"kpa.exe"- Unknown process runs on WinXP

[Guest]

Not sure what kap.exe does, but it keeps trying to connect to internet. For
now I have blocked access to internet at ZoneAlarm firewall.
After a while there are multiple kpa.exe processes running on my systems.
Memory usage for each one of these is approx. 7800K. Only way I can get rid
it is by ending process on each one this.
I searched whole machine and I cannot locate this file on my machine. Only
matches are prefetch file under windows/prefetch directory. I searched
regedit and the only hit shows "kpa.exe" under software/microsoft/search
assistant/ACMru/5603.
Please help !

 

[Bert Kinney]

Hi,

If that is the correct spelling i would suspect a virus or spyware.
I would suggest you start by doing a virus scan with up to date virus
software, then scan for and removing any installed spyware.
If you are in need of virus software, here are a couple to choose
from, for free.
Download the software, and in Update Manager run Update
then do a complete virus scan.
Free Offer: eTrust EZ Armor Security Suite from Computer Associates
http://www.my-etrust.com/microsoft/index.cfm

Grisoft Freeweb: AVG Free Edition:
http://free.grisoft.com/freeweb.php/doc/1/

Search and destroy any installed SpyWare/malware/adware:
Ad-aware is a free multi spyware removal utility that scans
your memory, registry and hard drives for known spyware
components and lets you remove them safely. After installing
Ad-Aware make sure to run the update feature before scanning.
http://www.lavasoftusa.com/ For large amounts of installed
spyware and such, it may be necessary to run Ad-Aware several
times to clear them all.

Here are a couple more removal tools that should also be run.
CWShredder: http://aumha.org/freeware/freeware.php#cwshred

Spybot: http://www.safer-networking.org/

SpywareBlaster:
http://www.wilderssecurity.net/spywareblaster.html
SpywareBlaster doesn't scan and clean for spyware - it
prevents it from ever being installed. SpywareBlaster is
a non memory resident utility. It works by setting a "kill bit"
for the CLSIDs of spyware ActiveX controls, it prevents the
installation of any of them from a webpage.

For more information:
The Parasite Fight:
http://aumha.org/a/parasite.htm

Cleaning a Pest-Infested Computer:
http://rgharper.mvps.org/cleanit.htm