Constant spawning of suspicious file C:\Program Files\Microsoft\taskeng.exe

Comodo Internet Security - CIS AntiVirus Help - CIS
#1

A suspicious file C:\Program Files\Microsoft\taskeng.exe gets quarantined continuously.

Comodo Antivirus (signature version 11314) is quarantining a suspicious file (see screenshot) almost every second. It has now quarantined the file for over 6000 times.
I ran a full virus scan of the system but no results, Comodo AV does ask me whether I want to reboot to complete the scan but at this stage I’m too afraid that it might be a rootkit that wants to install itself during system reboot.

Also, when I look at msconfig.exe, the taskeng.exe is added to the startup entry (see screenshot).
Does CIS actually have protection against malicious entries to the startup table? Because whenever I disable those entries they automatically get added the next time I open msconfig.exe

I’ve also scanned with the latest Spybot S&D but it only found a tracking cookie in IE8 (which I almost never use anyway).

My OS is Win7 Ultimate x86.

If it’s safe to reboot I’ll try to scan my system in a linux liveCD environment using clamav and post back the results.

Thanks in advance,
archive23

#2

With my Win 7 x86 taskeng.exe resides in the system32 folder. I would say the AV may be right. Try uploading it Virus Total to see what other scanners think

To know for sure that taskeng.exe is the original file you can use Sigcheck to see if it is digitally signed by Microsoft.

Download this zip archive and unpack it to C:\Program Files\SysinternalsSuite\ . When done run sigcheck.reg to add it to the registry.

When this is done navigate to the folder, look up and select taskeng.exe click right and choose Signature from the context menu. A black command box will pop up. See if it is signed or not.

#3

You can also follow the advice I give in my article about How to Know If Your Computer Is Infected.