ItsGeekToMe.co

The official home of It's Geek to Me on the web!

Issue #275: October 28, 2012

Q: When I start my Toshiba laptop (Satellite A505), I have recently been getting a dialog box with the title “taskeng.exe”. It has a few words about MS Windows and then disappears. This dialog box has only appeared within the last two months.  I googled the title and got the following information: “This is the task scheduler service under Windows Vista and Windows 7. It is responsible for keeping track of tasks set to run at a time predetermined by the user, and to invoke them when necessary. In other cases, taskeng.exe is a virus, spyware, trojan or worm! Check this with Security Task Manager.” I checked it with Security Task Manager, as well as Avast! Malwarebytes Antimalware, and SuperAntispyware. The results of all checks have been negative. Am I safe from malware, should I do more or should I take my laptop to a local computer analysis store?

Jack T.
Niceville, Florida

A: Wow! You’re asking me, after reading a few lines describing some diagnostic steps you’ve taken, to broadly declare you “safe from malware”?  That’s a pretty tall order, Jack.  You seem like a pretty Geeky guy (compliment intended) so instead, let’s discuss it a bit, and I’ll let you draw your own conclusions.

First, I can confirm that taskeng.exe is indeed a legitimate part of Windows.  As you said, this is a process that runs in the background, and is used to launch services and tasks at predetermined times (such as a disk defragmenter that runs in the middle of the night).  There are indeed known viruses that hide within, or disguise themselves as taskeng.exe.  Most of these should be detectable by the scanners that you mentioned.  Of course, a scanning program generally has to know what it’s looking for to be able to find it, which usually puts viruses one step ahead of virus scanners.

In general, the time to become concerned is when you first notice behavior from your computer that you’ve never seen before.  At that point, you can go back and check restore points, or look to see if any updates were recently installed that might explain a change in the system’s behavior, and perhaps even provide an opportunity to undo changes that are causing genuine system problems.  You said in your message that this dialog has been appearing for about two months, which makes this sort of analysis about impossible.

So, is your system infected?  Signs point to no, but of course, there’s no way for me to be certain.  Are you “safe from malware”?  Heck no!  None of us are.  All we can do is equip our computers with the best protection we can find (and you’ve done a pretty good job of that) and then watch what website we visit, and not click links in e-mails.

Q: Recently I have been getting email bounces that look like this:

kazan-r@rp1990.ru; Failed; 5.3.0 (other or undefined mail system status)

Obviously I didn’t send them. I assume this is from Russia. My son thinks I have been “zombified”. He is talking about a hacked router which I have and false “port forwarding” entries.  How do I fix this?  As a side symptom, computer is running very slow.

George G.
Fort Walton Beach, Florida

A: It’s been my experience, George, that actual “zombification” of computers is somewhat rare, but it does happen, even to people with security suites in place.  I am withholding the name of the one you mentioned for publication so that I can freely say that I have very little regard for it, because of all the people I talk to who use it seem to feel it doesn’t do a very good job.  That includes my own Daughterboard, whose system got a nasty infection while this suite was supposedly protecting her computer.

If your computer really has been zombified, it is running software that connects it to a central server running somewhere off on the Internet, which allows it to be remotely controlled.  It is probably part of a vast network of such computers, called a botnet (the proper term for your computer is a “bot”, rather than “zombie”).  Botnets are used for everything from denial-of-service attacks to sending SPAM e-mail (which would explain the bounced e-mails you’re getting).

You have described many of the symptoms of a computer that has been infected with bot software.  These are usually high-grade applications which are difficult to detect and remove.  I don’t recommend you try.  Your best protection in this case is to format your hard drive and completely reload your operating system, then change the password on your e-mail account.  It is the only way to guarantee your system is 100% clean.  Regarding your router, you can either remove the port forwarding entries manually, or if it has a reset function, just restore it to the factory settings.


Leave a Reply

May 2024
S M T W T F S
 1234
567891011
12131415161718
19202122232425
262728293031  

Search the site

Archives

Copyright Notice

All content on this site is Copyright © 2007-2024 by Jeff Werner – All rights reserved.