Strange new malware CRWAVE.exe 1

[griffindm]

Looking for some advice on this one. Running IE6 with latest patches on Win2K Pro (also current). IE is periodically pushed to a junkware site WinFirewall, etc. When closed IE crashes with an unrecoverable error.

Have run cwshredder, adaware, spybot, and HJT several times. I have a process running, CRWAVE.exe, that refuses to die. It also tries to contact the internet (stopped by ZA). It was originally loaded from c:\Winnt\fonts. I killed it there, but it continues to reload on reboot. No other instances of that file found.

The Hijackthis log is down to just:

O4 - HKLM\..\RunOnce: [*crwave] C:\WINNT\Fonts\crwave.exe rerun
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE

Anyone have some advice? I think this one is a morpher.

Thanks,

griffindm

The Decision Support Group
Reporting Consulting with Cognos BI Tools
"Magic with Data"
Want good answers? Read FAQ401-2487 first!

http://www.decisionsupportgroup.com

 

[griffindm]

Actually, I was able to track this down myself. No mention of it on the net though. A similarly named exe was used by Crystal for their sound cards back in the mid-1990's.

What I had forgotten to do was to ensure that Windows Messenger Service was shut down. It was using that to re-establish the registry setting and re-start the malware service everytime HijackThis was fixing the registry and/or I was killing the process.

It was also using a reverse spelling (evawrc.dat) to help it hide, though I was never able to find the file where HJT said it was pointing from the registry, which was in my Local Settings/Temp folder.

Still, if anyone wants to help me with a postmortem on this, feel free.

Thanks,

griffindm

The Decision Support Group
Reporting Consulting with Cognos BI Tools
"Magic with Data"
Want good answers? Read FAQ401-2487 first!

http://www.decisionsupportgroup.com

 

[bankboysb]

You might try doing safe-mode startup to make it possible for Spybot/HJT to knock it out. Sometimes that is the only way to kill the process. You might have to dig it out of the registry manually too.

 

[griffindm]

Just wanted to mention: I was able to kill the process and have HJT eliminate the registery entries via stopping the Messinger process.

Thanks.


The Decision Support Group
Reporting Consulting with Cognos BI Tools
"Magic with Data"
Want good answers? Read FAQ401-2487 first!

http://www.decisionsupportgroup.com