Jump to content


  • Content Count

  • Joined

  • Last visited

About epalmer

  • Rank
  1. Thanks for your response. It no longer shows up in task manager because SuperAntiSpyware removed it. After the alerts and finding that my computer was running slow, I opened up task manager and looked at the processes running. It showed a process labeled "kynaoch.exe" with a description of "IirDeramkel Antibibus Scagnur". It looks like it was initially loaded as an AppData/local/temp file. I believe that I picked it up through a XSS flaw in my browser. I was researching a Microsoft Office issue, found a link that appeared to be a blog addressing such issues (utteraccess.com), and was redirected to a page that looked like the Wikipedia entry for Word but with the current date as the browser tab and a different URL. I got a message that ..../rad8E849.tmp.exe is not a valid Win32 application. I then got a dialog box labeled "On-Access Scan Messages" (which I think is McAfee's alert) saying virus alert with the name...\Temporary Internet Files\Content.IE5\C2HRSQF7\exe[1].exe which was detected as "FakeAlert-Krypt!env.d". I appreciate any help you can give. Thanks
  2. Earlier today, I had a trojan installed on my computer. McAfee appeared to delete it, calling it "FakeAlert-Krypt!env.d". However, I found that my CPU was running at 100% and there was a process running called "kynaoch.exe" which I couldn't identify through a google search. The process description looked like it was some sort of antivirus but was written in another language (possibly Swedish). My help desk installed SuperAntiSpyware which quickly detected and removed it. However, I was wondering how I could learn more about the trojan and why McAfee thought it was something else. Does anyone know where I can find more information? Thanks, Eric
  • Create New...