Re: unknown program creating osc file eating up disk space

Yes to the Spybot question. Complete scan showed no problems. Complete scan
on MS Defender also showed no problems. Complete Trend scan showed no
problems. That's what's puzzling me. Some process is creating the osc file
and I need to identify what that process is.

"Thee Chicago Wolf" wrote:

I have a process that fires off on the 1st of every month. I can't locate
where it's coming from, or who made it. My Trend anti-virus doesn't detect
it as a virus. It's a process that continually renames itself something
different every time it runs. It creates a random file name ending in .osc
in my windows\temp directory. It eats up all my free space on my c:\ drive,
causing my print jobs and other tasks to fail. I'm able to identify the
process because it's an exe that's also put into the windows\temp directory.
Today the exe name is YYB6A4.exe. Every month the exe icon is a dog. I kill
the process, then delete the osc file. It appears to launch around 9 AM on
the 1st of every month. I don't have anything scheduled to launch at that
time. When I kill the process, the exe goes away. Any idea how to determine
how this is launching, why it's launching and if it's needed?

Sounds like a trojan or malware. Do you have Spybot or some such
anti-spyware app installed?

- Thee Chicago Wolf

.

Relevant Pages

  • Re: Spyware on an SBS client and what to do?
    ... came in an email pretenting to be from UPS in the form of a zipped exe. ... Neither clamav nor Trend WFBSA prevented the infection although the ... Trend logs showed some stuff had been found and cleaned. ...
    (microsoft.public.windows.server.sbs)
  • Re: Spyware on an SBS client and what to do?
    ... Les Connor [SBS MVP] ... Neither clamav nor Trend WFBSA prevented the infection although the Trend logs showed some stuff had been found and cleaned. ... A properly setup firewall would never have permitted an exe to pass through to the users email box. ... I would have thought that the Trend real-time scanner should have blocked this, but it didn't, although later inspection of the Trend logs shows that it did detect malware associated with this exe. ...
    (microsoft.public.windows.server.sbs)
  • Re: Spyware on an SBS client and what to do?
    ... Neither clamav nor Trend WFBSA prevented the infection although the Trend logs showed some stuff had been found and cleaned. ... A properly setup firewall would never have permitted an exe to pass through to the users email box. ... The mail is also pre-scanned with MailScanner (incorporates ClamAV anti-virus and SpamAssassin anti-spyware)before it hits Exchange. ... In any case, I am dissappointed in the performance of Trend in this instance, because despite the protection, a deep infection occurred, which required a site visit to fix. ...
    (microsoft.public.windows.server.sbs)
  • Re: launch an exe file from a web page...I use jsp and i cannot use VBScript...
    ... I want to launch an exe file(executable jar file) from a web page. ... Not on an Internet site. ...
    (comp.lang.javascript)
  • Re: Need an advice with this (multithread)
    ... be collected by the garbage collector before they've completed. ... An EXE is ... Windows Services ... >> I suggest you have ASP.NET launch an EXE to do this or queue up a windows ...
    (microsoft.public.dotnet.framework.aspnet)