Spyware, Viruses, & Security forum

General discussion

Qsfeci - has anyone heard of this program

I find it running, recurringly, on my daughter's WinME system. It may be associated, in some way with AOL Instant Messenger, but I am not sure.

It does not appear in any start or startup. I have been through MSConfig, Spybot and Adaware multiple times. I run McAfee up to date.

I have done a search on the hard drive for such a name, and it comes up blank.

Yet time and again, there it is.

A Google search turns up nothing other than some Oriential script, and ads for Safeco Insurance (why?).

Thanks for any help.

Mark Brifman <markbrifman@labridge.com>

Discussion is locked
You are posting a reply to: Qsfeci - has anyone heard of this program
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Qsfeci - has anyone heard of this program
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Hi Mark

In reply to: Qsfeci - has anyone heard of this program

I'm getting the same result with Google that you are and I think you are getting the Safeco ads because Google thinks you spelled the word wrong. Is the computer acting OK? Also, where are you seeing it, in the Taskmanager? One final question, why do you think it is from AIM? I'm just trying to narrow things down here.

Collapse -
Response to Roddy

In reply to: Hi Mark

I find it in Taskmanager. The computer appears to act OK, but at times I find the hard disk cycling on and off continuously. I doubt this is related, since occasionally I find that on her computer when I do not get the program.

I think from AIM beacuse at times (not all the time unfortunately), it seems to appear after that is run. It may be from some ad.

I have blocked all pop-ups, but while that has made it less pervasive, it has not stopped it.

Thanks for any help.

Mark

I think you are, of course, correct about that Google stuff. I just find it interesting and a bit weird.

Collapse -
I've got a suggestion that might

In reply to: Response to Roddy

narrow it down Mark. Merijn, who wrote the HijackThis and cwshredder programs also has a stand-alone tool called Itty Bitty Process Manager (IBProcMan). It's a good tool to have on hand anyway. It's a miniature Task Manager, but when you run it, you can double click on any of the processes to see the properties and when the properties window comes up, click on the version tab and it will give you all kinds of information such as company, version, etc. etc. It's a nice little tool. Once you have it on your computer it will show as being made by Soeperman Enterprises Ltd. I just wanted to let you that bit of info because a lot of people have asked. It's about halfway down the page on this link.
http://www.spywareinfo.com/~merijn/downloads.html

Collapse -
Itty Bitty Process Manager (IBProcMan) - thank you

In reply to: I've got a suggestion that might

thank you for the suggestion. I will run it on my daughter's computer and see what turns up.

Mark

Collapse -
It shows as a hidden file in the program

In reply to: I've got a suggestion that might

that hidden file resides in the root directory. Yet when I do a search, or simply look, in that directory (showing,I think, hidden files as well - "view" "show hidden files") nothing shows up.

Collapse -
Hi Mark

In reply to: It shows as a hidden file in the program

Sorry, I haven't been around much today. If you bring up the itty bitty process manager again and double click on that file. Then click on the ''version'' tab, you can look half way down where it says ''other version information'' and click on any of the things in the white window, it should tell you at least who it belongs to, company, etc. There are a lot of options in the window. My idea for using that was to give you more information as to whether or not it is a part of AIM or someone else.

Collapse -
More Info to come

In reply to: Hi Mark

But as I recall (from this morning so I may be wrong), although that tab did appear for other processes, it did not appear for this program.

I seem to recall that as disturbing as well. But I will check it out next time it appears. I closed it out earlier this evening.

Thank you so much for the time.

Collapse -
It seems to be run by Windows Internet Explorer

In reply to: Hi Mark

At least the two times I tried it, it was not running before, and was running immediatly after IE loaded.

There is no "version" tab. The only information is that it is an application, it is in C:\ and is a hidden file. I can not unhide it from the check box. I did un "archive" it.

Yet when I do a search, including for hidden files, I do not find it.

Again, thank you for the time and the interest.

Collapse -
Mark, I'm going to see

In reply to: It seems to be run by Windows Internet Explorer

if Marianna can look at this sometime later today. Maybe she will have another suggestion, I am running out of them I'm afraid. She has been dealing with this kind of thing a lot longer than I have and you have a strange one here. Hang in there, we will figure this out. LOL

Collapse -
Thank you for the help

In reply to: Mark, I'm going to see

This sure beats me. I tried to find out where to post to McAfee (my virus scanner), but they sure don't make it at all obvious (or hidden for that matter) where to report this sort of stuff.

Anyway, I shall stand by....

Thank you again. And to Marianna (whoever she may be)

Collapse -
Hidden file

In reply to: Thank you for the help

Did you:

Windows ME
Open My Computer.

Select the Tools menu and click Folder Options.

