{"id":82,"date":"2008-01-28T07:06:41","date_gmt":"2008-01-28T14:06:41","guid":{"rendered":"https:\/\/www.tungsai.com\/blog\/?p=82"},"modified":"2008-01-28T07:06:41","modified_gmt":"2008-01-28T14:06:41","slug":"the-plot-thickens-winsysldrexe-and-critical-error-occured","status":"publish","type":"post","link":"https:\/\/www.tungsai.com\/blog\/?p=82","title":{"rendered":"The Plot Thickens… WINSYSLDR.EXE and "Critical Error Occured""},"content":{"rendered":"

I am convinced that some viral \/ spyware is knocking on my door. This morning, Monday, January 28th, 2008, I came in to my office and my machine had been logged in all weekend (Locked, of course). Well, well, well, what did we have here: TWO instances of “WINSYSLDR.EXE” on my desktop.<\/p>\n

Sigh. Well, at least I’m able to gather additional information about this very possible threat. First, I noticed that the icon for it in the taskbar are the icon for Folders, as shown in this image:<\/p>\n

\"winsysldr_error_2x\"<\/a> <\/p>\n

 <\/p>\n

Second, in the Windows Task Manager, under the “Applications” tag, are two ACTUAL EXECUTABLE APPS, blatantly shown on the task manager. Note, people: A legitimate error message popped up by a legitimate application will NOT show up as a unique APPLICATION.<\/strong><\/p>\n

<\/strong> <\/p>\n

\"image\"<\/a> <\/p>\n

<\/strong> <\/p>\n

Thirdly: Under “Processes”, I now see a Process called “System”, <\/p>\n

 <\/p>\n

\"system_task_mgr_winsysldr\"<\/a> <\/p>\n

 <\/p>\n

PEOPLE, THERE IS NO LEGITIMATE PROCESS CALLED “SYSTEM”.<\/strong><\/p>\n

No doubt my system is infected, after googling “winsysldr.exe”. as of last week, this very blog is the #1 hit; but many more hits have been added under some lesser-known virus pages; something called “SaliarAR”. I’ve never heard of it. <\/p>\n

http:\/\/www.downloads-portal.com\/security-and-privacy\/anti-virus-tools\/saliarar_application-59071.html<\/a><\/p>\n

 <\/p>\n

I don’t even trust THOSE sites, though. I must get to the BOTTOM of which EXECUTABLE this shit is running under!! How can I possibly do this? While searching for the answer, Noel suggested that I head over to Spybot Search & Destroy, install it, run it, love it. Well… I didn’t wanna admit defeat, but as I scanned the impossibly long list of services running on my machine, trying to locate WHAT EXE was actually SPAWNING these dialogues, <\/p>\n

 <\/p>\n

A NEW MESSAGE APPEARED RIGHT BEFORE MY EYES.<\/p>\n

\"critical_error_occurred\"<\/a> <\/p>\n

 <\/p>\n

And sure enough, showed up as “Critical error occured”. SPELLING ERROR! BLATANT SIGN OF ADWARE\/SPYWARE! Some foreigner obviously cooked up this malicious bullshit. (Can you tell i’m getting impatient?) Yeah, yeah… I could reinstall everything and be done with it, but that wouldn’t be very fun, now, would it?<\/p>\n

I wonder if they have a keylogger installed and are, at this very moment, watching me type in this Blog update.<\/p>\n

\"critical_error_taskmgr\"<\/a><\/p>\n

 <\/p>\n

“Critical error occured.exe”? RIIIIiiight. Downloaded & installed SBS&D immediately. It’s running a scan now… it’s gonna take a while, so I’ll post this up on teh innernets for immediate consumption.<\/p>\n","protected":false},"excerpt":{"rendered":"

I am convinced that some viral \/ spyware is knocking on my door. This morning, Monday, January 28th, 2008, I came in to my office and my machine had been logged in all weekend (Locked, of course). Well, well, well, what did we have here: TWO instances of “WINSYSLDR.EXE” on my desktop. Sigh. Well, at… Continue reading The Plot Thickens… WINSYSLDR.EXE and "Critical Error Occured"<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-82","post","type-post","status-publish","format-standard","hentry","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/82","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=82"}],"version-history":[{"count":0,"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/82\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=82"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=82"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tungsai.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=82"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}