Windows XP Home SP3. Avast! 4.8 Home build 4.8.1356. SAS 4.26.0.1004. Zone Alarm Free firewall.
During start-up system process, 5894a498-c48f-41ce-a891-b776c4c1212a.exe, runs and consumes up to 95% of CPU memory. Search engines have not idetified this process though I suspect it may an Avast! routine - most likely the rootkit scan.
Could anyone please confirm what this process really is. Virus and spyware scans indicate the system is clean.
It most certainly has nothing to do with avast and as Tarq57 said, it looks dodgy.
If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).
MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
Check the Task Manager and see if this is a running process, if so End Task.
It might be worth checking the startup items in MSConfig (windows key+R and type msconfig), startup tab and see if there is an entry there for it if so disable it.
Very good. Surprising the Google search didn’t turn it up, unless the file name is designed to morph randomly. (DrWeb’s cureit did that, to prevent malware ID-ing and disabling it.)
Had I not uninstalled SAS a couple of months ago, I may have found it (or similar) on my own computer. (Yes, I did search it.)
Now the question: Would you be so kind as to provide the path (and purpose, if known,) of this file?
would be interesting to know what that is…hope you get some feedback on their forums…
ps: I think you should isolate those files until you learn more about them…and may be see if new ones are generated, isolating them being just a measure of safety for the rest of your system, just in case. You can do that manually if you have a HIPS on board.
Now that you mention that I’m pretty sure I’ve had this with another security software long ago…but I can’t remember which one, also running an executable with different name each time to avoid termination attacks…may be it was AVG antispy, not sure…
Unless something on the machine is targetting SuperAntispyware and preventing it from running, there is no need to run RUNSAS.EXE. Of course a munged install could possibly create the same effect.
You are right. I experienced this once with the DrWebCureIt program about two weeks ago. After a customary program update before use, noticed the usual executable was replaced with a strange alphanumeric. It did perform without any untoward incident, though.
Remembered reading advice here in the forums to manually rename the .exe file but, in this case, it appeared to have changed clothes on its own.