Solved Mysterious new service!

[Ich]

Good day people,

On checking my services recently I came across this item "COSXBEMI". Has anyone come across this before? For safety's sake I have disabled it but if there is anyone out there who is familiar with this item please get back to me.

 

[Night Hawk]

A quick Bing search reveals this thread is the only place where that name appears! I would run a few security sweeps just to make sure you didn't get hit with something if you didn't just add some new program on lately.

 

[Duzzy]

Definitely run a few security sweeps but also under the Services Window you can check the properties of it and check the "Path to executable" which may help determine if it's part of an application that you can investigate further. If it's svchost.exe I would have my concerns.

 

[Night Hawk]

Usually you can tell if it has "SYSTEM" or user account name seen next to it in the processes tab when going down the list there. I think I'll try a few other search engines as well to see if I simply end up right back here again since this is an odd one!

 

[brianzion]

bleepingcomputer.com does not see it as a start up program http://goo.gl/cDpd

download sysinternals autoruns and see if it pops up in services http://goo.gl/jDAcp

 

[Golden]

Hi,

What do you use your computer for? Any engineering or mathematical work?

Regards,
Golden

 

[Ich]

Definitely run a few security sweeps but also under the Services Window you can check the properties of it and check the "Path to executable" which may help determine if it's part of an application that you can investigate further. If it's svchost.exe I would have my concerns.

Hi Duzzy the path in question is this C:\Users\*******~1\AppData\Local\Temp\COSXBEMI.exe. I will give the folder in question a thorough check. Incidentally I checked the sys with MWB, Hitman Pro, Kasp TDSSKiller Avira etc none of them highlighted it as malware. After I have dug it up I will get back to you to close this. Thanks for your help troops. Ich

 

[Ich]

Hi,

What do you use your computer for? Any engineering or mathematical work?

Regards,
Golden

Funnily enough it has been used in the past for trigonometric functions. Rgs Ich

 

[Golden]

Hi,

What do you use your computer for? Any engineering or mathematical work?

Regards,
Golden

Funnily enough it has been used in the past for trigonometric functions. Rgs Ich

Hi,

OK, this is a complete stab in the dark, but I'm wondering whether COSXBEMI is actually COS(x) BEM. COS being cosine and BEM being boundary element modelling. Is COSXBEMI.exe an executable for running this type of modelling?

Regards,
Golden

 

[Night Hawk]

Good point! Another variation leaves both the "X" and "B" out of the equation entirely for the search results found. Try "COSEMI" as the end result. Or Cosemi Technologies for example for Optical components, light sensitive devices, etc. That was just one of several corporations with the same name soelling.

That was found when expanding to international as well as just about every other search engine where must did just what I suspected pointed back to the thread here.

 

[Ich]

Troops, System Internals Suite, Rootkit detector. I checked it a couple of times after deletion /restart & it morphed its title randomly. I don't think this app likes to play with W7! Cheers. Ich

 

[Duzzy]

I find it odd that a service would be ran from the temp folder because if you cleaned your temp files the service exe would no longer be found and the service would fail to start. There is a slight chance it was used for an installation and was meant to be removed if the install was sucessful.

I should have asked if it had a description under the properties as well.

Does the computer still have any software installed releating to the trigonometric functions or any other engineering or mathematical functions?

 

[Night Hawk]

The title change for the exact same process wouldn't be from any valid software installation but have the higher probably of a malware. Could be some fake ware that didn't get on quite fully or a trojan dropper.

Generally when looking up a specific name for a known process the search results will indicate at least one program whether a product info page or someone is having a problem with a program. On the other hand all search engines tried simply ending up back on this thread seems to suggest something else!

 

[Ich]

The title change for the exact same process wouldn't be from any valid software installation but have the higher probably of a malware. Could be some fake ware that didn't get on quite fully or a trojan dropper.

Generally when looking up a specific name for a known process the search results will indicate at least one program whether a product info page or someone is having a problem with a program. On the other hand all search engines tried simply ending up back on this thread seems to suggest something else!

Night Hawk,

Very valid point, I'll use one of my image archives to be on the safe side.


Rgs.

Ich

 

[Night Hawk]

This is one good reason for having a full system image backup kept safe somewhere just for these types of occasions! At least you have something to fall back on.

You titled this thread correctly for sure. Once you have the image restored look over things and see if anything is missing if you did happen to add something on since the image was first created. If you had downloaded a free utility or system tweaker of some type recently it may have included a hidden bug of some type. I've seen that enough times.

Then you'll know that you are better off without it!