DrSmartLoad, winde.exe, project1 and other annoyances

[Mumpitz]

Hi. I've just formatted and installed a new copy of XP, but now I've got various trojans, viruses ad registry changes to worry about. The ones mentioned in the title are found by AVG upon connecting to the net, usually after about 3 minutes. Whatever my online status I cannot run certain programs, they do not crash, they just simply fail to appear once the .exe is opened. Also, the taskbar crashes on a regular basis, while everything else still seems to be running fine. I ran HJT, please see the log below:

Logfile of HijackThis v1.99.1
Scan saved at 08:24:42, on 11/09/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\lssc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\alg.exe
C:\WINDOWS\system32\lsiss.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\dslagent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\ayqieg.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Winphx service] ayqieg.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Securety] security.exe
O4 - HKLM\..\RunServices: [Winphx service] ayqieg.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1157917256171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157917647375
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Network Location Manager - Unknown owner - C:\WINDOWS\system32\lssc.exe
O23 - Service: Microsoft Language Service (Windows Language Service) - Unknown owner - C:\WINDOWS\alg.exe
O23 - Service: Windows Remote Manager - Unknown owner - C:\WINDOWS\system32\lsiss.exe

I also ran PandaScan last night but couldn't find any errors. None at all. It can't have been running properly, but I'm reluctant to run it again as it has caused the laptop to crash a few times (screen goes multicoloured vertical lines...?). Any help is much appreciated!

Many thanks in advance

Marshall

[LonnyRJones]

Since you have already formated recenty why not do so again ?
Then install an antivirus and firewall and go get all windows updates before any other actions..

If you would like to attempt a cleanup >

Open a command prompt (start run type cmd press enter) type
sc delete "Network Location Manager"
press enter, type in
sc delete "Windows Language Service"
press enter, type in
sc delete "Windows Remote Manage"
press enter, type exit and press enter to exit the command prompt

Start Hijackthis and place a check next to these items If there.
O4 - HKLM\..\Run: [Winphx service] ayqieg.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Securety] security.exe
O4 - HKLM\..\RunServices: [Winphx service] ayqieg.exe
====================================
Hit fix checked and close Hijackthis.
Restart the PC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Install update and check for problems with SpyBot 1.4
http://www.safer-networking.org/en/tutorial/index.html
Install update and do a full scan with Ewido
http://www.ewido.net/en/download/

[tashi]

This topic has been archived.

If you need it re-opened please send me a private message (pm) and provide a link to the thread.
Applies only to the original topic starter.