Duplicate & triplicate processes problem

[primecut36]

Hi folks,

I have what is probably an old problem to you pros. My friend's computer was running very slowly. Spybot was able to fix that. But I noticed two & even three instances of several processes running. Sometimes the process had the same name just with a space added before the ".exe". I can provide a detailed list if necessary. This is on an XP SP2 system. Any help will be appreciated. TIA.

 

[gbhall]

Some such as svchost.exe always have several copies, but yes, it would be a good idea to list the multiples for us. Also use google to just enter the name of the executable, like 'isass.exe' (without the quotes of course), and you will find lots and lots of information about what the process is supposed to be. If in addition they tell you where it should run from, you can check that the location e.g. Windows\system32 has the ONLY copy of that particular executable, and mostly this ensures it is genuine.

**WARNING** most of the process description pages that come from the google search offer to 'chcek your system or 'download this to solve your problem' etc etc. DO NOT CLICK ANY OF THOSE LINKS.

Just absorb the information, which is almost always accurate, but do not fall into the trap of downloading something that might well be a trojan horse, or could make things worse so they can sell you a 'solution' to the mess they created. Unfortunately, it is impossible to tell which sites are genuine and which are organised EXTORTION.

Suddenly noticed you mentioned executables with a space before '.exe'. That sounds very, very suspicious to me.

 

[primecut36]

I have attached (2) screenshots of task manager which show the duplicate processes and extra space in some names.

I have searched several process names & know not to click on any "free scans". Most processes appear to be legitimate and/or no security threat. I am aware I need to disable/delete kernel.exe & mrofinu....exe. My main concern is the presence of duplicate processes and the ones with the space in the name. Do you know what may be causing this?

Thanks for your prompt response and assistance.

 

[gbhall]

Wow, see what you mean. Never seen anything like that before ! I can only see one with a space in the name, but that is mentioned everywhere as a trojan - you need a deep clean. Start here www.techspot.com/vb/topic58138.html

 

[DelJo63]

Hopefully Myra is a LUA account and not an Admin User.

Sure looks like an infection