Problems with spyware/adware and stuff...

[Ellethwen]

I know we have a topic on this but my problems are a little different.

Lately I've been experiencing troubles with pop-ups, my computer being slow, and processes I've never seen before. Once I found several folders for programs I never installed.

I scan my computer quite often with LavaSoft Ad-Aware SE, and while it does detect things on a full system scan, I remove them, yet the problems remain, and the removed files don't show up again.

I'm looking at my Task Manager now, and these are the fairly suspicious processes I'm seeing. I have never seen any of these before I got all the trouble.

alg.exe (I end and nothing happens)
bcmwltry.exe (I end but it keeps coming back, nothing happens)
ctfmon.exe (I end but it keeps coming back, nothing happens)
PDVDServ.exe (I end and nothing happens. I've actually heard this one's clean but I'm not sure.)
usnsc.exe (I end but it keeps coming back, nothing happens)
wltrysvc.exe (I end and nothing happens)
XWatDog.exe (I end and nothing happens)

I haven't seen any suspicious files on my computer ever since I uninstalled those programs I found, but these processes remain. I choose "End Process Tree" for all of them.

The pop-ups I get relate to spyware and ad-aware scans, for programs such as WinAntiVirus Pro. I have even been prompted to install programs before via a .exe window.

The style of the ads very between pop-up windos and in-window ads. I have even seen the in-window ads on the Oracle several times, which baffles me.

I also have a very weird problem involving two seperate processes:

imapi.exe
wmiprvse.exe

I ran a search on these and they're supposed to be important system processes, but I think they're directly corelated to errors I am getting everyday between 5-8 PM. And yes, it is isolated to those times. I call it "my little bug".

I will get a Microsoft Visual C++ error, telling me that explorer.exe is corrupted and the program must be restarted. As such explorer.exe refreshes, but when I open Task Manager, I can see wmiprvse.exe, which isn't there when I start the computer. I can also see imapi.exe, which tends to appear and disappear. If I end wmiprvse.exe, it goes away, but then comes back, and soon after it reappears I get the error again, and imapi.exe shows up.

This error happens a few times, then goes away, and neither wmiprvse.exe nor imapi.exe shows up again.

I know something is VERY WRONG here.

What's the deal?

[Amy-Chan]

well at a guess... you maybe have spyware/adware with viral activities ability (its in memory and just respawns itself when ordered to quit) or a actual virus

in these situations the brute force method is easier than the subtle method (tracking down bits inside the registry, finding out which files need to be deleted manually) save anything import to disc/dvd and reinstall windows (taking the reformat option) its also gets rid of rubbish left behind from uninstalls etc... you are actually reconmended i read somewhere to redo twice a year or at least once just to make sure the pc is running at peak performance

edit:
i looked up those two
imapi.exe - is used with cd/dvd burning software as a communicator for the hardware drivers and soffware
wmiprvse.exe - monitors system components

[Larry Laffer]

Let's see... yup spyware, but before you proceed to safe-mode-system-scan, lemme clarify some things:

alg.exe, should be there ONLY if it's located in %windir%(that's normaly c:\windows)\system32, and ONLY if you're using a shared Internet Connection!

bcmwltry.exe should be there ONLY if it's %windir%\system32 and ONLY if you're using a wireless internet connection

ctfmon.exe it has to do with the MS Office suit and the language bar... you should only worry if you don't have those two

PDVDServ.exe it's a background process for PowerDVD, again you should only worry if you don't have PowerDVD installed

usnsc.exe ... eh, honesty I've never heard of this, and according to google, you might be referring to usnsvc.exe, which is a MSN Messenger component, it should be placed in %programfiles%(that's usually c:\program files)\msn messenger\usnsvc.exe. And you should really switch to live messenger!

wltrysvc.exe should be ok, if if have something to do with Broadcom Corporation Wireless Network(it's the tray applet)... in other case, run for the hills (not really)

XWatDog.exe should be there, only and only if it's in %programfiles%\XGI\XwatDog.exe, and ONLY if you have something to do with XGI Volari graphics cards!

imapi.exe That's a process used by windows with various tasks such as the built-in CD burner wizard

wmiprvse.exe Well, if it's in %windir%\system32\wbem, you're in the clear, however, in your case it sounds like the "Blaster/Sasser" worm(double check it's location, and whether it's wmiprvse.exe or wmiprvsw.exe

Ok, now that those are [almost] out of the way, I suggest you jack up whatever antivirus/antispyware software you have(if not, get hold of Ad Aware, Avast, and Comodo), boot in Safe Mode(that is, shut down your computer, turn it on again, and right before the "Windows XP" loading screen, hammer the F8 key, then choose "Safe Mode") and use the above mentioned to scan. And after you finish scanning with each and every one of them, scan again! ^_^

After that, reboot normally and see if shit keeps happening(if it is, then we move on to HijackThis )

And you still think using IE is good for you? ^_^'


[edit]I'm aware Amy-Chan beat me to it, but it's not my fault it took me 30 minutes to do research/write this thing

[Ellethwen]

I will tell you that Ad Aware did point out various Mozilla Firefox things. And yes, I'm still and IE purist, so sue me XD

Thanks for all the help though! I'll go check all that stuff.

EDIT:

And no, I do not have MS Office...I have OpenOffice. Suppose I should worry.

[Larry Laffer]

Meh, only if it's not in %windir%\system32(since as I said, it has to do with them language bar, which you can't disable )

And for future reference, post one of Ad Aware's scan logs here! Just to help me help you! ^_^