Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

alg.exe, atiptaxx.exe and others


  • This topic is locked This topic is locked
4 replies to this topic

#1 vsmak

vsmak

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:24 AM

Posted 11 January 2009 - 01:10 PM

Hello, I have some processes runing on my laptop that I believe are spyware that I have not been able to remove with Adaware or Malwarebytes. I think that one of them also blocks the three tabs on my task manager from being displayed. I believe that the processes are: alg.exe, ati2evxx.exe, atiptaxx.exe and others. Mey post is below. Thank you in advance for any help that you will be able to provide.

DDS (Ver_09-01-07.01) - NTFSx86
Run by Administrator at 12:38:28.26 on Sun 01/11/2009
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.286 [GMT -5:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\acs.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Panasonic\HotKey Appendix\HKEYAPP.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\108Mbps Wireless LAN Adapter\WLANPRO.exe
C:\WINDOWS\system32\mgr8021x.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.foxnews.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = sec.proxy.meca.panasonic.com:8080
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DriverMax]
mRun: [Hotkey] c:\windows\system32\hkeyman.exe
mRun: [PCTVOICE] pctspk.exe
mRun: [PCinfo] c:\program files\panasonic\pcinfo\SetDiag.exe /FirstLogin
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [Panasonic HotKey Manager] "c:\program files\panasonic\hotkey appendix\HKEYAPP.EXE"
mRun: [ATIModeChange] Ati2mdxx.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [PRONoMgr.exe] c:\program files\intel\ncs\proset\PRONoMgr.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRunOnce: [DELDIR0.EXE] "c:\docume~1\admini~1\locals~1\temp\deldir0.exe" "c:\program files\mcafee\mcafee shared components\guardian\"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\108mbp~1.lnk - c:\program files\108mbps wireless lan adapter\WLANPRO.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\reg.lnk - c:\program files\108mbps wireless lan adapter\Reg.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wlanse~1.lnk - c:\windows\installer\{51559f52-2fac-11d6-9fbf-0050da5bc5d1}\mdc.ico
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
Notify: Sebring - c:\windows\system32\LgNotify.dll

============= SERVICES / DRIVERS ===============

R3 HOTKEY;Panasonic Hotkey Driver;c:\windows\system32\drivers\HOTKEY.SYS [2003-6-8 9216]
R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R4 pcinfo;Panasonic PC Info. Viewer Driver;c:\program files\panasonic\pcinfo\PCINFO.sys [2003-6-9 7808]
S3 vsdatant;vsdatant;\??\c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]

=============== Created Last 30 ================

2009-01-09 22:35 <DIR> --d----- c:\program files\Innovative Solutions
2009-01-09 22:33 156 a------- c:\windows\WinDrvGhost.ini
2009-01-04 13:22 <DIR> --d----- c:\docume~1\admini~1\applic~1\AVS4YOU
2009-01-04 13:21 <DIR> --d----- c:\docume~1\alluse~1\applic~1\AVS4YOU
2009-01-04 13:20 <DIR> --d----- c:\program files\common files\AVSMedia
2009-01-04 13:20 974,848 a------- c:\windows\system32\mfc70.dll
2009-01-04 13:20 487,424 a------- c:\windows\system32\msvcp70.dll
2009-01-04 13:20 344,064 a------- c:\windows\system32\msvcr70.dll
2009-01-04 13:20 1,700,352 a------- c:\windows\system32\GdiPlus.dll
2009-01-04 13:20 24,576 a------- c:\windows\system32\msxml3a.dll
2009-01-04 13:20 <DIR> --d----- c:\program files\AVS4YOU
2009-01-04 12:30 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys
2009-01-04 12:30 1,106,944 -c------ c:\windows\system32\dllcache\msxml3.dll
2009-01-04 09:18 23,576 a------- c:\windows\system32\wuapi.dll.mui
2009-01-03 22:42 <DIR> --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-01-03 22:42 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-01-03 22:42 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-03 22:42 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-01-03 22:42 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-12-15 20:52 410,984 a------- c:\windows\system32\deploytk.dll

==================== Find3M ====================

2008-10-23 07:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-16 15:38 826,368 a------- c:\windows\system32\wininet.dll
2008-10-16 14:07 208,744 a------- c:\windows\system32\muweb.dll
2008-10-13 18:20 87,131 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-06-08 14:14 5,476,495 a------- c:\documents and settings\administrator\6ad4fb10-5ba5-4247-b3db-90d7009dbbf2.zip

============= FINISH: 12:38:38.26 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:24 PM

Posted 12 January 2009 - 05:51 AM

Hi,

I don't see anything suspicious here. The files you mention as suspicious are legitimate, so you shouldn't worry about them.

I think that one of them also blocks the three tabs on my task manager from being displayed

No, just doubleclick the borders of your taskmanager and the tabs should reappear again. This has nothing to do with malware.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 vsmak

vsmak
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:24 AM

Posted 14 January 2009 - 07:39 AM

Thanks for the advice. Glad that it wasn't anything to be concerned about.

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:24 PM

Posted 14 January 2009 - 10:53 AM

Glad I could help :thumbsup:
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#5 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:06:24 PM

Posted 16 January 2009 - 05:46 AM

Since this issue appears resolved ... this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users