Archived from groups: microsoft.public.windowsxp.general (More info?)

I'm running XP Media Center Edition, Version 2002, SP2 with Norton
Internet Security 2004. The virus definitions are up-to-date.

We have had this computer, Sony Vaio PCV-RZ54G for nearly a year now and
this evening is the first time I tried the Windows Media Center stuff
and such. In doing so it initialized the Center for the first time.

Soon after, I rebooted and Auto-Protect detected a Trojan Horse called
Backdoor.Graybird:

"Backdoor.Graybird is a back door Trojan Horse that gives its creator
unauthorized access to your computer. The existence of the file,
Svch0st.exe, is an indication of a possible infection. Backdoor.Graybird
is a Delphi application."

The Alert said it was located in the file mc26.tmp in C:\Windows\Temp.
The Alert said it could not repair the file, could not quarantine the
file, and that it had denied access to the file. Wellll.... I
immediately manually searched the Temp folder for the file and it was
not there. I then did a total search of the whole computer and it was
not found. I then ran a full Virus scan of the computer and nothing was
found. I rebooted and the alert still pops up. I've been to the Symantec
knowledge base and could find not help and have posted on a Symantec
newsgroup - will be surprised if I get any help there. :-(

Now I suspect after starting/initializing Media Center, it is producing
temp files at booting and then after booting these files are removed
because the suspected file carrys the name "mc". Somewhere in setting up
Media Center guide it said something about info would be sent to MS....

Symantec has posted a removal process of this trojan but one needs to
delete the file first. As I can't find the file I can't delete it.

http://securityresponse.symantec.c [...] ybird.html

The rest of the process is to correct the damage:

1. End the Trojan process in Task manager by ending the process of
SvchOst.exe under the Processes tab
(right now the Processes Tab show 5 svchost.exe running)
2. Do a complete scan of the computer for any infected files and delete
them. (I've done a complete scan and nothing was found)
3. Reverse changes in the registry the Trojan Horse made.

I haven't gone into the Registry because it would be a futile gesture
for the next time I boot that temp file will be created again. As you
can see this borders on a "Catch 22" situation.

Pleaseeeee..... ****help****.... if this so called Trojan Horse file
mc26.tmp is being created by the Media Center:
1. Is it really a trojan horse?
2. How can I stop it being created?
3. Is the Media Center Guide causing it?

If Media Center isn't creating this file, what can I do to stop it being
created?

TIA.

--- Susan

Archived from groups: microsoft.public.windowsxp.general (More info?)

Susan wrote:
> I'm running XP Media Center Edition, Version 2002, SP2 with Norton
> Internet Security 2004. The virus definitions are up-to-date.
>
> We have had this computer, Sony Vaio PCV-RZ54G for nearly a year now and
> this evening is the first time I tried the Windows Media Center stuff
> and such. In doing so it initialized the Center for the first time.
>
> Soon after, I rebooted and Auto-Protect detected a Trojan Horse called
> Backdoor.Graybird:
>
> "Backdoor.Graybird is a back door Trojan Horse that gives its creator
> unauthorized access to your computer. The existence of the file,
> Svch0st.exe, is an indication of a possible infection. Backdoor.Graybird
> is a Delphi application."
>
> The Alert said it was located in the file mc26.tmp in C:\Windows\Temp.
> The Alert said it could not repair the file, could not quarantine the
> file, and that it had denied access to the file. Wellll.... I
> immediately manually searched the Temp folder for the file and it was
> not there. I then did a total search of the whole computer and it was
> not found. I then ran a full Virus scan of the computer and nothing was
> found. I rebooted and the alert still pops up. I've been to the Symantec
> knowledge base and could find not help and have posted on a Symantec
> newsgroup - will be surprised if I get any help there. :-(
>
> Now I suspect after starting/initializing Media Center, it is producing
> temp files at booting and then after booting these files are removed
> because the suspected file carrys the name "mc". Somewhere in setting up
> Media Center guide it said something about info would be sent to MS....
>
> Symantec has posted a removal process of this trojan but one needs to
> delete the file first. As I can't find the file I can't delete it.
>
> http://securityresponse.symantec.c [...] bird..html
>
> The rest of the process is to correct the damage:
>
> 1. End the Trojan process in Task manager by ending the process of
> SvchOst.exe under the Processes tab
> (right now the Processes Tab show 5 svchost.exe running)
> 2. Do a complete scan of the computer for any infected files and delete
> them. (I've done a complete scan and nothing was found)
> 3. Reverse changes in the registry the Trojan Horse made.
>
> I haven't gone into the Registry because it would be a futile gesture
> for the next time I boot that temp file will be created again. As you
> can see this borders on a "Catch 22" situation.
>
> Pleaseeeee..... ****help****.... if this so called Trojan Horse file
> mc26.tmp is being created by the Media Center:
> 1. Is it really a trojan horse?
> 2. How can I stop it being created?
> 3. Is the Media Center Guide causing it?
>
> If Media Center isn't creating this file, what can I do to stop it being
> created?
>
> TIA.
>
> --- Susan

Exactly the same problem started on my computer today ... and wasted a
whole day trying to get rid of it.

