Serious Computer Problem

[evilded]

I have a few strange programs running on my machine, and i have no idea what they are. They are: Admiliserv.exe, Admilikeep.exe, and vsmon.exe. I really don't like the idea of having these on my computer if i don't know what they are, and I can't close them. Anyone know what they are?

[Sebatianos]

In cases like that - don't ask - just delete!!! Doesn't sound like anything nice!

[FreeFreddy]

Did you scan you HD('s) with an anti-virus program already? Also what do you mean with "I can't close them"? Are they automatically loaded into memory when Windows starts?

[Wael]

Here (http://forums.thetechguys.com/archive/index.php/t-12569.html) is something,
that you might find of intrest...

[Yamcha]

get a yahoo toolbar with antyspam, then lavasoft ad-aware. Update them both if they need so and then perform a full system check. The antyspam is very usefull - it finds hijacks, adware and tracking coockies and trojans. Its great

[Petter1979]

VSMon.exe

(Zone Labs) This actually displays as True Vector in the Task List in Windows 95/98/ME, and as VSMON in Windows NT4/2000/XP/2003. Essential component of the Zone Alarm Internet firewall software. It is started via the registry in Windows 9x/ME, and as a service in NT/2000/XP/2003. This program enforces the security rules which you configured on the Zone Alarm screens.

Recommendation :
Essential to the proper running of Zone Alarm; leave well alone.



Source: http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

[evilded]

Thanks petter, but what are the admiliserv and admilikeep programs?

By i cant close i mean that in task manager, when i click end process, it says it can't.

[xoopx]

Originally posted by evilded@Jan 1 2005, 12:10 AM
Thanks petter, but what are the admiliserv and admilikeep programs?

By i cant close i mean that in task manager, when i click end process, it says it can't.
dont delete things without knowing what they do.

get spybot search and destroy http://www.safer-networking.org/en/index.html

its free

if they are bad things it will sort it out.

also get avg anti virus http://free.grisoft.com/
thats also free

[Tuttle]

The two admili* ones aren't good. Ad-Aware from www.lavasoftusa.com is another good free anti-spyware app; it sometimes finds stuff that Spybot doesn't and vice versa.

[Eagle of Fire]

I have a few strange programs running on my machine, and i have no idea what they are. They are: Admiliserv.exe, Admilikeep.exe, and vsmon.exe. I really don't like the idea of having these on my computer if i don't know what they are, and I can't close them. Anyone know what they are?
As stupid (or intriguing) as it sounds, firing up your prefered search engine and typing the name of those programs along with the .exe will usually bring you pretty well detailed infos on the program. That's what I usually do myself.

With Yahoo:

We didn't find any Web pages matching the following criteria:
Containing this query term: Admiliserv.exe


Suggestions:
- Check your spelling.
- Try more general words.
- Try different words that mean the same thing.

We didn't find any Web pages matching the following criteria:
Containing this query term: Admilikeep.exe


Suggestions:
- Check your spelling.
- Try more general words.
- Try different words that mean the same thing.
Those are really suspect. Since they don't show up in yahoo I would try to delete them on the spot, or at the very least try to find to which program they come from.
Are you sure about the spelling?

[evilded]

Ran adaware, LOL, it found 106 objects...

problem solved i think. thanks.

[Tulac]

This is kinda off offtopic but it makes no sense to open a special topic.
What is svchost.exe,what is it's use I remember having two viruses a year back and the problem was in the svchost.
Even as we speak there are 4 svchost.exe files running in the system and they actually take like 11 megabytes of memory.So is it file esential for running winxp or is my AV not recognizing something(It's updated)?

[Wael]

svchost - svchost.exe - Process Information

Process File: svchost or svchost.exe
Process Name: Microsoft Service Host Process

Description:
svchost.exe is a system process belonging to the Microsoft Windows Operating System which handles processes executed from DLLs. This program is important for the stable and secure running of your computer and should not be terminated. Note: svchost.exe is a process which is registered as the W32.Welchia.Worm. It takes advantage of the Windows LSASS vulnerability, which creates a buffer overflow and instigates your computer to shut down. To see more information about this vulnerability please look at the following Microsoft bulletin: http://www.microsoft.com/technet/security/...n/ms04-011.mspx (http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx) This is a registered security risk and should be removed immediately. Please see additional details regarding this process

From where-ever /-

[Tuttle]

svchost.exe is the Windows one. You'll probably have several (many of the things in Control Panel | Administrative Tools | Services are started using it), and they should stay.

scvhost.exe is the worm.

[radiv]

svchost.exe is the exe file that runs many of the windows services that makes windows appear like it does. One of the svchost.exes are maintaining the XP themes (if you disables it you'll get a classic Win 200x look with no option to change themes). It does also include the help system and indexing services, as well as network services.

