Vista - My system is haunted!

This is not a joke! I started to hear sporadically some music and voice on my
PC, like if I was listening to a radio station; I have no such application on
my system. When this is happening, only ordinary applications (like Outlook
or Word) are running. Stopping all the applications does not make any
difference. When it happens, I have noticed that a process called 17134.exe
is running and is consuming quite a lot of memory space. At start-up of my
system, the original memory space used by that process is around 2000K but
when I start hearing the sounds, the amount of memory used is around 58000K
and varying; it uses between 10 to 30% of CPU. If I stop the process, the
situation goes back to normal, no more sounds. The description of the process
is “Unload PerfMon Counters�. I looked for a file named 17134.exe on my disk
but there is no such file. When I start my system, I have a window with an
error message: 17134.exe application error, click OK to terminate the
program. The process is recreated automatically. I make sure that my
anti-virus is always up-to-date and I ran a full scan on my system. Nothing
unusual was detected. I would like to know if that process is legitimate, and
why it behaves like that. Any thoughts?

The file "17134.exe" is most certainly not legitimate, and is a sure
sign that whatever anti-virus application you're using is not adequate
protection. Not that the file is necessarily a virus, per se, but it is
certainly not a welcome addition to your system. What other
anti-malware measures have you taken? Remember, there are several types
of malware, and many of them are not detected by purely anti-virus
applications.

As you're getting an error message that clearly indicates that the
program is trying to initiate each time you start Windows, the first
thing you should do is use MSConfig to determine how the file program is
starting, and where it's located.

This Knowledge Base Article refers to WinXP, but the same
principles apply in Vista:

How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/default...b;EN-US;310560

Remember, Msconfig was designed to be a troubleshooting tool, not a
"startup configurer." Use MSConfig to determine the location of the
command that is attempting to start the program, and remove it. To
cease the selective startup notifications, either return your settings
to the way they were, or permanently remove the undesirable programs
from your startup configuration.

Additionally, in Vista, Windows Defender can be used to
monitor/control Startup programs. To use Windows Defender, click the
Orb > Control Panel > Windows Defender > Tools > Software Explorer and
select the "Startup Programs" category.

Additionally, AutoRuns from Sysinternals is a bit more complicated,
but it'll provide the same (and much more) information and capabilities:

http://www.microsoft.com/technet/sys.../Autoruns.mspx


I'd also have to conclude that the reason you've failed, so far, to
find the file is that you've unwisely left Windows Explorer's default
settings, and haven't re-enabled the capabilities to see and search for
hidden or "system" files.

Hey. .its an echo!
Must be reverberating from his empty head
peter

--
If you find a posting or message from me offensive,inappropriate
or disruptive,please ignore it.
If you dont know how to ignore a posting complain
to me and I will be only too happy to demonstrate :-)

"avgwarhawk" <guest@xxxxxx-email.com> wrote in message
news:e76274f08ced247148f17db82f260df4@xxxxxx-gateway.com...

BAL007 wrote:
As the others have told you, your computer is probably infected. Scanning
with an antivirus (which one?) isn't adequate. Go through these general
malware removal steps systematically -
http://www.elephantboycomputers.com/...moving_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

If you can't do the work yourself (and there is no shame in admitting this
isn't your cup of tea), take the machine to a professional computer repair
shop (not your local equivalent of BigComputerStore/GeekSquad). Please be
aware that not all local shops are skilled at removing malware and even if
they are, your computer may be so infested that Windows will need to be
clean-installed. If possible, have all your data backed up before you take
the machine into a shop.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
http://www.elephantboycomputers.com/#FAQ