Oisen.exe - what is it?

[gxshockwav]

noticed this in my list of processes this evening - oisen.exe

Can't find much info on what this process is...when I look it up in c:/windows/system32/oisen and clicked on properties it reads under the version tab :

Company: thumper
File version: 7.00.0001
Internal name: file
Language: english
Original file name: file.exe
Product name: WeRule
Product version: 7.00.0001

my first hunch was that it was spyware...so I ran updated versions of adaware SE 1.05 and spybot... nothing turned up. Ran symantec antivirus 2004 as well, and nothing. Stuff listed above looks iffy...

Help would be appreciated, thanks.

 

[episodic]

http://64.233.179.104/search?q...32+oisen.exe&hl=en

 

[bsobel]

Its a called spyware by some and a backdoor trojan by others. Appears to be part of the My Way search bar.. If you don't mind, use scan & deliver in NAV to submit a sample to Symantec. Also do the following (stolen from google, too lazy to retype it all)

Restart to safe mode.

How to start your computer in safe mode (http://service1.symantec.com/S...ocid/2001052409420406)

First in safe mode click on My Computer then click Tools > Folder Options. In Folder options click on the View tab. Under Files and Folders tick "Show hidden files and folders" then uncheck "Hide file extensions for known file types" and uncheck "Hide protected operating system files (recommended)". Now click "Like current folder" then "Apply" and "OK"

Now find and delete these files:

C:\WINNT\system32\mydnyr.exe
C:\WINNT\system32\oisen.exe

And this folder:

C:\Program Files\MyWay

Best,
Bill

 

[Schadenfroh]

Original file name: file.exe

file.exe is a sign of the third eye Trojan

i cant really give you a solution without seeing your hijackthis. Please post your log for analysis and i will create a solution to your malware problems and post it for you. instructions on how to post hijackthis log is in my sig.

 

[gxshockwav]

I got a copy of mcafee virusscan and it picked up and deleted the virus.

it's funny though that symantec AV2004 w/updated definitions didn't pick it up, even though the virus is a pretty old one.

thanks guys for all the help.