Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running a Windows Server 2003 box with SP1. Task manager lists a Process named "ZYBBB9" with the location field pointing to c:\windows\temp\zybbb9.exe. Does any one know what this process is for?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

I would generally agree that it's probably malicious software. Some versions of the Trend Micro OfficeScan antivirus program, though, generate a randomly-named executible on each startup of the software (a "watchdog" program, according to their site).

If you're running OfficeScan on that machine then your random executible may be an OfficeScan-generated EXE.

share|improve this answer
    
Woo-hoo! My psychic powers prevail again... –  Evan Anderson Jan 27 '10 at 15:45
1  
This sort of stupid things that these Anti-virus makers do disgust me. I did not expect what should have been a proper documented thing, hiding under a support ticket. My ranting aside, kudos to Evan! –  BlueGene Jan 27 '10 at 16:16
1  
Evan, I hope nobody ever burns you at the stake. That looked suspiciously like witchcraft... –  Kara Marfia Jan 27 '10 at 18:05
    
@Kara: >smile< The look and feel of the filename looked familiar. The algorithm that OfficeScan uses to generate its "random" filenames isn't too creative and I see a lot of their "random" filenames in "Task Manager" from week-to-week (what w/ a lot of my Customers using Trend Micro antivirus software). –  Evan Anderson Jan 27 '10 at 20:57

first thing to check: just run the Malicious Software Removal tool:

mrt

which is already installed on all newer Windows platforms and gets regularly updated by Microsoft. This will probably identify (and remove) this file as malware. Afterwards make sure you find the source of that infection.

share|improve this answer

That is most likely a randomly-generated executable name, created by malware on your system. I recommend you run your favorite anti-malware software (or even better multiple programs). My personal fave is Malwarebytes Anti-Malware.

Frankly, though, if this is a production server I'd get any data off that was not backed up currently (which is hopefully none), then re-image the box. There is no sense in ever risking production data security by trying to "clean" a server. Wipe and restore data from clean backups.

If it's a possibility, you may want to rotate in a backup production box and keep that one un-wiped (and quarantined) for now so that you can do some post-infection analysis, but if you need to get that particular server up and running immediately then just wipe and restore. One way or another, though, you'll want to track down the infection source.

share|improve this answer
    
+1 for the more thorough & helpful answer 30 seconds earlier. ;) –  Kara Marfia Jan 26 '10 at 21:24
1  
you could also try microsoft security essentials if there isn't any AV software runnin gonthe box. You should also try to investigate how that server got infected (someone browsing the web from the server, propagation from firewall misconfiguration etc,) –  Jim B Jan 26 '10 at 22:38

I'm 99% certain you need to slap that thing with an antivirus/malware scan.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.