Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Mirage Youcam scares me. :()


  • Please log in to reply
15 replies to this topic

#1 ComputerNeophyte

ComputerNeophyte

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:17 PM

Posted 04 October 2013 - 06:59 AM

Hello,

 

I don't really have a tech problem, I just want to sound off.  I don't trust that Mirage Youcam exe. file which is always running, as I noticed on my task manager.  I did a little research and am convinced that it might in effect be a virus.  I found this at the Cyberlink Community Forum, in response to the question, "What is it, and what exactly does it do?" [The Mirage Youcam exe.]  And here was the response By Cyberlink Customer Service:

 

 

 

YCMMirage.exe is a background process which will monitor if any AP is using our virtual driver.
Once it is detected, YCMMirage will launch YouCam, and then YouCam will provide and share the webcam video to client APs.
If you still need more info, feel free to contact with us.
Thanks!

Best Regards,
CyberLink Customer Service

 

I should add, I have no way of knowing if this response really was by customer service, but every indication says it is.

 

Now, as an average lay person reading that response, I can't help but wonder just what that means.  You decide for yourself.  But for me, there's just no darn good reason for that cam to be doing anything unless I want it to.  There's just no argument as far as I'm concerned.  I conjecture that what it might be doing is detecting movement, and then in response to that signal, sends a little "come and see" message to some unnamed peeping tom that happens to be on their "virtual driver."  I don't know just how possible that is, but as I've come to learn, practically anything is possible when it comes to computers. And since the cam does in fact have movement detecting capability, it certainly is within the realm of possibility. 

 

So now my Youcam lens has a piece of tape over it.  LOL  I got sick of going into task manager and shutting it down.  Not only that, I still didn't trust. it.  Call me paranoid.  I tried to delete the little exe. bugger but it has dug in its heels.  I suppose I should just take my medicine and relax. ;)  But that's getting harder to do, with cameras everywhere ya go, including the bathroom!  (Mpls.  public library)  Helloooooooo  big brother!

 

Thanks for listening. :)

 

Neophyte 



BC AdBot (Login to Remove)

 


#2 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:11:17 PM

Posted 04 October 2013 - 08:21 AM

AP = Active Process??

 

Have you tried to rename the exe instead of deleting it?

 

Or you could just uninstall the Cyberlink Suite altogether. They've nothing special you can't get from other apps.



#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 04 October 2013 - 08:29 AM

...I don't trust that Mirage Youcam exe. file which is always running, as I noticed on my task manager.  I did a little research and am convinced that it might in effect be a virus.


Anytime you come across a suspicious file or you want a second opinion, submit it to one of the following online services that analyzes suspicious files:--In the "File to Scan" (Upload or Submit) box, browse to the location of the suspicious file(s) and submit (upload) it for scanning/analysis. If you get a message saying "File has already been analyzed", click Reanalyze or Scan again.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 ComputerNeophyte

ComputerNeophyte
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:17 PM

Posted 04 October 2013 - 08:37 AM

AP = Active Process??

 

Have you tried to rename the exe instead of deleting it?

 

Or you could just uninstall the Cyberlink Suite altogether. They've nothing special you can't get from other apps.

 

AP = Active Process??

 

Have you tried to rename the exe instead of deleting it?

 

Or you could just uninstall the Cyberlink Suite altogether. They've nothing special you can't get from other apps.

 

Hello,

 

I can't open the file.  I suppose a more knowledgeable person could do it, but I'm taking my first computing baby-steps.  I can see it running on task manager, and from there I go to file location, but, like I said, I can't open it.  I'm thinking I need a special uninstall for this thing.  And I'd rather not uninstall the whole thing if I can avoid it.  I rather like it, except for that one wart.  I'll keep working on it.

 

Neophyte


 

...I don't trust that Mirage Youcam exe. file which is always running, as I noticed on my task manager.  I did a little research and am convinced that it might in effect be a virus.


Anytime you come across a suspicious file or you want a second opinion, submit it to one of the following online services that analyzes suspicious files: --In the "File to Scan" (Upload or Submit) box, browse to the location of the suspicious file(s) and submit (upload) it for scanning/analysis. If you get a message saying "File has already been analyzed", click Reanalyze or Scan again.

 

 

Hello,

 

Thanks, I look into your suggestions.

 

Neophyte



#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 04 October 2013 - 08:40 AM

Let us know what you find out.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 Netghost56

Netghost56

  • Members
  • 973 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Texas
  • Local time:11:17 PM

Posted 04 October 2013 - 09:19 AM

How to Remove Cyberlink Youcam



#7 ComputerNeophyte

ComputerNeophyte
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:17 PM

Posted 04 October 2013 - 09:26 AM

I found this on file.net:

 

"Important: Some malware camouflages itself as YCMMirage.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the YCMMirage.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security..."

 

...and so I searched that folder and found no sign of it.  Presently  then, it seems that particular exe. that's always running on my task manager is "legit." I put that in quotes, because I still don't trust it. I'm keeping my lens covered.  I'm aware of the fact that hackers can turn the cam on remotely.  And since my cam is always "active" with that exe. file I'm going to assume the worst..  It's kinda like talking on an old cordless phone,  chances are someone is listening.  I know, because when I was a teenager I used to do it.  (Lord, forgive me:))

 

Neophyte



#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 04 October 2013 - 09:30 AM

Yes, determining whether a file is malware or a legitimate process usually depends on the location (path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file. However, it then places itself in a different location (folder) than where the legitimate file resides and runs from there.

