Task Manager Process - Leonardo da vin

[wlfpackr]

I've got a former employee's Windows 2000 SP4 system here that whenever you look at Processes in the Task Manager there is a process called "Leonardo da vin". It ususes a little over a 1MB of memory and is also constantly using some CPU power.

Adware/Spyware scans are coming up clean now, however, I am having some problems with the anti-virus program which has me worried. I've never seen this process before and internet searches are coming up empty due to having to weed through all of the actual Leonardo Da Vinci sites.

Any ideas?

=================
There are 10 kinds of people in this world, those that understand binary and those that do not.

 

[DomenicoC]

Try using filemon and regmon to see what files and reg keys the process is using.

Both applications can be found at the link below:

http://www.sysinternals.com/

Good Luck,

Dom

 

[electronicsfreak]

Run this antivirus and see what it finds.

http://housecall.trendmicro.com/

 

[wlfpackr]

I physically pulled the hard drive out and set it up as a slave in my machine. Scanned and removed several infected files until the scans came up clean. I also scanned again for Spyware/Adware and removed any remnants I found.

When I installed it back into the original PC, it showed this process again after boot up.

Wasn't there a Da Vinci email program out at one time?












=================
There are 10 kinds of people in this world, those that understand binary and those that do not.

 

[electronicsfreak]

Download and run ewido below.

http://www.ewido.net/en/

After that download hijackthis from the link below. Extract to desktop or prefered folder. Then open the program and choose do a system scan and save a logfile. Post your logfile on here and I or someone else will go through it.

http://www.download.com/HijackThis/3000-8022_4-10379544.html?tag=lst-0-1

As for being in email I think there was something at one time on it not for sure though. I did a real quick search on google but didnt find anything although since it was a quick one I possibly could have overlooked something.