[SOLVED] Very bizarre Windows Startup Program

[luke.anthony.williams]

Hey guys.

So i happened to open my Task Manager and check Startup Programs today, and i have two strange programs listed. First one is has no icon, and is named "1". The second one also has no icon and is named "8852f68b-8a6f-43fc-869a-2959dec57375".
Right clicking on either one does NOT give me the option to "Open file location" or see "Properties" (both options are greyed out on both files). Searching online yields no results. I have a fully up to date Win11 and use Microsoft Defender. I also don't do anything 'shady' online. I watch Youtube and play games through Steam.

Any suggestions? I have not yet Disabled the files, but i will here in just a minute.

 

[USAFRet]

and play games through Steam.

Download any addons?

We've seen a couple of posts just like this recently.

Question - I found this startup process in the task manager but I don't know what it could be

PLEASE HELP ME

forums.tomshardware.com

 

[luke.anthony.williams]

Download any addons?

We've seen a couple of posts just like this recently.

Question - I found this startup process in the task manager but I don't know what it could be

PLEASE HELP ME

forums.tomshardware.com

Yes. Let's see, probably a week ago I downloaded two addons for Temple of Elemental Evil. First was called Circle of Eight,

Circle of Eight Modding Community - The Temple of Elemental Evil

Circle of Eight Modding Community - The Temple of Elemental Evil

co8.org

and the second is Temple+
https://www.nexusmods.com/thetempleofelementalevil/mods/1

also, Median XL for Diablo 2

Home - Median XL

The most popular Diablo II overhaul modification. Median XL is an action RPG with extensive endgame content, deep character customisation and challenging gameplay.

median-xl.com

 

[USAFRet]

Downloaded from where?

Likely, those were the source of an infection.

 

[luke.anthony.williams]

Downloaded from where?

Likely, those were the source of an infection.

All downloaded from the links provided, the original mod group/creators' sites.

Any idea why nothing pops on Microsoft Defender?

 

[USAFRet]

All downloaded from the links provided, the original mod group/creators' sites.

Any idea why nothing pops on Microsoft Defender?

Because they're not necessarily a "virus", but maybe some variant of malware.

 

[luke.anthony.williams]

Because they're not necessarily a "virus", but maybe some variant of malware.

This post, looks similar to mine, and mentions the game "Once Human". I did download that when it launched a few weeks back. Perhaps its' related to that game? https://forums.tomshardware.com/thr...t-know-what-it-could-be.3849943/post-23304166 (last post by naxopop)

Edit: It does look like something fishy (and/or stupid) is going on with Once Human. see link https://steamcommunity.com/app/2139460/discussions/0/4410795908427053768/

I'll just go ahead and uninstall that game, thank you very much.

Thanks for your help.

 

[Secret-Squirrel]

.................... Startup Program..........Right clicking on either one does NOT give me the option to "Open file location" or see "Properties" (both options are greyed out on both files).

That in itself is not suspicious because I think that occurs when the startup item is a service and not an executable file.

Have you looked in the Services app (RUN -> services.msc) ? If you find something that might be relevant then double-click on it and it'll give you more details such as the file location.

 

[luke.anthony.williams]

That in itself is not suspicious because I think that occurs when the startup item is a service and not an executable file.

Have you looked in the Services app (RUN -> services.msc) ? If you find something that might be relevant then double-click on it and it'll give you more details such as the file location.

They ended up being registry keys from the game "Once Human".

They were trackers for how many times you have ran the game, and the other one was related to your steam user ID or some such thing. Consensus seems to be just lazy or bad way of tracking such info. I have since removed the game and registry keys from Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

 

[Secret-Squirrel]

Thanks for the feedback.