What is calling the Ruby Interpreter?

Discussion in 'other software & services' started by Victek, Feb 1, 2013.

Thread Status:
Not open for further replies.
  1. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    5,127
    Location:
    USA
    Since installing the ZoneAlarm free firewall I've been getting warnings for the ruby interpreter. I understand that this is a legitimate program, but I don't know where it came from and what purpose it serves. TIA for any help with this.
     
  2. Sadeghi85

    Sadeghi85 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    747
    You probably have installed a software written in Ruby which needs Ruby interpreter to run. To find it type this in command prompt:

    Code:
    cd\ & dir /b /p /s *ruby*
     
  3. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    5,127
    Location:
    USA
    This is what results in the command window after running the above command:

    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation. All rights reserved.

    C:\Windows\system32>cd\ & dir /b /p /s *ruby*
    C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\bin\msvcrt-ruby191.dll
    C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\bin\rubyw.exe
    C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\lib\ruby
    C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\lib\ruby\site_ruby
    C:\Users\Victor\AppData\Local\Temp\ocr54D3.tmp\lib\ruby\gems\1.9.1\gems\win32-ap
    i-1.4.8-x86-mingw32\lib\win32\ruby19
    C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\bin\msvcrt-ruby191.dll
    C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\bin\rubyw.exe
    C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\lib\ruby
    C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\lib\ruby\site_ruby
    C:\Users\Victor\AppData\Local\Temp\ocrC715.tmp\lib\ruby\gems\1.9.1\gems\win32-ap
    i-1.4.8-x86-mingw32\lib\win32\ruby19
    C:\Windows\Prefetch\RUBYW.EXE-694C684F.pf

    C:\>


    It's not clear what this has to do with installed applications. Can you suggest what this means?
     
  4. Sadeghi85

    Sadeghi85 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    747
    Well, it appears you or someone/something else attempted to install something twice(two temp folders with same entries) but then it was blocked.
     
  5. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    5,127
    Location:
    USA
    Thanks. I initially blocked the process when my firewall popped up a warning since I didn't recognize it. It seems to be stuck in a loop at the moment.
     
  6. Sadeghi85

    Sadeghi85 Registered Member

    Joined:
    Dec 20, 2009
    Posts:
    747
    stuck in a loop? ProcessExplorer might help identifying what process is calling ruby, also check in Task Manager -> Processes tab -> view -> select columns -> command line.
     
  7. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    5,127
    Location:
    USA
    Thanks for the suggestion. In System Explorer I can see the chain of events - it's associated with the OpenVPN software I'm using which is a relief. I was worried that something nasty was going on. I can contact the VPN provider if necessary. It doesn't right that every time the PC runs all of these files get generated in the user "temp" folder.
     
Loading...
Thread Status:
Not open for further replies.