Unknown program icon

purplenova421 · Aug 25, 2017

Hello!
Recently I have noticed that there's strange program icon in icon bar, which bothers me.
I've checked Task Manager and didn't see any suspicious processes running.
I ran Malwarebytes and after scan there were found 7 threats, I deleted them but that didn't fix anything.

Here's picture of the icon: http://i.imgur.com/sgenV6i.png

Any help is appreciated, thanks!

JoshRoss · Aug 25, 2017

I am not familiar with this program, icon, and image search with google didn't give me much information. Try scanning your PC with Adwcleaner and post the logs. It will show if there is anything suspicious. After that, you can do a full scan with anti-virus software of your choice. Restart PC and check if the icon is still there.

By the way, what operating system are you running and any event that could have triggered the strange icon?

mdd1963 · Aug 25, 2017

Try a pass with portable Roguekiller (64 bits)....

https://www.adlice.com/download/roguekiller/#download

Be patient, the scan takes a while...

Is this icon in the main task bar, or the little abbreviated icon list by the clock?

purplenova421 · Aug 25, 2017

JoshRoss :

I just scanned my PC with Adwcleaner and the scan showed that were 36 elements (?), I deleted all of them. Restarted PC, but icon is still there.
I forgot to mention that the behavior of this icon is strange as well. Only way you can interact with the icon is by right-clicking it and only option that is available is "Quit", and it's appearance is random, icon can show up for 5 minutes, disappear and then return after an hour. My OS is Windows 7 Ultimate 64-bit.

Thanks.

JoshRoss · Aug 25, 2017

Could you please paste the logs of the scan

purplenova421 · Aug 25, 2017

JoshRoss :

Here:

# AdwCleaner 7.0.1.0 - Logfile created on Fri Aug 25 11:05:24 2017
# Updated on 2017/05/08 by Malwarebytes
# Database: 08-24-2017.1
# Running on Windows 7 Ultimate (X64)
# Mode: scan
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

PUP.Adware.Heuristic, AxAutoMntSrv

***** [ Folders ] *****

PUP.Optional.AdvancedSystemCare, C:\ProgramData\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\ProgramData\Application Data\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\Windows\System32\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\Users\All Users\IObit\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, C:\Users\Liga\AppData\LocalLow\IObit\Advanced SystemCare
PUP.Optional.Legacy, C:\ProgramData\IObit\ASCDownloader
PUP.Optional.Legacy, C:\ProgramData\Application Data\IObit\ASCDownloader
PUP.Optional.Legacy, C:\Users\All Users\IObit\ASCDownloader
PUP.Optional.Amigo, C:\Users\Liga\AppData\Local\Amigo
PUP.Optional.Mail.Ru, C:\ProgramData\Mail.Ru
PUP.Optional.Mail.Ru, C:\ProgramData\Application Data\Mail.Ru
PUP.Optional.Mail.Ru, C:\Windows\System32\config\systemprofile\AppData\Local\Mail.Ru
PUP.Optional.Mail.Ru, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Mail.Ru
PUP.Optional.Mail.Ru, C:\Users\All Users\Mail.Ru
PUP.Optional.Mail.Ru, C:\Users\Liga\AppData\Local\Mail.Ru
PUP.Optional.Yontoo, C:\Users\Liga\AppData\Local\Amigo
PUP.Adware.Heuristic, C:\ProgramData\{74E9F814-C737-42CC-B721-DBBC4059367A}

