Jump to content


Photo

slave.exe


  • Please log in to reply
1 reply to this topic

#1 j_holmes

j_holmes

    Member

  • New Member
  • Pip
  • 3 posts

Posted 22 July 2004 - 10:58 PM

I've been having problems with popups, winlogon.exe keeps accessing the Internet, with ads following right after. I just updated to Norton 2004, and it pics up this slave.exe. It states its a risk. But doesnt delete it. I've done a search on it (through windows search).
In the properties of it , it says:
Description :RA Server
Location :C:\WINDOWS
Comments :http://www.twd-industries.com
Company :TWD Industries SAS
Legal TradeMarks :Remote-Anything, RA
File Version :4.3.3

Does this thing belong to Windows?
Would this thing cause popups?
Any feed back would be much appreciated.
Thanks all..

Edited by j_holmes, 22 July 2004 - 10:59 PM.


#2 Marianna

Marianna

    Forum Deity

  • Retired Staff
  • PipPipPipPipPip
  • 752 posts

Posted 23 July 2004 - 01:05 AM

Hi

Filename: Slave.exe
Program Title: RA Server
Rating: 1 ( Not Recommended - Resource Hog, Spyware )
Comments: Added as a result of the RA VIRUS!


Backdoor.RA

This is a typical client-server remote administration utility that allows to connect to remote computer(s) and manage its (their) system resources in real time (similar to "pcAnywhere" by Symantec). This utility is known by the name "Remote-Anything", and is developed and distributed by the company TWD Industries (http://www.twd-industries.com).
This program is detected and classified as Backdoor trojan because it absolutely meets a Backdoor-program's behavior:

hidden installation to the system
completely hides itself in the system when active
allows to administrate affected system from remote host
The server component of this program hides itself in the system and is not visible to an average user, unlike other remote administration tools that:
have standard installation and deinstallation procedures
have any visible interface (an icon in tray-bar, for instance)


Removing the Server
To remove the server component from the system you need to run AVP with latest updates and let it delete the server. You also need to delete the registry key manually.
You may also manually delete the registry key, reboot the computer and delete the server file SLAVE.EXE in the Windows directory.

You may also use a special removing utility that is distributed by TWD Industries on their Web site.

http://www.avp.ch/av...backdoor/ra.stm

HTH
"The only source of knowledge is experience"
Albert Einstein (1879 - 1955)

Microsoft MVP Consumer Security 2006 - 2010




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button