Join or sign in Register for your free TechRepublic membership or if you are already a member, sign in using your preferred method below. Use Your Email Use FacebookUse Linkedin

Form1, Terrorizing my PC?

Locked

Ey, guys

When I startup my computer a program called Form1 pops up. When I open task manager to trace its origin, the process is called system.exe. This “system” is also in the list at the startup tab of MsConfig. What is this program? Can I remove it safely from the list?

Topic

Clarifications

In reply to Form1, Terrorizing my PC?

Clarifications

I wouldn’t recommend removing this

In reply to Form1, Terrorizing my PC?

I would try running something like your AV Scanner and Malwarebytes

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol&cdlPid=10878968

In Safe Mode to see if they pick up anything.

As for System.Exe you would have to look to see where it resides to even consider if it is safe to remove. But I would suggest scanning in Safe Mode without networking after you have updated your AV Product and installed & updated Malwarebytes.

The worst that will happen is you waste a bit of time and nothing shows.

Col

Reponse To Answer

In reply to I wouldn’t recommend removing this

It IS certainly safe to remove from the autostart list. “system” is a single process that is used to launch other processes. Services are not in the autorun list. They are managed from the “Services” MMC snap-in. System will also not be found in an Autorun list. It should show up as only “System” and not “System.exe”

“Form1” is certainly the default name of a VB object. This is a homebrew PUP, most likely malicious. Due to it’s amatuer nature it might not be found by traditional anti-virus programs.

If it’s filename is “system.exe” then it would be hard to distinguish it from the genuine System process. You may have to find the location of the file and manually delete it. In Win7 you can right click it and goto file location. For XP you will need a tool like this:
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Yeah, this sounds like a malware failure.

In reply to Form1, Terrorizing my PC?

Perhaps some n00b trying to create malware with VB or some other MS IDE.

Only thing I’d add to Col’s suggestion is that if you keep getting a positive on successive scans, kill System Restore and scan again (in Safe Mode).

[Author]

Replies