winmgnt.exe - Backdoor.Hale

winmgnt.exe - COM+ Component Service

sysshell.exe: A legitimate "At Your Service" utility from Prism Microsystems.

# Cdir.txt: A harmless text file.
# Csrss.exe: a Backdoor Trojan Horse detected as Backdoor.Padmin.
# Firedaemon.exe: A legitimate FireDaemon utility (used to start service processes).
# Libeay32.dll: A legitimate .dll file.
# Mswinsck.ocx: A legitimate .ocx file.
# Pskill.exe: A legitimate utility used to kill processes.
# Secure.exe: Detected as Backdoor.Hale.
# Servuperfcount.dll: A legitimate .dll file that Winmgnt.exe uses.
# Setup.bat: A batch file detected as Backdoor.Hale.
# Setup.pif: A harmless .pif file.
# Ssleay.dll: A legitimate .dll file.
# Winmgnt.exe: a Serv-U FTP server
# Winexplorer.dll: This is not a .dll, but a configuration file for the FTP server.
# Wget.exe: A legitimate program to fetch files using HTTP.
# "- V1.0D (Haley) -": A 0-byte file.

Backdoor.Hale
http://securityresponse.symantec.com

W32.Gismor
http://securityresponse.symantec.com


C:\WINDOWS\system32\winmgnt.exe
C:\WINDOWS\system32\csrs.exe

HijackThis

O23 - Service: COM+ Component Service (COMCSVC) - Unknown owner - C:\WINDOWS\system32\winmgnt.exe
O23 - Service: COM+ System Service (COMSS) - Unknown owner - C:\WINDOWS\system32\SSMS.EXE