twext.exe - one nasty to be on the look out for

Diggsy

Diggsy

Diggsy

Soldato
Joined
31 Aug 2007
Posts
4,860
As title, keep your eyes peeled on your systems for a file called twext.exe.

I had an email from eBay today stating that my account might have been compromised blah blah and they had removed items listed by a 3rd party and I had to reset my password etc. It was a genuine email.

Anyway, I reset my password etc, then I got to thinking, how did this happen and is my PC clean. I had just ran HijackThis about a week ago and all was well.

So I ran HijackThis only for it to find an entry called twext.exe. A little searching and I soon found this is supposedly a password stealing type of trojan.

It's located in the System32 folder somewhere as a deeply hidden file.

Little bugger is a backdoor trojan bot that edits the userinit and allegedly tries to steal password information and upload it to a server. Although I am not sure exactly what passwords it looks for and how it does so?

So I swiftly removed this by turning off System Restore and scanned using MalwareBytes. Everything now appears clean, although I have just had to spend the last hour or more changing all of my passwords - all email accounts, forum accounts, ebay, paypal, my router, the works.

Now, maybe it's a coincidence that my eBay account was allegedly compromised and this file was also on my system, but I was not prepared to take the chance.

This is just a heads up for everyone to be vigilant and check your system regularly. I would consider myself pretty careful whilst online and I do update regularly, but it just goes to show that it can happen easily to anyone. I have no idea where this file came from, or how it got through 'the net'.

I had been running Norton AV, with Norton Personal Firewall, Spybot (using Teatimer) and SpywareBlaster and this is the 1st time anything nasty has got through.

One time too many in my opinion though, so I have changed my AV to Avast and will check my system even more than normal now.

I am also wondering if I should install SuperAntispyware along with my current spyware software, or remove them and install it, or just leave as is?
 
Thanks for the heads up. :)
What firewall are using ? Still Norton ? I'd use Comodo FW. Any ideas How you got infected ?
You could install SuperAntispyware and run it as needs be (turn off real time scanning if too intensive), that gives you the most flexibility and protection.
 
Should be using a decent firewall. Anti-virus won't pick up everything even with a real time scan, whereas a firewall with almost all ports blocked and maximum security settings will stop almost any trojan working. Avoid Norton products at all costs. I use comodo personally.
 
Energize said:
Should be using a decent firewall. Anti-virus won't pick up everything even with a real time scan, whereas a firewall with almost all ports blocked and maximum security settings will stop almost any trojan working. Avoid Norton products at all costs. I use comodo personally.
Click to expand...

Not sure if the trojan got to work or not to be honest. I have a Belkin Router with firewall and was also using Norton Personal Firewall that is set to alert me to any attempt to access the net, inward or outward bound.

I must look at the security settings of my router again, although IIRC it is set to allow Windows PnP. Might need configured better, although I could do with a step-by-step guide.

Will look at Comodo Firewall. I am about to swap to my new system anyway, and it will be running Vista with Avast. I will probably install Comodo and SuperAntiSpyware on that too.

Just could've done without the headache. Although I am unsure if any traffic was sent out by this trojan. Would there be any way of confirming this via system logs or something?
 
That's interesting, I had to change my eBay password 4 times in the last few months..

Do you mean twext.exe and not twext.dll? And where did you find it in the system32 folder?
 
Last edited:
Greenlizard0 said:
That's interesting, I had to change my eBay password 4 times in the last few months..

Do you mean twext.exe and not twext.dll? And where did you find it in the system32 folder?
Click to expand...

Yeah twext.exe.

Run HijackThis, it will find it if it's there. Then MalwareBytes will remove it.
 
My brother got this too. And yes he had major issues with his eBay passwords as well.

It is a keylogger. It creates a .dat file in System32 folder with its keylogging history. My brother was completely shocked by the severity of it.
 
Thanks for the warning...
Any ideas on where it came from or how they got infected by it?
 
Some other tips in addition to software security:

Grab the Verisign PIN keyring from Paypal - works with Ebay too.

Basically, every time you log into Paypal or Ebay you've got to key in a 6-digit PIN number generated by the keyring device (as well as your normal username and password). It costs £3 but takes about 3 weeks to arrive from sunny California.

Also, shift your passwords over to a manager like Roboform, so you don't have to key them in and use (if you don't already) randomly generated passwords (Roboform will remember them and will also keep track of changes). Use 16/20/25-character passwords.

