Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

During my routine PC cleaning, I noticed a few things that may have been overlooked by MBAM Pro, Windows Defender, and Spybot S&D (all up-to-date, of course). I have never seen them before, on my computer or any other (I have 15 years of computer experience), and I am a little concerned.

I did some Google searching to no avail; my GoogleFu may be weak at the moment.

Here they are:

  • dehxp.exe enter image description here
  • Adobe148.exe & 6moxz.exe (displayed as New Tec)
  • Adobe852.exe & 5f5wt.exe (displayed as New Tec)
  • Adobe512.exe (displayed as Thunderbird)
  • WindowsMediaPlayer.exe & uem7r.exe (displayed as Setup Installer) enter image description here

All of these files reside in the %APPDATA% directory, which is C:\Users\[username]\AppData\Roaming on my machine.

I had to turn off the Hide protected operating system files (Recommended) option under View > [Folder] Options > View [tab] > Advanced settings in order to see the actual exe files.

I also disabled all of them prior to a required reboot after scanning, and dehxp.exe re-enabled itself.

Additionally, under dehxp.exe's dropdown, I can only get the properties or show the file location of dehxp.exe, both Explorer entries just have Search online enabled.

I am running Windows 8 Pro x64 (legit) with the latest updates. Also, I have never installed Mozilla Thunderbird on this computer, which is why I have it included on this list, especially since it isn't even thunderbird.exe.

Finally, in the bulleted list, any of them in the form of item1 & item2 are identical in file size and were created within minutes (usually one minute) of each other.

Has anyone seen any of these before? Should I be concerned?

Thanks!

EDITS AND UPDATES:

  1. User Aaron Miller suggested using ComboFix; however at the time of this writing it is not compatible with Windows 8, even if you try to install it with Compatibility Mode enabled.
share|improve this question

1 Answer 1

I haven't seen this specific set of symptoms before, but it sure looks like malware to me. Sounds like ComboFix time; if anything can get rid of malware, that tool is it, but do read the guide before you run it.

share|improve this answer
    
Alright cool! Thank you your quick response. I was waiting to run that guy actually since in my experience MBAM and SB S&D get 99.5% of all the malware on a machine when run in tandem. As I was unsure of these, for the above reasons AND the icons are weird; facebook and Half Life-esque. I will run it and see if it picks them up, then I will report back! –  Anders May 20 '13 at 19:33
    
Ugh..unfortunately CF will not run on windows 8. If you try to run it in compatibility mode, it also errors out saying it is not meant to run in compatibility mode... :( Do you happen to know any alternative programs that do similar operations as ComboFix? –  Anders May 20 '13 at 19:38
    
Yikes. Not sure what to suggest, in that case; sorry I can't be more help. –  Aaron Miller May 20 '13 at 19:38
    
No worries; I think I may just delete the potentially offensive files and remove them from the startup registry manually, that is if another solution does not present it self. Thanks again though, all input is greatly appreciated! –  Anders May 20 '13 at 19:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.