Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Kbd.sys, Cselect.dll & ~.exe


  • Please log in to reply
3 replies to this topic

#1 infobleep

infobleep

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:12:47 PM

Posted 27 April 2008 - 12:17 PM

Hi

Today I ran SDfix to check for and remove possible Trojans.

It located and removed the following:
kdb.sys
cselect.dll
~.exe

Can any one tell me what they are? I originally ran SDFix, when autoruns (Sysinternals program: http://technet.microsoft.com/en-gb/sysinte.../bb963902.aspx) show kdb.sys as not being verified. Then having done a Web search, to see what it might be, it came up as a virus.

However I've not been able to find anything on cselect.dll or ~.exe and I'm still not 100% certain what kbd.sys was trying to do on my computer.

This problem arose because after a while of being logged on, I was finding I was not being able to access my Internet, yet I could ping web addresses and resolve the IP address, via the command prompt. It may be that I still have problems with my Winsock and these are unrelated. If so I'm even more interested in what they were trying to do, as apart from that and my anti-virus using a lot of CPU from time to time, I didn't have any visible problems.

So any insight to what they are would be great.

BC AdBot (Login to Remove)

 


#2 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:08:47 AM

Posted 27 April 2008 - 01:01 PM

Report.txt ?

in the C:\SDFix folder
Chewy

No. Try not. Do... or do not. There is no try.

#3 infobleep

infobleep
  • Topic Starter

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:12:47 PM

Posted 28 April 2008 - 11:32 AM

Thanks for your reply DaChew.

I've read the report.txt but that does not explain what the Trojans are or what they might be doing. I actually got the names from that report and tried to search for them using a search engine but found nothing to tell me more about them.

Regards

Infobleep

#4 DaChew

DaChew

    Visiting Alien


  • Members
  • 10,317 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:millenium falcon and rockytop
  • Local time:08:47 AM

Posted 28 April 2008 - 12:10 PM

would you copy and paste the contents of that report into a reply and then we might have a few more clues?
Chewy

No. Try not. Do... or do not. There is no try.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users