 Movieland Popup Doesn't Stop! |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help DO NOT RUN ComboFix unless requested to. Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Dec 1 2005, 07:40 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 4 Joined: 1-December 05 Member No.: 42,652  |
My computer has been hijacked by Movieland too. Here's the hijack this log I saved: Logfile of HijackThis v1.99.1 Scan saved at 4:38:20, on 1/12/2548 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\zHotkey.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\eMachines Bay Reader\shwiconem.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\altpayV2\altpayV2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\WINDOWS\System32\alg.exe C:\Program Files\BigFix\BigFix.exe C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe C:\Program Files\Symmetricom\SymmTime\SymmTime.exe C:\PROGRA~1\Webshots\webshots.scr C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\MSNMES~1\msnmsgr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Documents and Settings\Mastask\My Documents\HijackThis\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.mess.be/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CHotkey] zHotkey.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real Alternative\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [wincin] C:\DOCUME~1\Mastask\LOCALS~1\Temp\w181609.Stub.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [AQ3HelperStartUp] C:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3 O4 - HKLM\..\Run: [Notification Utility] "C:\Program Files\altpayV2\altpayV2.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Reality Fusion GameCam SE.lnk = ? O4 - Global Startup: SymmTime.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe...up1.0.0.8-2.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab O18 - Protocol: bw+0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: offline-8876480 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe |
 |
 
|
|
Dec 1 2005, 01:40 PM
Post
#2
|
|
|
Forum Addict Group: Malware Response Team Posts: 10,603 Joined: 28-October 05 From: London Member No.: 38,920 |
Hi and Welcome to bleeping computer!!
 My name is David  Please do both of the following before we start if possible!: 1) Please print off these intructions - they will be needed later when internet access is not available. 2) Save these instructions in word/notepad to the desktop where they can be easily found for the same reasons as above. There is a bit to do on the log - i can almost guaruntee ewido will remove something - it's also a good free tool to keep in your arsenal!  Please download ewido security suite it is a free version of the program.
ewido manual updates Once the updates are installed do the following:
Post a new HJT log and the ewido log at the end! David |
|
|
|
|
Dec 1 2005, 03:21 PM
Post
#3
|
|
|
New Member Group: Members Posts: 4 Joined: 1-December 05 Member No.: 42,652 |
Hi, David
I followed your instruction. Movieland doesn't popup anymore, but the music of movieland still works. Now everytime i turn on my computer....the music plays automatically. I couldn't listen my musics or watch movies on my computer. Also, I found C:\Program Files\altpayV2 but i couldn't delete it! This new HJT log and the ewido log: Logfile of HijackThis v1.99.1 Scan saved at 12:16:05, on 1/12/2548 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\zHotkey.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\eMachines Bay Reader\shwiconem.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\altpayV2\altpayV2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\WINDOWS\System32\alg.exe C:\Program Files\BigFix\BigFix.exe C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe C:\Program Files\Symmetricom\SymmTime\SymmTime.exe C:\PROGRA~1\Webshots\webshots.scr C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\MSNMES~1\msnmsgr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Mastask\My Documents\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.mess.be/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CHotkey] zHotkey.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real Alternative\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [wincin] C:\DOCUME~1\Mastask\LOCALS~1\Temp\w181609.Stub.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [AQ3HelperStartUp] C:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3 O4 - HKLM\..\Run: [Notification Utility] "C:\Program Files\altpayV2\altpayV2.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Reality Fusion GameCam SE.lnk = ? O4 - Global Startup: SymmTime.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab O18 - Protocol: bw+0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: offline-8876480 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe --------------------------------------------------------- ewido security suite - Scan report --------------------------------------------------------- + Created on: 12:05:00, 1/12/2548 + Report-Checksum: F2DFAB7B + Scan result: HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -> Spyware.PopularScreensavers : Cleaned with backup :mozilla.10:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.11:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup :mozilla.12:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.13:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.14:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.15:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.18:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.19:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.21:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.22:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.23:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.24:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.25:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup :mozilla.26:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.37:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.38:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.56:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.58:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.59:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.60:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Bluemountain : Cleaned with backup :mozilla.61:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Bluemountain : Cleaned with backup :mozilla.62:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Bluemountain : Cleaned with backup :mozilla.63:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.64:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.65:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.67:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.68:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.69:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.70:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.71:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.72:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valuead : Cleaned with backup :mozilla.75:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup :mozilla.76:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup :mozilla.81:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.82:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.106:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.115:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Targetnet : Cleaned with backup :mozilla.117:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.137:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup :mozilla.149:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Clickagents : Cleaned with backup :mozilla.150:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Clickagents : Cleaned with backup :mozilla.151:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Clickagents : Cleaned with backup :mozilla.152:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Clickagents : Cleaned with backup :mozilla.153:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Clickagents : Cleaned with backup :mozilla.157:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.158:C:\Documents and Settings\Mastask\Application Data\Mozilla\Firefox\Profiles\xuw6j161.