Bagsbuild.exe

[Law93]

my zonealarm is telling me that this .exe file is under suspicious behavior. has anyone else had this thing on them before? should i allow it or should i just deny it? is it even a bad thing?

 

[DuckRacer]

...Just to clue everyone in more, I tried searching for this on google and nothing came up. Law also tried deleting the file yet he could not. Now, for all I know (hey, I'm a macintard), it could be some average system file, but this seems a bit peculiar...

 

[skip0110]

Download this (http://www.microsoft.com/technet/sysinternals/utilities/ProcessExplorer.mspx) unzip, and run procexp.exe

Find bagsbuild.exe and right click, choose properties.

Upload a screenshot of the Image tab here. I think that might provide us with some useful information to see where this is coming from.

 

[Law93]

that it? if it is, seems like its from IE

 

[skip0110]

So I'm guessing it doesn't appear in the main window where the processes are listed? If it does then you can right-click and get a dialog like this:


That search indicates that IE has an open handle to bagsbuild.exe.

 

[Law93]

looks like the ie PID 3356 is the bagsbuild.exe thing.....what does that conclude?

 

[skip0110]

It's adware.

http://spywaredlls.prevx.com/ssGDHJ4352171/LICEmore.html

http://sarc.com/avcenter/venc/data/adware.lop.html

Run an AdAware, and see if it catches it. Otherwise, it seems that the Prevx Home Trial should do the trick.

 

[Law93]

i also have something called second knob.exe..........it seems prevx names it as malware...

 

[skip0110]

That sounds like malware as well, I'd go with whatever Prevx says on those issues...