General discussion

Locked

tcpav.exe

By FlyingGoose ·
tcpav.exe is running process. Roughly every 5 seconds it consumes about 256MB of memory and 97% of my CPU cycles. It lasts about a second or two. Nothing shows up on any virus or spyware scan. I am using McAfee w/latest DAT + Spybot & Adaware. If I delete the process it comes right back, I have removed every reference of it in the registry and my HD. I found the .exe in \windows\prefetch, which I removed. But it must be hidden somewhere else.

I have, so far, been unable to find any reference of it anywhere.

Any ideas or suggestions would be greatly appreciated.

Thx

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

OS?

by scottsman In reply to tcpav.exe

What OS? if w2K or XP add a local group policy restricting tcpav.exe from running.

For questions concerning local group policy
http://labmice.techtarget.com/activedirectory/grpolicy.htm

This will not remove it but perhaps stop it from running.

Good Luck

Collapse -

Some suggestions

by BFilmFan In reply to tcpav.exe

Turn off System Recovery.
Reboot the system.
Scan it with Lavasoft's AdAware.
Scan it with BOClean.

See if you can find it then. I have to admit that I don't recall having seen anything on tcpav other than a distant memory that involved thermal tensors from my college days.

Hopefully some other expert will chime in here with the answer.

Collapse -

Process Librarty

by JamesRL In reply to tcpav.exe

I checked my usual source http://www.processlibrary.com/
but it doesn't show anything.

I would get a startup manager - you can find lots of freeware or shareware ones. That way you can block it from running.

I would suspect if it keeps coming back in the registry that another task initiates the infection.

James

Collapse -

Some additional Information

by FlyingGoose In reply to tcpav.exe

First, thx to all who have replied so far.

I forgot to mention the OS.....XP SP1.

Also, tcpav.exe does not show up in the startup tab of MSCONFIG, it only appears under the Process tab of Task Manager.

Collapse -

sometimes you gotta admit defeat

by gbrownlee In reply to tcpav.exe

As you have discovered, some things can be a bit of a pig to get rid of. I once spent countless hours trying to rid a system of a dialer virus. Eventually I found where it resided. It had renamed notepad.exe to notepad.com and moved it to a different location. It set up shop in a new folder it created called notepad.exe. Try looking in seldom used program files such as notepad or paint.

You are probably going to have to nuke your HDD and install a fresh OS.

Greg

Back to Malware Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums