Is OWMngr.exe a trojan?

---

Request for Question Clarification by livioflores-ga on 02 Jun 2003 22:19 PDT

I just found this info:

"We have seen 3 trojan or spyware programs so far, namely syslog.exe,
OWMngr.exe and ttps.exe. These all register theirselves in the
registry and starts each time the user login. They try to connect to
tp.searchseekfind.com and fastfind.org, and listens on different UDP
ports."

IS it enogh as an answer?

---

Clarification of Question by motleyfoolmania-ga on 04 Jun 2003 06:31 PDT

How do you get rid of it permanently?

---

Request for Question Clarification by livioflores-ga on 04 Jun 2003 09:26 PDT

There are different products that helps you ridding of spyware and
other pests.

First of all try with your installed antivirus, update it and do a
complete scan.

The second step is to go to start --> run --> and type msconfig then
press enter, this is the Configuration System Utility of windows, go
to Start tab and see if an strange program is in the list, may be this
file appears listed here, deselect it in order to prevent its restart
with the windows start up.

Then try with the ctrl+alt+del feature (Task Manager) to end this
owmgr.exe if its running, you can do this by selecting it (if appears
listed here) and clicking the End Task button. Now you can delete it
manually.

Even if the previous advice works fine or not I suggest you to install
one of the following free programs:

-SpyBot Search and Destroy-:
Download:
http://files.vollversion.de/spybotsd12.exe

Info:
http://security.kolla.de/index.php?lang=en&page=bots


-Adaware:
Download:
http://ftp.pcworld.com/pub/new/privacy___security/aaw6.exe

Info:
http://www.lavasoftusa.com/software/adaware/


After installed one of this programs (I use SpyBot) run an scan, and
then let it clean all the spyware that are in your PC.
Remember that some P2P programs didnīt work without the spyware that
they install in your PC and the antispyware programs like the
antivirus must be kept updated.

If this helps you let me know and I will post it as the answer.

Regards.
livioflores-ga

---

Clarification of Question by motleyfoolmania-ga on 04 Jun 2003 11:39 PDT

Seems to have worked!

Hi motleyfoolmania!!

In regards to the file OWMngr.exe, it appears to be a spyware. I found
at "SpywareInfo Support Forums" the following:
""We have seen 3 trojan or spyware programs so far, namely syslog.exe,
OWMngr.exe and ttps.exe. These all register theirselves in the
registry and starts each time the user login. They try to connect to
tp.searchseekfind.com and fastfind.org, and listens on different UDP
ports."
http://www.spywareinfo.com/forums/index.php?s=34915330fcbd92fc9136ce6f1d59f4a0&act=ST&f=11&t=6286&st=0&#entry46456

More recent forum threads about this topic:
http://www.spywareinfo.com/forums/index.php?act=ST&f=11&t=6436&s=
http://www.spywareinfo.com/forums/index.php?act=ST&f=11&t=6383&hl=

To remove it from your computer I suggest you to follow this
instructions:
First of all try with your installed antivirus, update it and do a
complete scan.
 
The second step is to go to start --> run --> and type msconfig then
press enter, this is the Configuration System Utility of windows, go
to Start tab and see if an strange program is in the list, may be this
file appears listed here, deselect it in order to prevent its restart
with the windows start up.
 
Then try with the ctrl+alt+del feature (Task Manager) to end this
owmgr.exe if its running, you can do this by selecting it (if appears
listed here) and clicking the End Task button. Now you can delete it
manually.
 
Even if the previous advice works fine or not I suggest you to install
one of the following free programs:
 
-SpyBot Search and Destroy-: 
Download: 
http://files.vollversion.de/spybotsd12.exe 
 
Info: 
http://security.kolla.de/index.php?lang=en&page=bots 
 
 
-Adaware: 
Download: 
http://ftp.pcworld.com/pub/new/privacy___security/aaw6.exe 
 
Info: 
http://www.lavasoftusa.com/software/adaware/ 
 
 
After installed one of this programs (I use SpyBot) run an scan, and
then let it clean all the spyware that are in your PC.
Remember that some P2P programs didnīt work without the spyware that
they install in your PC and the antispyware programs like the
antivirus must be kept updated.

Actually I know that this answer have worked on your PC, it make me
happy.
Remember to scan your PC with the antispyware that you used at least
one time at a week, it will help you to keep your Pc working
efficiently and your internet connection running fast.

Best Regards.
livioflores-ga


PS: Just curious, how did you remove owmngr.exe from your PC (which
part of my advice have worked on this task?)?, Which antispyware did
you used, if you did?
Thank you.

According to this newsgroup post, OWMngr.exe may be a spyware trojan:

http://groups.google.com/groups?hl=en&lr=lang_en&ie=UTF-8&oe=UTF-8&newwindow=1&safe=off&th=644c321b73bccb63&rnum=4

Pest Patrol seemed to work after I updated it.

I had the same problem and I recalled it started after I clicked on
YES when a website asked me to instal Shockwave to see a flash
plug-in. Oh well, stupid me... It bugged me so much that I searched
for a solution and found a solution that worked for me on the Symantec
website: http://securityresponse.symantec.com/avcenter/venc/data/adware.fastfind.html
(these blokes and shielas are smart). This is what I found out:

Apparently Adware.Fastfind is an Internet Explorer plugin that may be
used to display targeted advertisements. It monitors outgoing requests
to search engines and downloads advertisements from www.fastfind.org.
To get rid of the bugger, you have to remove the registry keys it
created (follow the directions carefully, so you don't have to backup
your registry to avoid malfunctioning of your windows box):

a) Click Start > Run. 
   Type regedit and click OK

b) Navigate to the key 

   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

   In the right pane, delete the value "IEService.exe" if it is found.


c) Navigate to and delete the following keys (you can find the keys by CTRL-F 
   and copying the key names one by one)

   HKEY_CLASSES_ROOT\TypeLib\{B929C108-045F-48D1-8638-E3195AD6FF03}
   HKEY_CLASSES_ROOT\Interface\{47D8F3A0-C511-4D91-A963-F00DDDEE4E49}
   HKEY_CLASSES_ROOT\Interface\{5A4E1627-8677-41F7-B78C-4CACDF5B12FF}
   HKEY_CLASSES_ROOT\CLSID\{9E992732-295F-4987-8BE3-16FAC1639198}
   HKEY_CLASSES_ROOT\CLSID\{D72A7651-8A16-476E-953C-347F0241FD32}
   HKEY_CLASSES_ROOT\E.HH
   HKEY_CLASSES_ROOT\E.ZZA


d) Exit the Registry Editor.

e) Reboot (to be on the safe side).

Voila, the bugger is gone.