sergey_z
07-04-2003, 04:11 PM
I have a file on my system that I cannot get rid of. It’s name is ecex.exe. I suspected that it might be some kind of a virus but I cannot find any information about it on the web.
It runs as a process in the background. It does not show up in the Windows task manager on Ctrl+Alt+Delete. I have to run EndItAll to see the process. The file is located on my station at C:\WINDOWS\All Users\Start Menu\Programs\StartUp
EndItAll gives me chance to kill the process and after that I can delete the file. However, when I start Notepad or Internet Explorer the file is back in C:\WINDOWS\All Users\Start Menu\Programs\StartUp and as a process. When the file starts it creates a temporary file in the TEMP folder. The name of the temp file has pattern vbaXXXX.tmp, where XXXX is a combination of digits and letters.
It looks like my station hangs up regularly when this process is running. When I kill the process the system runs much smoother.
I did the registry search and total file content search on my computer. It did not reveal any traces of records or files containing "ecex" in them.
I am posting the files on the web at http://serg.us/ecex/ecex.zip
Do not run executable file on your station in case it’s a virus.
Another weird thing is that I was not able to post file ecex.exe on the Internet. I uploaded it to my site and next moment it disappears from there. I did it for 10 times, the same result. Really weird...
Please advice what kind of file/process it might be and what should I do to try to remove it from my system.
Thank you.
Sergey
It runs as a process in the background. It does not show up in the Windows task manager on Ctrl+Alt+Delete. I have to run EndItAll to see the process. The file is located on my station at C:\WINDOWS\All Users\Start Menu\Programs\StartUp
EndItAll gives me chance to kill the process and after that I can delete the file. However, when I start Notepad or Internet Explorer the file is back in C:\WINDOWS\All Users\Start Menu\Programs\StartUp and as a process. When the file starts it creates a temporary file in the TEMP folder. The name of the temp file has pattern vbaXXXX.tmp, where XXXX is a combination of digits and letters.
It looks like my station hangs up regularly when this process is running. When I kill the process the system runs much smoother.
I did the registry search and total file content search on my computer. It did not reveal any traces of records or files containing "ecex" in them.
I am posting the files on the web at http://serg.us/ecex/ecex.zip
Do not run executable file on your station in case it’s a virus.
Another weird thing is that I was not able to post file ecex.exe on the Internet. I uploaded it to my site and next moment it disappears from there. I did it for 10 times, the same result. Really weird...
Please advice what kind of file/process it might be and what should I do to try to remove it from my system.
Thank you.
Sergey