Invisible Process

Hi,

i have this fake onlineeye.exe file that i cannot delete. It says that there are some processes that are using the file, or other user using it. I've checked task manager and i can't seem to be able to find the process that uses the file. I've tried deleting the registry, but it doesn't help. Can you give suggestions?

Thanks.

 

Can you send the file to submit@diamondcs.com.au ?

The first thing to try is boot into Safe Mode and see if you can move the file to a new location, or rename it

 

you could use Process Explorer from Sysinternals to determine which exe/service has that particular file open. (use the search handles function for this)

 

Hi,
I've tried using safe mode, but i still can't delete it.
Sorry, I don't know any Process explorer or sysinternals.
I sent the file to the email.
Thanks again for the help.

 

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

I use Port Explorer (DCS) first to see if there are connections on certain ports to the outside world, where you then can kill that process.
Further possibility the mentioned Process Explorer (URL above) or Faber Toys ( www.faberbox.com) both free tools.

 

Emm.. Sorry, I still can't figure out a way to find the invisible process and kill it.. But I've known something though, when I open the file, a new process shows up in Process Explorer, but disappears in an instant.. I'm sorry, but I'm a noob in computers.

Thanks.

 

I assume that from your previous post you downloaded and installed 'Process Explorer' from here
One way to find what process has the file in question (onlineeye) locked it to use 'Process Explorer' to search for the file handle.
To do this run Process explorer, then in the main menu (across the top of the window) select the 'Find' menu option, then select 'Find Handle'. A window will then pop up and ask you to enter the name of the file. Type in 'onlineeye' (without the quotes) then hit the search button. This should give you the name of the process locking the file. Yuo can then report back here with your findings.

 

Ok, now i got the process locking the file. It's explorer.exe. So, with my common sense i closed the handle. But still, i cannot delete the file, and everytime i try to delete it, the handle appears again. Btw, what is process handle?

 

Have you by any chance installed the Onlineeye Pro program written by pmasoft, if so can it be removed from 'add remove programs' in the 'control panel', is there a task bar icon which is called 'online eye' when you mouse over it? if so is there an 'exit' command in its right click menu?

 

yes, i downloaded the Online Eye Pro. But I downloaded it after i realised nothing happens and that the file is fake from the original link from softlandco.com.

Here is the link http://www.softandco.com/download/onlineeye-pro/free_download_17026.html

tried it again, and it now works. But i am sure that the file i downloaded was the file that i sent to submit@diamoncs.com.au

 

Nevermind, deleted the file already. Thanks y'all for ur help!