Scrgrd.exe

[Steve-O]

what is this scrgrd.exe?? My firewall is blocking the Hell out of it, 1000 Blocks of it within 10 minutes.....

 

[finty]

It must be some sort of dialer, because in google they have no english sites relating to it, and thats where alot of dialers come from, dodgy foreigners. :lol:

 

[Steve-O]

It must be some sort of dialer, because in google they have no english sites relating to it, and thats where alot of dialers come from, dodgy foreigners. :lol:

damn them people hehe...

I just Got rid of the Sasser Virus, do you think this file has anything to do with it?

 

[divadsci]

Just find it and delete it, thats the way to sort any problem of that sort.

 

[Rico]

Almost certainly a virus/trojan. The only reason you don't get much info about it is because it's probably a randomly-generated filename.

 

[Steve-O]

Ive ran Anti Virus software but it wont detect it.. I found teh file, Deleted it and it was gone... Restarted teh computer and it was back again...

hhmmmm

 

[GPJosh]

If your using XP, try type in "msconfig" in RUN prompt and disable it from starting up on startup.

 

[Phil]

i love mozilla, i haven't got a virus or trojan in months.

and i don't use kazaa any mo, its rubbish.

 

[Steve-O]

If your using XP, try type in "msconfig" in RUN prompt and disable it from starting up on startup.

Yup... I did that but its selected to start its self back up again and again...

In MSConfig it says theres 2 of them

Scrgrd.exe Location - HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN

Scrgrd.exe Location - SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN


Also this one seems to be causing problems as well -

PDSched Location - HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN

Ive ran Spybot SandD etc...

Also Explorer.exe Has been pissing the Firewall Off about 1200 Blocks already and the firewall says "Explorer.exe" "Intrusion Detection" "MAJOR"

hhmmmm

 

[Han]

Found this : http://www.myphone.gr/forum/

Read the top post... Most of the page is written with a cyrilic font, russian page or something. But it seems to be a virus/trojan of some sort... You will probably have to use Regedit to remove the registry keys to get rid of it...

 

[LHC]

Sounds to me like bog standard SubSeven, given the startup methods and random filename. However, I am suprised that your firewall hasn't detected it as such, so I'm not sure.

 

[GPJosh]

The English says:

Hello.
Recently I noticed that I had a process running
with which I was not familiar. scrgrd.exe
I searched my registry to find it's key and
It was listed as "Microsoft Restore".
I installed a firewall and it caught scrgrd.exe
trying to access the internet and that was
when I knew that something was wrong. The file was
under c:\windows\system32 and it had more than 1
registry initialization keys:
[Software\Microsoft\Windows\CurrentVersion\Run]
[Software\Microsoft\Windows\CurrentVersion\RunServ
ices]
[...]

The file was upx packed. It was also hidden, system
and read-only. I upx-unpacked it, and viewed it with
a hex editor. It contained strings which indicate password-collecting functions and file-transfer functions. It also contained SQL functions like SQLDisconnect, SQLExecDirect, odbc32.dll etc.

Other functions it contains are DeleteService , StartServiceA, etc. e.g. Windows Services manipulation.

The program also seems to create msdos batch files for scanning IP's.
"@echo off
:repeat
del "%%1"
if exist "%%1" go to repeat
del "%s" %sdel.bat
"

One of the string is "\\192.168.1.210\IPC$"

It is written in Microsoft Visual C++.

References to "ARP cache", "DNSFlush", "PSNIFF" might indicate
ARP-poisoning and/or sniffing abilities.

A really alarming feature is some IRC commands along with the string "paypal.com". It is certain that
this [worm? trojan?] works as an IRC bot.

It also has screen-capturing and key logging abilities:
"[CAPTURE]:Screen capture saved to: %s"
"[KEYLOG]:Keylogger active"

"rlogin","rloginstop" and other references to rlogin
indicate that an rlogin server might be an option too.

It also contained critical registry values
like "Software\Activision\Soldier of fortune II" and
many other game registry values where the games store
their serial numbers. Obviously the program collects
them and sends them to it's creator.. [Over IRC?]

Finally some suspicious strings contained are
{beagle1
beagle2
mydoom
MyDoom
lsass
netdevil
sub7}
etc..

Another interesting part is:
"Connected to %s
3.72.0.0 131.131.131.131 netninjaz_place 12/12/04 13:13:13 netmaniac was here neTmaNiac""
Could this be a time trigger?

Other wierd strings include "MEOW" all over the place
and \\ \C$\123456111111111111111.doc"

The program also has the ability to set up and delete network shares.
There is also a small dictionary of something,
most likely names.

To sum it up - I think this is REALLY big.
It contains most of the tricks in the book
and nobody has nothing on it yet.
[I googled it for "scrgrd.exe" and nothing was found]
This requires urgent attention IMHO, unless it is already known.

Thank you for your attention,
Anastasios Bitsios

It goes on to say in my peicing together of bad computer translations, that they reported it to http://www.f-secure.com/ and that it was identified as "W32.Spybot.Worm". Also, the word bloodhood and Nortonas (Norton?) came up alot.

 

[sam fisher]

Use a translator and that page is greek.

 

[GPJosh]

I just edited my above post after translating.

 

[Rico]

i love mozilla, i haven't got a virus or trojan in months.

and i don't use kazaa any mo, its rubbish.

Huh? Mozilla stops most IE spyware/exploits but Windows is still just as vulnerable to things like RPC. Also Moz has no built-in virus checker...

 

[Rico]

I heard a while back of people avoiding Spybot Search & Destroy 'because it contains spyware itself'. While I doubt that, possibly a few rogue servers have infected versions of it, and you picked one up?

Anyways looks like I was wrong about random filenames (although that is not uncommon). That thread was made a few days ago, so this looks very new.

 

[finty]

"W32.Spybot.Worm"

Ha! I had that thing for like a year, it infects alot of exe's and denies access. I didnt know it was sending serials though.

 

[Steve-O]

I just got pissed off with it so I did a Fresh installation of Windows XP and its Gone now

Thanks for all the help