Select the View Tab.

Under the Hidden files and folders heading select Show hidden files and folders.

Uncheck the Hide protected operating system files (recommended) option.

Click Yes to confirm.

Click OK.

Click Start, Programs and Accessories and open Windows Explorer.

Select a hard drive from the left hand side of the Windows Explorer window.

Select View the Entire contents of this drive.

Did you run an updated ad aware and SpybotS&D ??

Download and install the following programs, If they're not on your computer, yet:
- AdAware SE: http://www.lavasoftusa.com/support/download/
- Spybot 1.3: http://www.safer-networking.org/en/mirrors/index.html
- Crap-Cleaner: http://www.ccleaner.com/ccdownload.php

Do a System-Scan with AdAware SE:
- Open AdAware SE
- First of all, check for updates.
To do this, click on 'Check for updates now', click the 'Connect'-button and, if there are new updates, click 'OK' and then 'Finish'.
- Now, do a system-scan by clicking the 'Start'-button.
- In the next screen, select 'Perform Full System scan' and click the 'Next'-button.
- Sit back and relax, while Adaware is performing the system-scan.
- When the scan is done, right-click in the list of items, that AdAware found, and select 'Select All', click the 'Next'-button and then 'the 'Finish'-button.
- Close AdAware SE.

Do a system-scan with Spybot 1.3:
- Open Spybot 1.3
- First, Check for updates
click the 'Search for updates'-button. If there are updates available, select them and click the 'Download updates'-button.
- Click 'Search and destroy' and then 'Check for problems'.
- Relax, while Spybot is performing it's scan.
- When Spybot is done, it will show a list of found items (or congratulate you with a clean computer). Click 'Fix selected problems' to delete the items.
- Close Spybot 1.3

download - CCleaner: http://www.ccleaner.com/ccdownload.php

Once installed, run CCleaner click the Windows tab

Select the following:
Internet Explorer:
Temp Internet
History
Recently Typed URLs
Delete Index.dat files

System:
Empty Recycle Bin
Temporary Files
Memory Dumps
Chkdsk File Fragments
Old Prefetch Data

- If you want to keep the Internet Explorer Cookies, then unmark 'Cookies'
- If you want to keep the Internet Explorer History, then unmark 'History'
- If you want to keep Windows Log Files, then unmark 'Windows Log Files'
- you're using Mozilla's Firefox or Internet Suite
- Click the tab Applications
- If you want to keep the Internet History, then unmark 'Internet History' under 'Firefox/Mozilla'

UNCHECK ALL other default settings

Next: click Options click the Settings tab
Uncheck: "Only delete files older than 48 hrs.", click Ok
Then click Run Cleaner (bottom right) then Exit (reboot)

I have never heard of Qsfeci

Does a virus scanner find it?

How about doing an on-line scan at:

http://www.kaspersky.com/scanforvirus

Pls. let us know how you are doing !

Collapse -
Thank you Marianna

In reply to: Hidden file

There it is. I will delete it and see what happens. It is 416 K big.

Collapse -
(NT) (NT) Supergirl to the rescue. :D

In reply to: Thank you for the help

Collapse -
It is gone.

In reply to: (NT) Supergirl to the rescue. :D

And, surprisingly, the computer still boots and runs.

Thank you all so much for your time and effort. Perhaps someday someone will figure out what that program is, but for now I am happy just to have it gone.

Wonderful!!

Again, thanks so much.

Collapse -
(NT) (NT) You're welcome Mark, Glad WE could help.

In reply to: It is gone.

Collapse -
One more point

In reply to: (NT) You're welcome Mark, Glad WE could help.

In addition to manifold thank you's.

Originally when looking for this file I only unchecked the box in "view options" that said Do not Show Hidden Files. I did not see/realize/do anything about the box that said to Hide System Files. Yet that is the only way to see this file. You have to show the hidden system files.

This is apparently set up as a system file if someone else has the problem.

Again, thank you.

Collapse -
Mark, You Are Very Welcome...... but.......

In reply to: One more point

Collapse -
Thanks for posting back on that and

In reply to: (NT) You're welcome Mark, Glad WE could help.

I would keep the itty bitty process manager for emergencies too. It's a handy little tool and the reason it was made is that some malware will disable the task manager BUT it won't recoginze the ibprocman so I would keep it if I were you.

Collapse -
Mark

In reply to: Qsfeci - has anyone heard of this program

It may be of Italian origin as "feci" is "feces" in Italian. It may go by some other name elsewhere.

Cheers

Popular Forums

icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

DEALS, DEALS, DEALS!

Best Black Friday Deals

CNET editors are busy culling the list and highlighting what we think are the best deals out there this holiday season.