Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ehtray.exe pops up at startup and goes away?


  • Please log in to reply
13 replies to this topic

#1 Wizzlmang

Wizzlmang

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 16 June 2015 - 02:38 PM

To my knowledge this has never happened before, of if it did, it started very recently, so I looked into it, according to what I read it's "is a tray bar process for the Microsoft media center." and I can disable it from startup in msconfig

 

BUT, there is no tray icon for microsoft media center in my system tray, never has been. I ran msconfig and went to startup, but there's no media center process to stop from starting up, So what gives?

 



BC AdBot (Login to Remove)

 


#2 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 16 June 2015 - 05:01 PM

GNA85cT.jpg
Did another startup, all of these processes are running at startup before they all automatically close



#3 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 16 June 2015 - 05:53 PM

Went through my task scheduler, cant find anything that would launch these. I thought it might have been DispatchRecoveryTasks, but disabling that didn't keep them all from popping up



#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,895 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:28 PM

Posted 16 June 2015 - 07:46 PM

I would try running sfc /scannow command.  Is your install up-to-date on with critical updates?

 

http://www.bleepingcomputer.com/startups/ehtray.exe-1525.html , you can use Autoruns for Windows to see startup items...try the Logon tab first.

https://technet.microsoft.com/en-us/sysinternals/bb963902

 

You can run it online, no install necessary, see Run Autoruns Now on right upper side of webpage.

 

Louis



#5 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 16 June 2015 - 08:16 PM

ran sfc, "Windows Resource Protection did not find any integrity violations."

Went through msconfig again, found "Windows media center receiver service" and "windows media center scheduler service" checked in services, which I'm fairly sure are responsible for at least three of those programs.

1. are they safe to uncheck, and 2. How did they get checked in the first place?

Not long ago I ran Windows Repair (All in One) from tweaking.com trying to fix some other issues I was having, could that have changed those settings?



#6 hamluis

hamluis

    Moderator


  • Moderator
  • 55,895 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:28 PM

Posted 17 June 2015 - 08:17 AM

Msconfig is a diagnostic tool...it is not intended to manage startups.  The application I suggested is a startup manager and a very useful tool.

 

I have no idea whether the Windows Repair tool could have contributed to your issues.

 

Louis



#7 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 17 June 2015 - 10:30 PM

Ran services.msc, both of them had been set to automatic startup somehow rather than manual.

Ran Autoruns, not sure what may have changed their settings


Edited by Wizzlmang, 17 June 2015 - 10:30 PM.


#8 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 17 June 2015 - 10:43 PM

remote desktop services was also set to automatic and running, is that normal?


Edited by Wizzlmang, 17 June 2015 - 11:10 PM.


#9 hamluis

hamluis

    Moderator


  • Moderator
  • 55,895 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:28 PM

Posted 18 June 2015 - 08:23 AM

Black Viper Win 7 Service Listing

 

Restore Win 7 Default Services & Settings

 

Louis



#10 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 18 June 2015 - 02:37 PM

Im a little more concerned as to how these settings were changed in the first place than how to change them back. Particularly remote desktop services.

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 55,895 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:28 PM

Posted 18 June 2015 - 04:23 PM

Well...I don't have any idea...but the usual method services are changed is by the actions of the user.

 

Autoruns...doesn't fool with services...unless the user uses Autoruns to disable or delete such.

 

If you think that malware is the source of the changes...I suggest you initiate a new topic in the Am I Infected Forum, detailing your suspicions and reasons.

 

Louis



#12 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 18 June 2015 - 04:43 PM

Just a week ago I made a thread there for completely different reasons and found no signs of any sort of infection



#13 hamluis

hamluis

    Moderator


  • Moderator
  • 55,895 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:28 PM

Posted 18 June 2015 - 04:45 PM

Was the problem posted here...existing at that time?

 

Louis



#14 Wizzlmang

Wizzlmang
  • Topic Starter

  • Members
  • 105 posts
  • OFFLINE
  •  
  • Local time:01:28 PM

Posted 18 June 2015 - 04:48 PM

The Windows media center services weren't set to automatic at the time, no. Not sure how long remote desktop services was set to automatic and running since I only discovered it while investigating the first issue.

plus, so far, they haven't turned back on, so I'm not sure it's a malware issue. I only wan to investigate that if I can't find any other cause


Edited by Wizzlmang, 18 June 2015 - 04:49 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users