Removing Nssfrch Toolbar

tempest_inc
tempest_inc
in Malware talk

sorry about the previous off topic post. my apologies to the admistrators and the topic starter.


anyways, im running a trial of bitdefender 2008 internest security, planning to get the full version once the trial date expires. just noticed that there was this unknown toolbar at the top of my IE screen called a nssfrch toolbar. somehow i couldnt get rid of it and it keeps redirecting me to some anti spyware site. im a novice in this and simple details would b much appreciated. step-by-step instructions would b the best.


i ran a hijackthis as instructed, not sure what its for but these are the results:


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 21:39:13, on 25/10/2007


Platform: Windows Vista (WinNT 6.00.1904)


MSIE: Internet Explorer v7.00 (7.00.6000.16546)


Boot mode: Normal


Running processes:


C:\Windows\system32\taskeng.exe


C:\Windows\system32\Dwm.exe


C:\Windows\Explorer.EXE


C:\Program Files\Windows Defender\MSASCui.exe


C:\Program Files\DellTPad\Apoint.exe


C:\Windows\System32\rundll32.exe


C:\Windows\System32\rundll32.exe


C:\Program Files\Java\jre1.6.0\bin\jusched.exe


C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe


C:\Program Files\Dell\MediaDirect\PCMService.exe


C:\Program Files\Common Files\logishrd\LComMgr\Communications_Helper.exe


C:\Program Files\Logitech\QuickCam10\QuickCam10.exe


C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe


C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe


C:\Program Files\Windows Sidebar\sidebar.exe


C:\Program Files\DellSupport\DSAgnt.exe


C:\Program Files\Dell Support Center\bin\sprtcmd.exe


C:\Windows\ehome\ehtray.exe


C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe


C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe


C:\Program Files\Digital Line Detect\DLG.exe


C:\Program Files\Dell\QuickSet\quickset.exe


C:\Windows\System32\rundll32.exe


C:\Windows\ehome\ehmsas.exe


C:\Program Files\Windows Sidebar\sidebar.exe


C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe


C:\Program Files\DellTPad\ApMsgFwd.exe


C:\Program Files\DellTPad\Apntex.exe


C:\Program Files\DellTPad\HidFind.exe


C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe


C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe


C:\Program Files\MSN Messenger\msnmsgr.exe


C:\Program Files\Internet Explorer\ieuser.exe


C:\Program Files\Internet Explorer\iexplore.exe


C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


C:\Windows\system32\SearchFilterHost.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www1.ap.dell.com/content/default.as...;l=en&s=gen


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local


R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =


O1 - Hosts: ::1 localhost


O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll


O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\Windows\movctrlswd.dll


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll


O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll


O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll


O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B} - C:\Windows\nssfrch.dll


O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide


O4 - HKLM\..\Run: [Apoint] "C:\Program Files\DellTPad\Apoint.exe"


O4 - HKLM\..\Run: [NvSvc] "RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart


O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup


O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit


O4 - HKLM\..\Run: [NVHotkey] "rundll32.exe" C:\Windows\system32\nvHotkey.dll,Start


O4 - HKLM\..\Run: [sunJavaUpdateSched] "c:\Program Files\Java\jre1.6.0\bin\jusched.exe"


O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start


O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"


O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"


O4 - HKLM\..\Run: [dscactivate] "c:\dell\dsca.exe" 3


O4 - HKLM\..\Run: [iSUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup


O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"


O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide


O4 - HKLM\..\Run: [sigmatelSysTrayApp] "C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe"


O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"


O4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun


O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup


O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter


O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe


O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe


O4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"


O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')


O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')


O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')


O4 - Startup: .protected


O4 - Global Startup: .protected


O4 - Global Startup: Bluetooth.lnk = ?


