Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Identify These Two, Please?


  • This topic is locked This topic is locked
4 replies to this topic

#1 Reena

Reena

  • Members
  • 391 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:04:27 PM

Posted 02 February 2007 - 05:49 PM

First, if I have posted in the wrong section, my humblest apologies.

I regularly use Hijack This and, touch wood, have had no problems. I read quite a lot of these postings and the help given here has been invaluable.

What I would like to know is what are these two I find in my Hijack This log, please?


O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

For once Google has let me down and I would like to know whether they should be removed.

As I said, I am sorry if you would prefer me to post elsewhere. I thank you in advance for any information you can give me.

BC AdBot (Login to Remove)

 


#2 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:05:27 PM

Posted 02 February 2007 - 06:55 PM

Hey Reena,
Both of the entries you listed legitimate, and it is absoutely fine that they are in your Hijackthis log. Here is some information about WgaLogon:
http://www.liutilities.com/products/wintas...brary/wgalogon/
It is related to "Windows Genuine Advantage", which basically means that it makes sure that the version of Windows you are running is legitimate; Microsoft have recently been quite heavily targeting pirated versions of their Operating Systems, not providing updates or software for them etc. This used to be vountary (checking if your OS was 'genuine') but it has recently been made mandatory. So, this entry is perfectly safe to have in your HijackThis log.
The msgrapp.dll entry is a part of MSN Messenger, which we can tell from the "C:\PROGRA~1\MSNMES~1", which is a shortened form of C:\Program Files\MSN Messenger. Here is some information on this entry, although it isn't particularly in-depth:
http://www.liutilities.com/products/wintas...ibrary/msgrapp/
The fact that this file is listed as "missing" is actually wrong; this is one of only a few files that is incorrectly listed by HijackThis. This is explained at CastleCops here, which, since you say you often research the entries in your HijackThis log, is an excellent place to look. It is one of the lists of entries that helpers swear by due to their huge databases, and it is an excellent resource for you to use too.
So, there is nothing to worry about with these two entries.
However, if you'd like to to take a look over your whole log just to make sure it's clean, post it back in your next reply and I'll check it for you.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#3 Reena

Reena
  • Topic Starter

  • Members
  • 391 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:UK
  • Local time:04:27 PM

Posted 03 February 2007 - 10:49 AM

Thank you, Charles, for your very helpful reply. I am glad all is well with my two suspect files! Surprised Google wasn't more helpful here.


The other entries are all right but it was kind of you to offer to check them for me.


I shall certainly make good use of Castle Cops as I like to learn what these entries mean.

Your help appreciated.

#4 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:05:27 PM

Posted 03 February 2007 - 10:54 AM

You're very welcome for the help :thumbsup:

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#5 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:05:27 PM

Posted 12 February 2007 - 12:08 PM

Since this issue appears resolved, this topic is now closed.

If you need this topic reopened, please request this by sending me a Personal Message including a link to your thread.
This applies only to the original topic starter.

Everyone else please begin a New Topic.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users