Jump to content

Unknown files in StartUp


KeelBug
 Share

Recommended Posts

So I login to my work laptop yesterday and everything is peachy.

About 20 minutes later... I have no files on my desktop, start menu,quick launch and IE favorites.

The folder structure is there... just no files.

Now I've managed to recover the files from everywhere except my desktop (maybe already overwritten by the time I noticed it, which would have been 4-5 hours after it happened).

I run Trend anti virus & firewall as its a work standard, with the Spybot agent tracking registry changes and such and nothing was flagged.

This morning I login and a folder starts up from my startup (may have done this yesterday I might have just been to busy to notice) and it contains some suspicious files.

..\Startup\directory.src

..\Startup\makefile

..\Startup\cp\Directory.cpp

..\Startup\cp\directory.exe

..\Startup\cp\directory.obj

..\Startup\cp\directory.pdb

..\Startup\cp\makefile

..\Startup\cs\Directory.cs

..\Startup\cs\Directory.exe

..\Startup\cs\Directory.pdb

..\Startup\cs\makefile

..\Startup\vb\Directory.exe

..\Startup\vb\Directory.pdb

..\Startup\vb\Directory.vb

..\Startup\vb\makefile

You can download said files here > http://www.fase.me/Startup.rar < Pass 'hak5'.

Is anyone here (if you have time/nothing better to do :P ) able to go through these and see just what the hell it did to my system? Besides finally making me do more regular backups...

Cheers.

Link to comment
Share on other sites

They are programs apparently (not even downloading it).

Written in C++ (cpp)

Compiled in to machine code (obj)

Then linked with libraries to produce the program (exe)

pdb is possibly from the IDE used to write them?

Yeah I get that :P.

Just don't have the tools/time at work to deconstruct/sandbox them.

Theres no doubt some residual file hiding in my system somewhere.

Link to comment
Share on other sites

Sounds like you got pwned. Did you leave it on and unattended anywhere, like where other people could have plugged in a USB key ;)

I think PDB files contain debug information for compiled programs when testing. Chances are they were created by the cpp file.

That cpp file is encrypted or compiled code, so can't tell whats in it without knowing how to decrypt it first. Normally source code is in plain text. Whateve rit is, it looks like it failed to clean up after itself, so the code is probably broken to some extent.

CLEANUP = *.exe *.pdb *.obj

Guess it never did since you were able to see the files. Virus Total sees nothing but an encrypted archive: http://www.virustotal.com/analisis/7e90ab2...bfb333383175755

edit: well, if it was malicious, vitus total can't seem to see anything: http://www.virustotal.com/analisis/a9c48b6...e3d91858a0f27a1

that doesn't mean you don't have malware or anything like that on your pc. I'd backup your important stuff and reformat.

I am goign to reupload it to them in a seperate(unpassworded) file to be sure.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...