Community archive

Ask something
Discussion Locked

Mystery File: SYS32A.EXE

0 helpful
2 replies

by greeblie

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Looking at my task manger on my NT 4.0 workstation system I have discovered a program that runs the CPU meter up to about 70% every two seconds or so. Here is the directory info of that program and three others with the same timestamp. There are no other files on the whole PC with this timestamp. The last time I installed anything major was in September. This in \WINNT\SYSTEM32

SYS32A.EXE 1,101 KB Application 10/15/00 10:13 PM
NT5MEM.EXE 331 KB Application 10/15/00 10:13 PM
NETCAR.DLL 0 KB Application Exte... 10/15/00 10:13 PM
ADDLPA.DLL 0 KB Application Exte... 10/15/00 10:13 PM

Looking in the files with a hex editor I can see no copyright or other identifying info other than a Borland one, no doubt that's the tool that wrote it. In the Registry, there is a ..\CURRENTVERSION\RUN key with the name of the programs, SYS32A.EXE. There is also a set of keys under the ambiguous heading: HKLM\SYSTEM\CurrentControlSet\Services\Service1 that points to the NT5MEM.EXE program.

The SYS32A.EXE program in attempting to access the internet every few seconds. The ZONEALARM firewall I installed is set to prevent it. Not that it matters but this LAN its conencted to is also behind a hardware proxy firewall. I have McAfee and the latest DAT files loaded, but it finds nothing wrong with these programs. I've searched the WEB, MICROSOFT and other sites for any reference to this SYS32A.EXE or NT5MEM.EXE but have had no luck.

Last month I installed Diskeeper Workstation version 5.0 But this was way before the timestamp on these programs. Other folks are this office have Diskeeper and very similar setups but don't have these files. I just looked on my other workstation, a WIN2KPRO system and have discovered the same files? What is going on here?

Does anyone know what the hell this is? Please Help!

2 replies

by kolzy

hi, sys32a.exe and ipserver.exe are part of the same malware, keyloggers they are.
cant remember how to remove them but i just found them on another pc in my work.
if i find the removal destructions i will post here again...

by kolzy

n task manager under processes you may see a process called SYS32A.exe and IPSERVER
http://groups.google.co.uk/groups?q=sys32a&hl=en&lr=&selm=TnxF5.9877%2476.239440%40news1.rdc1.ab.home.com&rnum=3
see this post for more details.
basically this is a keylogger.
ipserver is its own 'transmitter'
i think the reg key is located here
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion|Run

you need to run some sort of ad removal program - that can also catch spyware.
adaware worked for me as did spybot.

This discussion is closed to new replies.