Options

Annoying pop-ups and flash

Unknown
edited November 2005 in Spyware & Virus Removal
Hello Im new, please go easy on me as Im not that familiar with spyware/hijacks.
Okay heres the deal I keep getting tabs with annoying flash adverts. and some with a site called www.forbes.com,
Some of the adverts are usually called www.mega-cheap.com and others VERY similar to it.
I also get FLASH adverts that just appear on my screen, not on my browser but just a advert in the middle of my screen.
Please help, and please keep your explainations simple, im not that pro yet ;P.
«1

Comments

  • TroganTrogan London, UK
    edited November 2005
    Hi,

    Click on the link below and download a tool called HijackThis (HJT).

    http://short-media.com/download.php?dc=69

    Create a log and post it here. :thumbsup:
  • Ca$quall
    edited November 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 10:13:55 PM, on 11/28/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
    C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    C:\Programmer\Alwil Software\Avast4\ashServ.exe
    C:\Programmer\Intel\Wireless\Bin\OProtSvc.exe
    C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
    C:\Programmer\Spyware Doctor\sdhelp.exe
    D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
    C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\acer\epm\epm-dm.exe
    C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
    C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
    C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
    C:\Programmer\MessengerPlus! 3\MsgPlus.exe
    C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    D:\Winamp\winampa.exe
    C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Programmer\iTunes\iTunesHelper.exe
    C:\Programmer\QuickTime\qttask.exe
    C:\Programmer\DAEMON Tools\daemon.exe
    C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe
    C:\windows\system32\mdms.exe
    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Programmer\Google\Google Talk\googletalk.exe
    D:\D-L\AveDesk\AveDesk.exe
    C:\Programmer\iPod\bin\iPodService.exe
    C:\Programmer\Skype\Phone\Skype.exe
    D:\BitLord\BitLord.exe
    C:\Programmer\Spyware Doctor\swdoctor.exe
    C:\Programmer\Clock Tray Skins\ClockTraySkins.exe
    C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    C:\Programmer\Logitech\SetPoint\KEM.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
    C:\Programmer\Rainlendar\Rainlendar.exe
    D:\Stardock\KLP\Keys.exe
    C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Programmer\WinRAR\WinRAR.exe
    C:\DOCUME~1\CASPER~1\LOKALE~1\Temp\Rar$EX00.438\HijackThis.exe

    O1 - Hosts: gic.com
    O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmer\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Iexplorer] C:\WINDOWS\iexplorer.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WB5Hack] HackIt.cmd
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [rtf32.exe] rtf32.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [IntelWireless] C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [EOUApp] C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe
    O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system32\mdms.exe
    O4 - HKLM\..\Run: [RegistryMechanic] C:\Programmer\Registry Mechanic\RegMech.exe /QS
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [googletalk] "C:\Programmer\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [AIM] D:\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [AVEDESK] "D:\D-L\AveDesk\AveDesk.exe"
    O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [BitComet] "D:\BitLord\BitLord.exe"
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programmer\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [SkinClock] C:\Programmer\Clock Tray Skins\ClockTraySkins.exe
    O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
    O4 - Startup: Adobe Gamma.lnk = ?
    O4 - Startup: Rainlendar.lnk = C:\Programmer\Rainlendar\Rainlendar.exe
    O4 - Startup: Stardock Keyboard Launchpad.lnk = D:\Stardock\KLP\Keys.exe
    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: officejet 6100.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Casper Behrndtz\Application Data\Mozilla\Firefox\Profiles\ergwwekc.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
    O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Casper Behrndtz\Application Data\Mozilla\Firefox\Profiles\ergwwekc.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O18 - Protocol: bw+0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: offline-8876480 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - AppInit_DLLs: wbsys.dll MsgPlusLoader.dll
    O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\irl6l53s1.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: EvtEng - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\OProtSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programmer\Spyware Doctor\sdhelp.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
  • TroganTrogan London, UK
    edited November 2005
    Download L2mfix from one of these two locations:

    http://www.atribune.org/downloads/l2mfix.exe
    http://www.downloads.subratam.org/l2mfix.exe

    Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

    IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

    if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
    C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.
  • Ca$quall
    edited November 2005
    L2MFIX find log 1.99
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellCompatibility]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\irl6l53s1.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-NI) ALLOW Read BUILTIN\Brugere
    (ID-IO) ALLOW Read BUILTIN\Brugere
    (ID-NI) ALLOW Full access BUILTIN\Administratorer
    (ID-IO) ALLOW Full access BUILTIN\Administratorer
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER


