VoyForums
[ Show ]
Support VoyForums
[ Shrink ]
VoyForums Announcement: Programming and providing support for this service has been a labor of love since 1997. We are one of the few services online who values our users' privacy, and have never sold your information. We have even fought hard to defend your privacy in legal cases; however, we've done it with almost no financial support -- paying out of pocket to continue providing the service. Due to the issues imposed on us by advertisers, we also stopped hosting most ads on the forums many years ago. We hope you appreciate our efforts.

Show your support by donating any amount. (Note: We are still technically a for-profit company, so your contribution is not tax-deductible.) PayPal Acct: Feedback:

Donate to VoyForums (PayPal):

[ Login ] [ Contact Forum Admin ] [ Main index ] [ Post a new message ] [ Search | Check update time | Archives: 1, 2, 3, [4] ]

[ Next Thread | Previous Thread | Next Message | Previous Message ]

Date Posted: 08:43:04 01/29/04 Thu
Author: Repost
Subject: New spyware?

Hey all,

So recently, Internet Explorer 6 stopped working on my machine. When
attempting to run it, it would immediately generate an error report
before opening any browser windows and exit. I looked in the
technical details of the error report, and the module throwing the
exception was "winnz.dll", which was residing in my Docuements and
Settings\\Application Data folder, under it's own folder
called "winnz". In that folder were the following files:

dict.dat
keywords.dat
msiesh.dll
submit2.exe
winnz.dll

Checking the properties of these files really didn't yield any clues
as to their functionality. Additionally, I have another partition on
my machine that has a separate installation of Windows XP on it (with
a working copy of IE6), so I inspected the Application Data directory
on that installation, and sure enough, this whole folder (winnz) and
the suspicious dll weren't there.

So I removed the winnz folder, and that resolved the problem.

My suspicions are that this was some kind of spyware that went awry.
I base this theory on several things:

1) Activation of the DLL only when running Internet Explorer (v6)
2) It's presence in a user specific location, rather than system-wide
3) The presence of a data file called "keywords.dat". Sure, it could
mean keywords for a lot of different applications, but combined with
some of the other factors, it kind of smacks of tracking user key
words entered while surfing.

Maybe I'm wrong about all this and it's not spyware, but it's absence
from other installations of XP (I've checked a few others since then)
seems like sufficient evidence that it's at least not part of the
Microsoft family.

I just wanted to make a public posting on this issue, because I did
some web searches on "winnz" and didn't find anything related to the
issue I was facing. Hopefully if someone else encounters anything
similar, they'll have some help now.

-jason

[ Next Thread | Previous Thread | Next Message | Previous Message ]
[ Contact Forum Admin ]

Forum timezone: GMT-8
VF Version: 3.00b, ConfDB:
Before posting please read our privacy policy.
VoyForums(tm) is a Free Service from Voyager Info-Systems.
Copyright © 1998-2019 Voyager Info-Systems. All Rights Reserved.