are back doors that respond to udp that do not show as listening ports. be very careful. mearly deleating exim may just give you a false sense of security.