Re: HELP: Three unknown services K.EXE, GXF.EXE and FRLCT.EXE - anyone

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance



That's what I thought too ... but when I looked at what was likely to be
found with these issues non of the other traces were found. Unfortunately
auditmypc doesn't give any detail, but the problems described are listed on
numerous other sites (for k.exe) when a whole pile of extra files and
registry entries were listed as associated to k.exe. Unfortunately none of
those files or registry entries were present on my system (and k.exe was not
actually present). There was a process called K which referenced a file in
my temp folder called k.exe but it had already been deleted.

To check again I have downloaded SpyWare Doctor which includes keylogger
detection, but how many of these products can you run before your system
becomes completely unusable - and you spend all your time running constant
scans ?

I should have said I am also behind a router firewall. I have a wireless
network running with WEP encryption (one network device doesn't support
WPA), but I live in a remote rural area where outside hacking is extremely
unlikely.

Cheers

Carol

"Mike" <Mike@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:E750A7B3-93FF-4BE9-BD37-313035B0363A@xxxxxxxxxxxxxxxx
> Take a look at these sites
> http://www.auditmypc.com/process/d--k.asp
> http://www.auditmypc.com/process/k.asp
> http://www.2-spyware.com/file-trojanspy-win32-keylogger-k-exe.html
> It looks like you might have a keylogger or trojan on your system.
>
> "Carol Haynes" wrote:
>
>> I have spotted two unknown services listed GXF.EXE and FRLCT.EXE.
>>
>> Both point to files which were in the Local Settings\Temp folder (but no
>> longer exist).
>>
>> Has anyone any idea what these are? Google etc. and antispyware/AV sites
>> come up with no info on either.
>>
>> I also recently found a similar service, K.EXE, which similarly
>> referenced a
>> file in the temp folder (which was no longer there). Various sites
>> suggested
>> it could have been a trojan, but none of the tojan 'specs' matched those
>> listed on Symantec and other sites (ie. the other files/registry entries
>> which were supposed to be present in a trojan infection were not there at
>> all).
>>
>> Any help on this would really be appreciated - I am beginning to get very
>> worried that something sinster is going on.
>>
>> I have done a complete antivirus scan and multiple anti malware scans
>> without showing up anything, and I have done a system search for these 3
>> files and can't find them anywhere on my system.
>>
>> My system setup is:
>>
>> Windows XP SP2 (fully up to date)
>> NOD32 AntiVirus
>> Sygate Pro Firewall (yes I know I need to change this as Symantec have
>> effectively made it abandonware recently)
>>
>> I also constantly run ProcessGuard (which stops unknown programs starting
>> without permission), WebRoot SpySweeper and MS AntiSpyware
>>
>> I have also scanned my system with AdAwareSE Pro and SpyBot Search &
>> Destroy
>> which shoed up no issues.
>>
>> Am I missing something here? How can services appear and disappear like
>> this?
>>
>> --
>> Carol Haynes
>> Reply address is set to vaporize - don't expect a reply!
>>
>>
>>
>>
>>


.



Relevant Pages

  • Re: HELP: Three unknown services K.EXE, GXF.EXE and FRLCT.EXE - anyone
    ... If you have used RootkitRevealer, it adds a random named service and runs as ... Carol Haynes hunted and pecked: ... > file in my temp folder called k.exe but it had already been deleted. ... >> It looks like you might have a keylogger or trojan on your system. ...
    (microsoft.public.windowsxp.general)
  • Re: New Trojan
    ... > has two registry entries in my Run, ... The trojan is apparently similar to Coreflood (and may even share some ... I haven't looked at the UDP ports yet, ... infection. ...
    (Incidents)
  • Re: Deleting Temp folder
    ... remove the trojan. ... > It gave the name of the www. to get the site online. ... > wrong with the real website as I have another pc and it is ok on there. ... > However now this laptop is XP and the Temp folder is quite different. ...
    (microsoft.public.windowsxp.help_and_support)
  • Cant remove Trojan
    ... Windows Defender and it makes 4 Registry entries and is ... I've run a scan from the Symantec site and it tells me that ... The Trojan really slows down my PC as evidenced by program loads and System ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Trojan svchost.exe in created folder windows/syst32 caught by Norton
    ... Be sure to clean this trojan as best you can. ... installed/made. ... automated tool to delete all files and registry entries that the trojan ... >> Norton firewall caught a trojan trying to send out info over internet. ...
    (comp.security.firewalls)