unknown program creating osc file eating up disk space

[Guest joe vaughan]

I have a process that fires off on the 1st of every month. I can't locate

where it's coming from, or who made it. My Trend anti-virus doesn't detect

it as a virus. It's a process that continually renames itself something

different every time it runs. It creates a random file name ending in .osc

in my windows\temp directory. It eats up all my free space on my c:\ drive,

causing my print jobs and other tasks to fail. I'm able to identify the

process because it's an exe that's also put into the windows\temp directory.

Today the exe name is YYB6A4.exe. Every month the exe icon is a dog. I kill

the process, then delete the osc file. It appears to launch around 9 AM on

the 1st of every month. I don't have anything scheduled to launch at that

time. When I kill the process, the exe goes away. Any idea how to determine

how this is launching, why it's launching and if it's needed?

[Guest Thee Chicago Wolf]

Re: unknown program creating osc file eating up disk space

 

>I have a process that fires off on the 1st of every month. I can't locate

>where it's coming from, or who made it. My Trend anti-virus doesn't detect

>it as a virus. It's a process that continually renames itself something

>different every time it runs. It creates a random file name ending in .osc

>in my windows\temp directory. It eats up all my free space on my c:\ drive,

>causing my print jobs and other tasks to fail. I'm able to identify the

>process because it's an exe that's also put into the windows\temp directory.

>Today the exe name is YYB6A4.exe. Every month the exe icon is a dog. I kill

>the process, then delete the osc file. It appears to launch around 9 AM on

>the 1st of every month. I don't have anything scheduled to launch at that

>time. When I kill the process, the exe goes away. Any idea how to determine

>how this is launching, why it's launching and if it's needed?

 

Sounds like a trojan or malware. Do you have Spybot or some such

anti-spyware app installed?

 

- Thee Chicago Wolf

[Guest joe vaughan]

Re: unknown program creating osc file eating up disk space

 

Yes to the Spybot question. Complete scan showed no problems. Complete scan

on MS Defender also showed no problems. Complete Trend scan showed no

problems. That's what's puzzling me. Some process is creating the osc file

and I need to identify what that process is.

 

"Thee Chicago Wolf" wrote:

> >I have a process that fires off on the 1st of every month. I can't locate

> >where it's coming from, or who made it. My Trend anti-virus doesn't detect

> >it as a virus. It's a process that continually renames itself something

> >different every time it runs. It creates a random file name ending in .osc

> >in my windows\temp directory. It eats up all my free space on my c:\ drive,

> >causing my print jobs and other tasks to fail. I'm able to identify the

> >process because it's an exe that's also put into the windows\temp directory.

> >Today the exe name is YYB6A4.exe. Every month the exe icon is a dog. I kill

> >the process, then delete the osc file. It appears to launch around 9 AM on

> >the 1st of every month. I don't have anything scheduled to launch at that

> >time. When I kill the process, the exe goes away. Any idea how to determine

> >how this is launching, why it's launching and if it's needed?

>

> Sounds like a trojan or malware. Do you have Spybot or some such

> anti-spyware app installed?

>

> - Thee Chicago Wolf

>

[Guest Thee Chicago Wolf]

Re: unknown program creating osc file eating up disk space

 

>Yes to the Spybot question. Complete scan showed no problems. Complete scan

>on MS Defender also showed no problems. Complete Trend scan showed no

>problems. That's what's puzzling me. Some process is creating the osc file

>and I need to identify what that process is.

 

Wow, that's a new one then. Try using Process Explorer

(http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx)

and see if you can trace the location of that strange .exe file or to

see what's running in the background. Another idea would be to run

Rootkit Revealer to see if there's any Rootkit installed

(http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx).

 

Other than that, the only info I've seen on .osc is associated with

RIS and this KB article:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325

Anything in it match what's happening on your machine?

 

- Thee Chicago Wolf

[Guest John Sulko]

Re: unknown program creating osc file eating up disk space

 

Trend spawns a random short named exe as part of its processing. Freaked us

out until we tracked it down. Is this possibly the log file from a monthly

virus scan?

 

 

"Thee Chicago Wolf" <.@.> wrote in message

news:bllal3tlsr9b422ta2c6fi8hrfipdrafm9@4ax.com...