O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe


O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe


O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000


O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm


O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll


O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll


O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll


O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL


O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm


O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm


O13 - Gopher Prefix:


O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab


O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx


O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL


O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll


O21 - SSODL: bxsbang - {A9721CC3-5FF2-4C3C-BA17-D05746EA87D9} - C:\Windows\bxsbang.dll


O21 - SSODL: ocgrep - {A93B5B3F-4B7C-4A56-853C-E8076BC7B8D7} - C:\Windows\ocgrep.dll


O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe


O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe


O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe


O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)


O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe


O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe


O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe


O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe


O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe


O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe


O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe


O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe


O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe


O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe


O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe


O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe


O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe


O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe


--


End of file - 11185 bytes


thanks for the help

Comments

  • alexcrist
    alexcrist ✭

    Hello tempest_inc,


    There are several things in the log that need fixing. Select the following lines:


    O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\Windows\movctrlswd.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B} - C:\Windows\nssfrch.dll
    O13 - Gopher Prefix: 
    O21 - SSODL: bxsbang - {A9721CC3-5FF2-4C3C-BA17-D05746EA87D9} - C:\Windows\bxsbang.dll
    O21 - SSODL: ocgrep - {A93B5B3F-4B7C-4A56-853C-E8076BC7B8D7} - C:\Windows\ocgrep.dll


    Also, I noticed that you are running Kaspersky IS, but there are some traces of Norton in this log. Do you have Norton installed?


    If you don't, but you did have it before KIS (and you uninstalled it), then also fix the following line:

    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)


    After you apply the fixes, reboot your computer and post here another log.


    Also, I suggest you to download SuperAntispyware, install and update it and make a full system scan with it in SafeMode (reboot your PC and keep pressed F8. From the Boot Menu choose Safe Mode).


    Cris.

  • tempest_inc
    tempest_inc

    hi,


    norton came with my laptop as a 30 day trial period. KIS was my a programme initially recommanded by my mate. but found it difficult to use and opt for bitdefender.


    both norton and kis have been uninstalled.


    thanks

  • alexcrist
    alexcrist ✭

    Be sure that you use the Uninstall Tools specific for Norton and KIS (http://forum.bitdefender.com/index.php?showtopic=1379). Use the tools to assure that BitDefender works correctly (any traces left behind by Norton or KIS might conflict with BD and result in errors).


    Cris.

  • patocp
    patocp
    Be sure that you use the Uninstall Tools specific for Norton and KIS (http://forum.bitdefender.com/index.php?showtopic=1379). Use the tools to assure that BitDefender works correctly (any traces left behind by Norton or KIS might conflict with BD and result in errors).


    Cris.


    Hi, i have the exact same problem, and would appreciate if you could help me too,


    as i dont have a clue how to get rid of it.


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 22:58:46, on 26/10/2007


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v7.00 (7.00.6000.16544)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe


    C:\Program Files\Network Associates\VirusScan\mcshield.exe


    C:\Program Files\Network Associates\VirusScan\vstskmgr.exe


    C:\Program Files\NetLimiter 2 Pro\nlsvc.exe


    C:\WINDOWS\system32\nvsvc32.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\system32\PnkBstrA.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\Explorer.EXE


    C:\WINDOWS\system32\ctfmon.exe


    C:\WINDOWS\System32\svchost.exe


    C:\Acer\Empowering Technology\eRecovery\Monitor.exe


    C:\WINDOWS\sm56hlpr.exe


    C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe


    C:\Program Files\Java\jre1.5.0_05\bin\jucheck.exe


    C:\Program Files\Microsoft Works\WksSb.exe


    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE


    C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe


    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe


    C:\Program Files\iTunes\iTunesHelper.exe


    C:\WINDOWS\SOUNDMAN.EXE


    C:\WINDOWS\system32\RUNDLL32.EXE


    C:\Program Files\iPod\bin\iPodService.exe


    C:\Program Files\MSN Messenger\MsnMsgr.Exe


    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


    C:\WINDOWS\system32\sistray.exe


    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe


    C:\Program Files\Microsoft Office\Office\WINWORD.EXE


    C:\Program Files\Microsoft Works\MSWorks.exe


    C:\Program Files\Internet Explorer\IEXPLORE.EXE


    C:\WINDOWS\msagent\AgentSvr.exe


    C:\Program Files\Internet Explorer\IEXPLORE.EXE


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! UK & Ireland


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.100.1:8080


    R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)


    R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)


    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll


    O2 - BHO: SohuDAIEHelper - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll (file missing)


    O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\WINDOWS\movctrlswd.dll


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll


    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll


    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll


    O2 - BHO: WebManager Class - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - C:\Program Files\Get-Torrent\TorrentManager.dll


    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll


    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll


    O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B} - C:\WINDOWS\nssfrch.dll


    O4 - HKLM\..\Run: [LaunchApp] Alaunch


    O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe


    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent


    O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe


    O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe


    O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe


    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers


    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe


    O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE


    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey


    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"


    O4 - HKLM\..\Run: [supdate2.dll] RUNDLL32.EXE C:\WINDOWS\system32\supdate2.dll,Run


    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"


    O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE


    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup


    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install


    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit


    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


    O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork


    O4 - HKCU\..\Run: [bitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized


    O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide


    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033


    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe


    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?