    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{562D5722-2D16-659C-3001-B8D4225F435F}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Egenskabsark for multimediefiler"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerstyring"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Sikkerhedsside"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Egenskabsside for OLE-dokumentfil"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Gr‘nsefladeudvidelse til deling"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rmkort"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rm"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rmpanorering"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security-side"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Kompatibilitetsside"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Udvidelsen Diskcopy"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Gr‘nsefladeudvidelser til Microsoft Windows-netv‘rksobjekter"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-sk‘rmstyring"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerstyring"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Gr‘nsefladeudvidelser til filkomprimering"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Gr‘nsefladeudvidelse til webudskrift"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Kontekstmenu til kryptering"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Rejsetaske"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-ikon"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profil"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Sikkerhedsside"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Gr‘nsefladeudvidelse til deling"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-filtype"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto signeringsfiltype"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netv‘rksforbindelser"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netv‘rksforbindelser"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scannere og kameraer"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scannere og kameraer"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scannere og kameraer"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scannere og kameraer"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scannere og kameraer"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell-udvidelser til Windows Script Host"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft-dataforbindelse"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Planlagte opgaver"
    "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Proceslinje og menuen Start"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="S›g"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Hj‘lp og support"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Hj‘lp og support"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="K›r..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Skrifttyper"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administration"
    "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Egenskabsside for tidligere versioner"
    "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Tidligere versioner"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internetv‘rkt›jslinje"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Status for hentning"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Webs›gning"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Redigeringsboks til adresse"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft URL-oversigtstjeneste"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="Oversigt"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Velkomstbillede til Internet Explorer 4-suiten"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internettet"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX-cachemappe"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Programstyring"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Opt‘lling af installerede programmer"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Udpakning af miniaturer til GDI+-filer"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Dokumentinfo om miniaturehandler (DOCFILES)"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Udpakning af HTML-miniaturer"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Guiden Webudgivelse"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Bestil billedudskrift over World Wide Web"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objekt til guiden Webudgivelse"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Guiden F† et Passport"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Brugerkonti"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanalfil"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Genvej til kanal"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Menuen Offlinefiler"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Indstillinger for mappen Offlinefiler"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Mappen Offlinefiler"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Efter &personer..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{2F603045-309F-11CF-9774-0020AFD0CFF6}"="Synaptics Control Panel"
    "{2b45bd21-71f8-4c8c-a87a-7eeb25a1a3e0}"="EPM-PO Shell Extension"
    "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
    "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
    "{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
    "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
    "{2F5AC606-70CF-461C-BFE1-734234536262}"="WindowBlinds CPL Extension"
    "{28C93B80-C2D8-467C-88C8-DA52F245BC69}"=""
    "{2D3398EB-CD00-451B-B7FE-192CFF2AAAB1}"=""
    "{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
    "{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
    "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
    "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="My Sharing Folders"
    "{FB41C6E7-E57D-4A2F-A6D3-205C54949B34}"=""
    "{24946758-8404-4049-8673-76C893F8ED9E}"=""
    "{472083B0-C522-11CF-8763-00608CC02F24}"="avast"

