shell.exe connecting to Hotmail

[doctorgonzo]

I have just recently had a problem with shell.exe dialing up to the 'net and trying to connect to Hotmail. It tries to do this every five minutes or so. I have scanned the PC for virii and trojans and have found nothing. Searching the M$ knowledge base doesn't turn up anything either.

My firewall is preventing the connection from being made, but I am curious as to why it is doing this, because I have never had this problem before. I am running XP Home. Anybody have any idea what this could be?

[akmsr]

just today in the afternoon i spent an hour in a friends house cleaning his machine of a backdoor virus called shellapi.exe. hopefully thats not what you have.

[doctorgonzo]

Thanks for the tip, I will have to check that one out.

[Statica]

Is shell.exe in your startup (registry entries)? If so I'd start gettign suspicious .. the other occurence, I'd seen in google was from the .NET service .. did you install those .NET framework files from windowsupdate?

[doctorgonzo]

I haven't downloaded the .NET framework, so it isn't that.

It was in the registry under HKLM/Run, I believe. I am suspicious about this.

[jamesrpm]

Do you have your e-mail set to check every so often?
OUtlook express>tools >general tab______ check for new messages every ....

I did this one to myself , my 10 year old pointed it out to me.

[Statica]

That is baffling indeed .. the only reference to shell.exe being overwritten was in http://www.viruslist.com/eng/viruslist.html?id=50237 .. I have no idea if that seems logical .. but thot I'd post to see if it turns out right .. the funny thing is that I couldnt get reference to that virus in many sites.

[doctorgonzo]

Statica, I found that virus reference too, and that does sound like what has happened. According to that article, though, it spreads between hard drives and floppy disks, and the only floppy disk I ever use is a Ghost boot disk, so I have no idea how it could have gotten on my PC if it is, in fact, that virus. I will have to check further.

[doctorgonzo]

Turns out it was a trojan called Trojan.Logger (and I'm not the first person to be infected recently, it appears). NAV deleted shell.dll and a file called mfc2.tmp which is probably the keystroke log. Hopefully, it's taken care of, and because the firewall blocked outgoing traffic, no damage was done. If I can only figure out where the heck it came from...

[Trent Steel]

doctorgonzo, check your PM.