Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

Upon restarting my Windows XP a command line process came up, looking weird (blank screen with the underscore jumping all over it), cidd_p and some random string was the name of it.

I never had anything like that before, and upon googling it seems it's maybe some sort of trojan, or something, but informations on it are pretty scarce.

What is it, and how can I remove it? Anyone have any advice?

In c:\windows directory there is a subdirectory with \cidd_p\lsass.exe in it.

share|improve this question
Sounds like a virus to me. Get Microsoft Security Essentials, give it a scan, and see if that works. – Breakthrough Nov 24 '11 at 12:41
That "underscore" is most likely the TUI cursor. – JdeBP Nov 24 '11 at 16:25

1 Answer

up vote 1 down vote

Everything impersonating itself as lsass.exe is definitely malware.

lsass.exe in the Local Security Authority Process (part of Windows). You cannot delete the real one. But the one in that directory is fake.

Boot up in safe mode, run HijackThis (or go through the registry manually), search for entries associated to cidd_p, fix them and delete the corresponding files.

Edit:

I have found to links the seem to deal with your trojan (or a closely related one):

share|improve this answer
Interestingly enough, there is nothing in the registry mentioning cidd_p. Will try the mentioned. – ldigas Nov 24 '11 at 14:06
Did you browse the registry is safe mode? Malware can hide itself when launched. – Dennis Nov 24 '11 at 14:11
I'm going to do a complete reinstall; usually it takes me less than to remove these things manually. Btw, what does that thing do anyways - I couldn't find that anywhere - does it do some actual damage to your data, or just sits there? – ldigas Nov 24 '11 at 14:13
I would not re-install the OS. Remove it manually, even if it takes longer. The links I provided should walk you through it. It will be easier the next time and eventually become a routine task. As for what it does: It seems to download other malware to your computer and sniff passwords (online banking!). – Dennis Nov 24 '11 at 14:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.