Whats Wrong here ?

Greeting's

Pardon me for not saying much about this but I was unable to go through logs and other important stuff related to security for about 3 weeks now... I found this when going through some of the regulars "HOT SPOTS".

Let me know if someone needs more information... Anyone heard or seen this before... or should i fear the worst :(

Nothing in the search engines on "gseopzohgghar", which is surprising. Can you disable the service? What's an AV scan telling you?

Probably wouldn't show up on a query if the service was randomly named by the infecting program. My guess is that it's some form of nasty malware...

Hey Hey,

Instead of showing us the service / dependancy view, how about the application that it runs? I've seen random services appear before, sometimes during my own messing around from stuff that's my fault... Knowing what the service launches will give a better idea of what it does... and what it is.

Peac,e
HT

Greeting's

I have one more picture of the same "THING"... Some more help guys ??? Nothing found in any scans till now.. I will keep you guys updated.

Thank you to everyone.

Even the displayname doesn't say anything. It's just a randomly created name..

Fire up regedit. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.
Look for the random name. What does the ImagePath key tell you?

An active piece of malware could prevent the detection when scanning.
So also have a look at your running processes.

I find this a useful resource, but your beastie is not listed :(

http://www.sysinfo.org/startuplist.php?filter=GSEOP

Another approach, albeit crude, would be to search for executables loaded in the last 4 weeks......as this is a user machine (hopefully NOT a developer) there should not be that many?

I was thinking of the multiple payload scenario where the Registry entry fires off one thing that triggers others?

Just a thought? :)

Whatever it is, it's new. I'd try an online scan, either Panda or TrendMicro.

If you find any strange files, particularly executables then this might help:

http://virusscan.jotti.org/

http://www.virustotal.com/en/indexf.html

They are a couple of online multiple AV scanning sites that I use, just submit the suspect item and they come back in a few minutes with the results of running it through most of the top AVs.

:)

Greeting's

Here I have got the pics of the same piece of "THING" in the registry... the next post will have the second picture file.

Thanks for the help.

Greeting's

Here is the second picture.

Well, as I see it.. It's probably a leftover.. The ImagePath isn't present and that's the key that actually points to the executable that gets started. Try and remove those keys with the "THING"'s name, reboot and recheck. I'm betting it'll be gone :)