Guest joe vaughan Posted December 3, 2007 Posted December 3, 2007 I have a process that fires off on the 1st of every month. I can't locate where it's coming from, or who made it. My Trend anti-virus doesn't detect it as a virus. It's a process that continually renames itself something different every time it runs. It creates a random file name ending in .osc in my windows\temp directory. It eats up all my free space on my c:\ drive, causing my print jobs and other tasks to fail. I'm able to identify the process because it's an exe that's also put into the windows\temp directory. Today the exe name is YYB6A4.exe. Every month the exe icon is a dog. I kill the process, then delete the osc file. It appears to launch around 9 AM on the 1st of every month. I don't have anything scheduled to launch at that time. When I kill the process, the exe goes away. Any idea how to determine how this is launching, why it's launching and if it's needed?
Guest Thee Chicago Wolf Posted December 3, 2007 Posted December 3, 2007 Re: unknown program creating osc file eating up disk space >I have a process that fires off on the 1st of every month. I can't locate >where it's coming from, or who made it. My Trend anti-virus doesn't detect >it as a virus. It's a process that continually renames itself something >different every time it runs. It creates a random file name ending in .osc >in my windows\temp directory. It eats up all my free space on my c:\ drive, >causing my print jobs and other tasks to fail. I'm able to identify the >process because it's an exe that's also put into the windows\temp directory. >Today the exe name is YYB6A4.exe. Every month the exe icon is a dog. I kill >the process, then delete the osc file. It appears to launch around 9 AM on >the 1st of every month. I don't have anything scheduled to launch at that >time. When I kill the process, the exe goes away. Any idea how to determine >how this is launching, why it's launching and if it's needed? Sounds like a trojan or malware. Do you have Spybot or some such anti-spyware app installed? - Thee Chicago Wolf
Guest joe vaughan Posted December 4, 2007 Posted December 4, 2007 Re: unknown program creating osc file eating up disk space Yes to the Spybot question. Complete scan showed no problems. Complete scan on MS Defender also showed no problems. Complete Trend scan showed no problems. That's what's puzzling me. Some process is creating the osc file and I need to identify what that process is. "Thee Chicago Wolf" wrote: > >I have a process that fires off on the 1st of every month. I can't locate > >where it's coming from, or who made it. My Trend anti-virus doesn't detect > >it as a virus. It's a process that continually renames itself something > >different every time it runs. It creates a random file name ending in .osc > >in my windows\temp directory. It eats up all my free space on my c:\ drive, > >causing my print jobs and other tasks to fail. I'm able to identify the > >process because it's an exe that's also put into the windows\temp directory. > >Today the exe name is YYB6A4.exe. Every month the exe icon is a dog. I kill > >the process, then delete the osc file. It appears to launch around 9 AM on > >the 1st of every month. I don't have anything scheduled to launch at that > >time. When I kill the process, the exe goes away. Any idea how to determine > >how this is launching, why it's launching and if it's needed? > > Sounds like a trojan or malware. Do you have Spybot or some such > anti-spyware app installed? > > - Thee Chicago Wolf >
Guest Thee Chicago Wolf Posted December 4, 2007 Posted December 4, 2007 Re: unknown program creating osc file eating up disk space >Yes to the Spybot question. Complete scan showed no problems. Complete scan >on MS Defender also showed no problems. Complete Trend scan showed no >problems. That's what's puzzling me. Some process is creating the osc file >and I need to identify what that process is. Wow, that's a new one then. Try using Process Explorer (http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx) and see if you can trace the location of that strange .exe file or to see what's running in the background. Another idea would be to run Rootkit Revealer to see if there's any Rootkit installed (http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx). Other than that, the only info I've seen on .osc is associated with RIS and this KB article: http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325 Anything in it match what's happening on your machine? - Thee Chicago Wolf
