Mystery Process ZB.EXE

[lifegard2]

I have a mystery process that has shown up in my c:\winnt\system32 folder: zb.exe. I can't seem to locate anything on this online. Anyone got any ideas? It was using over 100MB of RAM today before I killed it.

 

[karmic]

what antivirus are you using? Is it up to date?
If it's using that much ram, it could very well be a trojan or a dropper.

Try downloading a trojan scanner like swat-it or something. make sure you update the signitures and do a full system scan.
You can also run adaware or spybot just in case it's spyware.

check here in the registry to see if it's loading this way:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and
HKEY_CURRENT_USER_\Software\Microsoft\Windows\CurrentVersion\Run
Also check the list of services that are loading.

~ The day I think I know it all, i'm changing careers ~

 

[lifegard2]

Thanks will do. We're running Symantec AV Corp Edition. I learned it had not updated in two weeks. I updated and scanned that particular file, but nothing found. I'll run a system scan tonight (actually meant to do it last night, oops).

What's swat-it? Never heard of it.

That's my thought, with 100MB of RAM being used, it smells fishy. Thanks for your insight!!

 

[karmic]

http://swatit.org/download.html

It's just a trojan virus scanner. There's many out there. Remember, alot of the new trojan virii have the capability to stealth themselves from windows. If found, you have to delete them from dos.

I would definitely suggest manually downloading the virus definitions from symantecs website and installing. If your scanner is down or taken down by a virus, this will refresh norton.

~ The day I think I know it all, i'm changing careers ~