Triddll.exe and Systol.exe - Trojans?

[Kjonnnn]

Anyone have these two files in their run folders? How do I get rid of them.

 

[diogenes10]

Google gives one hit on triddll.exe - in Japanese or Chinese - seems to imply it's a trojan in that part of the world. Is there some kind of standard procedure for removing an unknown trojan that would be applicable here?
Scan registry for those entries?

 

[Kjonnnn]

Symantecs know nothing about them.
I've deleted them several times from the RUN folder in the registry

I scanned the registry and they only appear in the RUN folder. So I deleted them. Guess what. They came back even though I didnt reboot the computer.

They are broadcasting at a regular interim and locking up the computer. We can see the broadcast on our network.

 

[diogenes10]

I got one other hit on the university of peking-but it all comes up little square boxes except for triddll.exe and a couple of other file names, which doesnt tell me squat.
Instead of systol.exe, i saw systrol.exe.

The first hit I got had kind of a table listing and again the little square boxes for the text. My hits came up under triddll and triddll.enc so those are apparently the names of the trojan there. The dates were in August 2003 so you'd think they'd have been picked up somewhere.

I couldnt find anything on mcafee, symantec, or pest patrol.

There seem to be several threads that list hijack this logs right now. For lack of anything better maybe you could run that program and see if it gives you any ideas.

 

[Kjonnnn]

This started out as TWO problems. My boss first noticed that large broadcasts were coming from somewhere on our network at regular intervals. At the same time, the switchboard computer would freeze on a regular basis. During my usual diagonostics I check the RUN folder to see want was starting up. That how I first found these files.
So I deleted them from the RUN folded, but they kept coming back

None of the antivirus sites know of these files. Actually there are 3.

triddll.exe
systrol.exe
msexplor.exe

I found them in the SYSTEM folder of a WIN95 machine. Triddll and Systrol appeared in the RUN folder in the registry. I could delete them from the RUN folder, (but not the SYSTEM folder), but they would come right back as I watched. THis is WITHOUT rebooting the machine.

What i ended up doing is booting the computer up in DOS, and renaming those 3 files. That seemed to have done the trick. No more broadcasts, and no more lock ups.

 

[FatesWebb]

you should submit a sample to someplace like

https://www.webimmune.net/default.asp

FatesWebb

if you do what I suggested it is not my fault...

 

[Xemus]

Have you tried running a spyware removal tool?

http://security.kolla.de

- Spybot

http://www.lavasoftusa.com

- Adaware

http://www.tomcoyote.org/hjt/

- Hijack This

All freeware programs that will probably find something. Not sure about the specifics of your files, but have a look and see what they remove.

http://www.closedsocket.com

 

[SYAR2003]

Run hijack this and look for
registry entrys at HKLM Run / HKCU run with a regedit -s entry . This loads registry keys for malware at each boot.

 

[Kjonnnn]

Please read above.

Solved the problem.

Its not spyware, nor found by nortons.

It only reinstalls itself in the run folder if you delete it.