WinXP Unwanted process is running in the background

PaulProteus · 27 Jan 2007 at 10:32

Hello

For two weeks now (after I installed the latest version of FireFox) on my PC (WinXP SP2) my computer does not behave as it should be. From the start a process that says iexplore.exe kicks in (I can see it in the Task Manager) and I could not stop it. If I try to delete it then another one anteho~1.exe replaces it and still "eats" 65 Mb RAM. I have noticed that when I start Firefox an Internet Explorer windows will kick in and some add will appear (very annoying).

I have tried to clean up the start up, the msconfig and have looked in the Add/Remove programs for any suspicious program that may cause it but to no avail.

I have found the file anteho~1.exe in the Windows/Prefetch subdirectory, but deleting it from there did not help either.

Can anyone advise me how I could find the culprit and delete it properly as not to bother me again?

The other way is clean install but I am putting off this for the time begin given the number of programs I have to re-install afterwards.

Thank you in advance for helping me out!

Cheers,
Jordan

dagwoood · 27 Jan 2007 at 10:53

Hi PaulProteus. From the behaviour you're describing it sounds like you have some sort of malware on your system. Have you tried running any anti-spyware/adware programs? Do you have any anti-virus s/w installed?

If not, download, install and update the following:

AVG Anti-Spyware: http://www.filehippo.com/download_ewido/

Spybot S&D : http://www.filehippo.com/download_spybot_search_destroy/

Run them and see if they pick anything up. These two programs are normally pretty good at finding malware on your system. Run your anti-virus s/w and see if that finds anything.

Burnsy2023 · 27 Jan 2007 at 13:58

If you want to see what application is instantiating a process, download Process Explorer from Sysinternals (I'm recommending this a lot recently)

Burnsy

PaulProteus · 27 Jan 2007 at 16:53

Thanks a lot!
I have NOD32 running 24/7 and Zone Alarm that has the spy-ware.

I will however install the programs you suggest and see what happens.

I will post later the results.

PaulProteus · 27 Jan 2007 at 17:49

I have installed SpyBot S&D and discovered several hundreds malware. Fixed now.

Unfortanutely it did not identified the process or whatever causes it and let it on the system.

The Process Explorer however, in contrast with the Task Manager was able to delete the process. The problem is that I have to do it manually every time I start Windows.

Is there any way for the Process Explorer to do this automatically upon start?

Burnsy2023 · 27 Jan 2007 at 21:04

Process explorer is only meant as a tool to identify the process so that you can delete it manually.

You can delete processes through the registry, google to find out how.

Burnsy