What is EncMontr.exe

[lostit44]

I have a question that I am hoping someone might know. My AVG keeps bringing up this file and telling me that it has a suspicious code Heuristic/ Backdoor Generic. I went on google and all I was able to find out was that it is a simple brower from Yahoo. Now what I want to know is it important to have or is it safe to delete. My daughter uses Yahoo and by deleting is file will she still be able to use her account? I am running Windows98se and keep up on the patches , IE6 yes I know not the greatest but I need it for work. Any more info would be nice also what other programs might be affected if I delete it. Thanks

[CybertecOne]

never heard of it before. which probably means that your AV is correct in saying its suspicious.

however, yahoo does have a habbit or adding in certain object. if you delete it your daughter will still be able to access her mail, but if she uses any programs or games (that might have used that file) she will just be promted to install the file again.

Recommendations: Delete the file, ask your daughter if she uses anything more than mail on Yahoo. see if it comes up again later on. then get back to us.

CTO

[nihil]

All AV products are likely to give you the occasional false positive. On the other hand it probably has some genuine concern about what the program actually does, but that does not mean that it is malicious.

I would recommennd:

1. Submit a copy of the file to the AV company for analysis. You should find instructions on how to do this in "help" or on their website.

2. Get a "second opinion".............

"Housecall" from Trend Micro and "Online scanner" from Panda Software are good online scanners with up to the minute definitions.

Hope that helps

[Und3ertak3r]

Wait just a minute:

Where IS the file? like c:\program files\Yahoo
or is it C:\Windows\.....

Go to Start - run type in Msconfig , click ok
Open the STARTUP Tab.. is this program listed in here?



Some may ask to run HiJackThis and post the log Back here.. we will see how we move from the above first.. (I would recommend moving this thread to either the Antiivirus or Spyware/Adware forum.. but that is not important.. sorting the problem is)


Cheers

Dambed Johnno,, yopu beat me to it..

Found a bit about the File in question..

Associated with ENCOMPASS...and Easy Internet

[lostit44]

To answer Und3ertak3r the file is in c:\ program files\encompass and no it is not in the Startup files. As for nihil suggestion I use Housecall about once a month and it does not find it. What the one website related was a simple browser from Yahoo but my kid did not download it and because we have dialup anything that wants to be downloaded has to be allowed. I have set up the computer so nothing can download on its on. This program file seems to be bundled in the encompass file which is one of the programs that comes with my recovery cd I have never used the the encompass program so have no idea what it is. As for adaware and spybot neither one has reported this. It has not accessed the net if it tryed it would set off my firewall and my daughter knows if my firewall warning goes off to get me to check and see what caused it. I am using Sygates firewall and and AntiVir 9x kept updated and before the last update it did not show up. The file has been on my computer sence my last reformatting but has never been accessed. I am figuring because it has never been used that I can delete it safely any not have any problems. I was just wondering if anyone else had heard of this program before. But thanks for the ideas it makes me feel good that I am doing the right steps in protecting the computer.

[nihil]

Hi lostit, many thanks for the feedback.

From what I found, the program is not malicious and does not seem to be involved in any significant systems problems such as clashes, resource hogging or whatever. Everything I read sais it was NOT critical so deleting it should not do any harm, at least your OS will still run

An old trick that I use when I have doubts about a non-system file is to rename and move it. Then if the computer runs for a week without problem I assume that it is pretty safe to delete it.

I would still send the file to the AV company as it looks like their latest pattern file is producing a false positive, and I am sure that they would be glad of the information.

Cheers