General discussion

Mysterious program running every few minutes

In the past few days, my Windows 98SE computer has started to do something strange. Every few minutes (sometimes every minute), some program briefly takes control and attempts to access the "local zone" using "SSDP Service on Windows Millennium" - that's C:\Windows\SSDPSRV.exe. I know this because my firewall warns me.

Although this mysterious program immediately returns focus to the program I was working on, it causes a couple of problems:

- It prevents my screensaver from starting.

- If I'm using the mouse to drag or scroll when this program takes over, I have to restart the operation. Likewise, if I'm typing, the last couple of keystrokes are lost.

Aside from the irritation, I'm wondering if it's some sort of spyware. My anti-spyware software reports nothing (both Ad-Aware and Spybot).

Two days ago, my anti-virus showed nothing on a full scan. I redid the scan yesterday, and it found Win32:Agent-DZT[Trj] - that's C:\Windows\uneng.exe, which the anti-virus deleted for me. (I have no idea what the Trojan does; I didn't find any useful information on Google.) Because the virus seemed to have come in only yesterday, I don't know if it has anything to do with the problem.

Question:

How can I find out which program is doing this, allowing me to uninstall or disable it?

Thanks

Discussion is locked
Follow
Reply to: Mysterious program running every few minutes
PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.
Reporting: Mysterious program running every few minutes
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Comments
- Collapse -
Probably not a virus

SSDPSRV.exe is a process (Simple Service Discovery Protocol) that is a subcomponent for USB. Although some reports say this program is important for the stable and secure running of your computer and should not be terminated, I am not so sure.

If you have no USB devices attached, I don't see why you can't disable the process.

Links giving more information below;

http://www.justtext.com/processes-tasks/ssdpsrv-exe.html
http://www.securitystronghold.com/gates/spyware-adware-solutions/SSDPSRV_ssdpsrv.exe_solution.htm
http://www.liutilities.com/products/wintaskspro/processlibrary/ssdpsrv/
http://experts.about.com/q/Windows-2580/SSDPSRV-EXE.htm
http://www.bleepingcomputer.com/startups/ssdpsrv.exe-5174.html

The last link shows the best way to disable/remove this process.

With ZoneAlarm you can simply deny access, and tick the box within the popup to "Remember this action".

Mark

- Collapse -
USB not helping...

Mark, thanks for your answer. The links you gave were informative.

Unfortunately, I have two USB devices in frequent use, so disabling it is not an option for me.

I have checked their connections, and it hasn't helped.

So, again, is there any way for me to find out which program is running (briefly) every minute or so and interrupting my typing or mouse use?

Thanks,

Paddy

- Collapse -
Ahh, I see

I can only think of the Task Mananger, (it's been a while since I used Win 98, so I am not sure how much information it can give), and the System Configuration Utility, or msconfig which you can access through Start > Run, and type in msconfig.

In there you can see what is loaded at startup, and you can disable those one at a time to test what effect it has.

I have to say I am not clear with the information I found. It seems easy enough to disable/uninstall this through Add/Remove Programs, but does that mean that any USB devices stop working? I'm not sure it does.

The last thing I can think of is a thorough sweep of your computer for viruses and spyware, as this may be something trying to "phone home". Do you use a firewall? If not, I would consider one.

Mark

- Collapse -
I'll try this

Thanks again, Mark. I'll try the route of selectively disabling startup programs.

I have done full virus and spyware scans. The PC has firewall, antivirus and spyware, and the router also has a firewall.

I'll let you know what results I find; it may take a few days, as it will take some time.

- Collapse -
just a reminder

not all AV programs will catch a trojan, and, after a quick Google, i see that uneng.exe is also linked to Roxy CD (maybe it's an udate or something?)


jonah

,.

- Collapse -
Successfuil result

Some feedback on a successful result.

I used MSCONFIG to disable a few unnecessary tasks, including SSDPSRV. The USB devices still worked.

Sadly, though, it didn't solve my problem.

So, I played with other startup options. I discovered that a bona fide program was trying to auto-update every minute without success. I disabled the auto-update (the program is non-critical) and everything works!

Thanks for your help.

CNET Forums