2

I'm running a Windows Server 2003 box with SP1. Task manager lists a Process named "ZYBBB9" with the location field pointing to c:\windows\temp\zybbb9.exe. Does any one know what this process is for?

Improve this question

4 Answers 4

Reset to default
3

I would generally agree that it's probably malicious software. Some versions of the Trend Micro OfficeScan antivirus program, though, generate a randomly-named executible on each startup of the software (a "watchdog" program, according to their site).

If you're running OfficeScan on that machine then your random executible may be an OfficeScan-generated EXE.

Improve this answer
4
  • Woo-hoo! My psychic powers prevail again...
    – Evan Anderson
    Jan 27, 2010 at 15:45
  • 1
    This sort of stupid things that these Anti-virus makers do disgust me. I did not expect what should have been a proper documented thing, hiding under a support ticket. My ranting aside, kudos to Evan!
    – BlueGene
    Jan 27, 2010 at 16:16
  • 1
    Evan, I hope nobody ever burns you at the stake. That looked suspiciously like witchcraft...
    – Kara Marfia
    Jan 27, 2010 at 18:05
  • @Kara: >smile< The look and feel of the filename looked familiar. The algorithm that OfficeScan uses to generate its "random" filenames isn't too creative and I see a lot of their "random" filenames in "Task Manager" from week-to-week (what w/ a lot of my Customers using Trend Micro antivirus software).
    – Evan Anderson
    Jan 27, 2010 at 20:57
7

That is most likely a randomly-generated executable name, created by malware on your system. I recommend you run your favorite anti-malware software (or even better multiple programs). My personal fave is Malwarebytes Anti-Malware.

Frankly, though, if this is a production server I'd get any data off that was not backed up currently (which is hopefully none), then re-image the box. There is no sense in ever risking production data security by trying to "clean" a server. Wipe and restore data from clean backups.

If it's a possibility, you may want to rotate in a backup production box and keep that one un-wiped (and quarantined) for now so that you can do some post-infection analysis, but if you need to get that particular server up and running immediately then just wipe and restore. One way or another, though, you'll want to track down the infection source.

Improve this answer
2
  • +1 for the more thorough & helpful answer 30 seconds earlier. ;)
    – Kara Marfia
    Jan 26, 2010 at 21:24
  • 1
    you could also try microsoft security essentials if there isn't any AV software runnin gonthe box. You should also try to investigate how that server got infected (someone browsing the web from the server, propagation from firewall misconfiguration etc,)
    – Jim B
    Jan 26, 2010 at 22:38
5

I'm 99% certain you need to slap that thing with an antivirus/malware scan.

Improve this answer
2

first thing to check: just run the Malicious Software Removal tool:

mrt

which is already installed on all newer Windows platforms and gets regularly updated by Microsoft. This will probably identify (and remove) this file as malware. Afterwards make sure you find the source of that infection.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .