Windows Forum

Ask something
Discussion Locked

What is apiep.exe?

0 helpful
6 replies

by allisonmea

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My win2000 machine hung during login. I ctrl alt deleted and noticed a process running multiple times named apiep.exe. I had to restart the machine to get rid of it. Google doesn't show anything by that name. Anybody seen this beastie?

Mike Allison

6 replies

by joseph moore

If you couldn't find it with Google, then it's probably a virus. Many viruses pick random names for themselves.
Get some antivirus software, update it to the current definitions, and do a full scan.
Get some antispyware software too, update it, and run its full scan also. I recommend Ad-Aware:
http://www.lavasoftusa.com/support/download/

by maxwell edison

I think Joseph Moore was right on, and you should have acepted his answer.

I, too, believe that you have a virus, more likely a trojan. A couple of my users were recently infected with the Backdoor.Berbew.F trojan.

The Backdoor.Berbew.F is a Backdoor Trojan horse that allows a compromised computer to be used as a Web proxy. This Trojan also attempts to steal cached passwords from an infected computer and send them to a Web site in some far away place like Estonia.

The trojan creates files with names that are apparently no more than random characters. The ones I found on my users' computers were:

jsrxeeli.exe
lhtotcol.exe
qzlwfkyt.exe

No reference to any of those files anywhere - including Symantec itself - even though they were indeed trojans.

Moreover, Norton antivirus standard edition did not pick it up. However, Norton's Corporate edition did indeed identify those files as infected with this trojan.

That's what you've got, at least I'd wager a buck that you do.

by maxwell edison

.
Another possibility - but same conclusion:

http://www.symantec.com/avcenter/venc/data/pf/w32.bobax.d.html

This Symantec Web site describes a worm that created files using a random number of random characters when creating itself. Symantec says the following:

When W32.Bobax.D is executed, it performs the following actions:

1. Creates a mutex named "00:24:03:54A9D" so that only a single copy of the worm is present in memory.

2. Copies itself as
%System%\.exe, where is a random number of random characters.

There is also a registry entry created, but read the article for more symptoms.

Just food for thought.....

By the way, Joseph Moore is a sharp guy, and hit this one right on the head, at least in my opinion.

This discussion is closed to new replies.