Question Rasdial.exe random pop up

[shipwreck5]

recently, theres been random pop ups of cmd windows running /Windows/system32/rasdial.exe and then quickly closing whenever i run a vpn. It would keep dong this until i restart. Also they would randomly appear once every few minutes when not using a vpn. This started ever since i installed tighvncserver (though uninstalling did not help) or when i installed shady usb to ethernet drivers (i installed both around the same time).

 

[Colif]

This process is known as Remote Access Client Side Command Line Dial UI and is located in C:\Windows\System32 by default.

sure sounds like something that would be tied into vpn.

To be sure, have you scanned for malware? used Malwarebytes? What AV have you got?

 

[laviniuc]

get cccleaner portable and check the autorun/startup items and the scheduled tasks for anything suspicious

 

[shipwreck5]

malwarebytes found nothing. On ccleaner i found energyWV2apowriteSpeech and MaxxVoiceAPO3064MusUpdat.

 

[Colif]

the only reference to one of those file names that isn't this post is

The following is a description of this virus:

1. The name of the virus is: energyWV2apowriteSpeech.exe

2. The path to this virus: a folder with a random name in C:\Program Data

3. The virus is described as Easy 7-Zip Setup 4. This virus will only take up 50% of your computer's CPU utilization.

5. This virus detects that the task manager ends its own process immediately after starting, and restarts after closing the task manager for 30 seconds.

6. This virus uses a method to hide itself from the C:\Program Data path, and "Show hidden files" cannot be displayed. (so I can't extract the EXE submission)

7. This process uses the "Windows Command Processor" service to start itself.

Translated from an question here: https://bbs.guanjia.qq.com/thread-508007-1-1.html?direction=1

so try running Bitdefender Free and see if it has same answer as Malwarebytes did

 

[shipwreck5]

bitdefender didnt find anything

 

[Colif]

does ccleaner let you disable those 2 files at startup?

I am not sure what this is but the 2nd file could be innocent - https://maxx.com/technologies/wavesmaxx-voice/

neither could be cause, I am just following a lead

is there anything in task scheduler set to run rasdial?