« previous next »
Pages: 1 [2]   Go Down

Author Topic: Unrecognised start-up process.  (Read 7643 times)

0 Members and 2 Guests are viewing this topic.

Offline davexnet

  • Poster
  • *
  • Posts: 540
Re: Unrecognised start-up process.
« Reply #15 on: October 23, 2009, 10:10:51 PM »
The reason to run it under an alternate name is that certain malware recognize the SAS process
by it's executable name and stop it from running...
Logged
AMD FX-4300 4GB DDR3
avast free 2279 (Windows XP), MBAM free

Hermite15

  • Guest
Re: Unrecognised start-up process.
« Reply #16 on: October 23, 2009, 10:31:41 PM »
Quote from: davexnet on October 23, 2009, 10:10:51 PM
The reason to run it under an alternate name is that certain malware recognize the SAS process
by it's executable name and stop it from running...

Now that you mention that I'm pretty sure I've had this with another security software long ago...but I can't remember which one, also running an executable with different name each time to avoid termination attacks...may be it was AVG antispy, not sure...
Logged

Offline Gopher John

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2098
Re: Unrecognised start-up process.
« Reply #17 on: October 23, 2009, 11:22:37 PM »
SuperAntispyware - Alternate start calls RUNSAS.EXE, and your assumptions are correct.  See http://www.superantispyware.com/supportfaqdisplay.html?faq=71.

Unless something on the machine is targetting SuperAntispyware and preventing it from running, there is no need to run RUNSAS.EXE.  Of course a munged install could possibly create the same effect.
Logged
AMD A6-5350M APU with Radeon HD Graphics, 8.0GB RAM, Win7 Pro SP1 64bit, IE11
i7-3610QM 2.3GHZ, 8.0GB Ram,  Nvidia GeForce GT 630M 2GB, Win7 Pro SP1 64bit, IE 11
Common to both: Avast Premium Security 19.7.2388, WinPatrol Plus, SpywareBlaster 5.5, Opera 12.18, Firefox 68.0.2, MBam Free, CCleaner

greyshade

  • Guest
Re: Unrecognised start-up process.
« Reply #18 on: October 24, 2009, 05:15:39 AM »
Quote from: Logos on October 23, 2009, 10:31:41 PM
Quote from: davexnet on October 23, 2009, 10:10:51 PM
The reason to run it under an alternate name is that certain malware recognize the SAS process
by it's executable name and stop it from running...

Now that you mention that I'm pretty sure I've had this with another security software long ago...but I can't remember which one, also running an executable with different name each time to avoid termination attacks...may be it was AVG antispy, not sure...

You are right. I experienced this once with the DrWebCureIt program about two weeks ago. After a customary program update before use, noticed the usual executable was replaced with a strange alphanumeric. It did perform without any untoward incident, though.

Remembered reading advice here in the forums to manually rename the .exe file but, in this case, it appeared to have changed clothes on its own.
Logged
Pages: 1 [2]   Go Up
« previous next »