"process deneid" running on win2k machine

I've a friend who is running win2k and has had recent problems with his
floppy drive as well as the scanner drivers. The scanner stopped
working. He looked at the running processes and discovered something
called "Process Deneid" -- spelling correct. He's tried to stop it but
it continues to come back. He's pretty meticulous about keeping his AV
and spyware blockers up to date. Both of us searched for this "process
deneid" and came up with nothing.

Does anyone here have any familiarity with this? It would be much
appreciated.

Thanks,

Jane

Jane

Jane wrote:

> I've a friend who is running win2k and has had recent problems with his
> floppy drive as well as the scanner drivers. The scanner stopped
> working. He looked at the running processes and discovered something
> called "Process Deneid" -- spelling correct. He's tried to stop it but
> it continues to come back. He's pretty meticulous about keeping his AV
> and spyware blockers up to date. Both of us searched for this "process
> deneid" and came up with nothing.
>
> Does anyone here have any familiarity with this? It would be much
> appreciated.
>
> Thanks,
>
> Jane

Never heard of that but sounds very suspicious...

Michael

Michael J. Pelletier

On Thu, 16 Jun 2005 18:16:23 -0400, Jane <> wrote:

>I've a friend who is running win2k and has had recent problems with his
>floppy drive as well as the scanner drivers. The scanner stopped
>working. He looked at the running processes and discovered something
>called "Process Deneid" -- spelling correct. He's tried to stop it but
>it continues to come back. He's pretty meticulous about keeping his AV
>and spyware blockers up to date. Both of us searched for this "process
>deneid" and came up with nothing.
>
>Does anyone here have any familiarity with this? It would be much
>appreciated.
>
>Thanks,
>
>Jane

Can he find the path to the component? Instead of looking in Task Manager, have
him get Process Explorer (free) from
<http://www.sysinternals.com/ntw2k/freeware/procexp.shtml>. He can use that to
find the full path to the executable module.

Then submit the module to Jotti and VirusTotal for scanning.
<http://virusscan.jotti.org/>
<http://www.virustotal.com/flash/index_en.html>

--
Cheers,
Chuck
http://nitecruzr.blogspot.com/
Paranoia is not a problem - it's a normal response from experience.
My email is AT DOT
actual address pchuck sonic net.

Chuck