[hybridfury]

Hey all, first post here I recently just noticed a new process running in my task manager called upexmhwn.exe, apparently its been there for a month. The file is located at c:\ProgramData\qpadengd\upexmhwn.exe. The description in the task manager just says the file name. I've searched multiple search engines for this file and all have come up with 0 hits. It seems to load up with windows everytime I boot up. It doesn't appear in services. I have renamed the file which seems to have stopped it from starting up upon reboot. Does anyone have any insight on what this file may be? Should I just delete it?

 

[deleted122510]

Hi -

Kill it.

 

[hybridfury]

By just deleting it? It's no longer booting up since I renamed it, but It's likely i guess that its embedded in registry somewhere, should I be concerned about that? I searched in msconfig in services and startup, but it doesn't appear there anywhere.

 

[deleted122510]

Hi -

Have you tried a third-party start up manager like CCleaner?

I'm going to analyze your process, please use the following guide :

I'll begin assuming you're capable and that you have all necessary tools such as an appropriate archive tool such as 7z and that you downloaded this debugger tool (Mirror #1, Mirror #2).

Lets begin :

Step 1: Open the debugger tool.
Step 2: You'll now see this. Go to "File" in the top-right corner located here.
Step 3: Click on "File", and select "Open Executable..." located here. If you believe you're process is a virus or corrupted select "Attach to a Process" which is directly below "Open Executable" as shown here.
Step 4: Please select "c:\ProgramData\qpadengd\upexmhwn.exe".
Step 5: You'll now see a white dialog within the debugger tool (like this) - go up to "Edit" right besides "File" located here.
Step 6: Select "Select all" located here. Now, ALL text will be highlighted (it will be all blue if highlighted)
Step 7: Copy it all by either moving your mouse over the highlighted text and right-click and select "Copy" OR just press "CTRL" + "C" keys on your keyboard, this will automatically copy all the selected text.
Step 8: Make all the copied text a text file, if you know how to do this, post it as an attachment, if you do not know how to do this - please continue this guide. If you're able to do this, do not continue this guide and post it as an attachment.
Step 9: Make a new text file by right-clicking on your desktop anywhere and selecting "New" then "Text Document" as shown here - from here you can just paste all the copied text from the debugging tool into the window by right-clicking and selecting "Paste" or simply by pressing "CTRL" + "V". Go to "File" and select "Save as..." and save it to your desktop. Post it as an attachment on TSF.

 

[hybridfury]

Here it is, thanks for you assistance.

 

[hybridfury]

Oh, and no I have never used CCleaner, but it's downloading now

 

[deleted122510]

Hi -

Interesting, it's attached to system files.

If you could please download Process Explorer and send me it's log, I'd really appreciate a second opinion (since the above method was just to check something about, nothing official really)

Thanks.

 

[hybridfury]

Here ya go.

 

[deleted122510]

Hi -

It's taking up quite a bit of CPU there..

Step 1: Go back into Process Explorer.
Step 2: Select "upexmhwn.exe".
Step 3: Right-Click, go to "Properties"
Step 4: Please take a screen grab of the "Performance" and "TCP/IP" tabs.

Thanks.

 

[deleted122510]

Hi -

What exactly happens when you kill it? Do you got a BSOD or an error?

When did you first see it?

Around the first time you saw it, did you recently have any viruses or download any programs?

Thanks.

 

[hybridfury]

Here they are.

 

[hybridfury]

I just noticed it today, but the date stamp on the file and folder are from a bit over a month ago. If I end the process nothing happens that I notice other than it doesn't show up anymore in processes. I have never had any viruses on this pc that I know of.

 

[deleted122510]

Hi -

I'd go ahead and kill it especially since there's a network attached to it - that's just not right, especially for a process Google has never even heard of. Sounds really..really..fishy.

 

[hybridfury]

Hi -

I'd go ahead and kill it especially since there's a network attached to it - that's just not right, especially for a process Google has never even heard of. Sounds really..really..fishy.

If I kill it, it just starts back up upon reboot. I can rename it and it doesn't boot back up tho.

 

[deleted122510]

Hi -

(sorry for the long wait time, I just ate dinner)

Make it to where it doesn't boot back up.

 

[deleted122510]

Hi - What's in the folder with the process?

Are there any other other files?

 

[hybridfury]

Ok, I renamed it and it is no longer starting up upon boot. Should I just delete the file or leave it there in it's renamed state?

 

[deleted122510]

Read the above post to answer that question; http://www.techsupportforum.com/2153736-post16.html

 

[hybridfury]

Read the above post to answer that question; http://www.techsupportforum.com/2153736-post16.html

Oh, oops didn't see that post lol. Nope there is nothing else in the folder so I deleted it with no problems. Thanks for your time and support and I hope your dinner was good

 

[deleted122510]

Thank you, no problem.

If you have any more problems, just ask.

Also, it was good - My Mom is full Italian - so that means good food!

Take it easy.