Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.



  • Please log in to reply
1 reply to this topic

#1 CuriousBob


  • Members
  • 1 posts
  • Local time:09:39 AM

Posted 09 November 2006 - 10:05 PM

Basically, this .exe has been trying to access the internet today, and I've never seen it before. Normally I'd go and remove the file, but much to my surprise, the location my internet security gave me (C:\WINDOWS\system32\protector.exe), does not exist!

That file is not there, I've run several spyware and antivirus scans, as well as searching specifically for that file, but nothing has been found. Even now I'm getting an alert that the file (which apparently doesn't exist) is still trying to access the internet.

I've looked up what this file is, and I've come across several sites saying it's from a hijacking type of trojan. I'd rather my PC remain under my control.

Any help in removing this annoyance would be appreciated.

Edited by CuriousBob, 09 November 2006 - 10:06 PM.

BC AdBot (Login to Remove)


#2 buddy215


  • Moderator
  • 13,313 posts
  • Gender:Male
  • Location:West Tennessee
  • Local time:09:39 AM

Posted 09 November 2006 - 10:27 PM

Recommend you run a scan in safe mode with the two programs in the links below. If you still have a problem afterwards, post a Hijack This log by following the directions found here:http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/


http://www.sophos.com/security/analyses/trojsmallcn.htmlThis section contains the description and advanced technical information
Troj/Small-CN is a Trojan for the Windows platform that downloads and runs executables from the predefined location without user's consent.

Troj/Small-CN attempts to launch a silent_install.exe file associated with the Elite Tool Bar browser plugin and a protector.exe file as a download from the install.searchmiracle.com.

For details about protector.exe see Troj/StartPa-NK.

Troj/Small-CN sets the following registry entries:

HKLM\SOFTWARE\Elitum\EliteToolBar\AccountNumber = "protopro"
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
Enable Browser Extensions = "yes"
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users