cler.exe autorun - what is this?

[tradmusic]

We have a file called cler.exe running at start up and we're not sure if
it's legitimate.

We've been having problems with svchost.exe running up RAM usage until
eventually the system crashes and we're pretty sure it's a trojan or worm of
some kind.

There's nothing in Google about cler.exe and we're wondering if this is the
culprit.

When opening msconfig, cler.exe is listed as:

Startup Item: cler
Command: cler.exe autorun
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Does anyone know what this is? Also. what's the best way to get rid of it?

Thanks
Tracey.

 

[David Candy]

What does the file properties say about it. What folder is it in.

Type tasklist /svc in a command prompt
compare process ID with task manager and which service host is it (you'll have 4 or 5 (on a network)srvhost. Post the list of services in the svchost you are having problems with.

 

[tradmusic]

Thanks David,

Typed tasklist /svc into the command prompt and all I get is:

'tasklist' is not recognised as an internal or external command, operable
program or batch file.

What is happening is that svchost.exe is running several times in Task
Manager. One of these svchost.exe's, which is the only one marked as LOCAL
SERVICE, keeps increasing in RAM use until eventually the whole machine
crashes/freezes.

No anti-virus, anti-trojan or anti-pest software has detected anything
suspect with our system (and we have tried McAfee, PestPatrol, Adaware and
others!).

Really fed up of it now, and no-one seems to know what the problem is.
Really hope you can help. Thanks.

--
Trace.

What does the file properties say about it. What folder is it in.

Type tasklist /svc in a command prompt
compare process ID with task manager and which service host is it (you'll
have 4 or 5 (on a network)srvhost. Post the list of services in the svchost
you are having problems with.

 

[David Candy]

On my machine these are the services that are used by that one
svchost.exe 888 Alerter, LmHosts, RemoteRegistry, SSDPSRV,
WebClient
Tasklist is a XP pro command.

Type services.msc in Start - Run, stop the services one by one and see which service is causing the memory condition. Start with ssdpsvc as that sometimes causes other problems.

 

[davetest]

Thanks David,

Typed tasklist /svc into the command prompt and all I get is:

'tasklist' is not recognised as an internal or external command, operable
program or batch file.

What is happening is that svchost.exe is running several times in Task
Manager. One of these svchost.exe's, which is the only one marked as LOCAL
SERVICE, keeps increasing in RAM use until eventually the whole machine
crashes/freezes.

No anti-virus, anti-trojan or anti-pest software has detected anything
suspect with our system (and we have tried McAfee, PestPatrol, Adaware and
others!).

Really fed up of it now, and no-one seems to know what the problem is.
Really hope you can help. Thanks.

download the process explorer from www.sysinternals.com
use it to find out more about your system.
Regarding the file, use the search companion to find it,
review it's properties and location. Perhaps it will help.

Dave

 

[Plato]

We have a file called cler.exe running at start up and we're not sure if
it's legitimate.

One can easily disable it from running or rename it.

 

[tradmusic]

Thanks David,

Typed tasklist /svc into the command prompt and all I get is:

'tasklist' is not recognised as an internal or external command, operable
program or batch file.

What is happening is that svchost.exe is running several times in Task
Manager. One of these svchost.exe's, which is the only one marked as LOCAL
SERVICE, keeps increasing in RAM use until eventually the whole machine
crashes/freezes.

No anti-virus, anti-trojan or anti-pest software has detected anything
suspect with our system (and we have tried McAfee, PestPatrol, Adaware and
others!).

Really fed up of it now, and no-one seems to know what the problem is.
Really hope you can help. Thanks.

--
Trace.

What does the file properties say about it. What folder is it in.

Type tasklist /svc in a command prompt
compare process ID with task manager and which service host is it (you'll
have 4 or 5 (on a network)srvhost. Post the list of services in the svchost
you are having problems with.

 

[David Candy]

I posted the list of services on my machine in that svchost and told you to stop them one by one.