Has anyone heard of this? (Virus, perhaps?)

[TheGrandHooHa]

I am having a strange problem with a friend's computer:

Upon logging in, two programs with random names will appear in the Processes list. Their names are something like QabIf.exe and Kcf48AX.exe. These programs then proceed to open up new programs with different random names every 5 minutes or so. As you can imagine, this quickly fills up the memory of the computer making it downright unusable. Now, I have run Ad-Aware and SpyBot several times, and both are reporting that there are no suspicious files. I ran McAfee VirusScan (which is what she had installed) with an update from Nov. 21, and it found nothing. I also had the virus removal tools for Welchia and Blaster there, so just taking a shot in the dark I ran those but , as expected, got no results. I also tried searching for some of the file names that had popped up, but I couldn't find them.

Has anyone heard of a similar problem and, if so, how can I resolve it?

Thank you in advance,
-TGHH

 

[mechBgon]

Check your McAfee settings to ensure that it's set to scan ALL files (no exeptions or exemptions), to kill on sight, and has heuristics and macro detection enabled. You can search McAfee's virus-information library for your suspicious files here: link

What version of Windows does the computer run, by the way?


edit: while we're at it, what version of McAfee VirusScan is it? Right-click the VirusScan icon by the clock and choose "About." It should have the 4306 DATs if you've got the ones from November 21, I think?

 

[TheGrandHooHa]

I searched in the VIL for some of the file names, but none were found. I will double-check them at a later time, as I don't have her computer in front of me.

The computer is running WindowsXP.

She was using the 4306 DATs, I remember seeing that number.

Thanks for the reply, and any further information is appreciated.

-TGHH

 

[mechBgon]

Since it's WinXP, you'll want to make sure that you disable System Restore so WinXP doesn't save a copy of the virus for later Also, download and install the latest SuperDAT, which has the 4308 DAT files plus the latest scan engine itself, from here. Max out every scan setting you can find, including scanning within compressed files and such, and give it another whirl. You may want to start the computer in Safe Mode too.

 

[TheGrandHooHa]

Will do. Thank you, mechBgon. I'll update this thread when I get a chance to do all that stuff.

 

[BT7990]

May be the same?

 

[TheGrandHooHa]

That's exactly it. Thank you, BT7990!