1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

"En" taskbar icon

Discussion in 'Firefox, Thunderbird & SeaMonkey' started by broni, 2002/12/20.

Thread Status:
Not open for further replies.
Page 1 of 2
  1. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    This is from my friend.
    While visiting http://www.asus.com.cn/
    he accepted a plug-in (Netscape asked for it...I believe font/language plug-in). Since then, every time he starts either Netsacape or IE, that "En" icon appears in systray (it's not there while just in Windows). I got same type of icon when using Word, where I have English, and Polish keyboard settings enabled.
    I searched with him in every known to me place to find where it comes from....couldn't find anything. When he right click on that icon, he has two pieces of info:
    "When I right click on the "En" two options come up:
    What's this?
    Properties...
    When click on What's this:
    Makes it possible for you to switch between installed keyboard languages and layouts. To switch to another keyboard language and layout, click this indicator, and then click the keyboard language and layout you want.
    Properties
    It's heading is Keyboard Properties. "
    He says, that when he goes CAD, and closes something called INTERNAT (never heard of it), that "En" icon dissapears.
    I started to think, that maybe it's hidden somewhere in .jar files, but I'm not that familiar with them, so I don't want to make any damage.
    He went already with "scanreg /restore ". It didn't help.
    Any thoughts?
    Broni
     
    broni,
    #1
  2. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    I visited the site you linked and the offer was to install a Simplified Chinese language pack. That was probably the same that your friend got. I went ahead and let it install. WOW! It took quite some time and I noticed it was placing files in the Windows\System directory as well as several fonts in the Fonts folder. When it finished, I look in Control Panel for any new program listings. I found nothing in Add/Remove programs or anywhere else. Nothing new was listed on the Start Menu-Programs either. I ran RegCleaner and it had no New entries listed. I found no way to uninstall this beast.

    I recorded the drive usage and used GoBack to ditch the download and return to the previous condition. Then I checked the drive usage again and found that I was 200 megs lighter after getting rid of the beast. That's a pretty hefty download!

    While it was installed, I didn't get the EN thing that you mentioned nor could I find any trace of the Chinese language pack. I don't have Netscape so maybe that's a factor too.

    If your friend gets that icon in the Task Bar, then you should be able to find what's starting the program by using Msconfig or StartCop.

    I'll do some more checking and see if I can dig up something better since I haven't been much help so far. Perhaps someone else will chime in that has made that same slip before and will have something to offer.
     
    Last edited: 2002/12/20
    Zephyr,
    #2


  3. to hide this advert.

  4. 2002/12/20
    Ramona

    Ramona Geek Member Alumni

    Joined:
    2001/12/31
    Messages:
    7,481
    Likes Received:
    2
    Hi broni,

    Internat.exe (28 KB) is a Windows System File: C:\WINDOWS\System

    What Version of Netscape does your friend use? If it is 7.0/01 he can look in Preferences|Appearance|Languages/Content to see which Language Packs are installed. I don't know about the plugin that Netscape installed, but I will find out for you.

    If internat is in his Startup, this is probably how it will show up:

    internat (internat.exe)

    Language selection icon in system tray Makes it possible for you you to switch between installed keyboard languages and layouts. It’s your choice

    He can try removing it from his Startup and that should disable the icon in the system tray. If he wants the language function, then he will have to either make a shortcut for the Desktop or browse to the file in C:\WINDOWS when he wants to use the feature.

    Zephyr,
    I've been to the page twice, after clearing Cache and History, and I got no offers of a plugin! :rolleyes: Guess I don't rate, huh? broni states that Netscape requested the plugin, so I have to assume that IE did the same?

