Re-appearing file

Blast · 06-25-2008, 08:31 PM

stupid crash.exe keeps appearing. It disappears for a while (weeks to months), and then comes back. I have tried Spybot shredder, normal delete and hijackthis delete on reboot. Nothing works. It isn't detected as a virus, but, it is somewhat known what crash.exe does...uhh...maybe crash the computer XD

Any ideas?

Located in C:\windows\system32\crash.exe

tetonbob · 06-25-2008, 09:41 PM

Possibly this:

http://www.bleepingcomputer.com/star....exe-8844.html

Scan the file at www.virustotal.com and see what it comes up with.

If you need further assistance....

If you think your computer is infected....

Blast · 06-26-2008, 10:42 AM

it always comes up empty in any virus scan i have done. I tried virus total, nothing.

It does not run when i turn my computer on. Well...in taskmanager.

I did the bleeping computer tutorial and that did not help. I DON'T SEE IT IN THE AUTORUN THING!!!

What can i do?

tetonbob · 06-26-2008, 02:09 PM

Typing in CAPS is akin to yelling. Please don't.

Check the file properties for a version tab. Company name, etc..

Upload the file here:

http://www.bleepingcomputer.com/subm...php?channel=28

Blast · 06-26-2008, 09:22 PM

I submitted it. What do i do now?

(sorry for caps, i didn't see them XD)

tetonbob · 06-26-2008, 09:34 PM

Do you have an ATI Radeon video card?

Blast · 06-27-2008, 10:42 AM

Yes. ATI Radeon XPress 1100

tetonbob · 06-27-2008, 11:29 AM

This file contains strings which relate the the bios version of an ATI Radeon card.

I don't think it's malicious.

Blast · 06-27-2008, 12:47 PM

mmk....so it is safe?

(but still don't click on it XD)

tetonbob · 06-27-2008, 01:02 PM

It would seem so. 33 Vendors find no suspicious/malicious behavior at VirusTotal. Does your own onboard AntiVirus concur? It should. You do have an AntiVirus, right?

Strings in the file seem to say it has something to do with BIOS version for a video card you have installed. Might have something to do with BIOS updates for the video card, but I'm not sure.

You may want to ask the guys in hardware section if they recognize it for what it is or does, but it certainly doesn't seem malicious.

How do you happen to notice it? Does it appear in your running processes? Under what scenario does it appear?

You can use something like Process Explorer to see what dlls are loading to try to help you pin it down, but I don't think I'd worry too much about it. It's really too small to hold much malicious code, even if it were, which I'm reasonably certain it is not.

Blast · 06-27-2008, 01:23 PM

I have: AVG 8, Spybot S & D, Hijackthis, Emsisoft A-Sqaured for antivirus not to mention a hacker (my friend with my permission) guarding my computer. He said he did not want to risk dissecting it and that i should just be cautious with it. He says it may crash my system judged by the name.

I have never seen it in my taskmanager.

06-25-2008, 08:31 PM	#1 (permalink)
Blast Registered User Join Date: Jun 2008 Location: North Dakota Posts: 144 OS: Windows XP SP3 My System	Re-appearing file stupid crash.exe keeps appearing. It disappears for a while (weeks to months), and then comes back. I have tried Spybot shredder, normal delete and hijackthis delete on reboot. Nothing works. It isn't detected as a virus, but, it is somewhat known what crash.exe does...uhh...maybe crash the computer XD Any ideas? Located in C:\windows\system32\crash.exe

06-25-2008, 09:41 PM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 25,490 OS: 2000 Pro; XP Pro; XP Home	Re: Re-appearing file Possibly this: http://www.bleepingcomputer.com/star....exe-8844.html Scan the file at www.virustotal.com and see what it comes up with. If you need further assistance.... If you think your computer is infected.... __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Our help is voluntary, but this site needs donations to operate. Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience.

06-26-2008, 10:42 AM	#3 (permalink)
Blast Registered User Join Date: Jun 2008 Location: North Dakota Posts: 144 OS: Windows XP SP3 My System	Re: Re-appearing file it always comes up empty in any virus scan i have done. I tried virus total, nothing. It does not run when i turn my computer on. Well...in taskmanager. I did the bleeping computer tutorial and that did not help. I DON'T SEE IT IN THE AUTORUN THING!!! What can i do? Last edited by Blast : 06-26-2008 at 11:12 AM.

06-26-2008, 02:09 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 25,490 OS: 2000 Pro; XP Pro; XP Home	Re: Re-appearing file Typing in CAPS is akin to yelling. Please don't. Check the file properties for a version tab. Company name, etc.. Upload the file here: http://www.bleepingcomputer.com/subm...php?channel=28 __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Our help is voluntary, but this site needs donations to operate. Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience.

06-26-2008, 09:22 PM	#5 (permalink)
Blast Registered User Join Date: Jun 2008 Location: North Dakota Posts: 144 OS: Windows XP SP3 My System	Re: Re-appearing file I submitted it. What do i do now? (sorry for caps, i didn't see them XD)

06-26-2008, 09:34 PM	#6 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 25,490 OS: 2000 Pro; XP Pro; XP Home	Re: Re-appearing file Do you have an ATI Radeon video card? __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Our help is voluntary, but this site needs donations to operate. Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience.

06-27-2008, 10:42 AM	#7 (permalink)
Blast Registered User Join Date: Jun 2008 Location: North Dakota Posts: 144 OS: Windows XP SP3 My System	Re: Re-appearing file Yes. ATI Radeon XPress 1100

06-27-2008, 11:29 AM	#8 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 25,490 OS: 2000 Pro; XP Pro; XP Home	Re: Re-appearing file This file contains strings which relate the the bios version of an ATI Radeon card. I don't think it's malicious. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Our help is voluntary, but this site needs donations to operate. Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience.

06-27-2008, 12:47 PM	#9 (permalink)
Blast Registered User Join Date: Jun 2008 Location: North Dakota Posts: 144 OS: Windows XP SP3 My System	Re: Re-appearing file mmk....so it is safe? (but still don't click on it XD)

06-27-2008, 01:02 PM	#10 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 25,490 OS: 2000 Pro; XP Pro; XP Home	Re: Re-appearing file It would seem so. 33 Vendors find no suspicious/malicious behavior at VirusTotal. Does your own onboard AntiVirus concur? It should. You do have an AntiVirus, right? Strings in the file seem to say it has something to do with BIOS version for a video card you have installed. Might have something to do with BIOS updates for the video card, but I'm not sure. You may want to ask the guys in hardware section if they recognize it for what it is or does, but it certainly doesn't seem malicious. How do you happen to notice it? Does it appear in your running processes? Under what scenario does it appear? You can use something like Process Explorer to see what dlls are loading to try to help you pin it down, but I don't think I'd worry too much about it. It's really too small to hold much malicious code, even if it were, which I'm reasonably certain it is not. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Our help is voluntary, but this site needs donations to operate. Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience.

06-27-2008, 01:23 PM	#11 (permalink)
Blast Registered User Join Date: Jun 2008 Location: North Dakota Posts: 144 OS: Windows XP SP3 My System	Re: Re-appearing file I have: AVG 8, Spybot S & D, Hijackthis, Emsisoft A-Sqaured for antivirus not to mention a hacker (my friend with my permission) guarding my computer. He said he did not want to risk dissecting it and that i should just be cautious with it. He says it may crash my system judged by the name. I have never seen it in my taskmanager.