what is oleban.exe ?

[RBBRMADE]

Can't find anything googling it.

It is in the Winnt/system32 folder.

I unchecked it in start up in msconfig, but it reappeared, and I noticed two instances running in the task manager.

Thanx for any insight!
Ron

 

[n0cmonkey]

Anything show up in anti-spyware or anti-virus software? What did the owner do to his machine recently?

 

[Unkno]

one easy solution...dl some anti-spyware (ad-aware for example), then scan your computer. Even if oleban.exe doesn't come up as a spyware, most anti-spywares (includes ad-aware) gives you a report and also shows you the tasks that are currently operating. Just go to the oleban.exe task and it would show you what it is/do

 

[RBBRMADE]

I used Process Explorer to give me more info.
The only thing it told me was the company name 'PTech'.
After some digging, I realized it was a variant of the E2Give, 'prutect.exe' malware.
After manually removing oleban.exe from system folder and registry, all looks well.
Avast, Trend Micro, ravantivirus, Ad-aware, and Spybot S&D would not completey clean this variant.
Trend Micro said it cleaned 'prutect.exe', and the others did not locate it after that.
All other scans came back clean as a whistle!

Thanx for the help,
Ron