Tried UnHackMe - no joy.

Even tried paying for support at Symantec ... but after ½ hour gave
up.

Anyone else got an idea?

Malcolm

Archived from groups: microsoft.public.windowsxp.general (More info?)

Are you using Spysweeper?

We were having the same problem today and it is a conflict between
spysweeper's latest updates and norton.

To test it, disable spysweeper, restart the PC and you won't see the
error message.

Spysweeper is working on a fix.

Malcolm wrote:
> Susan wrote:
> > I'm running XP Media Center Edition, Version 2002, SP2 with Norton
> > Internet Security 2004. The virus definitions are up-to-date.
> >
> > We have had this computer, Sony Vaio PCV-RZ54G for nearly a year now and
> > this evening is the first time I tried the Windows Media Center stuff
> > and such. In doing so it initialized the Center for the first time.
> >
> > Soon after, I rebooted and Auto-Protect detected a Trojan Horse called
> > Backdoor.Graybird:
> >
> > "Backdoor.Graybird is a back door Trojan Horse that gives its creator
> > unauthorized access to your computer. The existence of the file,
> > Svch0st.exe, is an indication of a possible infection. Backdoor.Graybird
> > is a Delphi application."
> >
> > The Alert said it was located in the file mc26.tmp in C:\Windows\Temp.
> > The Alert said it could not repair the file, could not quarantine the
> > file, and that it had denied access to the file. Wellll.... I
> > immediately manually searched the Temp folder for the file and it was
> > not there. I then did a total search of the whole computer and it was
> > not found. I then ran a full Virus scan of the computer and nothing was
> > found. I rebooted and the alert still pops up. I've been to the Symantec
> > knowledge base and could find not help and have posted on a Symantec
> > newsgroup - will be surprised if I get any help there. :-(
> >
> > Now I suspect after starting/initializing Media Center, it is producing
> > temp files at booting and then after booting these files are removed
> > because the suspected file carrys the name "mc". Somewhere in setting up
> > Media Center guide it said something about info would be sent to MS....
> >
> > Symantec has posted a removal process of this trojan but one needs to
> > delete the file first. As I can't find the file I can't delete it.
> >
> > http://securityresponse.symantec.c [...] ybird.html
> >
> > The rest of the process is to correct the damage:
> >
> > 1. End the Trojan process in Task manager by ending the process of
> > SvchOst.exe under the Processes tab
> > (right now the Processes Tab show 5 svchost.exe running)
> > 2. Do a complete scan of the computer for any infected files and delete
> > them. (I've done a complete scan and nothing was found)
> > 3. Reverse changes in the registry the Trojan Horse made.
> >
> > I haven't gone into the Registry because it would be a futile gesture
> > for the next time I boot that temp file will be created again. As you
> > can see this borders on a "Catch 22" situation.
> >
> > Pleaseeeee..... ****help****.... if this so called Trojan Horse file
> > mc26.tmp is being created by the Media Center:
> > 1. Is it really a trojan horse?
> > 2. How can I stop it being created?
> > 3. Is the Media Center Guide causing it?
> >
> > If Media Center isn't creating this file, what can I do to stop it being
> > created?
> >
> > TIA.
> >
> > --- Susan
>
> Exactly the same problem started on my computer today ... and wasted a
> whole day trying to get rid of it.
>
> Tried UnHackMe - no joy.
>
> Even tried paying for support at Symantec ... but after ½ hour gave
> up.
>
> Anyone else got an idea?
>
> Malcolm

Archived from groups: microsoft.public.windowsxp.general (More info?)

I use Spyware Doctor, not Spysweeper.
I disabled it at start-up and the Norton reported virus of Backdoor
Graybird did not appear!
When I enabled Spyware Doctor after booting I got the Norton Alert!
Are Spyware Doctor and Spysweeper using the same databases and
upgrades?
I'll report my findings to Spyware Doctor.
Thanks,
Malcolm

Archived from groups: microsoft.public.windowsxp.general (More info?)

Interesting that its Spy Sweeper, which I hope. I have the exact same
problem as Susan, and tried all the fixes by Symantec, but couldnt
replicate or find the files or registry values they mention for any
Graybird variant. My staff at work all got this message this morning
upon logging into the network and i got it on 9/15 at 11:41 PM CST. How
does anyone know for sure that its Spysweeper? There was no information
posted on Webroot or Symantec, so i am curious.

Good thing is that I did disable Spy Sweeper on startup and I did not
receive the alert. Also noticed that one of my employees who has an
expired version of Spy Sweeper didnt get the alert either. Also, our
servers do not have any files like those who have Spy Sweeper installed
locally on their PCs. Steve, did you contact Webroot about this and
thats what they told you? Just want to be sure...

Archived from groups: microsoft.public.windowsxp.general (More info?)

Malcom, Malcom, Malcolm!!!!

You are wonderful!! Watch out, I'm blowing you a kiss from Memphis. :-)

I didn't have any hope your message would help for I have had the same
definitions on NAV and Spy Sweeper for nearly 3 days and no Alert had
occurred until last night.

