Solved

Process abc123YImia.exe running -- virus or spyware?

Posted on 2007-03-28
3
169 Views
Last Modified: 2013-12-04
Today, I noticed a new icon in the system tray -- a red donut with a black hole.  When I hovered over it, a balloon popped up saying, "Your computer is infected."  Double-clicking or right-click had no effect.  So, I checked the process list and found an unknown entry, abc123YImia.exe.  I ended the process, but the red donut was still in the system tray.  I ran HiJack This, Ewido, AdAware, SpyBot S&D, and McAfee VirusScan, but found nothing except a couple of tracking cookies (which were deleted).  After rebooting, the process and donut icon are gone.  So, my question is...

Is this a new virus or adware program?  (Google searches found nothing.)  Is something hiding on my system?
0
Comment
Question by:photoartguy
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 3

Assisted Solution

by:TheTechGuysNYC
TheTechGuysNYC earned 60 total points
ID: 18813655
Yes, I would say so.

I've seen cases where companies have found a way to do what you described. In this way, the user clicks and says "oh hsit... I'm infected," downloads the program from the company, and presto, it is gone. In most cases, it is not malicious, just an easy way to make money off of unsuspecting PC users.

Get a mac :)
0
 
LVL 32

Accepted Solution

by:
r-k earned 65 total points
ID: 18813698
If you ran all those programs and they found nothing then probably your system is clean. To be complete about it, you may want to do a scan with RootkitRevealer:

  http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx

0
 

Author Comment

by:photoartguy
ID: 18879116
I'm not sure what it was, but I couldn't find a registry entry.  But, I did find the EXE file as well as 'abc123.pid' in the  C:\Documents and Settings\Administrator\Local Settings\Temp  directory  and deleted them.  It hasn't come back, yet -- so, hopefully that takes care of it.

Thanks for your help!
Dale

0

Featured Post

10 Questions to Ask when Buying Backup Software

Choosing the right backup solution for your organization can be a daunting task. To make the selection process easier, ask solution providers these 10 key questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question