    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE


    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm


    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?e16ddc2efbf34281b2bd467c709e9eb3


    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?e16ddc2efbf34281b2bd467c709e9eb3


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O15 - Trusted Zone: netreg.uea.ac.uk


    O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab


    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204


    O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab


    O16 - DPF: {339234B4-4E14-4280-B8B4-8BAE5AF99063} (Chess Object) - http://zone.msn.com/bingame/zpagames/zpa_kqrp.cab51831.cab


    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab


    O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab


    O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab


    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab


    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab


    O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60231.cab


    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


    O16 - DPF: {D1BDCFB6-22F8-4CBF-A080-85675F2466A2} (UEANetTeam.Scanner) - http://netreg.uea.ac.uk/UEANetTeam.CAB


    O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab


    O21 - SSODL: bxsbang - {D544D7DD-E537-4B49-AD86-A52D89CFDD0B} - C:\WINDOWS\bxsbang.dll


    O21 - SSODL: ocgrep - {A82EC856-A386-41AF-97EC-AFDF2964D95C} - C:\WINDOWS\ocgrep.dll


    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe


    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe


    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe


    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe


    O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe


    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe


    O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm


    --


    End of file - 11284 bytes


    Thanks for any help you can give me!

  • alexcrist
    alexcrist ✭
    edited October 2007

    Hello patocp,


    Fix the following lines:


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2
    R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
    R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
    O2 - BHO: SohuDAIEHelper - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll (file missing)
    O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\WINDOWS\movctrlswd.dll
    O2 - BHO: WebManager Class - {D5792AA9-D373-4039- 8670-2CDAB6A71F15} - C:\Program Files\Get-Torrent \TorrentManager.dll
    O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A 081-A7E5EAD1529B} - C:\WINDOWS\nssfrch.dll
    O4 - HKLM\..\Run: [supdate2.dll] RUNDLL32.EXE C:\ WINDOWS\system32\supdate2.dll,Run
    O21 - SSODL: bxsbang - {D544D7DD-E537-4B49-AD86-A52D89CFDD0B} - C:\WINDOWS\bxsbang.dll
    O21 - SSODL: ocgrep - {A82EC856-A386-41AF-97EC-AFDF2964D95C} - C:\WINDOWS\ocgrep.dll


    If you don't know this address: netreg.uea.ac.uk fix the following line:


    O15 - Trusted Zone: netreg.uea.ac.uk


    Do you know this process: PnkBstrA.exe? As far as I found on the web, it is related to PunkBuster, and it's used by some games. Search Google for it, see if you need it and, if you don't, follow instructions here to remove it (2nd post).


    After you followed the steps from the link, make another scan with HijackThis. If this line still appears:


    O23 - Service: PnkBstrA - Unknown owner - C:\WIND OWS\system32\PnkBstrA.exe

    fix it.


    Cris.

  • jkwan31
    jkwan31
    hi,


    norton came with my laptop as a 30 day trial period. KIS was my a programme initially recommanded by my mate. but found it difficult to use and opt for bitdefender.


    both norton and kis have been uninstalled.


    thanks


    hey I have the same problem can you please help me out thanks


    here is the log


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 2:39:10 AM, on 10/28/2007


    Platform: Windows Vista (WinNT 6.00.1904)


    MSIE: Internet Explorer v7.00 (7.00.6000.16546)


    Boot mode: Normal


    Running processes:


