BleepingComputer.com: alg.exe, atiptaxx.exe and others

Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

alg.exe, atiptaxx.exe and others My task manager has lost the option tabs

#1 User is offline   vsmak 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 3
  • Joined: 10-January 09

Posted 11 January 2009 - 01:10 PM

Hello, I have some processes runing on my laptop that I believe are spyware that I have not been able to remove with Adaware or Malwarebytes. I think that one of them also blocks the three tabs on my task manager from being displayed. I believe that the processes are: alg.exe, ati2evxx.exe, atiptaxx.exe and others. Mey post is below. Thank you in advance for any help that you will be able to provide.

DDS (Ver_09-01-07.01) - NTFSx86
Run by Administrator at 12:38:28.26 on Sun 01/11/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.286 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\acs.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Panasonic\HotKey Appendix\HKEYAPP.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\108Mbps Wireless LAN Adapter\WLANPRO.exe
C:\WINDOWS\system32\mgr8021x.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.foxnews.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = sec.proxy.meca.panasonic.com:8080
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DriverMax]
mRun: [Hotkey] c:\windows\system32\hkeyman.exe
mRun: [PCTVOICE] pctspk.exe
mRun: [PCinfo] c:\program files\panasonic\pcinfo\SetDiag.exe /FirstLogin
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Panasonic HotKey Manager] "c:\program files\panasonic\hotkey appendix\HKEYAPP.EXE"
mRun: [ATIModeChange] Ati2mdxx.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [PRONoMgr.exe] c:\program files\intel\ncs\proset\PRONoMgr.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRunOnce: [DELDIR0.EXE] "c:\docume~1\admini~1\locals~1\temp\deldir0.exe" "c:\program files\mcafee\mcafee shared components\guardian\"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\108mbp~1.lnk - c:\program files\108mbps wireless lan adapter\WLANPRO.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\reg.lnk - c:\program files\108mbps wireless lan adapter\Reg.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wlanse~1.lnk - c:\windows\installer\{51559f52-2fac-11d6-9fbf-0050da5bc5d1}\mdc.ico
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Notify: Sebring - c:\windows\system32\LgNotify.dll

============= SERVICES / DRIVERS ===============

R3 HOTKEY;Panasonic Hotkey Driver;c:\windows\system32\drivers\HOTKEY.SYS [2003-6-8 9216]
R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R4 pcinfo;Panasonic PC Info. Viewer Driver;c:\program files\panasonic\pcinfo\PCINFO.sys [2003-6-9 7808]
S3 vsdatant;vsdatant;\??\c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]

=============== Created Last 30 ================

2009-01-09 22:35 <DIR> --d----- c:\program files\Innovative Solutions
2009-01-09 22:33 156 a------- c:\windows\WinDrvGhost.ini
2009-01-04 13:22 <DIR> --d----- c:\docume~1\admini~1\applic~1\AVS4YOU
2009-01-04 13:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVS4YOU
2009-01-04 13:20 <DIR> --d----- c:\program files\common files\AVSMedia
2009-01-04 13:20 974,848 a------- c:\windows\system32\mfc70.dll
2009-01-04 13:20 487,424 a------- c:\windows\system32\msvcp70.dll
2009-01-04 13:20 344,064 a------- c:\windows\system32\msvcr70.dll
2009-01-04 13:20 1,700,352 a------- c:\windows\system32\GdiPlus.dll
2009-01-04 13:20 24,576 a------- c:\windows\system32\msxml3a.dll
2009-01-04 13:20 <DIR> --d----- c:\program files\AVS4YOU
2009-01-04 12:30 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys
2009-01-04 12:30 1,106,944 -c------ c:\windows\system32\dllcache\msxml3.dll
2009-01-04 09:18 23,576 a------- c:\windows\system32\wuapi.dll.mui
2009-01-03 22:42 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-01-03 22:42 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-03 22:42 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 22:42 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 22:42 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-12-15 20:52 410,984 a------- c:\windows\system32\deploytk.dll

==================== Find3M ====================

2008-10-23 07:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-16 15:38 826,368 a------- c:\windows\system32\wininet.dll
2008-10-16 14:07 208,744 a------- c:\windows\system32\muweb.dll
2008-10-13 18:20 87,131 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-06-08 14:14 5,476,495 a------- c:\documents and settings\administrator\6ad4fb10-5ba5-4247-b3db-90d7009dbbf2.zip

============= FINISH: 12:38:38.26 ===============

Attached File(s)


#2 User is offline   miekiemoes 

  • Malware Killer Dog
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Team
  • Posts: 19,287
  • Joined: 18-February 05
  • Gender:Female
  • Location:Belgium

Posted 12 January 2009 - 05:51 AM

Hi,

I don't see anything suspicious here. The files you mention as suspicious are legitimate, so you shouldn't worry about them.

Quote

I think that one of them also blocks the three tabs on my task manager from being displayed
No, just doubleclick the borders of your taskmanager and the tabs should reappear again. This has nothing to do with malware.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 User is offline   vsmak 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 3
  • Joined: 10-January 09

Posted 14 January 2009 - 07:39 AM

Thanks for the advice. Glad that it wasn't anything to be concerned about.

#4 User is offline   miekiemoes 

  • Malware Killer Dog
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Team
  • Posts: 19,287
  • Joined: 18-February 05
  • Gender:Female
  • Location:Belgium

Posted 14 January 2009 - 10:53 AM

Glad I could help :thumbsup:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 User is offline   miekiemoes 

  • Malware Killer Dog
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Malware Response Team
  • Posts: 19,287
  • Joined: 18-February 05
  • Gender:Female
  • Location:Belgium

Posted 16 January 2009 - 05:46 AM

Since this issue appears resolved ... this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users