What is calling the Ruby Interpreter?

Since installing the ZoneAlarm free firewall I've been getting warnings for the ruby interpreter. I understand that this is a legitimate program, but I don't know where it came from and what purpose it serves. TIA for any help with this.

 

You probably have installed a software written in Ruby which needs Ruby interpreter to run. To find it type this in command prompt:

Code:

cd\ & dir /b /p /s *ruby*

 

This is what results in the command window after running the above command:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>cd\ & dir /b /p /s *ruby*
C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\bin\msvcrt-ruby191.dll
C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\bin\rubyw.exe
C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\lib\ruby
C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\lib\ruby\site_ruby
C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\lib\ruby\gems\1.9.1\gems\win32-ap
i-1.4.8-x86-mingw32\lib\win32\ruby19
C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\bin\msvcrt-ruby191.dll
C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\bin\rubyw.exe
C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\lib\ruby
C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\lib\ruby\site_ruby
C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\lib\ruby\gems\1.9.1\gems\win32-ap
i-1.4.8-x86-mingw32\lib\win32\ruby19
C:\Windows\Prefetch\RUBYW.EXE-694C684F.pf

C:\>


It's not clear what this has to do with installed applications. Can you suggest what this means?

 

Well, it appears you or someone/something else attempted to install something twice(two temp folders with same entries) but then it was blocked.

 

Thanks. I initially blocked the process when my firewall popped up a warning since I didn't recognize it. It seems to be stuck in a loop at the moment.

 

stuck in a loop? ProcessExplorer might help identifying what process is calling ruby, also check in Task Manager -> Processes tab -> view -> select columns -> command line.

 

Thanks for the suggestion. In System Explorer I can see the chain of events - it's associated with the OpenVPN software I'm using which is a relief. I was worried that something nasty was going on. I can contact the VPN provider if necessary. It doesn't right that every time the PC runs all of these files get generated in the user "temp" folder.