What the heck is gkbubhz.exe

[Mark H]

I have been trying to figure out what is troubling my
network performance (internet specifically). According to
ZoneAlarm, there is a program called 'gkbubhz.exe' that is
constantly accessing the internet. In desperation, I have
told ZoneAlarm to deny access to the 'net for this
program. I then proceeded to kill the process in Task
Manager. As soon as I did that my network performance
*significantly* improved. I have searched the Microsoft
site and have been unable to find any references to this
program. I backed up my registry, then searched through
it and found several references to this program (labelled
Microsoft Update most of the time in the registry). I
removed all references to this (for the time being).
My question is does anyone know what 'gkbubhz.exe' is all
about ?

Thanks in advance
MarkH

 

[Steve Winograd [MVP]]

I have been trying to figure out what is troubling my
network performance (internet specifically). According to
ZoneAlarm, there is a program called 'gkbubhz.exe' that is
constantly accessing the internet. In desperation, I have
told ZoneAlarm to deny access to the 'net for this
program. I then proceeded to kill the process in Task
Manager. As soon as I did that my network performance
*significantly* improved. I have searched the Microsoft
site and have been unable to find any references to this
program. I backed up my registry, then searched through
it and found several references to this program (labelled
Microsoft Update most of the time in the registry). I
removed all references to this (for the time being).
My question is does anyone know what 'gkbubhz.exe' is all
about ?

Thanks in advance
MarkH

That's probably a spyware program with a randomly generated name. It
isn't a Microsoft program.

Download and run these spyware removal tools:

Ad-aware: http://www.lavasoftusa.com
Spybot Search and Destroy: http://www.safer-networking.org
--
Best Wishes,
Steve Winograd, MS-MVP (Windows Networking)

Please post any reply as a follow-up message in the news group
for everyone to see. I'm sorry, but I don't answer questions
addressed directly to me in E-mail or news groups.

Microsoft Most Valuable Professional Program
http://mvp.support.microsoft.com

 

[refv2]

(snip)

My question is does anyone know what 'gkbubhz.exe' is all
about ?

Thanks in advance
MarkH

Short answer = Spyware, Malicious adware, Trojans, Backdoors.

Ever heard of Adaware, Spybot Search and Destroy, Highjack This,
CWShredder? Google is your friend!

Later

 

[Michael D. Alligood]

gkbubhz.exe is associated with spyware programs. Anti-virus software and firewalls do not fully protect your system against the majority of spyware and privacy threats. Spyware is commonly bundled with software downloads, attached to e-mails, or transmitted through networks so it can appear to be legitimate software, but once installed it can be nearly impossible to detect and remove without the help of a dedicated spyware removal tool such as:

Ad-Aware 6.0 (build 6.181)

SpyBot 1.3

SpyWare Blaster

HiJackThis

Please make sure that you download the updates for each of these programs to ensure complete detection of known spyware programs. Although nothing is absolute in removing spyware and keeping it off, downloading and executing the programs above can dramically decrease future infections.

After Spyware / Adware is remove, you may get an error finding files on reboot

After you use anyone of these programs (with the exception of HiJackThis) you may receive an error of some sort after rebooting your system. This is pretty common. Many spyware programs add themselves in the Startup location and execute when Windows boots. If you recieve an error when rebooting after removing spyware, do not panic. This is more than likely a startup remnant trying to access the spyware program that is no longer on your computer. HiJackThis is a great utility to find and remove these startup remnants. However, there is a less technical way of removing these items:

(1) Click START to RUN and type: msconfig
(2) Select the STARTUP tab
(3) Uncheck the file that pertained to the startup error message you received
(4) Click APPLY and OK
(5) Reboot your system

If this fails to fix the startup error message after reboot, there are still options:

(1) Navigate to C:\Documents and Settings\All Users\Start Menu\Programs\Startup
(2) Delete the icon that pertained to the startup error message you received
(3) Navigate to C:\Documents and Settings\username\Start Menu\Programs\Startup
(4) Delete the icon that pertained to the startup error message you received
(5) Reboot your system

--
Best of luck!

Michael D. Alligood
MCSA, MCP, CCNA, A+,
Network+, i-Net+, CIW A, CIW CI