catdos.exe process

[doubletoker]

I have a process called catdos.exe that will not end. If I end it within a few seconds it is back up. We have cleared the temp, cookies, and temp internet files from all user accouts. I have also deleted all the download internet files, temp, prefetch. It is Windows XP pro with SP2 and the latest files. I have ran Ad-aware and Mcafee on the machine and it did not find anything (both was to latest def and dat file). I have tried to remove it from the workstation in safe mode and deleted all entries refering to that from the registry but it keeps on. It is a compaq D530.

 

[wvajenm]

Sounds like adware/spyware or a virus to me, something fairly new or the scanners would catch it. I would check my registry, clear the run entries, check MS-Config, clear that, and then begin looking for the file that is lurking out there restarting this process everytime you end it. Check the spyware forum for some tips and other tools to use.

 

[bcastner]

Do a file search for catdos.exe.
Right-click the file, Properties, and read the Version information as to the publisher of this thing.
If it sounds suspicious, use Killbox.exe on the malware:

http://www.lavasoftsupport.com/index.php?showtopic=54511

 

[doubletoker]

There was some entries in the registry but we removed them (a couple of keys and in the run, runonce key). The odd thing is that this process runs even in safe mode. We originally found the file in the windows prefetch directory. After removing it and then restarting we then found it in the windows driver directory. I have system restore turned off. If I find anything out I will let everyone know. Thanks for your help.

 

[bcastner]

For some of these VX2 variants, you will not find them with a registry search.

See my earlier link.