Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

rch.exe & xer.exe?


  • Please log in to reply
4 replies to this topic

#1 computerconfuse

computerconfuse

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:51 AM

Posted 23 June 2009 - 04:17 PM

Hi, pmon.exe (process monitor) lists these processes as image names.

rch.exe
xer.exe
ex
.exe

No scanner detects them as malware and a search of the computer does not find them.

Could pmon.exe truncate the process names? I copied the pmon output and attached it. There is also another copy that shows xer.exe very active (pmoncopy2).

Any suggestions on what these are? It is usually fairly easy to confirm they are valid processes, but a search suggests they could be trojans.

Thanks.

Attached Files



BC AdBot (Login to Remove)

 


m

#2 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:12:51 PM

Posted 23 June 2009 - 04:33 PM

rch.exe is a worm:
http://www.prevx.com/filenames/24692300870...X1/RCH.EXE.html
xer.exe is a trojan according Dr Web
You didn't mention what scan tools you used
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 computerconfuse

computerconfuse
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:51 AM

Posted 23 June 2009 - 04:48 PM

Thanks garmomma, thanks for the reply. I realize rch.exe could be part of RemoConChubo and exr.exe could be a part of Trojan.PWS.LDPinch too.

But I've scanned and scanned with Malwarebytes, Norton 360, AVG free, AdWare, SUPERAntiSpyware Free Edition and ConboFix. I've been installing and uninstalling scanners all weekend and since a search of the computer does not find them, I can only conclude these are probably valid files with their names truncated in pmon.exe, but can't be sure. But my laptop, with a fresh install of XP Media Edition does not list them with pmon.exe. At this point I guess a better understanding of pmon.exe would do, but I can't confirm it truncates process names.

#4 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:12:51 PM

Posted 23 June 2009 - 05:29 PM

Try Dr. Web CureIt
http://www.freedrweb.com/cureit/
And
Smitfraud Fix
http://www.bleepingcomputer.com/virus-remo...se-smitfraudfix
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#5 computerconfuse

computerconfuse
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:51 AM

Posted 23 June 2009 - 06:03 PM

Try Dr. Web CureIt
http://www.freedrweb.com/cureit/
And
Smitfraud Fix
http://www.bleepingcomputer.com/virus-remo...se-smitfraudfix


Thanks for the suggestions. Turns it they are all part of the Microsoft Desktop Search. It wasn't on my laptop yet and pmon did not list those processes. After installing Desktop Search, there they were. Pmon must truncate long file names because these were probably microsoftseaRCH.exe and windowsindeXER.com.

Thanks, and I probably have the cleanest computer on the West coast now :thumbsup: Sure runs smooth.

Edited by computerconfuse, 23 June 2009 - 06:59 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users