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup C:\Documents and Settings\Mastask\Cookies\mastask@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\085A296B-89C9-4E33-A1DD-4D1E43 -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\20EAC554-BF6E-4743-86B4-80CC8D -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\2B2D7E9B-A3DB-4BEB-B6D3-210C47 -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\33C76B3C-D428-4236-B3DD-3D0041 -> Spyware.Wesbar : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\3F40623B-B6B9-4842-A5F6-2CD351 -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\3F7D7F1E-BB43-4A06-A0F4-5A35D9 -> Spyware.Wesbar : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\418D0944-9E9E-4230-A5D9-1EAAFB -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\425F7D67-AEF6-41A2-8181-B2345F -> Spyware.Wesbar : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\5B498195-CE8C-4F3F-8820-9EF7C9 -> Spyware.FunWeb : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\5BD29D2D-8413-428B-BFB2-B72086 -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\61749C62-9EE3-459B-B36E-B02D2B -> Spyware.Wesbar : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\6275CF5F-4A36-4F9E-B2FF-5DB7C8 -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\B7B4FA1E-E961-48AD-A087-F56690 -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\C04C8160-7DC2-4DFF-BFB5-23B66D -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\C5E29809-1053-4B47-BC44-11E62D -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\CE426E5C-9729-4E24-8EE5-BC1FA6 -> Spyware.Wesbar : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\E4141178-70D3-40EE-B9F5-8CEBDF -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\EBC7EBC6-7CF1-4384-A94A-716F16 -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\B7F46035-3363-4657-ABC4-D8B72E\FB3AD3DC-AB7B-44C8-8F2D-40834D -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll -> Spyware.MyWebSearch : Cleaned with backup C:\Program Files\Spyware Doctor\swdoctor.exe -> Heuristic.PossibleMalware : Cleaned with backup C:\Program Files\Uninstall My Web Search.dll -> Spyware.MyWebSearch : Cleaned with backup C:\WINDOWS\Downloaded Program Files\BundleLite.exe -> Adware.Saha : Cleaned with backup ::Report End Thank you |
|
|
|
|
Dec 1 2005, 03:36 PM
Post
#4
|
|
|
Forum Addict Group: Malware Response Team Posts: 10,603 Joined: 28-October 05 From: London Member No.: 38,920 |
Please do both of the following before we start if possible!:
1) Please print off these intructions - they will be needed later when internet access is not available. 2) Save these instructions in word/notepad to the desktop where they can be easily found for the same reasons as above. _____________________ Download KillBox here: http://www.downloads.subratam.org/KillBox.zip Save it to your desktop. DO NOT run it yet. _____________________ With IE closed, run Hijack This again. Put a checkmark on these entries and hit "fix checked": O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O4 - HKLM\..\Run: [wincin] C:\DOCUME~1\Mastask\LOCALS~1\Temp\w181609.Stub.exe O4 - HKLM\..\Run: [AQ3HelperStartUp] C:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE /partner AQ3 O4 - HKLM\..\Run: [Notification Utility] "C:\Program Files\altpayV2\altpayV2.exe" _____________________ Boot into Safe Mode Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box. C:\PROGRA~1\AQUATI~1\AQ3HEL~1.EXE C:\Program Files\altpayV2\altpayV2.exe _____________________ Manually delete this folder: C:\Program Files\altpayV2 _____________________ Please Navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder. (if you cannot delete some items it's fine!) _____________________ Then go to Start > Run and type %temp% in the Run box. The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.f _____________________ Finally go to Control Panel > Internet Options. m Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK. _____________________ Empty the Recycle Bin. _____________________ Reboot to normal mode and post a new HJT log David |
|
|
|
|
Dec 1 2005, 05:00 PM
Post
#5
|
|
|
New Member Group: Members Posts: 4 Joined: 1-December 05 Member No.: 42,652 |
The lastest HJT log:
Logfile of HijackThis v1.99.1 Scan saved at 13:57:57, on 1/12/2548 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\Spyware Doctor\sdhelp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\zHotkey.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\eMachines Bay Reader\shwiconem.exe C:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\WINDOWS\System32\alg.exe C:\Program Files\BigFix\BigFix.exe C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe C:\Program Files\Symmetricom\SymmTime\SymmTime.exe C:\PROGRA~1\Webshots\webshots.scr C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\MSNMES~1\msnmsgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Documents and Settings\Mastask\My Documents\HijackThis\HijackThis.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Messenger\msmsgs.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.mess.be/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CHotkey] zHotkey.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\eMachines Bay Reader\shwiconem.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real Alternative\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Reality Fusion GameCam SE.lnk = ? O4 - Global Startup: SymmTime.lnk = ? O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab O18 - Protocol: bw+0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: offline-8876480 - {AD51467B-CB99-48CA-A675-E85DB2F8793E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Thank You 
|
|
|
|
|
Dec 1 2005, 05:02 PM
Post
#6
|
|
|
Forum Addict Group: Malware Response Team Posts: 10,603 Joined: 28-October 05 From: London Member No.: 38,920 |
Fix this:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) How's everything running? David |
|
|
|
|
Dec 1 2005, 05:09 PM
Post
#7
|
|
|
New Member Group: Members Posts: 4 Joined: 1-December 05 Member No.: 42,652 |
I'm not quite sure...Does it still popup later? but now everything's running well.
Thank You very much. I appreciate your help. mastask 
|
|
|
|
|
Dec 2 2005, 11:29 AM
Post
#8
|
|
|
Forum Addict Group: Malware Response Team Posts: 10,603 Joined: 28-October 05 From: London Member No.: 38,920 |
The pop-up shouldn't come now!
Ok! Glad i was able to help you! The log is clean! If i have helped you please consider making a donation using the "make a donation" button in my signature. My help is free, but please consider it to keep me fighting spyware for you and others! Now turn off System Restore: On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. Restart your computer, turn System Restore back on and create a restore point. To create a restore point: Single-click Start and point to All Programs. Mouse over Accessories, then System Tools, and select System Restore.In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button. Type a description for your new restore point. Something like "After trojan/spyware cleanup". Click Create and you're done. David |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 29th July 2010 - 09:29 AM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.