Identify these processes?

[Pretorius]

bfhaxh.exe
tmotbozp.exe
winitr32.exe
regsrv32.exe
serm32.exe
winmon32.exe
asetup32.exe

I'm under the impression that most unfamiliar files that crop up with '32' in their title are unwelcome.

And can anyone recommend a really good downloadable firewall (free, preferably).

Thanks.

 

[Lorand]

You probably have a virus. So first run a virus check (http://housecall.trendmicro.com).
A good (and free) firewall is ZoneAlarm (http://www.download.com/3000-2092-10039884.html?part=zonealarm&subj=dlpage&tag=button).

 

[Praetor]

The only one there that should be there is regsvr32 which is just a DLL/OCX registry tool

 

[Lorand]

It depends on how it was executed. The W32/Rbot-GM worm (http://www.sophos.com/virusinfo/analyses/w32rbotgm.html) copies itself to regsrv32.exe in the Windows system folder.

 

[Praetor]

Ya that too.. odds are, regarding regsvr32, it'll finish so fast you'll never see it in the taskmanager for long.

 

[Pretorius]

Ya that too.. odds are, regarding regsvr32, it'll finish so fast you'll never see it in the taskmanager for long.

No, it stays there. And when it's there, Task Manager shuts down the instant it opens.

I've had trouble with lsasss, avserve2, etc. But all of a sudden these weird processes are popping up, like I have something on my computer that's randomly generating them.

The list of new processes is now:

bfhaxh.exe
tmotbozp.exe
winitr32.exe
regsrv32.exe
serm32.exe
winmon32.exe
asetup32.exe
cwcvcw.exe
tiujpu.exe
wowexec.exe
ntvdm.exe
syscfg32.exe

I got Process Explorer, which allows me to close them on startup. But they keep coming.

 

[Praetor]

- Run a spyware check (while not online)?
- Consider Agnitum's Outpost firewall (free and quite effective)