Windows Forum

Ask something
Discussion Locked

Unknown Service Running

0 helpful
11 replies

by -bw-

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I had a system on our network that is losing all of its processor time to a process called odbcweb.exe. No matter what I do, I can?t seem to end the process. I?ve searched Google, MSN, Excite, Symantec and Microsoft?s website for anything relating to this file, and have found absolutely nothing. Here is what I?ve done to try and fix/get rid of this process. I?m thinking rebuilding the machine will be the only way to get rid of it.

Ran SpyBot S&D with updated files in both normal mode and safe mode, and on startup.
Removed all other adware/spyware applications on the machine using SpyBot and Add/Remove Programs.
Checked the core files used by ODBC and any other files that ODBC uses, and this never comes up, so I believe it is totally unrelated.
Searched the entire machine for odbcweb* and only found 2 files, odbcweb.exe and odbcweb-A42E.pf (not pif). It found both files in the C:\Windows\Driver Cache folder. I tried renaming both files and ending the process, but to no avail, it started back up again. I also tried deleting the files, which it allowed, and now both files are completely gone. I tried ending the process after that, and it continues to start back up. I then restarted the machine in case it was running completely from memory, but it still starts when anyone logs in. And the files are still no where to be found.
Searched all of the services that are running on the machine in normal mode and safe mode and found nothing relating to this file.
Searched the entire registry and deleted all keys pertaining to odbcweb*.
Ran msconfig from the RUN window and modified all of the startup options.

So, now I?m stuck. There are no files on the computer named odbcweb* or anything in the registry pertaining to odbcweb* and this process continues to start and hog all resources. My only guess is that the real file behind this is named something else?

Anyone have any suggestions?

11 replies

by house

Sounds like a bot to me. It probably won't be recognized by your spyware remover if it is a newer irc hack. Use the trend micro site. They can scan for malware remotely with their housecall utility.

Do a search for *.bat and check out unusual entries with the edit command. Check out your c:\ - c:\windows or c:\winnt - c:\wutemp; look for unusual folders in your root. Also look for *.txt and read every one that is suspect.

by blackcurrant

Hi

As well as trying the suggestions above, try searching for files containing the text odbcweb*. Some spyware/adware is contained within compressed files and this may identify the source.

Good luck

by yetanotheradmin

I had something similar recently every time I ended the process it started up again. Jot down all running processes, end the process tree and see what else goes missing. Then get rid of the culprit. It seems to be another process that automatically creates and starts odbcweb.exe Also check the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Good luck!

This discussion is closed to new replies.