Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MSNNOED.exe keeps coming back


  • Please log in to reply
2 replies to this topic

#1 Rutt Roh

Rutt Roh

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 11 January 2009 - 04:59 PM

so i didn't have this problem before and i JUST upgraded to SP2 via windows update and the installation went normal.

everything seems to work fine but there's this program that i wasn't sure about that popped up as an alert from ZoneAlarm: MSNNOED.exe. i tried to google to see if this was a legit file but i couldn't find anything so i click no to not allow it to access the internet.

i ran my virus checker and it didn't pick up anything. but when i ran malewarebytes with the most recent update, it found 3 "infected" files, one of which was the MSNNOED.exe and malewarebytes says it's a trojan agent. also it finds a comsa32.sys file which it deems as a trojan agent. when i search for that MSNNOED.exe file on my computer, it's in the WINDOWS\SYSTEM32 directory and there's another file in the Prefetch directory: MSNNOED.EXE-05ABE18F.pf

not sure what they are but malewarebytes quarantines them and removes them but requires a restart, which i do. when i restart and load back up, everything is fine and the file is supposedly gone (meaning when i try doing a search, MSNNOED.exe isn't there anymore as well as the other files). but when i try to open up task manager to see if it really is, shortly afterward i get an alert from ZoneAlarm saying do i want to let MSNNOED.exe access the internet. i click no. i do a search on my system again and sure enough, those same files are back there. is there a "hidden" program that's starting this? i looked on my scheduled startup programs/processes and nothing out of the ordinary is there.

i dont know how i got this now, just after upgrading to SP2. i think it's worth mentioning that i didn't have this problem when i had SP1. how do i permanently get rid of this???

btw, after doing a bit more research, i found possibly the same trojan agent but named differently on other websites where people have had this similar issue: it's MSNIOED.exe but i have the MSNNOED.exe and both versions are 1,0,0,2 around 59-62 bytes in size.

Edited by Rutt Roh, 11 January 2009 - 06:17 PM.


BC AdBot (Login to Remove)

 


#2 Rutt Roh

Rutt Roh
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 11 January 2009 - 06:41 PM

i found something that problem might work here: http://www.bleepingcomputer.com/forums/t/178477/win32refpro/

this person had the same issue that i'm having now i'm thinking. the only difference is that in my HJT log, i see an MSCNCO.exe running in my SYSTEM32 directory which probably is running the MSNNEOD.exe file. i have an entry that says: O23 - Service: Ms Database Manager Service (mscncosd) - Unknown Owner - C\WINDOWS\SYSTEM32\mscnco.exe

the only problem is i can't delete this file because it says it's in use. i haven't done combofix, as i'm not sure how to use it and am awaiting your help. supposedly that's the file causing the loading of the other files, according to that person who posted in the link i provided.

please advise. thanks!!

#3 Rutt Roh

Rutt Roh
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 11 January 2009 - 07:35 PM

i apologize... i posted this same thread in the "Am I Infected" subforum. i did some digging and found that others on this site had this similar issue. but anyway, here's a link to my post so you can see what i found out:

http://www.bleepingcomputer.com/forums/t/194383/msnnoedexe-keeps-coming-back/

when i ran a hijack log as someone who had a similar problem did, i have this weird entry:

O23 - Service: Ms Database Manager Service (mscncosd) - Unknown Owner - C\WINDOWS\SYSTEM32\mscnco.exe

if you read in the link i provided, i tried deleting the file but couldn't... says it's in use. i hoping combofix will rid of this and prevent this thing from reinstalling itself. haven't installed combofix or done anything at the moment... i'm awaiting what you guys think i should do.

thanks!!

Merged topics. This one was in the HiJack This forum and did not contain any logs. ~ OB

Edited by Orange Blossom, 12 January 2009 - 12:16 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users