Proyecto1.exe

[rosica]

Hello everybody,
I've found recently in my Task Manager a program running - Proyecto1.exe. I asked Internet and it said:
Filename: Proyecto1.exe
Name: DevicePath
Description: Added by the GRUEL WORM!
Recommendation: Definitely not required - typically viruses, spyware, adware and "resource
hogs"
I can't get rid of it. I use Avast! 4.8.1351 Home Edition witch does not react. I just end the task manually.
Please help me!

[DavidR]

Lots of hits, http://www.google.com/search?q=Proyecto1.exe

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and false positive/undetected malware in the subject.
 
Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn't already in the chest) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.
 
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.

If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

• 1.  MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
• 2. SUPERantispyware On-Demand only in free version.

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.

[Shiw Liang]

http://www.bleepingcomputer.com/forums/topic32099.html

[polonus]

Hi rosica,

Proyecto1.exe Runtime Estimated Statistics
 
Average RAM Usage:   3 megabytes
Average CPU Usage:   0.41%
Multithreaded Capability:   No
Harmfulness Rating:   26%
Known to Affect Macs:   No
Known to Affect Windows Vista:   No
Recent Rundll32.exe News and Issues
What is rundll32.exe And Why Is It Running? :: the How-To Geek
Since there's no way to directly launch a DLL file, the rundll32.exe application is simply used to launch functionality store ... read more
Cant start AntiVir guard - Viruses and other Security risks...http://forum.avira.com/wbb/index.php?page=Thread&threadID=102103
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start O4 - HKLM\ ... read more: http://www.howtogeek.com/howto/windows-vista/what-is-rundll32exe-and-why-is-it-running/
Registry files info: http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_GRUEL.D&VSect=T

Other Processes That May Be Present:
Msgsr32.exe  http://www.pcprocesses.org/8248-process-load.html
Atix10.exe  http://www.pcprocesses.org/933-process-atix10.html
Update.exe  http://www.pcprocesses.org/15685-process-aa-bbcc-dde-effgghh-jj.html

polonus

[rosica]

Hi guys,
Highly appreciate your help. I feel quite frightened so I think over reinstalling my Windows XP instead of copying system files from.
DavidR. I ran Malware Bytes and after scanning it said I had 1 infected file: "Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken". Do you think I have to remove it (I mean is this removing threatening somehow the stability of the system)?

[DavidR]

Yes run it again and remove it.

Whilst the MyWebSearch is a mild issue, it frequently comes with other products. It purports to make your searching more relevant to you, etc. but it gathers data which can be used for marketing purposed and directed ads, you are better off without it.

It will have zero impact on your system stability, MBAM also places copies of the items/entries it removes in quarantine that would enable you to restore if required.