Is a DRAM Processor - msconfig.exe spyware?

chermesh · 03-22-2008, 08:45 AM

My system (winxp pro (sp3)) seemes to be under a spyware's attack. Upon startup, mcafee reports a c.bat file of the ZapChast.reg trojan type. I tried various suggestions to get rid of the ZapChast.reg trojan, but none worked. My efforts, though, might have been blocked since my system suffers fron a former inability to access Safe Mode.
I ran an analysis of my system, and found a bit which may or may not be connected with my ZapChast.reg problem. When I check my startup, I find the an item labelled as DRAM Processor and represented by the msconfig.exe file. I tried to locate this file on my system, and failed to find it. Still, when I runit from the Run window, it shows the familiar output. I checked my registry, and tried to delete a running of msconfig.exe on my startup, and found two occurances of it, one in the [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"DRam prosessor"="msconfig.exe"
and the other in the
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"DRam prosessor"="msconfig.exe"
Any effort to delete these values, failed. The system keeps recreating them.

Can anyone offer a solution, one which does not require operation from a Safe Mode?

Ran

chermesh · 03-23-2008, 01:07 AM

Looks like I did get rid of this pest.
In order to make sure it's a pest, I entered my system via command prompt. MSCONFIG.EXE wasn't on my DIR list. I checked its attributes, and found it was a hidden file. I changed the attributes, and renamed it to MSCONFIG.BAD. Upon login, McAfee no longer hit a ZapChast.reg problem. I copied the file to another directory and renamed it to its original name, run the free PREVX application, and it identified the file as a trojan.
To complete my cleanup, I entered my startup list and deleted the call for the DRAM Processor.
So far, so good.

Ran

03-22-2008, 08:45 AM	#1 (permalink)
chermesh Registered User Join Date: Sep 2003 Posts: 15 OS: win2k pro	Is a DRAM Processor - msconfig.exe spyware? My system (winxp pro (sp3)) seemes to be under a spyware's attack. Upon startup, mcafee reports a c.bat file of the ZapChast.reg trojan type. I tried various suggestions to get rid of the ZapChast.reg trojan, but none worked. My efforts, though, might have been blocked since my system suffers fron a former inability to access Safe Mode. I ran an analysis of my system, and found a bit which may or may not be connected with my ZapChast.reg problem. When I check my startup, I find the an item labelled as DRAM Processor and represented by the msconfig.exe file. I tried to locate this file on my system, and failed to find it. Still, when I runit from the Run window, it shows the familiar output. I checked my registry, and tried to delete a running of msconfig.exe on my startup, and found two occurances of it, one in the [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "DRam prosessor"="msconfig.exe" and the other in the [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "DRam prosessor"="msconfig.exe" Any effort to delete these values, failed. The system keeps recreating them. Can anyone offer a solution, one which does not require operation from a Safe Mode? Ran

03-23-2008, 01:07 AM	#2 (permalink)
chermesh Registered User Join Date: Sep 2003 Posts: 15 OS: win2k pro	Re: Is a DRAM Processor - msconfig.exe spyware? Looks like I did get rid of this pest. In order to make sure it's a pest, I entered my system via command prompt. MSCONFIG.EXE wasn't on my DIR list. I checked its attributes, and found it was a hidden file. I changed the attributes, and renamed it to MSCONFIG.BAD. Upon login, McAfee no longer hit a ZapChast.reg problem. I copied the file to another directory and renamed it to its original name, run the free PREVX application, and it identified the file as a trojan. To complete my cleanup, I entered my startup list and deleted the call for the DRAM Processor. So far, so good. Ran