periodic blank process - is it malware?

Question

I have a Latitude D400, about 2 yrs old, running XP Pro. Starting about a week or two ago, I have begun noticing a blank process that appears periodically, about once an hour or so. I see a tab along the Taskbar with no description appear and disappear after a couple of seconds, too quickly to click on it and see anything. I am concerned that this is spyware or other type of malware. I have run a couple of anti-spyware tools on my system - Microsoft AntiSpyware and Spybot. There appears to be nothing out of the ordinary in my startup process list - a bunch of utilities for 3 HP printers and a Maxtor USB backup device, and so on.

Can anyone give me an idea what's going on or some help on how I can find out more about this? My system is running OK but I'm concerned about spyware.

Thanks,

- bill.

dunedin · Answer

Hi,

You have run anti-spyware scans but have you scanned for virus/trojans

Run these online scans

Trojan Scan http://www.windowsecurity.com/trojanscan/

Panda http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Also
CTRL + ALT +DEL to bring up Task Manager. If the blank process disappears so quickly you might not be able to spot it here but it is worth a try.
Keep Task Manager/Processes open on top of Windows and see if you can see something at the time it appears.

In any case go to the link below and check all the processes which are running. It will tell you what they all are
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

iKlaatu · Answer

I've been noticing this same or similar thing recently. I, too, had been trying to figure it out and the Task Manager seems to show it to be wmiprvse.exe. I think so, anyway, because I've seen that appear and disappear from the list. Not easy to get the list to show before the taskbar changes.   Something that I thought of, at first, was HP stuff I have running in the background. You said you have HP things, too. But I'm also wondering if it's related to .NET instead. I had signed into that recently, after a long time of not doing so.   AV scans don't turn anything up and I checked one possible virus related to wmiprvse.exe by looking in the system registry... nothing there set to run at startup (logon), though, unlike what the virus were to be doing if it existed.   I'll probably keep checking on it until I either don't see it anymore or know exactly why it is there.

dunedin · Answer

Hi,
wmiprvse.exe

What is it?
Windows Management Instrumentation Provider Host program - wmiprvse.exe

It can also be W32/Sonebot-B Worm

http://www.sophos.com/virusinfo/analyses/w32sonebotb.html

Read the description from the Description Tab

Removal Tab tells you how to check if it is in the registry and how to remove it.
Be sure to back up the registry first.

OR
You could try running the scans I linked to above and see if they find it for you.

billrosenblatt · Answer

The trojan detecting program picked up nothing, and I should add that I have Norton Anti Virus running with current virus definitions.

Is it possible to get Task Manager under XP Pro to log process starts in a file? That would be one way of catching whatever this is...

Windows General

periodic blank process - is it malware?

Was this post helpful?