Question

  • Creator
    Topic
  • #2173817

    Form1, Terrorizing my PC?

    Locked

    by wompai ·

    Ey, guys

    When I startup my computer a program called Form1 pops up. When I open task manager to trace its origin, the process is called system.exe. This “system” is also in the list at the startup tab of MsConfig. What is this program? Can I remove it safely from the list?

All Answers

  • Author
    Replies
    • #2811015

      Clarifications

      by wompai ·

      In reply to Form1, Terrorizing my PC?

      Clarifications

    • #2811011

      I wouldn’t recommend removing this

      by oh smeg ·

      In reply to Form1, Terrorizing my PC?

      I would try running something like your AV Scanner and Malwarebytes

      http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol&cdlPid=10878968

      In Safe Mode to see if they pick up anything.

      As for System.Exe you would have to look to see where it resides to even consider if it is safe to remove. But I would suggest scanning in Safe Mode without networking after you have updated your AV Product and installed & updated Malwarebytes.

      The worst that will happen is you waste a bit of time and nothing shows.

      Col

      • #2881497

        Reponse To Answer

        by spitfire_sysop ·

        In reply to I wouldn’t recommend removing this

        It IS certainly safe to remove from the autostart list. “system” is a single process that is used to launch other processes. Services are not in the autorun list. They are managed from the “Services” MMC snap-in. System will also not be found in an Autorun list. It should show up as only “System” and not “System.exe”

        “Form1” is certainly the default name of a VB object. This is a homebrew PUP, most likely malicious. Due to it’s amatuer nature it might not be found by traditional anti-virus programs.

        If it’s filename is “system.exe” then it would be hard to distinguish it from the genuine System process. You may have to find the location of the file and manually delete it. In Win7 you can right click it and goto file location. For XP you will need a tool like this:
        http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

    • #2811005

      Yeah, this sounds like a malware failure.

      by seanferd ·

      In reply to Form1, Terrorizing my PC?

      Perhaps some n00b trying to create malware with VB or some other MS IDE.

      Only thing I’d add to Col’s suggestion is that if you keep getting a positive on successive scans, kill System Restore and scan again (in Safe Mode).

Viewing 2 reply threads