Strange Program

[mot98]

Hi All,

One of my users started complaining about his system running really slowly. I have run an updated virus scan, and run SpyBot to remove any viruses and spywares on his system.

There is a strange program still running on his system though. When I "CTRL,ALT,DEL" I see the program called "n", when I try and close it, it attempts to shutdown windows.

Has anyone seen this before? I can't find out what it is.

Thanks...


mot98

"I'd rather be dead and cool..then alive and uncool."
---Harley Davidson & The Marlboro Man

 

[mattjurado]

What viruses were found? Boot to safe mode, run your virus scan and spybot again.

Matt J.

 

[mot98]

No viruses found, and SpyBot sucessfully removed all the spyware programs.

But this program is still running in the background!!

mot98

"I'd rather be dead and cool..then alive and uncool."
---Harley Davidson & The Marlboro Man

 

[mattjurado]

Okay, so try what I suggested, let me know if the problem persists...

Also, check MSCONFIG, startup tab.

Matt J.

 

[Rached]

try these 2 methods:
1- get PrcView (freeware) from

http://www.xmlsp.com/pview/prcview.htm

and run it.. right click on the "n" program you mentioned and choose "startup info" to know where and what program is that, or "modules" for system details, then you can kill it and delete it from your HD.. good luck.

2- In case it attempts to shutdown windows and can't stop it.. get Startup Control Panel (freeware) from

http://www.mlin.net/StartupCPL.shtml

and use it to disable the program on startup. Not done, also get StartupMonitor from the same site, that's in case the same program "n" tries to register itself for startup again, then you can prevent it on reboot and delete it from your system.
Good Luck.
good luck

 

[mot98]

This is very strange. I ran the PrcView program, and it doesn't show up in the list of programs that are running.

But if I "CTRL,ALT,DEL" through windows, it shows that it is?



mot98

"I'd rather be dead and cool..then alive and uncool."
---Harley Davidson & The Marlboro Man

 

[diogenes10]

Hi mot98
I was perusing spybot and I see
"TOOLS" containing a "process list" and "system startup"
It looks like each of those have location info.
Maybe you could look at those, figure out where n is, reboot in dos, rename it, reboot and figure out what the next step is.

 

[rockerfellerz]

"End It All" from

http://www.pcmag.com

(free) shows all processes running on your computer and gives the option to KILL any you would like. It shows path info as well, so you can see where it is starting from.

If you're going through Hell...keep going... (Winston Churchill)
RocKeRFelLerZ

 

[Naanu]

Hi,

This should surely be an issue with a virus or a trojan. The following should resolve the issue:

1. Go to Start/Run/MsCONFIG/Startup, remove all unnecessary items, apply, ok.
2. Go to

http://sarc.com/

and click on "Free Online Virus and Security Check" and finish the virus scan (Very reliable).
3. Restart the computer in MS-DOS mode, at the prompt type:

FDISK /MBR and then enter.

4. Restart the computer to normal mode.

Regards,

Karthik Makam
Bangalore
Indian