Windows 7 - Identify systray icon process/executable and remove it

1

I know, I am aware. After a very heavy duty day I erroneously clicked on the wrong link and executed a fake installation on my windows 7 machine:

  1. CTA

enter image description here

  1. Download

enter image description here

The installer eventually installed Opera browser and a annoying and suspicious systray process:

enter image description here

I have already get rid of Opera, but I am having trouble with the systray process.

Here what I tried so far:

  1. Searched the file system for the ICSW1.14_0S1F2Y1C1R1P0F1F1C1N1P1.14.exe executable. Not found.

  2. Search the registrer (regedit.exe) for the ICSW. Found only the following entry without any keys:

     HKEY_USERS\S-1-5-21-762979615-2031575299-929701000-475874\Software\ICSW1.14
    
  3. Search the sys config (msconfig.exe) any suspicious entry. Nothing found.

  4. Search the Program and features entries. Nothing found.

  5. Search the task manager. Nothing found.

Question

I would like to identify the source executable corresponding to the sys tray icon and remove it from the file system in the proper way (stop and disable any related service or process, remove the executable, clear the registry).

So:

  1. Where are the systray processes configured/listed?
  2. How may I relate a process to the corresponding executable or service?

Constraints

I really avoid to install any additional or unreliable program. So please do not suggest any app. Please.

Alberto De Caro

Posted 2015-10-09T09:34:36.470

Reputation: 111

to suggest the obvious... is it in task manager somewhere? – Journeyman Geek – 2015-10-09T09:55:01.233

@Jurnyman Geek: not found anything – Alberto De Caro – 2015-10-09T10:09:35.517

Answers

0

Use Process Hacker portable http://processhacker.sourceforge.net/ to find the launch command line for a running process from the right click properties menu.

Also look at Sysinternals autoruns https://technet.microsoft.com/en-us/sysinternals/bb963902.aspx to hunt for and disable suspicious software.

yobbo

Posted 2015-10-09T09:34:36.470

Reputation: 11

Hi Yobbo. Good advice. I did not know the autoruns. Unfortunately I found no evidence of the tray element in the autoruns reports. – Alberto De Caro – 2015-10-09T14:43:56.003