Security Task Manager is a 30-day trial. There are plenty of free alternatives so you don't need it.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 ComputerNeophyte

ComputerNeophyte
  • Topic Starter

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Local time:10:17 PM

Posted 04 October 2013 - 10:34 AM

Yes, determining whether a file is malware or a legitimate process usually depends on the location (path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file. However, it then places itself in a different location (folder) than where the legitimate file resides and runs from there.

Security Task Manager is a 30-day trial. There are plenty of free alternatives so you don't need it.

 

 

 

I tried the Autoruns as you suggested.  That program rocks.  I went into "scheduled tasks" and disabled that exe. file, restarted, and ta da! it's gone.  I then went back and tried my cam, and everything works as it should, including recording and special effects, etc.   There was no reason for my computer to be notifying any "virtual drive" about the status of my cam; that's just too suspicious for a paranoid fool like me;)  There may be certain situations that call for that exe file, but I'm not one of them. 

 

That Autoruns is one heck of a tool.  I wish I'd had it during my hijack session with CONDUIT and SWEETPACKS, I would have liked to examine their stealth tactics, if any.  And I'm wondering if a rootkit could outmaneuver AutoRuns.  Rootkits...so evil...yet, so interesting :)  I must get this knowledge. :)

 

Neophyte

 

Oh, and I forgot to thank you...so, thanks.:)


Edited by ComputerNeophyte, 04 October 2013 - 10:36 AM.


#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 04 October 2013 - 04:33 PM

You're welcome.

If you're going to keep Autoruns (which I recommend), be careful using it and be sure to read:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 nolacs22

nolacs22

  • Members
  • 41 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:17 AM

Posted 27 April 2014 - 07:10 PM

Hello,

 

I don't really have a tech problem, I just want to sound off.  I don't trust that Mirage Youcam exe. file which is always running, as I noticed on my task manager.  I did a little research and am convinced that it might in effect be a virus.  I found this at the Cyberlink Community Forum, in response to the question, "What is it, and what exactly does it do?" [The Mirage Youcam exe.]  And here was the response By Cyberlink Customer Service:

 

 

 

YCMMirage.exe is a background process which will monitor if any AP is using our virtual driver.
Once it is detected, YCMMirage will launch YouCam, and then YouCam will provide and share the webcam video to client APs.
If you still need more info, feel free to contact with us.
Thanks!

Best Regards,
CyberLink Customer Service

 

I should add, I have no way of knowing if this response really was by customer service, but every indication says it is.

 

Now, as an average lay person reading that response, I can't help but wonder just what that means.  You decide for yourself.  But for me, there's just no darn good reason for that cam to be doing anything unless I want it to.  There's just no argument as far as I'm concerned.  I conjecture that what it might be doing is detecting movement, and then in response to that signal, sends a little "come and see" message to some unnamed peeping tom that happens to be on their "virtual driver."  I don't know just how possible that is, but as I've come to learn, practically anything is possible when it comes to computers. And since the cam does in fact have movement detecting capability, it certainly is within the realm of possibility. 

 

So now my Youcam lens has a piece of tape over it.  LOL  I got sick of going into task manager and shutting it down.  Not only that, I still didn't trust. it.  Call me paranoid.  I tried to delete the little exe. bugger but it has dug in its heels.  I suppose I should just take my medicine and relax. ;)  But that's getting harder to do, with cameras everywhere ya go, including the bathroom!  (Mpls.  public library)  Helloooooooo  big brother!

 

Thanks for listening. :)

 

Neophyte 

This program comes with cyberlink, as has already been said,  and some of the crapware that comes bundled WITH the computer. If you did NOT install it, and it did NOT come bundled with  say your HP,dell,Sony computer then uninstall it if you don't want it, but it is safe as far as i know, I have it as a bundled package with my HP pavilion g-6 laptop for 2 years now, but you are right about web cams some college kid was arrested for hacking in to female students computers, demanding sexual things from them or he would continue his harassment of them. A real perv he is. Some how he was remotely viewing through their web cams.


Edited by nolacs22, 27 April 2014 - 08:10 PM.


#12 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 27 April 2014 - 07:37 PM

ComputerNeophyte resolved the issue using Autoruns.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#13 etoolz65

etoolz65

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:17 PM

Posted 11 February 2015 - 08:33 PM

I know this is an old post, but youcam can be uninstalled by itself and the other features left, and the cam can be disabled in your device properties, etc also.

 

I have always uninstalled "just" the youcam mirage feature as it can be accessed at times by the company and their "affiliates" to monitor usage, etc.  They also access the microphone features at times when the camera might be in use and youcam mirage activates.

 

I just thought I would say that as I use the other features of this app, but don't trust youcam mirage to always be respectable of my privacy concerns.

 

 



#14 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,271 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:17 AM

Posted 11 February 2015 - 09:19 PM

Mirage Youcam is related to CyberLink which is pre-installed on OEM computers like HP and Lenovo. Several CyberLink apps are installed as a scheduled task. You can open Windows Task Scheduler and disable or remove it from there. AutoRuns and CCleaner will also allow you to list & manage (disable/remove) scheduled tasks.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#15 Thatguywiththefire

Thatguywiththefire

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:05:17 AM

Posted 13 September 2015 - 10:22 AM

I've been trying to figure out if i should get rid of youcam, and I searched it across the whole computer system. Several files came up titled: "Lenovo YouCam", but when I searched for it on the lenovo website, I got no results. So now I'm going through my entire computer deleting the f**k out of it. I'll put up a post when i find out if that was a good idea or not. :)






3 user(s) are reading this topic

0 members, 3 guests, 0 anonymous users