I have a strange process

drazenn · 31 Dec 2009

I would suggest deleting withou thinking about it twice.
I would be dumb(and every body else too) if you even think about believing that process with name such abcdbcdefgabc.exe could be legit process.
Try to remember did you visit one of the "black" sites(maybe unintentionally) with keygens,cracked apps,etc.,cause I remember that I get process named abcd.exe once,from that kind of site.

TaraSWinTeam · 31 Dec 2009

Make sure you are keeping up security to prevent malware: Security checklist for Windows 7.

Cheers,
Tara
Windows Outreach Team

McSeven · 31 Dec 2009

Jacee said:

I would suggest running Malwarebytes' Anti-Malware, just to make sure you got all the malware off your machine.
Chances are, this file didn't come by itself.

download Malwarebytes' Anti-Malware to your desktop
|MG| Malwarebytes Anti-Malware 1.43 Download
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.

Ok, I ran it and it found the following ...

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChange s (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

But I don't know what it really means.

Dinesh · 31 Dec 2009

McSeven said:

Jacee said:

I would suggest running Malwarebytes' Anti-Malware, just to make sure you got all the malware off your machine.
Chances are, this file didn't come by itself.

download Malwarebytes' Anti-Malware to your desktop
|MG| Malwarebytes Anti-Malware 1.43 Download
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.

Ok, I ran it and it found the following ...

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChange s (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

But I don't know what it really means.

Your system is clean

McSeven · 31 Dec 2009

Ok, I guess all is well for now, so I thank everyone's help!

jav · 31 Dec 2009

McSeven said:

Ok, I ran it and it found the following ...

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChange s (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

But I don't know what it really means.

Don't worry, false Positive.
more info: (Hijack.DisplayProperties) - Malwarebytes Forum

Malwarebytes Staff said:

Hello

It is not an actual infection, but instead a non-default setting that is often altered by actual infections, however, in Windows Vista and Windows 7 Microsoft changed the default setting to the opposite of what it was in XP so on Vista and Windows 7 systems (such as your own) this detection should be ignored .

If you need anything else please post.

Thanks

McSeven From your log I can see that it was quarantined and deleted. You should fix it as it's Windows native component.
And then run quick scan and when it finds it tell it to ignore it.

How to fix it: (Hijack.DisplayProperties) - Malwarebytes Forum

Jacee · 31 Dec 2009

It looks to be clean ... set a fresh restore point, so you don't accidently go back to the bad one.

System Restore Point Shortcut