Thread: internat.exe process

Does anyone else have this process open when you press ctrl + alt + del?

I discovered it today, searched on google for what it was, and one website stated it was a trojan keylogger. I immediately deleted from it from system32 in fear of bad things, but I soon discovered after a second google search that it is ALSO the name of the little blue icon that allows you to switch between russian and english in XP. How stupid of me. I really hope that wasn't vital to anything, but for some reason I can still switch between english and russian...

It is not running on my computer.

Well, you shouldn't have deleted it from the C:/windows/system32 folder. That is where the good internat.exe resides. The virus resides in C:/windows. Also, the icons are different. The good internat has a zip icon, while the Netsnake trojan has "?".

If you have windows xp, it shouldnt make a difference whether you have it or not. I dont have it, and everything works fine for me.

AVG Antivirus will take care of the trojan.

The point is, if you see internat.exe running in the processes window, its the virus.

Originally Posted by saibot

Well, you shouldn't have deleted it from the C:/windows/system32 folder. That is where the good internat.exe resides. The virus resides in C:/windows. Also, the icons are different. The good internat has a zip icon, while the Netsnake trojan has "?".

If you have windows xp, it shouldnt make a difference whether you have it or not. I dont have it, and everything works fine for me.

AVG Antivirus will take care of the trojan.

The point is, if you see internat.exe running in the processes window, its the virus.

Well i'm not exactly sure if it was in system32 because I did a file search and it just appeared in the window. But thanks for the icon tip. Apparently it was the virus because i remember it having a ? icon before I deleted it. I will try AVG. Stupid human race.. terrorizing other humans with malicious computer code.

saibot, it appears I have found a contradiction to your comment on the icon:

PWSteal.Netsnake collects password information, creates its own mail message, and sends the information to the intruder. It copies itself to %windir%\Internat.exe. Please note that there is a legitimate Windows application called %windir%\system\Internat.exe. The Trojan file is 82.5 KB in length and uses a zip file icon. The "real" Internat.exe is generally about 20 KB in length with a "?" icon.

from http://securityresponse.symantec.com/av ... snake.html

So by deleting the ? i in fact did delete the "real" internat program. Oh well. I didn't like that blue taskbar icon anyways. My alt + shift command still works so all is well. Thank you for the help, though. (AVG returned 0 infected files, by the way)

Thats backwards. Every other source said it the other way.

Originally Posted by saibot

Thats backwards. Every other source said it the other way.

Well I don't know what to think anymore. I found mixed descriptions as well. The virus scan picked up nothing so I guess my deleting of it took care of the problem because its not on the process list. I think I will unplug my computer and weep in a corner.

which Windows version do you have? internat.exe is international support for win9x, i.e. if you have Russian keyboard input etc. In windows 2000\XP internat should no exist.

Originally Posted by ST

which Windows version do you have? internat.exe is international support for win9x, i.e. if you have Russian keyboard input etc. In windows 2000\XP internat should no exist.

Windows 2000. I don't know why I said XP in the first post.