    C:\Windows\system32\Dwm.exe


    C:\Windows\system32\taskeng.exe


    C:\Windows\Explorer.EXE


    c:\Program Files\Bioscrypt\VeriSoft\Bin\AsGHost.exe


    C:\Program Files\Windows Defender\MSASCui.exe


    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe


    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


    C:\Windows\RtHDVCpl.exe


    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe


    C:\Program Files\Common Files\Symantec Shared\ccApp.exe


    C:\Program Files\HP\QuickPlay\QPService.exe


    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe


    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe


    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe


    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe


    C:\Program Files\iTunes\iTunesHelper.exe


    C:\Program Files\Scansoft\PaperPort\pptd40nt.exe


    C:\Windows\System32\rundll32.exe


    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe


    C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe


    C:\Program Files\Windows Sidebar\sidebar.exe


    C:\Program Files\AIM6\aim6.exe


    C:\Program Files\Rainlendar2\Rainlendar2.exe


    C:\Windows\ehome\ehtray.exe


    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe


    C:\Windows\System32\rundll32.exe


    C:\Program Files\LimeWire\LimeWire.exe


    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE


    C:\Program Files\Vongo\Tray.exe


    C:\Windows\ehome\ehmsas.exe


    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe


    C:\Program Files\Windows Sidebar\sidebar.exe


    C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe


    C:\Program Files\AIM6\aolsoftware.exe


    C:\Program Files\Internet Explorer\ieuser.exe


    C:\Program Files\Internet Explorer\iexplore.exe


    C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe


    C:\Windows\system32\taskeng.exe


    C:\Windows\system32\SearchFilterHost.exe


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =


    O1 - Hosts: ::1 localhost


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB-9D79836A6066} - C:\Windows\movctrlnkd.dll


    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    O2 - BHO: VeriSoft Access Manager - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - c:\Program Files\Bioscrypt\VeriSoft\Bin\ItIEAddIn.dll


    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll


    O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\Windows\nssfrch.dll (file missing)


    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide


    O4 - HKLM\..\Run: [sMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe


    O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe


    O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe


    O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"


    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"


    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start


    O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe


    O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe


    O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe


    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"


    O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\BIOSCR~1\VeriSoft\Bin\ASTSVCC.dll,RegisterModule


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime


    O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"


    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"


    O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe


    O4 - HKLM\..\Run: [indexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe


    O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart


    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup


    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit


    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe


    O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe


    O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe


    O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun


    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp


    O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe


    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe


    O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')


    O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')


    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe


    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe


    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE


    O4 - Global Startup: Bluetooth.lnk = ?


    O4 - Global Startup: Vongo Tray.lnk = ?


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000


    O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm


    O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll


    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL


    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm


    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm


    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll


    O13 - Gopher Prefix:


    O20 - AppInit_DLLs: APSHook.dll


    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe


    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe


    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe


    O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe


    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe


    O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe


    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe


    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe


    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe


    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


    O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe


    --


    End of file - 11350 bytes


    thanks

  • maags78
    maags78

    I have the very same problem I downloaded hijackthis and this is my log file. Also when you say fix these lines do you mean delete them? Also how do you make these changes, where are they saved too? Any help would be great!!! Thanks in advance.


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 10:05:51 AM, on 10/29/2007


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe


    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe


    C:\WINDOWS\Explorer.EXE


    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe


    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\Program Files\Symantec AntiVirus\DefWatch.exe


    C:\Program Files\ADP\DataExtraction\EPSchSrv.exe


    C:\WINDOWS\system32\inetsrv\inetinfo.exe


    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe


    C:\Program Files\PDF Complete\pdfsvc.exe


    C:\Program Files\Symantec AntiVirus\Rtvscan.exe


    C:\Program Files\sda\bin\tgsrvc.exe


    C:\WINDOWS\system32\igfxtray.exe


    C:\WINDOWS\system32\hkcmd.exe


    C:\WINDOWS\system32\igfxpers.exe


    C:\WINDOWS\RTHDCPL.EXE


    C:\Program Files\PDF Complete\pdfsty.exe


    C:\WINDOWS\SMINST\Scheduler.exe


    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe


    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe


    C:\Program Files\sda\bin\sprtcmd.exe


    C:\Program Files\Common Files\Symantec Shared\ccApp.exe


    C:\PROGRA~1\SYMANT~1\VPTray.exe


    C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe


    C:\Program Files\Messenger\msmsgs.exe


    C:\Program Files\Logitech\SetPoint\SetPoint.exe


    C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe


    C:\Program Files\ADP\DataExtraction\EPSchTbs.exe


    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe


    C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE


    C:\Program Files\Internet Explorer\IEXPLORE.EXE


    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/


    O1 - Hosts: 204.125.92.66 sda.ds.adp.com


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll


    O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146-409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


