1

I know, I am aware. After a very heavy duty day I erroneously clicked on the wrong link and executed a fake installation on my windows 7 machine:

  1. CTA

enter image description here

  1. Download

enter image description here

The installer eventually installed Opera browser and a annoying and suspicious systray process:

enter image description here

I have already get rid of Opera, but I am having trouble with the systray process.

Here what I tried so far:

  1. Searched the file system for the ICSW1.14_0S1F2Y1C1R1P0F1F1C1N1P1.14.exe executable. Not found.

  2. Search the registrer (regedit.exe) for the ICSW. Found only the following entry without any keys:

     HKEY_USERS\S-1-5-21-762979615-2031575299-929701000-475874\Software\ICSW1.14
    
  3. Search the sys config (msconfig.exe) any suspicious entry. Nothing found.

  4. Search the Program and features entries. Nothing found.

  5. Search the task manager. Nothing found.

Question

I would like to identify the source executable corresponding to the sys tray icon and remove it from the file system in the proper way (stop and disable any related service or process, remove the executable, clear the registry).

So:

  1. Where are the systray processes configured/listed?
  2. How may I relate a process to the corresponding executable or service?

Constraints

I really avoid to install any additional or unreliable program. So please do not suggest any app. Please.

  • to suggest the obvious... is it in task manager somewhere? – Journeyman Geek Oct 9 '15 at 9:55
  • @Jurnyman Geek: not found anything – Alberto De Caro Oct 9 '15 at 10:09
0

Use Process Hacker portable http://processhacker.sourceforge.net/ to find the launch command line for a running process from the right click properties menu.

Also look at Sysinternals autoruns https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx to hunt for and disable suspicious software.

  • Hi Yobbo. Good advice. I did not know the autoruns. Unfortunately I found no evidence of the tray element in the autoruns reports. – Alberto De Caro Oct 9 '15 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.