Pls help me lots of .exe

Please help me lots of .exe i found in my windows task manager
and before, i saw something like just it installed automatically in a flash some .exe
i could not even catch up how fast it was like a second or 2. (:AGY)

Here are the lists because i dont know how to post its screenshot haha (:TNG)

intelin.exe
iexplorer.exe
taskmgr.exe
iexplorer.exe
Ymsgr_tray.exe
wscntfy.exe
alg.exe
ati2evxx.exe
Rtvscan.exe
scardsvr.exe
MDM.exe
spoolsv.exe
DefWatch.exe
svhost.exe
svhost.exe
svhost.exe
svhost.exe
svhost.exe
ati2evxx.exe
Isass.exe
services.exe
winlogon.exe
csrss.exe
smss.exe
ApntEx.exe
Skype.exe
ctfmon.exe
VPTray.exe
atiptaxx.exe
Apoint.exe
cfpconfg.exe
BCMWLTRY.EXE
WLTRYSVC.EXE
explorer.exe
System
System Idle Process

Hahaha… I’m still newbie… And i just rely on search and download…
I may installed a lot of things in my laptop…
Before i already crashed this and my internet becomes very slow.
So we sent it to someone who could fix it…
and just now,i again might had downloaded more
spywares,viruses etc…
Maybe some of these .exe im familiar with like
yahoo messenger, skype…
I know its my fault…
but could someone pls give me a link to clean
this mess up? i dont want my guardian get angry to me again.
i already installed some of an antispyware from this comodo but still
no threats found. i might have installed the wrong one.
pls reply.

it looks clean…
they’re genuine processes.
Are you having any problem such as a slow down etc. ?

i guess processes are not my problem…?
my internet connection used to be faster than
before… and my wireless connectivity was
good or very good…
but it turned out much slower and
low wireless connectivity after a week or 2…
i may hav downloaded some virus etc
while i was using some sites youtube?
i also installed skype and yahoo messenger…
i dont know i really dont hav any idea
how to bring back the speed of my internet
connection…
no format please…
because i dont even have the window xp cd…
i already installed SUPERantispyware…
but it seems to be not working?
i always scan, find and quarantine or remove…
but everytime i scan, it always finds one…
it never was cleansed…

Hello kais3r.

You could try scanning with MBAM and AVIRA Free. If you’ve scanned with avira\mbam\SAS I highly doubt you have anything infected.

Do you have a router\hardware firewall?

I’ve attached a screenshot capturing uility for you to download.

[attachment deleted by admin]

Tnx a lot Kyle…

I’ll try this now, i’ll give you news…
and thanks also for the FastStone Capture…
I just installed it…

Yea i think we have a router…
Dats how i connect thru wi-fi right?

Hey kaiz3r !

Also check Add/Remove programs and remove any unnecessary programs you may have installed. Also, Go to Start>Run and type msconfig and check your startup tab for any unnecessary stuff that loads on startup. For instance, Skype.exe = VOIP (Voice Over Internet Protocol) which is basically online chat with microphone, so you can safely disable that automatically running.

You should only really have only your security software running on startup, unless of course a certain hardware needs software to auto run.

Cheers,
Josh

I only just noticed this thread.

svhost.exe needs checking out. There are many startups using this name and ALL of them are bad I think. Mainly added by worms and trojans. See here:
http://www.bleepingcomputer.com/startups/searchpage-svhost.exe-filename-0.html

Edit: I just checked the first two on the list and they are both bad, so probably there will be more.

If you cannot run Superantispyware it is probably being disabled by something bad.

It looks like you will need to have a HijackThis log checked at one of the help forums.

svchost.exe is a genuine microsoft process.
though lots of malware adds this process , he needs to make sure if svchost is in system32 folder. if it isnt, then its malware…

As well as svhost.exe (should be svchost.exe in System32), Isass.exe (note the leading “i”) looks very suspicious (should be lsass.exe in System32). There is a virus called this, but I suspect both svchost.exe & Isass.exe could be typeos.

Rather than MSConfig, I recommend Autoruns. It’s far superior & that’s an gross understatement.

Also a HijackThis run would probably help.

Yes but if you look at what he posted, it is not svchost.exe it is several instances of svhost.exe which has long been known as various malwares as you will see from my link to Bleeping Computer.

His Intelin.exe is a completely unknown process, so probably randomly named and surely a baddy.

His iexplorer.exe is likewise not Internet Explorer which is iexplore.exe. You need to research these properly instead of assuming they are good because they look familiar. Malware frequently uses identities which at first glance look like normal processes. You can see it here:

http://www.pcreview.co.uk/startup/iexplorer.exe.php

Yes this is the other one which looks bad, I doubt whether they are all mistyped.

http://www.pcreview.co.uk/startup/index.php?file=Isass.exe&do=file&Submit=Submit

I would think that BOClean would probably be well worth a run to see what it would find here, but Norton seems to be installed, so why does it not find them?

True. But in the case of lsass.exe & svchost.exe, it is the absence of the proper processes on the list that makes me suspect that they might be typeos. Supplanting them using a different name doesn’t quite ring true to me. Usually the slightly different name is used to hide them from the user amongst the real processes.

BOC might be worth a try, although not if the processes have been supplanted. BOC might remove them with potentially unfortunate results. BOC might have prevented it from happening in the first place, but adding BOC after the fact… can have risks.

I’ve not used Norton in many years, so I cannot comment on that.

The OP copied the list from Task Manager and having just looked in mine, it does not show system processes unless you choose to show the processes of all users (I am using Vista). I have no svchost.exe or lsass.exe in my list but when I look in running processes under Defence+ they are there of course.

[ at ]kaiz3r if you have Defense+ you can look to see whether it shows all the processes mentioned, good and bad.

Yup!
Tnx to all of you guys!
I really learned a lot from you! (:AGL)

Tnk Josh, Kyle, JamesFrance, and Kail, State-of-sense!
As of now i come to have quite good internet connection
because I re-installed the Comodo Internet Security,
SUPERantispyware and I also tried Avira as prefered by Kyle…
Though having a lot of these installed applications might cause
another trafficing or something? But it’s kind of a quite good-performing
so Im just gonna keep an eye and observation for late effects… (:SAD)

And yeah I’ll try to check svhost.exe to my system32 if that’s a malware or not…
and i’ll try this msconfig command though i remember using it before…
and the Autorun and the HiJackThis thing (:HUG)

By the way i couldnt use my yahoomessenger anymore,
i guess i blocked its request upon connection outside internet?
Notice of ComodoDef i guess?
and i couldnt allow it anymore because it never asked me again…
Anyway, not a prob because im using the web messenger online… (:TNG)

Tnx again guys!

By the way this is my latest taskmanager processes…

[attachment deleted by admin]

How about can you tell me how can I improve
the responses in my computer?
Like after I doubleclick the internet explorer,
it kind of a takes a little some more time before it opens…
Same with the other folders…
Is it possible i could make like it was a new formatted pc?
I hope you dont think of me as abusive,
it’s just I want to know more about these things…

By the way, u just tried the autoruns thing…
Can you tell what are things i should be unchecking?
There’s the intelinet thing and it’s kinda fishy…
Here i got the shot…

[attachment deleted by admin]

Hi kaiz3r,

Everything there is looking good, Intelinet is ok but not installed on your computer now.

If you have the Avira guard running it could be interfering with Comodo antivirus so you could disable it and only use Avira for occasional scans. That could be what is slowing you down. 2 avs running together is not a good idea.

Just one thing, HijackThis is dangerous if you make any changes with it, so do not remove anything with it without guidance.

Good that you are ok now.

(:WAV)