    O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8676-BA16DEB23C70} - C:\WINDOWS\nssfrch.dll


    O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe


    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe


    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe


    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe


    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


    O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"


    O4 - HKLM\..\Run: [setRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe


    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe


    O4 - HKLM\..\Run: [Reminder] C:\WINDOWS\Creator\Remind_XP.exe


    O4 - HKLM\..\Run: [scheduler] C:\WINDOWS\SMINST\Scheduler.exe


    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE


    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe


    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe


    O4 - HKLM\..\Run: [sda] "C:\Program Files\sda\bin\sprtcmd.exe" /P sda


    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"


    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe


    O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"


    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9


    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background


    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe


    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe


    O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe


    O4 - Global Startup: Schedule Wizard Notification Icon.lnk = ?


    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    O16 - DPF: {00906302-0F14-442C-B39C-275F61BC25BC} (atSdaCfg Control) - file://E:\autorun\atSdaCfg.CAB


    O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - http://sdaproxy.ds.adp.com/sdccommon/download/ssrc.cab


    O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} (SupportSoft Listener Control) - http://sdaproxy.ds.adp.com/sdccommon/download/sprtctlln.cab


    O16 - DPF: {4E8AEBE0-31A6-43B0-A429-748DB14A70A0} (SysEngW2k Control) - file://E:\autorun\PC-CONFIG-CHECK.CAB


    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab


    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab


    O17 - HKLM\System\CCS\Services\Tcpip\..\{F01BA954-BC1C-4758-84EE-0D18D5B072C3}: NameServer = 209.125.133.2,170.102.249.9


    O18 - Protocol: bw+0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw+0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw-0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw-0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw00 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw00s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw10 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw10s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw20 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw20s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw30 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw30s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw40 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw40s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw50 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw50s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw60 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw60s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw70 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw70s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw80 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw80s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw90 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bw90s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwa0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwa0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwb0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwb0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwc0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwc0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwd0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwd0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwe0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwe0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwf0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwf0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll


    O18 - Protocol: bwg0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwg0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwh0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwh0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwi0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwi0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwj0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwj0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwk0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwk0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwl0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwl0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwm0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwm0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwn0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwn0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwo0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwo0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwp0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwp0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwq0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwq0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwr0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwr0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bws0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bws0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwt0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwt0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwu0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwu0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwv0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwv0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bww0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bww0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwx0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwx0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwy0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwy0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwz0 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: bwz0s - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O18 - Protocol: offline-8876480 - {66820C97-EEC1-4CBD-8FDD-0F6A196D7F53} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll


    O21 - SSODL: bxsbang - {ECD19AD0-4A27-433F-94EF-B7A2B508BB2F} - C:\WINDOWS\bxsbang.dll


    O21 - SSODL: ocgrep - {F88F97E9-8AA8-415F-A12F-65BBAC05DB38} - C:\WINDOWS\ocgrep.dll


    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe


    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe


    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe


    O23 - Service: ADP Data Extraction Scheduler (ElitePlus! Scheduler) - ADP, Inc. - C:\Program Files\ADP\DataExtraction\EPSchSrv.exe


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe


    O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe


    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe


    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe


    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe


    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe


    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe


    O23 - Service: SupportSoft Repair Service (sda) (tgsrvc_sda) - SupportSoft, Inc. - C:\Program Files\sda\bin\tgsrvc.exe

  • alexcrist
    alexcrist ✭

    Hello jkwan and maags78,


    Sorry for the delay. I've been so very busy these last few days.


    Hopefully, tomorrow I'll have time to take a look at your logs and give you instructions (if not tomorrow, the day after tomorrow I'll sure be available :) )


    Cris.

  • Niels
    Niels ✭

    Hello jkwan


    Check these entries and press on fix checked.


    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =


    O1 - Hosts: ::1 localhost


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\Windows\nssfrch.dll (file missing)


    Best regards


    Niels


    Hello maags78


    Backup are created in the default installation folder which is X:\Program Files\Trend Micro\HijackThis\


    You have to check the entries and confirm the message.


    I recommend that you download superantispyware.


    Install it double click on the shortcut. You will see an icon which looks like a bug (insect) rightclick on it press on check for updates. Reboot your pc afterwards but press several times on the F8 button before the windows loading screen choose safe mode press enter. Log in with your account do the same thing but choose now for scan for adware,spyware,malware,scan your computer,select complete scan and press next. Place a new log afterwards


    Best regards


    Niels

  • jkwan31
    jkwan31
    Hello jkwan


    Check these entries and press on fix checked.