***** [ Files ] *****

PUP.Optional.Legacy, C:\END

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

PUP.Optional.AdvancedSystemCare, [Key] - HKLM\SOFTWARE\IOBIT\ASC
PUP.Optional.AdvancedSystemCare, [Key] - HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, [Key] - HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare
PUP.Optional.AdvancedSystemCare, [Key] - HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare
PUP.Optional.Mail.Ru, [Key] - HKLM\SOFTWARE\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKU\.DEFAULT\Software\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKU\S-1-5-21-3150854470-4246040130-1270987361-1000\Software\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKU\S-1-5-21-3150854470-4246040130-1270987361-1000\Software\AppDataLow\Software\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKU\S-1-5-18\Software\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKCU\Software\Mail.Ru
PUP.Optional.Mail.Ru, [Key] - HKCU\Software\AppDataLow\Software\Mail.Ru
PUP.Optional.YahooChrome, [Key] - HKLM\SOFTWARE\Yahoo\SS
PUP.Optional.Yontoo, [Key] - HKU\.DEFAULT\Software\Amigo
PUP.Optional.Yontoo, [Key] - HKU\S-1-5-18\Software\Amigo
PUP.Optional.InfoG, [Key] - HKLM\SOFTWARE\Classes\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries.

*************************

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt ##########

JoshRoss · Aug 25, 2017

Advanced system care is not much of a concern, that is a false positive. What about Mail(dot)Ru or Yontoo? Do you recognize these applications? If not, try to remove the folders manually.

In addition to that, use RKill to kill malicious applications and scan your PC with Hitman Pro. Let me know if this helps.

purplenova421 · Aug 25, 2017

mdd1963 :

RogueKiller V12.11.11.0 (x64) [Aug 21 2017] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : https://forum.adlice.com
Website : http://www.adlice.com/download/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Liga [Administrator]
Started from : C:\Users\Liga\Downloads\RogueKiller_portable64.exe
Mode : Scan -- Date : 08/25/2017 14:21:54 (Duration : 00:49:06)

¤¤¤ Processes : 1 ¤¤¤
[VT.Unknown] KMService.exe(1888) -- C:\Windows\kmsem\KMService.exe[-] -> Found

¤¤¤ Registry : 6 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{1D7AF000-2786-4C8C-83F5-C2C52A3F7131}C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe|Name=hl.exe|Desc=hl.exe|Defer=User| [-] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{E47CFAF7-CBD9-473B-973C-E538EA749A86}C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe|Name=hl.exe|Desc=hl.exe|Defer=User| [-] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | TCP Query User{1D7AF000-2786-4C8C-83F5-C2C52A3F7131}C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|App=C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe|Name=hl.exe|Desc=hl.exe|Defer=User| [-] -> Found
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules | UDP Query User{E47CFAF7-CBD9-473B-973C-E538EA749A86}C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe : v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|App=C:\users\liga\appdata\local\counter-strike 1.6 (2015-06-08)\hl.exe|Name=hl.exe|Desc=hl.exe|Defer=User| [-] -> Found
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 3 ¤¤¤
[PUP][Folder] C:\ProgramData\Babylon -> Found
[PUP][File] C:\Users\Liga\AppData\Roaming\Microsoft\Windows\Recent\log_file.lnk [LNK@] C:\Users\Liga\AppData\Roaming\Babylon\log_file.txt -> Found
[PUP][Folder] C:\ProgramData\Babylon -> Found

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA DT01ACA100 SCSI Disk Device +++++
--- User ---
[MBR] eb56436ee09e4b9be5ba88ca28c19edc
[BSP] ae9ba12a3a8d4fee52984b75b7d0c729 : Windows Vista/7/8|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

That's what I got with Roguekiller scan, and the icon is by the clock in the bottom right corner.

JoshRoss · Aug 25, 2017

Can you try booting into Windows "Safe mode with networking," do another scan with Adwcleaner and Malwarebytes and see if the issue persists?

SinxarKnights · Aug 25, 2017

You are unlikely to find anything with adware/malware cleaners but it usually doesn't hurt anything.

Can you give us a list of what you have installed? It appears to be an auto updater of sorts for something you installed.

