Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

strange unremovable exe file in "Local Settings/temp


  • Please log in to reply
1 reply to this topic

#1 rsimcox

rsimcox

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:48 AM

Posted 02 September 2012 - 12:47 AM

This may be nothing but I recently got hit by one of those fake Security software scams... no idea what happened but it was the worst hit I ever had. With anti malware, avira, sas, rogue killer, maybe something else, and a bunch of safe modes I finally cleaned it out. One thing seems to still be here or perhaps it was installed by one of the spyware cleaners i used like Rogue Killer. In c-documents and setting/my name/local settings/temp there is now a persistent .exe file that cannot be eliminated nor is it found by any virus/spyware checker as bad. Right now it's called WwYNcbL.exe and shows up in system configuration startup also. If I delete it it instantly reappears as a new named .exe file and in system config. Looking at properties it's description is "de'mettaient re'tractant rationalise'" its internal name is "cimenter" its version is 9.5.0.5, and it's copyright is "pre'serv bacterio 1999". Looks french so i thought maybe it's Rogue Killer's way of preserving itself but I thought I'd ask here where the experts know these things. Thanks.

Randy

Edited by rsimcox, 02 September 2012 - 01:24 AM.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,272 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:05:48 AM

Posted 02 September 2012 - 07:55 AM

If it's a temporary file...I'd try using Temporary File Cleaner .

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users