Recently, When looking at the customer's log, I noticed the file "c:\windows\system32\msconfg.exe" as a suspicious running process. A file by the similar name of msconfig.exe is a legitimate windows file which is installed with the operating system. It is a windows system configuration utility. The valid file normally resides in the "c:\WINDOWS\PCHEALTH\HELPCTR\Binaries" folder.
The customer had recently purchased Spyware Nuker because he had come across a bundleware executable which had installed several infections on his PC. Spyware Nuker had removed all of the known spyware items, but this file had been left behind. The customer's PC was not stable and his internet connection was running slower than normal. I requested that the customer upload the file to our research server so that I could analyze it and see if it was the cause of his problems.
I put the file in the system32 folder of a clean test machine with windows XP. After running the file, nothing seemed to happen. There were no obvious popup windows or, no HTTP network activity. Unsolicited HTTP network activity is a telltale sign of adware and spyware, because those types of infections use HTTP connections to download and display advertisements in a browser. This msconfg executable appeared at first glance to do nothing. On closer inspection, i saw that the file was running silently in the background. It was doing two malicious things. It was systematically scanning all possible local IP addresses for an open port 135. It had also silently established a connection to 65.96.11.164:5555 using local port 3020.
Port 135 (or port epmap) is used by windows for distributed COM services. A windows Machine may open this port and listen for incoming messages from other 'client' PC's which may want to access a DCOM service. Several known viruses exploit this. There are vulnerabilities which can be taken advantage of if certain DCOM services are running on the machine. The msconfg.exe scans for computers on the local network. It started scanning all IP addresses starting at 192.168.*.* and continued scanning all possible IP addresses for an open port 135. This causes a lot of network traffic and would slow down the network connection.

The second thing that the infection was doing was related to the connection to 65.96.11.164:5555. Running a packet sniffer on my test machine, and setting a filter to view all packets sent to and received from that IP address, I was able to figure out what was going on. I navigated to several web sties, and noticed that the URL's were being sent to the connection at 65.96.11.164. This is a normal symptom of a spyware program, but what I noticed a little bit later, as I began to type this journal, was that every word I typed was being sent to 65.11.164. Msconfg.exe was logging all my keystrokes and sending them to it's server, most likely in hopes of obtaining some usernames and corresponding passwords or other private information.

It was easy to see that this was a malicious program and that it needed to be removed. I logged all my findings and created an entry in the Spyware Nuker database to remove this item.