JoshRoss · Aug 25, 2017

For a list should probably run a scan with JRT or Minitoolbox.

purplenova421 · Aug 25, 2017

List of programs:

MiniToolBox by Farbar Version: 17-06-2016
Ran by Liga (administrator) on 25-08-2017 at 16:19:05
Running from "C:\Users\Liga\Downloads"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Model: H81M-S2V Manufacturer: Gigabyte Technology Co., Ltd.
Boot Mode: Normal
***************************************************************************

=========================== Installed Programs ============================

.NET Core SDK 1.0.2 (x64) (HKLM\...\{EA35E834-8CA4-46DF-A8E5-8F11AC872A30}) (Version: 4.0.37723 - Microsoft Corporation) Hidden
.NET Core SDK 1.0.2 (x64) (HKLM-x32\...\{782476be-43c2-4bac-8292-b1ddff900c7b}) (Version: 1.0.2 - Microsoft Corporation)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.1.0 - )
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.012.20095 - Adobe Systems Incorporated)
Adobe Flash Player 26 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 26.0.0.151 - Adobe Systems Incorporated)
Age of Empires III - Complete Collection (HKLM-x32\...\Age of Empires III - Complete Collection_Origami_is1) (Version: 1.0 - R.G. Origami, Seraph1)
Avast Free Antivirus (HKLM-x32\...\Avast Antivirus) (Version: 17.5.2303 - AVAST Software)
CCleaner (HKLM\...\CCleaner) (Version: 5.26 - Piriform)
Discord (HKCU\...\Discord) (Version: 0.0.297 - Hammer & Chisel, Inc.)
Dota 2 (HKLM\...\Steam App 570) (Version: - Valve)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 60.0.3112.101 - Google Inc.)
Google Drive (HKLM-x32\...\{A90339B3-2C3F-492E-B3A7-0BDFC691E526}) (Version: 2.34.6425.2548 - Google, Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{18455581-E099-4BA8-BC6B-F34B2F06600C}) (Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.21.115 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment)
Heroes of Might & Magic III HD Edition (HKLM-x32\...\Heroes of Might & Magic III HD Edition_R.G. Mechanics_is1) (Version: - R.G. Mechanics, markfiter)
HiSuite (HKLM-x32\...\Hi Suite) (Version: 32.610.27.00.06 - Huawei Technologies Co.,Ltd)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.20.286 - SurfRight B.V.)
IIS 10.0 Express (HKLM\...\{0148E8AA-4A50-4673-B532-DB9F30F804BE}) (Version: 10.0.1737 - Microsoft Corporation)
IIS Express Application Compatibility Database for x64 (HKLM\...\{08274920-8908-45c2-9258-8ad67ff77b09}.sdb) (Version: - ) Hidden
IIS Express Application Compatibility Database for x86 (HKLM\...\{ad846bae-d44b-4722-abad-f7420e08bcd9}.sdb) (Version: - ) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4578 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.0.3.1001 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.16 - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)
Life Is Strange™ (HKLM\...\Steam App 319630) (Version: - DONTNOD Entertainment)
Malwarebytes version 3.2.2.2018 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2018 - Malwarebytes)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (ENU) (HKLM-x32\...\{D3517C62-68A5-37CF-92F7-93C029A89681}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 SDK (HKLM-x32\...\{2F0ECC80-B9E4-4485-8083-CD32F22ABD92}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 Targeting Pack (ENU) (HKLM-x32\...\{8EEB28EE-5141-411C-9CF0-9952264FE4AF}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.6.1 Targeting Pack (HKLM-x32\...\{8BC3EEC9-090F-4C53-A8DA-1BEC913040F9}) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Help Viewer 2.2 (HKLM-x32\...\Microsoft Help Viewer 2.2) (Version: 2.2.25420 - Microsoft Corporation)
Microsoft Identity Extensions (HKLM\...\{F99F24BF-0B90-463E-9658-3FD2EFC3C992}) (Version: 2.0.1459.0 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visio Premium 2010 (HKLM-x32\...\Office14.VISIO) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Web Deploy 3.6 (HKLM\...\{5CB4DD27-6252-4C08-BFCF-22F6A110CBFA}) (Version: 10.0.1972 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Minecraft 1.7.5 (HKLM-x32\...\Minecraft 1.7.5) (Version: 1.7.5 - Mojang)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.3.1 - Notepad++ Team)
NVIDIA PhysX (HKLM-x32\...\{B455E95A-B804-439F-B533-336B1635AE97}) (Version: 9.14.0702 - NVIDIA Corporation)
Path of Exile (HKLM\...\Steam App 238960) (Version: - Grinding Gear Games)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.82.317.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8036 - Realtek Semiconductor Corp.)
Roslyn Language Services - x86 (HKLM-x32\...\{6970C7E1-F99D-388D-8903-DF8FCE677FED}) (Version: 14.0.25431 - Microsoft Corporation) Hidden
SafeZone Stable 4.58.2552.909 (HKLM-x32\...\SafeZone 4.58.2552.909) (Version: 4.58.2552.909 - Avast Software) Hidden
Samsung Kies3 (HKLM-x32\...\{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16044.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16044.2 - Samsung Electronics Co., Ltd.)
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.61.0 - Samsung Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0057-0000-0000-0000000FF1CE}_Office14.VISIO_{359ADBEC-068A-4CC9-9174-77AB8EDB867A}) (Version: - Microsoft)
ShareX (HKLM\...\82E6AC09-0FEF-4390-AD9F-0DD3F5561EFC_is1) (Version: 11.4.1 - ShareX Team)
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype™ 7.39 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.39.102 - Skype Technologies S.A.)
Smart Switch (HKLM-x32\...\{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.16081.8 - Samsung Electronics Co., Ltd.) Hidden
Smart Switch (HKLM-x32\...\InstallShield_{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.16081.8 - Samsung Electronics Co., Ltd.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Team Explorer for Microsoft Visual Studio 2015 Update 3.1 (HKLM-x32\...\{7A95671A-759E-3B83-B763-4289D1D24D73}) (Version: 14.102.25619 - Microsoft) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
Tildes Birojs (HKLM-x32\...\{29651EAC-EF78-4BDD-AD50-D90450AF3D60}) (Version: 1.0.36 - Tilde SIA)
Total Commander Extended (HKCU\...\Total Commander Extended) (Version: 14.10 - BurSoft)
TypeScript Tools for Microsoft Visual Studio 2015 (HKLM-x32\...\{BA5762C7-D35F-4725-A4BD-525854127018}) (Version: 1.8.36.0 - Microsoft Corporation) Hidden
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 5.3.5f1 - Unity Technologies ApS)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
Warframe (HKLM\...\Steam App 230410) (Version: - Digital Extremes)
WinRAR 5.21 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.21.0 - win.rar GmbH)
Workflow Manager Client 1.0 (HKLM\...\{C056B194-9664-4443-9019-6C84B4CCC512}) (Version: 2.0.50408.1 - Microsoft Corporation) Hidden

