My system is haunted!

[BAL007]

This is not a joke! I started to hear sporadically some music and voice on my
PC, like if I was listening to a radio station; I have no such application on
my system. When this is happening, only ordinary applications (like Outlook
or Word) are running. Stopping all the applications does not make any
difference. When it happens, I have noticed that a process called 17134.exe
is running and is consuming quite a lot of memory space. At start-up of my
system, the original memory space used by that process is around 2000K but
when I start hearing the sounds, the amount of memory used is around 58000K
and varying; it uses between 10 to 30% of CPU. If I stop the process, the
situation goes back to normal, no more sounds. The description of the process
is “Unload PerfMon Countersâ€. I looked for a file named 17134.exe on my disk
but there is no such file. When I start my system, I have a window with an
error message: 17134.exe application error, click OK to terminate the
program. The process is recreated automatically. I make sure that my
anti-virus is always up-to-date and I ran a full scan on my system. Nothing
unusual was detected. I would like to know if that process is legitimate, and
why it behaves like that. Any thoughts?

 

[Bruce Chambers]

This is not a joke! I started to hear sporadically some music and voice on my
PC, like if I was listening to a radio station; I have no such application on
my system. When this is happening, only ordinary applications (like Outlook
or Word) are running. Stopping all the applications does not make any
difference. When it happens, I have noticed that a process called 17134.exe
is running and is consuming quite a lot of memory space. At start-up of my
system, the original memory space used by that process is around 2000K but
when I start hearing the sounds, the amount of memory used is around 58000K
and varying; it uses between 10 to 30% of CPU. If I stop the process, the
situation goes back to normal, no more sounds. The description of the process
is “Unload PerfMon Countersâ€. I looked for a file named 17134.exe on my disk
but there is no such file. When I start my system, I have a window with an
error message: 17134.exe application error, click OK to terminate the
program. The process is recreated automatically. I make sure that my
anti-virus is always up-to-date and I ran a full scan on my system. Nothing
unusual was detected. I would like to know if that process is legitimate, and
why it behaves like that. Any thoughts?

The file "17134.exe" is most certainly not legitimate, and is a sure
sign that whatever anti-virus application you're using is not adequate
protection. Not that the file is necessarily a virus, per se, but it is
certainly not a welcome addition to your system. What other
anti-malware measures have you taken? Remember, there are several types
of malware, and many of them are not detected by purely anti-virus
applications.

As you're getting an error message that clearly indicates that the
program is trying to initiate each time you start Windows, the first
thing you should do is use MSConfig to determine how the file program is
starting, and where it's located.

This Knowledge Base Article refers to WinXP, but the same
principles apply in Vista:

How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;310560

Remember, Msconfig was designed to be a troubleshooting tool, not a
"startup configurer." Use MSConfig to determine the location of the
command that is attempting to start the program, and remove it. To
cease the selective startup notifications, either return your settings
to the way they were, or permanently remove the undesirable programs
from your startup configuration.

Additionally, in Vista, Windows Defender can be used to
monitor/control Startup programs. To use Windows Defender, click the
Orb > Control Panel > Windows Defender > Tools > Software Explorer and
select the "Startup Programs" category.

Additionally, AutoRuns from Sysinternals is a bit more complicated,
but it'll provide the same (and much more) information and capabilities:

http://www.microsoft.com/technet/sysinternals/SystemInformation/Autoruns.mspx


I'd also have to conclude that the reason you've failed, so far, to
find the file is that you've unwisely left Windows Explorer's default
settings, and haven't re-enabled the capabilities to see and search for
hidden or "system" files.


--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

 

[peter]

Hey. .its an echo!
Must be reverberating from his empty head
peter

 

[Malke]

This is not a joke! I started to hear sporadically some music and voice on
my PC, like if I was listening to a radio station; I have no such
application on
my system. When this is happening, only ordinary applications (like
Outlook or Word) are running. Stopping all the applications does not make
any difference. When it happens, I have noticed that a process called
17134.exe is running and is consuming quite a lot of memory space. At
start-up of my system, the original memory space used by that process is
around 2000K but when I start hearing the sounds, the amount of memory
used is around 58000K and varying; it uses between 10 to 30% of CPU. If I
stop the process, the situation goes back to normal, no more sounds. The
description of the process is ?Unload PerfMon Counters?. I looked for a
file named 17134.exe on my disk but there is no such file. When I start my
system, I have a window with an error message: 17134.exe application
error, click OK to terminate the program. The process is recreated
automatically. I make sure that my anti-virus is always up-to-date and I
ran a full scan on my system. Nothing unusual was detected. I would like
to know if that process is legitimate, and
why it behaves like that. Any thoughts?

As the others have told you, your computer is probably infected. Scanning
with an antivirus (which one?) isn't adequate. Go through these general
malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

If you can't do the work yourself (and there is no shame in admitting this
isn't your cup of tea), take the machine to a professional computer repair
shop (not your local equivalent of BigComputerStore/GeekSquad). Please be
aware that not all local shops are skilled at removing malware and even if
they are, your computer may be so infested that Windows will need to be
clean-installed. If possible, have all your data backed up before you take
the machine into a shop.

Malke