some strange services in task manager and in msconfig/startup that I cannot close

Question

I was trying to fix a friend's computer because it was really slow, it was working but after some 20 minutes it was starting go really slow or just freeze
and I've formatted the hard drive, installed windows xp, and after a while I've noticed that it is still slow, so this is what I saw in:
Task Manager / processes

• ujjxxjr.exe (more than one)
• sanbmxkvdlo.exe

in msconfig / startup

• jjutebujdpbpvotuhy2x
• wznpddzrodsjsowbqkone
• uvhhtrlbwjwlsmsviac

I tried to close the processes from task manager, they were restarting instantly
I unchecked the items in startup (msconfig), after reboot they were back in there
and all this is after a clean install of windows (but with the internet cable on)
anybody knows about this services, anything ?

UPDATE: I've just mounted my flash drive which was mounted on my friend's computer and noticed some new exe files in it all with strange names like yclvcjs.exe (I've immediately formatted it )

Answer 1

I believe these are program-generated task names and that your computer is still infected. This means that some product that you install is actually a virus, or that another computer in your network is re-infecting yours every time. Better also check that the computer is really behind a firewall.

I suggest that you :

1. Reformat and reinstall Windows
2. Install several antivirus products, at least Malwarebytes' Anti-Malware and Avast and an anti-intrusion product such as Threatfire.
3. Then install one-by-one any product, analyzing first all installations. Re-download the installation files from their sites and make sure that these sites are not known malware. Do not trust your friend. See this article:
   Check A Website For Malware With Google Safe Browsing Tool

Answer 2

This is a virus; I don't know which one.

You should boot to a CD (WinPE, Knoppix, etc) and delete all of those files.

Answer 3

Harrymc's solution is good, sometimes when a virus infestation is very big, you just don't know if you can trust the system again. Like you are seeing, there could be a number of things that retrigger the malware to come back at a later date.

However, some general advise for fixing a malware infected system:

Start with a good tool such as Spybot Search and Destroy or Malwarebytes Anti Malware and perform a full scan.

After this has finished, use Microsoft / Sysinternals Autoruns and look through most of the tabs (you especially want to pay close attention to Logon and Scheduled tasks) and delete most of the items that you think are viruses or research them first.

Next, protect your system with a good antivirus. I personally recommend Microsoft Security Essentials.

Again though, once you have a virus on your system, you have no idea what it can do or where it can hide, it is possible to hide from AV scans and sometimes it is both safer and quicker to reinstall. The decision is up to you!

Answer 4

Sounds like you got immediately re-infected after installing Windows.

You have to make sure you follow a careful process when installing Windows XP these days. Basically download SP3 offline package on another machine, then install XP without any network connection on the machine in question, install SP3, make sure the firewall is enabled, then immediately install all security patches from Windows Update.

Next install some anti-virus, before you install anything else.

Answer 5

I've just mounted my flash drive which was mounted on my friend's computer and noticed some new exe files in it all with strange names like yclvcjs.exe (I've immediately formatted it )

Before you reinstall Windows (which is your best bet), make sure to check all USB drives you plan to connect after the installation for viruses.

If you open an infected flash drive via double click in My Computer, then there is a good chance that the computer gets infected immediately. always use right click > explore!

Another tip: holding down SHIFT while inserting a USB flash drive can temporarily disable Autorun.

Answer 6

If the re-infection don't come back from the network or the launching of an old executable, it's certainly a boot sector virus. You could manually look for it but it's more secure to follow SLaks's answer...

So, the more secure (maybe paranoïd) way:

1. Apply the answer from SLaks. But I recommend to use the latest kaspersky removal tool and malwarebytes from the boot cd, with all options to speed the scan disabled. (You could easily include them in ubcd4win, like spybot and many other tools...) and delete everything they found.
2. Backup your files
3. Apply the answer from harrymc but according Will and the latest av-comparative test, Microsoft Security Essentials is the (actual) better (free) anti-malware. (Personally I use: Kaspsersky Anti-Virus + Comodo Internet Security and Sandboxie to test new software / browse securely)

Note: if the usb autorun of your computer was activated, you should check your computer too...