Process Information

I am going through my processes in the task manager using the site http://www.processlibrary.com/ but I have one they don't have any info on.

JOC0DB.EXE

The second O is a zero. That seems strange to me. Is it a malware or something? Thank you for any help.

 

Is there a path with it.

 

Forgive me but what do you mean "path"?

 

ok search for the file using windows search (enable search hidden files and folders and enable searching of system files.) and tell me where it finds it for example c:\windows\system32\JOC0DB.EXE

 

Well I ran the search you said and all I found was all the searches I had ran on the internet looking for info on this deal. I called abuddy that said "Why don't you kill the process and see if it has any effect." So I did and thats why I didn't find it. Then I thought "I'll reboot and see if it's there again." Well it's not... But there is now a process that is "GM306.EXE" And there is no info on this process either but all the others are thae same. I do a search on this and find that it's in "F:\Windows\temp" Also it has a what looks like a samll dog icon in front of it. This is a work PC and we are closing. I think Ill try to delete this little succa and see what I have tomarrow. Let me know if you think you know what it is. I'll post tomarrow if I find something else.

 

GRRR!!!! I just tried to delete the succa and it says "Access denied" Let me know what you suggest and have a good night.

 

This really looks like malware to me. If you killed the process, or rebooted, and a new process with random names comes up, definitaly points to malware(spyware/virus), IMHO.

Read and follow exacty: http://forums.majorgeeks.com/showthread.php?t=35407 <--- READ & RUN ME FIRST Before Asking for Support

Read and follow exactly: http://forums.majorgeeks.com/showthread.php?t=38752 <--- NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Then post here: http://forums.majorgeeks.com/forumdisplay.php?f=35 <--- Malware Removal

 

Do you have Trend Micro antivirus software? If you use Process Explorer and it's a sub-process of the Trend product ( NTRtScan ), then it's Trend's way of protecting itself from malware designed to shut down AV software - it's random for the same reason that virusus use random names, to avoid detection.

Kind of crappy of them not to tell anyone, but I understand why they do it. Causes people trying to clean up machines fits.

I work at a company that uses Trend, and on my first malware cleanup, it was killing me trying to figure out what this was. It's actually created by the main Trend program, so you can not only kill it but delete it on disk and it comes back. I'll see if I can get it added to Process Library, but the problem is that it's name is random - you can't search for it. "Little Doggy Icon with Random Name?"

 

Sorry, meant to add this to my first post:

http://rahulbagal.blogspot.com/2006/11/dog-icon-exe-with-random-name-in-temp.html