I went off line, turned off Spy Sweeper so it would not come on at
Windows loading, and rebooted. No Alert!!!! For the past couple of days
Spy Sweeper has been bugging me about getting the latest definition
updates. I went back online, downloaded and installed the latest
definitions, and rebooted with Spy Sweeper on. No alert on booting!!!
Spy Sweeper has fixed the problem in their latest definitions.

Thank you, thank you, thank you!!! You have really polished up your halo
today.

--- Susan

Malcolm wrote:

> Susan wrote:
>
>>I'm running XP Media Center Edition, Version 2002, SP2 with Norton
>>Internet Security 2004. The virus definitions are up-to-date.
>>
>>We have had this computer, Sony Vaio PCV-RZ54G for nearly a year now and
>>this evening is the first time I tried the Windows Media Center stuff
>>and such. In doing so it initialized the Center for the first time.
>>
>>Soon after, I rebooted and Auto-Protect detected a Trojan Horse called
>>Backdoor.Graybird:
>>
>>"Backdoor.Graybird is a back door Trojan Horse that gives its creator
>>unauthorized access to your computer. The existence of the file,
>>Svch0st.exe, is an indication of a possible infection. Backdoor.Graybird
>>is a Delphi application."
>>
>>The Alert said it was located in the file mc26.tmp in C:\Windows\Temp.
>>The Alert said it could not repair the file, could not quarantine the
>>file, and that it had denied access to the file. Wellll.... I
>>immediately manually searched the Temp folder for the file and it was
>>not there. I then did a total search of the whole computer and it was
>>not found. I then ran a full Virus scan of the computer and nothing was
>>found. I rebooted and the alert still pops up. I've been to the Symantec
>>knowledge base and could find not help and have posted on a Symantec
>>newsgroup - will be surprised if I get any help there. :-(
>>
>>Now I suspect after starting/initializing Media Center, it is producing
>>temp files at booting and then after booting these files are removed
>>because the suspected file carrys the name "mc". Somewhere in setting up
>>Media Center guide it said something about info would be sent to MS....
>>
>>Symantec has posted a removal process of this trojan but one needs to
>>delete the file first. As I can't find the file I can't delete it.
>>
>>http://securityresponse.symantec.com/avcenter/venc/data/backdoor.graybird.html
>>
>>The rest of the process is to correct the damage:
>>
>>1. End the Trojan process in Task manager by ending the process of
>>SvchOst.exe under the Processes tab
>> (right now the Processes Tab show 5 svchost.exe running)
>>2. Do a complete scan of the computer for any infected files and delete
>>them. (I've done a complete scan and nothing was found)
>>3. Reverse changes in the registry the Trojan Horse made.
>>
>>I haven't gone into the Registry because it would be a futile gesture
>>for the next time I boot that temp file will be created again. As you
>>can see this borders on a "Catch 22" situation.
>>
>>Pleaseeeee..... ****help****.... if this so called Trojan Horse file
>>mc26.tmp is being created by the Media Center:
>>1. Is it really a trojan horse?
>>2. How can I stop it being created?
>>3. Is the Media Center Guide causing it?
>>
>>If Media Center isn't creating this file, what can I do to stop it being
>>created?
>>
>>TIA.
>>
>>--- Susan
>
>
> Exactly the same problem started on my computer today ... and wasted a
> whole day trying to get rid of it.
>
> Tried UnHackMe - no joy.
>
> Even tried paying for support at Symantec ... but after ½ hour gave
> up.
>
> Anyone else got an idea?
>
> Malcolm
>

Archived from groups: microsoft.public.windowsxp.general (More info?)

Susan ... we work as a team, stumbling in the dark!

Spyware Doctor replied to my email saying ...
"Please be assured that Spyware Doctor does not contain a virus. This
appears to be a false detection resulting from the latest Norton
Antivirus Updates. We are currently investigating this. You may also
wish to contact Norton concerning this detection."

Over to Nortan to fix this!

Regards,
Malcolm

Archived from groups: microsoft.public.windowsxp.general (More info?)

Latest Liveupdate from Norton has fixed this problem on my machine.

Archived from groups: microsoft.public.windowsxp.general (More info?)

DC1978 wrote:
> Interesting that its Spy Sweeper, which I hope. I have the exact same
> problem as Susan, and tried all the fixes by Symantec, but couldnt
> replicate or find the files or registry values they mention for any
> Graybird variant. My staff at work all got this message this morning
> upon logging into the network and i got it on 9/15 at 11:41 PM CST. How
> does anyone know for sure that its Spysweeper? There was no information
> posted on Webroot or Symantec, so i am curious.
>
> Good thing is that I did disable Spy Sweeper on startup and I did not
> receive the alert. Also noticed that one of my employees who has an
> expired version of Spy Sweeper didnt get the alert either. Also, our
> servers do not have any files like those who have Spy Sweeper installed
> locally on their PCs. Steve, did you contact Webroot about this and
> thats what they told you? Just want to be sure...

Webroot is aware of this problem and (as of Friday) they were working
on a fix.

I'm going to see if updating NAV fixes this as well, but, as I said,
Webroot is aware.