    Ramona :D
     
    Last edited: 2002/12/20
    Ramona,
    #3
  5. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Zephyr, Ramona
    I appreciate your help.
    We checked Startup under MSCONFIG...nothing unusual there. Besides, that "En" doesn't show up when Windows start, only when IE, or Netscape is brought up. He doesn't want to juggle anything there, since he is not Chinese. He just wants to get rid of it. Why he installed it in a first place...even he doesn't know. I checked also Preferences|Appearance|Languages/Content...nothing there.
    Checked Preferences>Navigator>Languages...nothing there
    What do you think, if I ask him to temporary rename that "internat.exe" file to "internat.old ", and see what happens? I don't think it'll have any impact on Windows.
    I may also ask him to go further back with restore.
    Broni
     
    Last edited: 2002/12/20
    broni,
    #4
  6. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    Hi Ramona, I suspect that at some time or the other you have tagged the box labeled "Never download language packs." I just did that/rebooted and the site no longer bugs me for it either. Now just watch, I'll need that back and won't know how to re-enable it. :D

    Cheers. :)
     
    Zephyr,
    #5
  7. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    Renaming might work. If it causes an error screen, then perhaps the details will show the source of the call. Worth a shot.
     
    Zephyr,
    #6
  8. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    One more thing.
    When i go to that site, it displays Chinese signs (I never installed any Chinese pack), and it doesn't ask me to install anything.
    Broni
     
    broni,
    #7
  9. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    btw, I just noticed in IE under Tools > Internet Options > Languages Button > I have only one listing (English-United States EN-US) so maybe take a look there and remove any listing not wanted.
     
    Zephyr,
    #8
  10. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    Broni, Apparently what you see on that site is the same as I do, Chinese script, and I don't have the download now either.
     
    Zephyr,
    #9
  11. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    My friend was suppose to leave, and be back just right after Christmas, so I'm not sure, if I'll get any feedback from him soon. I'll let you know, as soon, as he's back.
    Broni
     
    broni,
    #10
  12. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I went with him to that "Language" button through Control Panel>Internet Options>General....I'm pretty sure it's a very same setting. Nothing there.
    Broni
    P.S. Ramona knows, that I post here only GOOD ones...LOL
    Broni
     
    broni,
    #11
  13. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    OK, and just so you know, I did a full drive search and I don't have the file "Internat.exe. "

    I'll keep this project on the burner for a while and look forward to more from you later.

    Ciao and Happy holidays!
     
    Zephyr,
    #12
  14. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Zephyr
    I DO have "internat.exe" in Windows\System
    You don't, maybe that's why after installing that Chinese pack, you didn't get "En" in a taskbar. On the other hand, it looks like it's not MUST HAVE file.
    Broni
     
    broni,
    #13
  15. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    I am finding evidence that indicates that internat.exe may be a Trojan. Give me a moment and I'll follow through and post back.
     
    Zephyr,
    #14
  16. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    Last edited: 2002/12/20
    Zephyr,
    #15
  17. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    Last edited: 2002/12/20
    Zephyr,
    #16
  18. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Zephyr
    From what I can see it's a legit Microsoft file. It's described as "Keyboard Language Indicator Applet ".
    "Indicator "....looks like something sitting somewhere (taskbar) to show you, what language setup your keyboard is using.
    I have same "En" when I use Word (English/Polish setup).
    Broni
     
    broni,
    #17
  19. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    All i got is 404
    Broni
     
    broni,
    #18
  20. 2002/12/20
    Zephyr

    Zephyr Inactive

    Joined:
    2002/01/21
    Messages:
    1,519
    Likes Received:
    0
    Zephyr,
    #19
  21. 2002/12/20
    broni

    broni Moderator Malware Analyst Thread Starter

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OK
    Symantec says, that a trojan installs itself here:
    %windir%\Internat.exe
    and legit Microsoft file is here:
    %windir%\system\Internat.exe
    I have it under System, so it looks like OK.
    I'll ask my friend about that location, but I'm pretty sure he would tell me if he had a bizzare display at Windows startup: "Hello. I'm NetSnake." (Symantec). Also Symantec says, that trojan runs at startup, which is not my friend's case (nothing like that in MSCONFIG/STARTUP....he even sent me a copy of Startup tab, and looks CLEAN).
    Broni
     
    broni,
    #20
Page 1 of 2
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...