    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =


    O1 - Hosts: ::1 localhost


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    O3 - Toolbar: The nssfrch - {AC9BBDB2-8FCD-49C8-96F7-CC3CF7B453CD} - C:\Windows\nssfrch.dll (file missing)


    Best regards


    Niels


    Hello maags78


    Backup are created in the default installation folder which is X:\Program Files\Trend Micro\HijackThis\


    You have to check the entries and confirm the message.


    I recommend that you download superantispyware.


    Install it double click on the shortcut. You will see an icon which looks like a bug (insect) rightclick on it press on check for updates. Reboot your pc afterwards but press several times on the F8 button before the windows loading screen choose safe mode press enter. Log in with your account do the same thing but choose now for scan for adware,spyware,malware,scan your computer,select complete scan and press next. Place a new log afterwards


    Best regards


    Niels


    hey thanks


    the nssfrch toolbar is removed but I still have this werid thing that pops up sometimes when I'm surfing the web


    I took a screen shot of what it looks like please help me thanks

    post-5979-1193721685_thumb.jpg

  • Niels
    Niels ✭

    Hello jkwan


    The problem is that I can't download any attachments in this forum section only virus researchers can do that.


    I also recommend that you perform a scan with superantispyware. Start Internet Explorer.


    Go to tools,Pop-up Blocker,Pop-up Blocker Settings,select remove everything.


    Best regards


    Niels

  • alexcrist
    alexcrist ✭
    edited October 2007

    Hello jkwan,


    You also have to fix the following:


    O2 - BHO: MSVPS System - {077F45D5-5CC9-4FC8-A7BB -9D79836A6066} - C:\Windows\movctrlnkd.dll
    O13 - Gopher Prefix:


    @Niels: This line:


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


    was legit! It belonged to Windows Live Messenger and shouldn't have been fixed.


    @jkwan: if you have problems with MS Live, try to re-install it.


    @maags78: I'll also take a look at your log and post if anything needs fixing.


    Edit: Done. Check next post.

  • alexcrist
    alexcrist ✭
    edited October 2007

    @maags78:


    Please fix the following lines:


    O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146 -409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
    O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8 676-BA16DEB23C70} - C:\WINDOWS\nssfrch.dll
    O21 - SSODL: bxsbang - {ECD19AD0-4A27-433F-94EF-B 7A2B508BB2F} - C:\WINDOWS\bxsbang.dll
    O21 - SSODL: ocgrep - {F88F97E9-8AA8-415F-A12F-65 BBAC05DB38} - C:\WINDOWS\ocgrep.dll


    Also, if you know this address (and you know it's safe): sda.ds.adp.com, fix the following line:


     O1 - Hosts: 204.125.92.66 sda.ds.adp.com


    Please post if your problem is fixed.


    Cris.

  • Niels
    Niels ✭
    edited November 2007

    Hello Cris


    no file , no name means that it was only a registry entry with no association to a particular file.


    So in this case that entry could be fixed because there wasn't any reference to a particular file.


    Best regards


    Niels

  • maags78
    maags78

    Problem is fixed, 01 line is ok.


    Thank you very much!!!


    @maags78:


    Please fix the following lines:


    O2 - BHO: MSVPS System - {6EB10F79-5E53-4F76-B146 -409EFCDCB957} - C:\WINDOWS\movctrlfqd.dll
    O3 - Toolbar: The nssfrch - {DF0ACE0C-4A3F-4A1F-8 676-BA16DEB23C70} - C:\WINDOWS\nssfrch.dll
    O21 - SSODL: bxsbang - {ECD19AD0-4A27-433F-94EF-B 7A2B508BB2F} - C:\WINDOWS\bxsbang.dll
    O21 - SSODL: ocgrep - {F88F97E9-8AA8-415F-A12F-65 BBAC05DB38} - C:\WINDOWS\ocgrep.dll


    Also, if you know this address (and you know it's safe): sda.ds.adp.com, fix the following line:


     O1 - Hosts: 204.125.92.66 sda.ds.adp.com


    Please post if your problem is fixed.


    Cris.

All Time Leaders

Categories

Defenders of the month