WINDOWSSHED = ??? Virus?

FatRakoon · 3 Jan 2007 at 16:12

Earlier on, the PC just sort of hung... Mouse clicks did nothing, and CTRL-SHIFT-ESC brought up the Taskmanager, but it did not respond.

On searching through the system, I find somethign called WINDOWSSHED???

Anyone heard of this?

Anyway, it took me a short while to sort it out, because I have just added another pair of RAM sticks to the system, plus I have installed ZoneAlarm Firewall and thats crashing all the time, and so, I had thought that it could be one of those, but Im not sure???

I have managed to kill off the 2 files... Sure one was an exe but I cant be 100% and now it seems to be ok, but I still would like to know what it was supposed to be???

t31os · 3 Jan 2007 at 16:23

How much ram did you upgrade from, if its enough to run XP then take the new ram out and see if it helps, if not, then its not the ram is it...

Might help to provide some more specific info, and the above.

FatRakoon · 3 Jan 2007 at 17:38

No, its got nothign to do with the RAM Im sure...

I had 2x512MB Geil 6400

I just added another pair, so now I got 4x512MB

Sure enough, I have tried all 4 sticks individually just in case and they seem to be fine.

Apart from that there is nothign else I can say????

Just wondered if anyone else has any knowledge of the file called WINDOWSSHED ? nothing is coming up in google apart from windows and sheds LOL

t31os · 3 Jan 2007 at 18:15

FatRakoon said:
nothing is coming up in google apart from windows and sheds LOL

lol, can't say i've ever heard of it....

You got any dodgy exes running in task manager?.......

What AV and Spyware scanner you using?

You sure it was definately called WINDOWSSHED?

FatRakoon · 3 Jan 2007 at 18:47

Nor me... Its a new one.

Dodgy EXEs - No, all looks normal.

AV = NOD32
SPY = NoAdware 4, Spyware Doctor 4, AdawareSE 1.6

All are fully up to date and all have scanned since and found nothing apart from a couple of negligible ones with AdAwareSE

Yes, WINDOWSSHED as in WINDOWS and SHED joined together.

Just cant figure it out, and I still cannot find the cause or where it came from???

Dont think it was Downloaded with ZoneAlarm??

I did disable the XP FireWall while I put ZA in and I suppose something could have sneaked in during that time?

t31os · 3 Jan 2007 at 21:16

If it had, i would aspect nod32 to notice it, you have all the IMON, EMON etc enabled right?....

Any shared folders with full write permissions on your PC?..... only way i see something getting in.

Could try using an ap like ResHack to check out the code on the suspect file.

FatRakoon · 4 Jan 2007 at 11:38

I got hit again??

I checked taskmanager and in there, I saw RUNDLL32 and RUN32DLL

I checked my startups and I saw 2 instances of both.

I removed them of course and they went away by hand ( Locked the files until I killed them manually in TaskMan ) when Windows told me the files needed for windows need to be reloaded from the CD ( So, I did that ) and it run the right file back.

Now, I have NEVER had this before.... I used to run the XP FireWall, and it seems a bit suspect to me, that as soon as I try ZoneAlarm, Im getting infected, whereas previously, I never did???

I keep getting the ZoneAlarm message box coming up telling me that such and such app is trying to access the internet, and of course some are obvious, but some are not...

taskmngr.exe ?
The right one is taskman.exe isnt it!

Anyway, I am going to have to fully update my AV / Spyware and give them all a full run-through and see what else comes up?

They are all up to date already and they have had a full scan only 2 days ago... Just before I installed ZA and everythign came up clean, but who knows?