> >Yes to the Spybot question. Complete scan showed no problems. Complete

> >scan

>>on MS Defender also showed no problems. Complete Trend scan showed no

>>problems. That's what's puzzling me. Some process is creating the osc

>>file

>>and I need to identify what that process is.

>

> Wow, that's a new one then. Try using Process Explorer

> (http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx)

> and see if you can trace the location of that strange .exe file or to

> see what's running in the background. Another idea would be to run

> Rootkit Revealer to see if there's any Rootkit installed

> (http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx).

>

> Other than that, the only info I've seen on .osc is associated with

> RIS and this KB article:

> http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325

> Anything in it match what's happening on your machine?

>

> - Thee Chicago Wolf

[Guest joe vaughan]

Re: unknown program creating osc file eating up disk space

 

The random named exe file appears to always reside in windows\temp. If I

kill the process, it automatically restarts with a new file name. I've

scanned the exe with our anti-virus, but it comes up clean.

 

How did you track it down?

 

"John Sulko" wrote:

> Trend spawns a random short named exe as part of its processing. Freaked us

> out until we tracked it down. Is this possibly the log file from a monthly

> virus scan?

>

>

> "Thee Chicago Wolf" <.@.> wrote in message

> news:bllal3tlsr9b422ta2c6fi8hrfipdrafm9@4ax.com...

> > >Yes to the Spybot question. Complete scan showed no problems. Complete

> > >scan

> >>on MS Defender also showed no problems. Complete Trend scan showed no

> >>problems. That's what's puzzling me. Some process is creating the osc

> >>file

> >>and I need to identify what that process is.

> >

> > Wow, that's a new one then. Try using Process Explorer

> > (http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx)

> > and see if you can trace the location of that strange .exe file or to

> > see what's running in the background. Another idea would be to run

> > Rootkit Revealer to see if there's any Rootkit installed

> > (http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx).

> >

> > Other than that, the only info I've seen on .osc is associated with

> > RIS and this KB article:

> > http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325

> > Anything in it match what's happening on your machine?

> >

> > - Thee Chicago Wolf

>

>

>

[Guest John Sulko]

Re: unknown program creating osc file eating up disk space

 

Trend's support forums, although the article doesn't address XP it does it

as well.

 

 

http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-126558&id=EN-126558

 

 

"joe vaughan" <joevaughan@discussions.microsoft.com> wrote in message

news:F3F36405-427C-43E3-9F63-95E4F03BB50F@microsoft.com...

> The random named exe file appears to always reside in windows\temp. If I

> kill the process, it automatically restarts with a new file name. I've

> scanned the exe with our anti-virus, but it comes up clean.

>

> How did you track it down?

>

> "John Sulko" wrote:

>

>> Trend spawns a random short named exe as part of its processing. Freaked

>> us

>> out until we tracked it down. Is this possibly the log file from a

>> monthly

>> virus scan?

>>

>>

>> "Thee Chicago Wolf" <.@.> wrote in message

>> news:bllal3tlsr9b422ta2c6fi8hrfipdrafm9@4ax.com...

>> > >Yes to the Spybot question. Complete scan showed no problems.

>> > >Complete

>> > >scan

>> >>on MS Defender also showed no problems. Complete Trend scan showed no

>> >>problems. That's what's puzzling me. Some process is creating the osc

>> >>file

>> >>and I need to identify what that process is.

>> >

>> > Wow, that's a new one then. Try using Process Explorer

>> > (http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx)

>> > and see if you can trace the location of that strange .exe file or to

>> > see what's running in the background. Another idea would be to run

>> > Rootkit Revealer to see if there's any Rootkit installed

>> > (http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx).

>> >

>> > Other than that, the only info I've seen on .osc is associated with

>> > RIS and this KB article:

>> > http://support.microsoft.com/default.aspx?scid=kb;EN-US;q268325

>> > Anything in it match what's happening on your machine?

>> >

>> > - Thee Chicago Wolf

>>

>>

>>

[Guest pyrofire232@gmail.com]

Re: unknown program creating osc file eating up disk space

 

I have a virus with almost the exact same symptoms.

 

the differences are:

 

i am running windows xp, and do not have officescan

the files are the exact size of 130 kb

the files have no icon.

 

 

PLZ HELP!