"Enabled"

[Guest]

Hi,
I'm trying to figure out an entry under the "Exceptions" tab in Windows
Firewall dialogue box. Most of them are very obvious e.g. Dreamweaver,
hp..., Windows Media Connect(?) but this one is named "enabled" under
"Programs and Services". If I click on "edit" it lists an executable
"voi634.exe". I can't figure out what this is. I've tried Google and
Answers That Work's database and I can't find anything. I'm hoping someone
might have come across this.

Best regards of the season,

 

[Steven L Umbach]

See if the path to the file is in a folder that belongs to legitimate
application you have installed on your computer or not which may provide a
clue as to what it is for. You could also use the free port mapping utility
called TCPView to see if you find that executable/process listening or
established on a port and if you click on a process it will tell you who the
publisher is that can help identify it. Personally I have never seen any
info on that file and it would be smart to scan your computer for malware
and spyware. You could also remove the exemption and make sure that "display
a notification when Windows Firewall blocks a program" so that you can see
when it tries to access your computer whether it is something you need or
not. --- Steve

http://www.sysinternals.com/Utilities/TcpView.html --- TCPView

 

[Guest]

I'll try TCPView ty and I'll post back if I find anything definitive as to
whether or not it's malware. There is/was (should be gone now) a trojan on
the computer (these holiday seasons bring all kinds of presents) that Trend
sent down a new pattern file on late tonight - Troj_DLOADER.BFK - but I'm not
knowledgeable enough about ports etc to know if that has anything to do with
it.

I tried to trace the exe file as soon as I saw it. However it shows up
nowhere on the system. I realize that doesn't mean it can't possibly be
there but I don't see it from the "cmd" prompt at "run" either. I haven't
tried bypassing Windows completely on boot but I suppose I could. I was
looking for the easy answer Anyway I have blocked it for now until I can
find out more.

Thanks for you input.

 

[Steven L Umbach]

When you look for the file in the path that was shown be sure to select the
folder option/view to show hidden and system files. Also you can use search
for a file and select "more advanced options" to search for system and
hidden files which you may not want to do on a normal search since it could
take a lot longer to search for a regular file. It is possible the file has
already been removed by a malware/spyware scan or when you uninstalled an
application. --- Steve

 

[Guest]

Steve, your link dosent work I get error 404

See if the path to the file is in a folder that belongs to legitimate
application you have installed on your computer or not which may provide a
clue as to what it is for. You could also use the free port mapping utility
called TCPView to see if you find that executable/process listening or
established on a port and if you click on a process it will tell you who the
publisher is that can help identify it. Personally I have never seen any
info on that file and it would be smart to scan your computer for malware
and spyware. You could also remove the exemption and make sure that "display
a notification when Windows Firewall blocks a program" so that you can see
when it tries to access your computer whether it is something you need or
not. --- Steve

http://www.sysinternals.com/Utilities/TcpView.html --- TCPView

 

[Steven L Umbach]

Hmm. It seems to work for me. If you search Google for TCPView you will find
it. --- Steve