**** End of log ****

eclipse457 · Aug 25, 2017

Go to control panel and check your installed programs. Uninstall anything you find suspicious and reboot. Btw, how did this issue crop up? Like, suddenly?

purplenova421 · Aug 25, 2017

eclipse457 :

I didn't notice any suspicious programs there, and I never really paid attention to the icon bar near the clock until today, when I noticed it.

purplenova421 · Aug 25, 2017

JoshRoss :

I used Rkill and there were 2 processes terminated, I can't find a log, but the names were KMService.exe and srvany.exe
I rebooted PC and the icon is gone for now.

JoshRoss · Aug 28, 2017

Glad to hear the issue is sorted. If any of my solutions helped you out, feel free to mark them as a solution. On the other note, I was expecting RKill to do the job. It seemed like a sustained malware process that needed termination. Which is what you did! Sorry for the late response, had a jam-packed weekend.

eclipse457 · Aug 28, 2017

purplenova421 :

Just a side note, watch out for that icon coming back. Because if a PC is infected once, it's really hard to "clean" it until you re-install.
Step up your PC's security and be careful while browsing

JoshRoss · Aug 29, 2017

Good point. After RKill you can attempt to use JRT, Malwarebytes anti-rootkit, and Hitman Pro to assure that there are no further issues.

Unknown program icon

Prominent

Notable

Titan

Prominent

Notable

Prominent

Notable

Prominent

Notable

Distinguished

Notable

Prominent

Prominent

Prominent

Prominent

Notable

Prominent

Notable

Share this page