Results 1 to 11 of 11

Thread: DUCINS~1

  1. #1
    4 Star Lounger
    Join Date
    Jan 2001
    Location
    Atlanta
    Posts
    568
    Thanks
    7
    Thanked 1 Time in 1 Post

    DUCINS~1

    I am running Windows ME. Occasionally while I work, a DOS window opens and instantly closes. I never see any commands execute. I have noticed that the name of this windown is DUCINS~1. I have no EXE, COM, or BAT file by that name. I have run both an antivirus and spyware program and found nothing wrong. I run a Norton firewall set on high and I never download programs from the internet so I doubt it is spyware but it only recently started so I am a little concerned. Any suggestions?

    Ronny
    Ronny Richardson

  2. #2
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: DUCINS~1

    DOS names generally are constructed from the first six non-space characters of the long Windows name, which makes it hard to match them exactly in a file name search...

    Does your computer have any "scheduled tasks" (e.g., backups, stock quote checks) or any hotkey assignments (i.e., is it possible that you are pressing some key combination that is running this program)?

  3. #3
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: DUCINS~1

    Two suggestions:
    1. <LI>try a search in Windows Explorer on your entire hard disk for anything starting with DUCINS (use DUCINS*.* as the file search string)<LI>see whether there is something in your Startup List that you don't recognise. One program which will show you what gets started after a reboot is Autoruns
    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  4. #4
    4 Star Lounger
    Join Date
    Jan 2001
    Location
    Atlanta
    Posts
    568
    Thanks
    7
    Thanked 1 Time in 1 Post

    Re: DUCINS~1

    This has happened without me touching the keyboard or mouse so I am certain I am not triggering it. I have not manually scheduled anything but it did only recently start. No software/hardward has been installed during that period of time. It seems to only happen when I am online, which is why I suspected spyware but the scanners find nothing and I never install downloaded software.

    Ronny
    Ronny Richardson

  5. #5
    4 Star Lounger
    Join Date
    Jan 2001
    Location
    Atlanta
    Posts
    568
    Thanks
    7
    Thanked 1 Time in 1 Post

    Re: DUCINS~1

    Searching on DUCINS*.* is not enough since D_U__C_I_N_SABC (Where _ is a space) would generate the same DOS shortcut. I tried DUC*.* and had no files with this name. Searching on DU*.* yielded a number of files but none that would have a DOS shortcut name of DUCINS~1.

    I run Startcop every now and then and it does not appear to have chanced.

    Ronny
    Ronny Richardson

  6. #6
    Platinum Lounger
    Join Date
    Nov 2001
    Location
    Melbourne, Victoria, Australia
    Posts
    5,016
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: DUCINS~1

    Have you tried restarting in (true) MS-DOS mode, and from the root directory C: running the command:

    DIR DUCINS~1*.* /S

    and any other similar ones that might be appropriate. If you DO find a culprit, I'd rename it to something "easy" before a reboot. Then maybe take a look at it in a hex editor to see if there's any "giveaway" readable ASCII text in there that might connect it to spyware, before deciding whether to delete it.

    Alan

  7. #7
    4 Star Lounger
    Join Date
    Jan 2001
    Location
    Atlanta
    Posts
    568
    Thanks
    7
    Thanked 1 Time in 1 Post

    Re: DUCINS~1

    Found nothing and also found no reference to the file in the registry. I also tried ATTRIB DUCINS~1.* /s in case it was a hidden file that would not show up to DIR.

    Ronny
    Ronny Richardson

  8. #8
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: DUCINS~1

    Have you tried my Autoruns suggestion? Or looked in the Processes tab of Task Manager, for "unexpected processes"?

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  9. #9
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,571
    Thanks
    5
    Thanked 1,056 Times in 925 Posts

    Re: DUCINS~1

    Try downloading and running Sysinternals Freeware - Utilities for Windows NT and Windows 2000 - Autoruns. Don't worry it is also for 98/ME. It will show you everything getting started on your machine. Even though you've done malware scans it seems as though you've gotten infected. Use Autotun to see if there is something you can't figure out.

    Joe
    Joe

  10. #10
    Platinum Lounger
    Join Date
    Jan 2001
    Location
    Quedgeley, Gloucester, England
    Posts
    5,333
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: DUCINS~1

    Ah, Windows ME. I don't think you get a Task Manager with that...!!

    John
    <font face="Script MT Bold"><font color=blue><big><big>John</big></big></font color=blue></font face=script>

    Ita, esto, quidcumque...

  11. #11
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,571
    Thanks
    5
    Thanked 1,056 Times in 925 Posts

    Re: DUCINS~1

    Sorry, for the repeat about Autoruns. Just missed it when perusing the prior posts.

    Joe
    Joe

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •