Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Has anyone seen/or knows anything identical to this:

enter image description here

1515..:19699.exe with a semicolon in the center?

Whenever I launch an app that lists the currently running processes (e.g. SysInternals "Process Explorer" or Nirsoft "cprocess"), they are immediately terminated and access rights are changed from the default valid ones to something different (I verified this with cacls).

I can no longer access the file, unless I take ownership of it (with cacls or through the Windows dialog box). As you can see, it runs under the NT AUTHORITY\SYSTEM user.

I tried terminating this PID with pstools, namely psexec -s. That gives the running process NT AUTHORITY\SYSTEM rights but to no avail. It also modifies the .exes in such a way that an additional "MS-DOS" tab is added to the file properties.

share|improve this question

marked as duplicate by Ƭᴇcʜιᴇ007, Diogo, 8088, Nifle, studiohack Sep 21 '11 at 7:14

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Boot sector viruses are common these days, see my post on how to remove… – Moab Sep 20 '11 at 2:35

colon in the middle usually means alternate data stream. find the file named the left side of the colon.

share|improve this answer
C:\Windows\1515176842.exe; the size is 0 bytes and i can freely delete it. however, upon OS start - it is recreated. – electroglow Sep 19 '11 at 15:16
@ellectroglow. Sounds like a virus to me! – surfasb Sep 19 '11 at 16:35
then there's an additional executable you need to find – RobotHumans Sep 19 '11 at 17:12
one option would be to create your own 151...whatever.exe that tries to disclose its parent process. sorry not 151...exe but 151...exe:whatever.exe – RobotHumans Sep 19 '11 at 17:13
i don't know if it's even possible, but you may be able to put a do nothing empty .exe there and change file permissions such that NT AUTHORITY/SYSTEM is denied access when trying to execute or write to it. maybe if that generated an error message you could use a sysinternals tool to get the parent process of the error message box... – RobotHumans Sep 20 '11 at 18:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.