Start -> Run -> services.msc

And you'll get a list of services you can disable to improve system speed.

http://www.windowsnetworking.com/kbase/Win...erformance.html (http://www.windowsnetworking.com/kbase/WindowsTips/Windows2000/UserTips/Network/Disableunnecessaryservicestoimproveworkstationsper formance.html)

Here is a list of "safe" things to disable. At least things most of us won't miss.

[evilded]

Back to the topic of my pos computer; I cant get rid of admilikeep and admiliserv. I go to task manager and end process and it closes, then opens right away down the list of programs running.

I wish i could post pics because it would make things clearer so much.

[Wael]

You could try the following (No guarantees though, I found it on the web, conserning these programs);

Check your add and remove program for these entries if there remove them:

C:\Program Files\ShopAtHomeSelect Agent
C:\Program Files\Messenger Plus! 3
C:\Program Files\Admilli Service

MessengerPlus ,2, 3- third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware; the software does offer you a choice during setup: make sure to install MessengerPlus WITHOUT that "sponsor program"!

If the entry for ShopAtHomeSelect remains in your Add/Remove Programs even though the software is uninstalled, you can get rid of it by opening the registry (Start->Run->regedit) and deleting the key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\Uninstall\ShopAtHomeSelect Agent'.



----------------------------------------------------------------------
Adaware SE Personal Edition (this is a freeware version)
http://majorgeeks.com/download.php?det=506

1st Install, run it and Update it.
Then put the this Configuration settings before scanning.
Click on the configuration Windows button.
Click on Scanning, and choose the following settings to:
-"Scan within archives"
-"Scan active processes,
-"Scan registry"
-"Deepscan registry"
-"scan my IE Favourites for banned URL's"
-"scan my host's file"
Then click on Tweaks, go to "Cleaning engine" and set it to:
-"Automatically try to unregister objects prior to deletion"
-"Let Windows remove files in use after reboot."
Click on "Proceed" to save these Preferences.
Click on the "Scan Now" button.

Remove everything it finds.
-----------------------------------------------------------------------


Download and run:

http://cexx.org/lspfix.htm

Remove the bad DLL:

1. Run LSPFix.
2. Check 'I know what I'm doing'.
3. Select lsp.dll .
4. Click the right-pointing arrow (moves it to the "remove" page).
5. Click 'Finished'.
6. Restart your computer in "Safe Mode" (F5 or F8 when starting Windows).
7. Delete the following file: lsp.dll
8. Restart your computer and bring it up in normal mode.
---------------------------------------------------------------------

Next

Turn Off System Restore (see links below for how to)
Windows XP
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam)

Windows Me
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239?OpenDocument&src=sec_doc_nam)


Reboot your computer to safemode (see link below for how to)
How To Boot Into SafeMode!!!

WINDOWS 95
WINDOWS 98/ME
WINDOWS 2000
Windows XP
WINDOWS as part of a multi boot system

http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam)

Disable hidden Files & Folders (see link below for how to)
How To Show Hidden Files And Folders!!!
http://service1.symantec.com/SUPPORT/tsgen...x&osv=&osv_lvl= (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339?Open&src=ent&docid=2002092514302348&nsf=ent-security.nsf&view=docid&dtype=corp&prod=Symantec%20AntiVirus%20Corporate%20Edition&ver=8.x&osv=&osv_lvl=)

1. Open Hijackthis and Rescan Your Computer
2. Place a Check Beside Each Item Listed Below
3. DO NOT CLICK FIX YET
--------------------------------------------------------------------
4. While in SAFE MODE
Locate and delete if found:

C:\WINDOWS\system32\SahAgent.exe
--------------------------------------------------------------------
5. Close all Browser Windows (Including This One) and Click The Fix Checked Button on Hijackthis
----------------------------------------------------------------------
Here are the items To Check for Removal.
---------------------------------------------------------------------

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"

O4 - HKLM\..\Run: [Admilli Service] C:\Program Files\Admilli Service\AdmilliServ.exe
O4 - HKLM\..\Run: [SAHAgent] C:\WINDOWS\system32\SahAgent.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

---------------------------------------------------------------------
Delete files/folder from the following directories (But not the directory itself, for example delete all files/folder IN temp.
C:\Windows\Temp\
C:\Documents and Settings\<Your Profile>\Local Settings\Temp\
C:\Documents and Settings\<All other users Profile>\Local Settings\Temp\
C:\Documents and Settings\<Your Profile>\Local Settings\Temporary Internet Files\ <<<This will delete your files in your internet cache--including cookies.
C:\Documents and Settings\<All other users Profile>\Local Settings\Temporary Internet Files\
Empty your "Recycle Bin"

[evilded]

Wow. Ill try that. Thanks loads.

[xoopx]

about the turning off of non-essential services to increase performance, make sure you only manage those through my computer - manage and not using msconfig

[quatroking]

Admiliserv.exe and Admilikeep.exe ?
i think its spyware.
Vsmon.exe can you stand there. i have it too.
(if your pc go run slowly, CTRL+ALT+DELETE and stop the program)