Discussion Locked

Unknown executable in Task Manager

0 helpful
7 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hello, my user has had huge problems with Spyware and Viruses. I have removed most of them and I am trying to identify this exe. tcpkb.exe. I Have been unable to identify it. Also why does it re-appear after it has been stopped using MSCONFIG? It re-appears almost immediately. My user is running WinXP Home SP-1. She is connecting to the internet via Netzero.

7 replies

by blackcurrant

Hi Thawk704

Some spyware does not exist as an executable per se. Some is loaded by a command from the registry, which extracts the file from a zipped archive. I would do a search of all files and look for any file containing the text 'tcpkb.exe' or 'tcpkb' sans quotes.

I use Norton AntiVirus as well as Adaware, and have discovered that because NAV scans compressed files, it identifies compressed spyware that Adaware misses.

Good luck

by thawk55

Thanks, I have used both Norton and Ad-Aware. Neither identified
this executable. I will however check the registry. I beleive this exe has something to do with the user's ISP.

by techierob

MSCONFIG is only half the battle, sometimes you have to disable the corresponding keys in the registry. Also check if this executable is trying to run as a service.
For all of my virus related stuff, I use spybots search and destroy and Nortons. I find that any scan from safe mode pretty much eliminates any threat I have found so far

Hope that helps :)

by zlitocook

I can not find that tcpkb any where on the net. Are you sure on the spelling? Any way you need to disable the system restore, because it will alow a virus or other malware to reinstall itself. Dao this before trying to remove it. Then update all antivirus, ad aware and spybot search and destroy programs. Run ad aware, spybot and your antivirus. Let it remove any thing that is not needed then go to start/run and type in regedit. Then back up the registry to a place that you can find if you need it. Because when you make changes to the registry it can cause your computer to be unstable or unusable. You can use the find in the registry to locate the tcpkb and delete it. You can also look in HKEY/LOCALMACHINE/SOFTWARE/MICROROSOFT/WINDOWS/CURRENTVERSION. Or close to that to see what is set to load at start up, look at the run settings this will show you what is setup to run at start up. Be vary carefull with the registry!

by thawk55

Thanks, I have never been comfortable editing the Registry, but I think I will give it a try.

This discussion is closed to new replies.