Program named 1433978100 wants to set itself to start when computer starts

[Gustavus]

Anytime I open a pdf document with Adobe Reader, Win Patrol pops up saying it has detected a new program 1433978100 which will start anytime the computer starts etc. This has been going on for quite a long time and I simply deny permission -- in Win Patrol -- for it to be installed. There is 100% correlation between opening a document in Adobe Reader and the Win Patrol popup. I have searched on net with the program "name" -- nothing -- and all sorts of combinations with Adobe, Adobe Reader etc. Win Patrol can not provide any additional information.

Have any of you ever heard of this program?

Thanks.

 

[inachu]

Find it and delete it.

Also click start buttton then regedit click on edit find then paste that file name in and start search and after finding it then delete the entry then hit f3 to search further into the registry. Sometimes temp files are made after a fresh install and they use these strange techniques to set permission on a new install but I also think it is a bad file and it should be deleted.

 

[Gustavus]

inachu

It doesn't appear in a Windows search, but does appear in a registry search. When I delete it, it returns immediately with Win Patrol popping up the following box

I've run both of Antimalware's programs and they did not find the culprit.

Postscript
It seems by examining the registry that it is tied in some way to Adobe Speed Launch. On net I find that there is malware which piggy backs on Adobe updates -- but can't find a reference to this anonymous/numbered program

 

[denis280]

try in safe mode,but first clean the temp folder,you could also disconnect internet when doing it

 

[Charlie98]

Maybe try something like Search Everything to pull it up...

 

[Gustavus]

Registry search turns up four instances of 1433978100 -- whcih can't be deleted. Well they can, but immediately return.

Search Everything finds no instance.

 

[nsafreak]

Sounds like you have some malware that's gotten in pretty deep. Personally my recommendation when that happens is the "nuke it from orbit" approach and that's to format the hard drive and re-install the OS. Your other option, if you just don't want to do an OS re-install is to use a boot disk with AV on it. Eset has a set of utilities available here: http://www.eset.com/int/download/utilities/detail/family/239/ .

 

[Gustavus]

The Win Patrol just popped up again -- with a different program name

 

[nsafreak]

The Win Patrol just popped up again -- with a different program name

Yeah not a good sign, either run a decent AV from a boot CD like what I've linked or format & re-install. You might also want to look into getting a better AV. If you're more into free I would look into either BitDefender free edition or Avira.

 

[Gustavus]

I think I have a good AV -- ESET System Security 6.0.308 which updates the virus definitions several times each day.

Neither it nor SuperAntiSpware find any suspicious entries

Doesn't make any difference something is going on that isn't right.

 

[postmortemIA]

you also have XP, which cannot be secured anymore online, as Microsoft has stopped doing any security fixes for it for over a year.

 

[LTC8K6]

you also have XP, which cannot be secured anymore online, as Microsoft has stopped doing any security fixes for it for over a year.

My old laptop is still receiving XP updates. That will end for sure very soon:

Microsoft will continue to provide Security Essentials virus definitions and updates for its Malicious Software Removal Tool (MSRT) for XP until July 14, 2015.[115]

 

[Gustavus]

postmortemIA
You are right. The two computers I keep running most of the time are XP machines. I have a 4.3 GHz machine and a laptop running 8.1 which after nearly a year's experience I hate almost as much as having a root canal. Small example from today. For several generations of Windows by holding down F8 while booting you could go into Safe mode to undo things that had gone wrong in an install. Today I had to get to safe mode on the laptop to undo a bit of Toshiba craziness. Instead of simply holding down F8 I had to go into msconfig, click on safe boot, and minimal. The system would then boot in safe mode -- but unlike all previous versions of Windows where if you booted without depressing the F8 key you got a normal boot, you now must go into msconfig again, uncheck the safe boot box etc. It is almost as though the OS designers at MS had been given the assignment of making what had been one of the simplest and most useful features in Windows as obscure and obtuse as possible. Virtually everything about Windows 8.1 is like this which is why I -- and millions of other -- still use Windows XP even though it is no longer supported. By necessity I have the two Windows 8.1 machines -- but it is by preference I still have the two Windows XP ones.