Guest John Sulko Posted December 4, 2007 Posted December 4, 2007 Re: unknown program creating osc file eating up disk space Trend spawns a random short named exe as part of its processing. Freaked us out until we tracked it down. Is this possibly the log file from a monthly virus scan? "Thee Chicago Wolf" <.@.> wrote in message news:bllal3tlsr9b422ta2c6fi8hrfipdrafm9@4ax.com... > >Yes to the Spybot question. Complete scan showed no problems. Complete > >scan >>on MS Defender also showed no problems. Complete Trend scan showed no >>problems. That's what's puzzling me. Some process is creating the osc >>file >>and I need to identify what that process is. > > Wow, that's a new one then. Try using Process Explorer > (http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx) > and see if you can trace the location of that strange .exe file or to > see what's running in the background. Another idea would be to run > Rootkit Revealer to see if there's any Rootkit installed > (http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx). > > Other than that, the only info I've seen on .osc is associated with > RIS and this KB article: > http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325 > Anything in it match what's happening on your machine? > > - Thee Chicago Wolf
Guest joe vaughan Posted December 6, 2007 Posted December 6, 2007 Re: unknown program creating osc file eating up disk space The random named exe file appears to always reside in windows\temp. If I kill the process, it automatically restarts with a new file name. I've scanned the exe with our anti-virus, but it comes up clean. How did you track it down? "John Sulko" wrote: > Trend spawns a random short named exe as part of its processing. Freaked us > out until we tracked it down. Is this possibly the log file from a monthly > virus scan? > > > "Thee Chicago Wolf" <.@.> wrote in message > news:bllal3tlsr9b422ta2c6fi8hrfipdrafm9@4ax.com... > > >Yes to the Spybot question. Complete scan showed no problems. Complete > > >scan > >>on MS Defender also showed no problems. Complete Trend scan showed no > >>problems. That's what's puzzling me. Some process is creating the osc > >>file > >>and I need to identify what that process is. > > > > Wow, that's a new one then. Try using Process Explorer > > (http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx) > > and see if you can trace the location of that strange .exe file or to > > see what's running in the background. Another idea would be to run > > Rootkit Revealer to see if there's any Rootkit installed > > (http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx). > > > > Other than that, the only info I've seen on .osc is associated with > > RIS and this KB article: > > http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325 > > Anything in it match what's happening on your machine? > > > > - Thee Chicago Wolf > > >
Guest John Sulko Posted December 6, 2007 Posted December 6, 2007 Re: unknown program creating osc file eating up disk space Trend's support forums, although the article doesn't address XP it does it as well. http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-126558&id=EN-126558 "joe vaughan" <joevaughan@discussions.microsoft.com> wrote in message news:F3F36405-427C-43E3-9F63-95E4F03BB50F@microsoft.com... > The random named exe file appears to always reside in windows\temp. If I > kill the process, it automatically restarts with a new file name. I've > scanned the exe with our anti-virus, but it comes up clean. > > How did you track it down? > > "John Sulko" wrote: > >> Trend spawns a random short named exe as part of its processing. Freaked >> us >> out until we tracked it down. Is this possibly the log file from a >> monthly >> virus scan? >> >> >> "Thee Chicago Wolf" <.@.> wrote in message >> news:bllal3tlsr9b422ta2c6fi8hrfipdrafm9@4ax.com... >> > >Yes to the Spybot question. Complete scan showed no problems. >> > >Complete >> > >scan >> >>on MS Defender also showed no problems. Complete Trend scan showed no >> >>problems. That's what's puzzling me. Some process is creating the osc >> >>file >> >>and I need to identify what that process is. >> > >> > Wow, that's a new one then. Try using Process Explorer >> > (http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx) >> > and see if you can trace the location of that strange .exe file or to >> > see what's running in the background. Another idea would be to run >> > Rootkit Revealer to see if there's any Rootkit installed >> > (http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx). >> > >> > Other than that, the only info I've seen on .osc is associated with >> > RIS and this KB article: >> > http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325 >> > Anything in it match what's happening on your machine? >> > >> > - Thee Chicago Wolf >> >> >>
Guest pyrofire232@gmail.com Posted December 21, 2007 Posted December 21, 2007 Re: unknown program creating osc file eating up disk space I have a virus with almost the exact same symptoms. the differences are: i am running windows xp, and do not have officescan the files are the exact size of 130 kb the files have no icon. PLZ HELP!
Recommended Posts