Hi all - alg.exe has just started requesting to accept connections from the trusted zone (I a using Zone Labs Firewall). I am aware of what the service does and that it can be a legitimate windows service. I am also aware that it could be something more malicious in disguise and that the difference between the 2 lies in location. The legitimate .exe is in C:\windows\system32 - anything else is dodgy, especially if it is a sub-folder on system32. I have alg.exe in system32 (which I assume is legitimate). However I also have a alg.exe in a subfolder of system32 called dllcache. I have run a scan with avg (up-to-date) and it detected nothing untoward. However I haev attached a Hijackthis log. I woudl appreciate it if someone could take a look at it and advise accordingly. With thanks.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If a third party firewall warns you that Alg.exe wants to access, check to make sure you're not double firewalled. If you, are disable ICF. If you are using neither ICF or ICS and are warned that Alg.exe is trying to access the Internet, deny it. A Trojan or worm is trying to use it as a backdoor.
You can run hijackthis again and check/fix these:
O2 - BHO: IEsys - {58A53F72-7365-11DC-8314-0
O8 - Extra context menu item: &Search - http://kl.bar.need2find.co
...remember to close all windows except for the hjt application's window before clicking "Fix Checked", then reboot to properly record the changes to the hard disk.
You have a couple other issues I noticed from the log. The program "Spyware Terminator" had been listed in the past on the "Rogue/Suspect Anti-Spyware list" here:
http://www.spywarewarrior.
Considering the unsavory history of that software I would advise that you uninstall it in favor of any one of the time tested other "free" applications available on the public domain.
Your java is also outdated and causing a slight security risk as a result. You should uninstall the outdated version(s) you have and install the latest version Here:
http://www.majorgeeks.com/
One final caveat, read Here: http://www.us-cert.gov/cas
...for information regarding the risks of using File Sharing software.
Hi 1972vet - thanks for all this. I hjave carried out the actions regarding HTJ and fixed the entries as shown. I have also uninstalled Spyware Terminator. and updated Java. In addition you concerns regarding file sharing are noted. Just one final question - is it worth deleting (or renaming) the 'extra' alg.exe file that is located in the wrong place ? Thanks
The alg.exe is a critical system file. You're likely to find this file in several locations:
\Windows\Prefetch
\Windows\System32
\Windows\ServicePackFiles\
\Windows\SoftwareDistribut
\Windows\system32\dllcache
Currently, the size of the legitimate file is:
43.5 KB (44,544 bytes)
It's doubtful that you were bothered by the IRC worm that was circulating several years ago but one never knows when a new variant will surface. You can read more Here:
http://www.f-secure.com/v-
You should locate and delete (if still present) the following file:
ie-improver.dll
...located Here:
C:\Program Files\IE System\ie-improver.dll
Hi 1972vet - thansk for this. TYhe ie-improver.dll file has already gone. It is nice to know this second copy of alg.exe in teh system32 sub-folder is legit. I was fairly sure I was uninfected as I am fairly well protected and keep it up to date. However it is always nice to get a second opinion from an expert! With many thanks.....
Business Accounts
Answer for Membership
by: jvuzPosted on 2008-05-06 at 03:57:50ID: 21506167
Do a scan with (updated) http://www.superantispywar