Try and not use a password manager that stores your settings centrally. That's just an opportunity for an online database to be hacked.

Randomly generated passwords mean the next time Spotify database is hacked, the password they nick from that isn't the same as something you use on Ebay/Paypal/Bank account.

Get into the habit of only using your own PC for any online transactions (once your PC is guaranteed nasty-free) - the randomly generated passwords will force you to do that anyway.

Security questions: try and select questions/answers that only you will know (mother's maiden name, birthdays, birthplace can all be figured out by friends and family). Although, you can be limited in what you can choose.

Paranoid, moi!?
 
NathanE said:
My brother got this too. And yes he had major issues with his eBay passwords as well.

It is a keylogger. It creates a .dat file in System32 folder with its keylogging history. My brother was completely shocked by the severity of it.
Click to expand...
I hope you've disowned him. :D

Le Samourai said:
Some other tips in addition to software security:

Grab the Verisign PIN keyring from Paypal - works with Ebay too.

Basically, every time you log into Paypal or Ebay you've got to key in a 6-digit PIN number generated by the keyring device (as well as your normal username and password). It costs £3 but takes about 3 weeks to arrive from sunny California.

Also, shift your passwords over to a manager like Roboform, so you don't have to key them in and use (if you don't already) randomly generated passwords (Roboform will remember them and will also keep track of changes). Use 16/20/25-character passwords.

Try and not use a password manager that stores your settings centrally. That's just an opportunity for an online database to be hacked.

Randomly generated passwords mean the next time Spotify database is hacked, the password they nick from that isn't the same as something you use on Ebay/Paypal/Bank account.

Get into the habit of only using your own PC for any online transactions (once your PC is guaranteed nasty-free) - the randomly generated passwords will force you to do that anyway.

Security questions: try and select questions/answers that only you will know (mother's maiden name, birthdays, birthplace can all be figured out by friends and family). Although, you can be limited in what you can choose.

Paranoid, moi!?
Click to expand...
A few years ago this probably would have been seen as paranoid but nowadays, unfortunately, it is probably quite a good set of rules to adhere to. :(
 
NathanE said:
My brother got this too. And yes he had major issues with his eBay passwords as well.

It is a keylogger. It creates a .dat file in System32 folder with its keylogging history. My brother was completely shocked by the severity of it.
Click to expand...

Can you ask your brother the name of the dat file please? If it's still on my system I would like to know what it has logged/sent out.
 
Le Samourai said:
Some other tips in addition to software security:

Grab the Verisign PIN keyring from Paypal - works with Ebay too.

Basically, every time you log into Paypal or Ebay you've got to key in a 6-digit PIN number generated by the keyring device (as well as your normal username and password). It costs £3 but takes about 3 weeks to arrive from sunny California.

Also, shift your passwords over to a manager like Roboform, so you don't have to key them in and use (if you don't already) randomly generated passwords (Roboform will remember them and will also keep track of changes). Use 16/20/25-character passwords.

Try and not use a password manager that stores your settings centrally. That's just an opportunity for an online database to be hacked.

Randomly generated passwords mean the next time Spotify database is hacked, the password they nick from that isn't the same as something you use on Ebay/Paypal/Bank account.

Get into the habit of only using your own PC for any online transactions (once your PC is guaranteed nasty-free) - the randomly generated passwords will force you to do that anyway.

Security questions: try and select questions/answers that only you will know (mother's maiden name, birthdays, birthplace can all be figured out by friends and family). Although, you can be limited in what you can choose.

Paranoid, moi!?
Click to expand...

Thanks for those tips. Does Roboform generate passwords too, or do I need to use something else for that?
 
Diggsy said:
Can you ask your brother the name of the dat file please? If it's still on my system I would like to know what it has logged/sent out.
Click to expand...

I can't remember sorry.

Go into your System32 folder and sort it by Date Modified or Date Created in descending order. You will see all the "recent" files added to the folder at the top. Just look for a .dat file created fairly recently and load it up in Notepad.
 
NathanE said:
I can't remember sorry.

Go into your System32 folder and sort it by Date Modified or Date Created in descending order. You will see all the "recent" files added to the folder at the top. Just look for a .dat file created fairly recently and load it up in Notepad.
Click to expand...

No worries. I have looked at the folder extensively for both recently created/modified and there was nothing at all malicious. I opened the only couple that had been created recently and there was nothing obvious.
 
You must log in or register to reply here.
Back
Top Bottom