Helping people with computers... one answer at a time.

A string of random characters ending with ".exe" may be manifestations of virus files left behind.

What is (random-characters).exe?

I frequently get questions asking "what is qwijbo.exe", where "qwijibo" is what can best be described as a random assortment of characters. Examples include wfwvkdyl.exe, tjuazuyt.exe, and others. They key is that the name appears completely nonsensical.

What are they? Hard to say. But my initial guess doesn't bode well.

My belief is that these are manifestations of viruses (or maybe spyware). Several viruses are known to generate random names for the files they leave behind on infected machines.

My advice as always is to get a good virus scanner, keep the virus database up to date, and scan regularly. Same story for spyware.

Article C2156 - August 14, 2004 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

7 Comments
Levin
September 4, 2004 9:04 AM

I may have had the same thing. Ad-aware found a process called VX2 and could kill it, but not remove files. I would have random looking process names in Task Manager, and if I killed them, they reappeared instantly. Names were like Rsv7.exe, ntlkpapi.exe, Wsf8tb.exe. I'd kill one, it would come back with the same or one of the alternate names. About 4 kb. Msconfig showed one item in startup called ntlkpapi with a start location in Win32 folder, but the supposed start location didn't exist. I think the file that actually ran was in a folder called %prog dir%\SEP\

Greg
September 15, 2004 7:56 AM

We have 2 Win98 PCs with is same problem. They both have up-to-date AV software and weve been running Spybot & Ad-aware. Something is starting this random exe.I Hope someone out ther knows what this is. I searched the c: for *.exe and every few min. there are new hidden exes with dates from today. I'm stumped.

Dave
September 23, 2004 7:50 AM

I have the same problem on a Windows XP machine. Does anyone know how to remove the source of the problem?

ili
November 18, 2004 2:28 AM

i noticed the same thing on mine, the only difference:

it keeps creating folders with random names in C:\Programs\Shared Files\
or
C:\Programme\Gemeinsame Dateien\

inside those folders .exe are created also with random names + 1 file with weird extensions, for example .ndl , .el etc

if you try and delete them and the system refuses it means that there are running processes supporting them, which you have to stop first.
Havent found the real source yet and it buggs me :(

Ahlong
May 1, 2005 9:26 PM

http://forums.spywareinfo.com/lofiversion/index.php/t45102.html

not sure if that will help but closest thing i found so far will try it and report back later.. if i remember =p

Mandi
March 11, 2008 6:30 AM

I've found RI943D.exe on my server in C:\WINDOWS\Temp, ended the process and it literally vanished, then on my computer found NN5675.exe in the same location. Same action, same result. Vanished from the computer. Nothing has come back on either computer, but we have 14 more in a domain group. I'll have to check them all i suppose.

james
November 3, 2008 6:44 PM

This is the same thing I got. Win XP with the updates.

Random string characters.exe

IF I terminate they start again.
I tried to CC Cleaner to stop them at startup
HOwever, they renamed themselves to something else.
Anyone got a solution? I'd appreciate it!!

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.