what is 914169524:1273070281.exe?

November 11, 2011 at 11:29:03
Specs: Win XP, AMD Turion 40 / 2Gig
I believe that this is a virus but I cannot seem to fine any info on it and it disabled my McAfee and I download and installed Malwarebytes and it disabled it too.

Gil Roman


See More: what is 914169524:1273070281.exe?

Report •

#1
November 11, 2011 at 12:09:53
Any .exe made up of random numbers is highly likely to be some sort of malware. Start off by running Malwarebytes in safe mode - a lot of these programs are just set to start in normal mode so deleting them in safe mode should get around the problem.

"I've always been mad, I know I've been mad, like the most of us..." Pink Floyd


Report •

#2
November 11, 2011 at 17:46:43
EDIT:
SEE POST BELOW WHICH REQUESTS YOU NOT TO RUN ANY ANTI-MALWARE PROGRAM JUST YET. I will leave the rest of this post "as is" for information.

Try changing the MalwareBytes exe extension to cmd or bat. It is designed that way to get around issues due to the malware disabling it. This applies to both the download exe file and the program file mbam.exe.

When the malware has gone you are OK to change the program file exe back to mbam.exe.

Always pop back and let us know the outcome - thanks


Report •

#3
November 11, 2011 at 19:45:23
gilcom1,

That file appears to be an Alternate Data Stream (ADS) characteristic of the ZeroAccess Rootkit.

If the file is located in C:\WINDOWS, let's take care of it:
C:\WINDOWS\914169524:1273070281.exe

It throws a wrench in the works, and programs will not run successfully...

Please download DummyCreator.zip:
http://download.bleepingcomputer.co...

Unzip the folder:
Right-click and select: Extract all
Follow the prompts to extract

Open the new folder that appears on the Desktop:
Double-click 'DummyCreator/DummyMaker' to run the tool.

Now, copy/paste the following into the blank area:

C:\WINDOWS\9141695244

Press the 'Create' button.

Save the content of the 'Result.txt' to your Desktop, and post it in your reply.

Next, restart the computer!

This utility moves the malware ADS file and makes a locked dummy folder for it.

Please do not run any malware removal programs yet.
Doing so may just make matters worse!

Thanks!

~~~~
Retired - Doin' Dis, Dat, and slapping malware.
Malware Eliminator/Member of UNITE and the
Alliance of Security Analysis Professionals


Report •

Related Solutions

#4
November 12, 2011 at 07:16:14
aaflac44

I've edited my post #2 in the light of your last line.


Report •

#5
November 12, 2011 at 09:56:53
Saw it, Derek. Thanks.

If he has ZeroAccess, and that ADS file is normally a good sign, the chances of being able to run malware removal programs are slim. Malwarebytes' might start, but more than likely not finish. Of course, with malware, there is always the 'surprise' element, as you know.


In this case, we may never know...no reply, so far.

~~~~
Retired - Doin' Dis, Dat, and slapping malware.
Malware Eliminator/Member of UNITE and the
Alliance of Security Analysis Professionals


Report •

Ask Question