2

I'm running a Windows Server 2003 box with SP1. Task manager lists a Process named "ZYBBB9" with the location field pointing to c:\windows\temp\zybbb9.exe. Does any one know what this process is for?

3

I would generally agree that it's probably malicious software. Some versions of the Trend Micro OfficeScan antivirus program, though, generate a randomly-named executible on each startup of the software (a "watchdog" program, according to their site).

If you're running OfficeScan on that machine then your random executible may be an OfficeScan-generated EXE.

4
  • Woo-hoo! My psychic powers prevail again... Jan 27 '10 at 15:45
  • 1
    This sort of stupid things that these Anti-virus makers do disgust me. I did not expect what should have been a proper documented thing, hiding under a support ticket. My ranting aside, kudos to Evan!
    – BlueGene
    Jan 27 '10 at 16:16
  • 1
    Evan, I hope nobody ever burns you at the stake. That looked suspiciously like witchcraft... Jan 27 '10 at 18:05
  • @Kara: >smile< The look and feel of the filename looked familiar. The algorithm that OfficeScan uses to generate its "random" filenames isn't too creative and I see a lot of their "random" filenames in "Task Manager" from week-to-week (what w/ a lot of my Customers using Trend Micro antivirus software). Jan 27 '10 at 20:57
7

That is most likely a randomly-generated executable name, created by malware on your system. I recommend you run your favorite anti-malware software (or even better multiple programs). My personal fave is Malwarebytes Anti-Malware.

Frankly, though, if this is a production server I'd get any data off that was not backed up currently (which is hopefully none), then re-image the box. There is no sense in ever risking production data security by trying to "clean" a server. Wipe and restore data from clean backups.

If it's a possibility, you may want to rotate in a backup production box and keep that one un-wiped (and quarantined) for now so that you can do some post-infection analysis, but if you need to get that particular server up and running immediately then just wipe and restore. One way or another, though, you'll want to track down the infection source.

2
  • +1 for the more thorough & helpful answer 30 seconds earlier. ;) Jan 26 '10 at 21:24
  • 1
    you could also try microsoft security essentials if there isn't any AV software runnin gonthe box. You should also try to investigate how that server got infected (someone browsing the web from the server, propagation from firewall misconfiguration etc,)
    – Jim B
    Jan 26 '10 at 22:38
5

I'm 99% certain you need to slap that thing with an antivirus/malware scan.

2

first thing to check: just run the Malicious Software Removal tool:

mrt

which is already installed on all newer Windows platforms and gets regularly updated by Microsoft. This will probably identify (and remove) this file as malware. Afterwards make sure you find the source of that infection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.