 

[LTC8K6]

I've never needed safe mode in 8.1

Not in any of my computers.

That is a big change from previous versions of windows.

 

[Gustavus]

LTC8K6
We have all developed habits in how we do things. I don't often need safe mode, but every once in awhile I need to make changes that would be interferred with or prevented by software which would load if I allowed a full boot.

 

[Ketchup]

I have seen a similar thread before about that WinPatrol (maybe it was also from you Gustavus). I think you would be better off getting rid of that program and upgrading to Windows 7 or 8. Windows 7 is the most prone to attack of any OS in use, and does not receive free security updates from Microsoft (legally) making it even worse.

 

[Gustavus]

Thanks for the reply ketchup79

No, if you saw a similar thread elsewhere it wasn't by me. I'll look for it to see if there was any resolution of the problem.

I can't be sure my computer is OK, but denying permission for the program to be installed in startup seems to be working. At least scans by ESET and SuperAntiSpyware give the machine a clean bill of health, There are those worrisome entries in the registry which can't be deleted though.

These machines are my lifeblood. I do long -- sometimes well over a day -- computations in support of my research. Often have two or more computers running at the same time. So long as they work OK I shouldn't be concerned -- but must admit it bothers me when they have some anomalous behavior like this. Especially since none of the others do.

Again, thanks to all who have responded to my post

 

[Ketchup]

Thanks for the reply ketchup79

No, if you saw a similar thread elsewhere it wasn't by me.

Nope, it was you.
http://forums.anandtech.com/showpost.php?p=37396505&postcount=12

Winpatrol and XP: Dump them both!

 

[ninaholic37]

Have you tried something other than Adobe Reader to read pdfs? I normally uninstall Adobe and use something lighter, last time I used Sumantra PDF:

http://www.sumatrapdfreader.org

Curious to see if using that program instead gives you the same error...

 

[Ketchup]

Have you tried something other than Adobe Reader to read pdfs? I normally uninstall Adobe and use something lighter, last time I used Sumantra PDF:

http://www.sumatrapdfreader.org

Curious to see if using that program gives you the same error...

Just to add, Foxit it also a great program. Has gotten a little bloated over the years, but nowhere near Adobe, and much easier to do several different things IMO.

 

[boomerang]

I can't remember are their Scheduled Tasks in XP? I was messing with somebody's computer within the last year trying to remove some annoying thing (yeah, I know, real definitive) and eventually I looked in Scheduled Tasks to find that it was launching from there. Same kind of deal where nuking all traces of it didn't work because it kept coming back.

 

[Ketchup]

I can't remember are their Scheduled Tasks in XP? I was messing with somebody's computer within the last year trying to remove some annoying thing (yeah, I know, real definitive) and eventually I looked in Scheduled Tasks to find that it was launching from there. Same kind of deal where nuking all traces of it didn't work because it kept coming back.

Asus uses scheduled tasks for a lot of their software. Other than that, I hadn't seem programs use that method in years.

 

[boomerang]

Asus uses scheduled tasks for a lot of their software. Other than that, I hadn't seem programs use that method in years.

No, this was malware of some type but it wasn't so much malicious as annoying. I seem to remember popups that would barely allow the computer to be used. The owner was smart enough not to click on any of it or it probably would have become truly malicious.

 

[Gustavus]

ketchup79
Sorry about that. I am 84 so apparently getting forgetful.

I have spent a lot of time today reading up on Foxit, Nitro, Sumatra etc. I was already suspicious my anomaly was tied to Adobe Speed Launch and am now pretty sure it is. Foxit sounds great but there are uncountably many (and I am a mathematician) complaints about it sneaking in Conduit -- which I have had bad experiences with from a different source before.

I write papers with Word Perfect as my word processor, but unfortunately no publisher will accept a .wpd file. Some will still accept .pdf files which I can publish to from WordPerfect. Many journals are no longer accessible to me since they will only accept LaTeX mark up files which I don't know how to do and am too old to learn.

 

[Ketchup]

Never seen conduit (but I do the most simplistic install) and have installed Foxit dozens of times.

I hear you though. Staying away from MSoffice is pretty tough in today's world.