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{2D3398EB-CD00-451B-B7FE-192CFF2AAAB1}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{2D3398EB-CD00-451B-B7FE-192CFF2AAAB1}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{2D3398EB-CD00-451B-B7FE-192CFF2AAAB1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{2D3398EB-CD00-451B-B7FE-192CFF2AAAB1}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{FB41C6E7-E57D-4A2F-A6D3-205C54949B34}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{FB41C6E7-E57D-4A2F-A6D3-205C54949B34}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{FB41C6E7-E57D-4A2F-A6D3-205C54949B34}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{FB41C6E7-E57D-4A2F-A6D3-205C54949B34}\InprocServer32]
    @="blank"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{24946758-8404-4049-8673-76C893F8ED9E}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{24946758-8404-4049-8673-76C893F8ED9E}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{24946758-8404-4049-8673-76C893F8ED9E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{24946758-8404-4049-8673-76C893F8ED9E}\InprocServer32]
    @="C:\\WINDOWS\\system32\\aeycfilt.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    aeycfilt.dll Mon Nov 28 2005 9:21:08p ..... 235,963 230.43 K
    bassmod.dll Sat Oct 29 2005 9:48:18p A.... 34,308 33.50 K
    browseui.dll Sat Sep 3 2005 1:05:16a A.... 1,019,904 996.00 K
    cdfview.dll Sat Sep 3 2005 1:05:16a A.... 151,552 148.00 K
    cdosys.dll Sat Sep 10 2005 2:55:14a A.... 2,067,968 1.97 M
    danim.dll Sat Sep 3 2005 1:05:16a A.... 1,055,744 1.00 M
    davx_x~1.dll Wed Nov 23 2005 10:53:34p ..S.R 234,215 228.72 K
    dglayx.dll Sun Nov 13 2005 1:37:48p ..S.R 233,795 228.31 K
    dn2o01~1.dll Sun Nov 13 2005 3:25:26a ..S.R 236,276 230.74 K
    dn4q01~1.dll Sun Nov 27 2005 10:27:58p ..S.R 235,963 230.43 K
    dxtrans.dll Sat Sep 3 2005 1:05:16a A.... 205,312 200.50 K
    ebentprf.dll Wed Nov 23 2005 10:32:56p ..S.R 234,215 228.72 K
    en0ml1~1.dll Wed Nov 23 2005 10:37:18p ..S.R 234,215 228.72 K
    extmgr.dll Sat Sep 3 2005 1:05:16a A.... 55,808 54.50 K
    fnl021~1.dll Mon Nov 28 2005 3:23:40p ..S.R 235,963 230.43 K
    fpr203~1.dll Sun Nov 13 2005 7:06:48p ..S.R 233,795 228.31 K
    g4lmle~1.dll Wed Nov 23 2005 10:32:50p ..S.R 234,215 228.72 K
    gdi32.dll Thu Oct 6 2005 4:18:32a A.... 280,064 273.50 K
    iepeers.dll Sat Sep 3 2005 1:05:16a A.... 251,392 245.50 K
    inseng.dll Sat Sep 3 2005 1:05:16a A.... 96,768 94.50 K
    irl6l5~1.dll Sun Nov 27 2005 7:49:22p ..S.R 235,963 230.43 K
    ktpol7~1.dll Thu Nov 24 2005 6:40:44a ..S.R 234,215 228.72 K
    l40ule~1.dll Mon Nov 21 2005 8:10:12p ..S.R 235,781 230.25 K
    linkinfo.dll Thu Sep 1 2005 2:43:26a A.... 19,968 19.50 K
    lv0609~1.dll Thu Nov 24 2005 6:38:44a ..S.R 234,824 229.32 K
    m0820a~1.dll Tue Nov 22 2005 3:32:56p ..S.R 236,131 230.59 K
    m682lg~1.dll Wed Nov 23 2005 10:30:50p ..S.R 235,501 229.98 K
    mjvcp60.dll Wed Nov 23 2005 10:49:34p ..S.R 234,215 228.72 K
    msgplu~1.dll Wed Oct 12 2005 8:42:20p A.... 45,640 44.57 K
    mshtml.dll Tue Oct 4 2005 4:27:36p A.... 3,013,120 2.87 M
    mshtmled.dll Sat Sep 3 2005 1:05:18a A.... 448,512 438.00 K
    msrating.dll Sat Sep 3 2005 1:05:18a A.... 146,432 143.00 K
    mstime.dll Sat Sep 3 2005 1:05:18a A.... 530,432 518.00 K
    n82uli~1.dll Tue Nov 22 2005 3:08:16p ..S.R 235,123 229.61 K
    pngfilt.dll Sat Sep 3 2005 1:05:18a A.... 39,424 38.50 K
    quartz.dll Tue Aug 30 2005 4:55:56a A.... 1,291,264 1.23 M
    r86uli~1.dll Thu Nov 24 2005 8:54:20p ..S.R 234,215 228.72 K
    rhvpmsg.dll Thu Nov 24 2005 10:12:16p ..S.R 235,963 230.43 K
    shdocvw.dll Sat Sep 3 2005 1:05:18a A.... 1,483,776 1.41 M
    shell32.dll Fri Sep 23 2005 4:07:22a A.... 8,462,336 8.07 M
    shlwapi.dll Sat Sep 3 2005 1:05:18a A.... 473,600 462.50 K
    sirenacm.dll Mon Oct 24 2005 3:06:02p A.... 114,688 112.00 K
    ucicows.dll Fri Nov 25 2005 5:36:40p ..S.R 235,963 230.43 K
    urlmon.dll Sat Sep 3 2005 1:05:18a A.... 605,696 591.50 K
    vzr.dll Sat Nov 26 2005 11:22:08a ..S.R 235,963 230.43 K
    wbnbrand.dll Thu Nov 24 2005 6:38:44a ..... 234,215 228.72 K
    wbnhttp.dll Wed Nov 23 2005 10:30:50p ..S.R 234,215 228.72 K
    wchisn.dll Thu Nov 24 2005 8:42:22p ..S.R 234,215 228.72 K
    wininet.dll Sat Sep 3 2005 1:05:18a A.... 659,968 644.50 K
    winsrv.dll Thu Sep 1 2005 2:43:26a A.... 291,840 285.00 K
    zlbw.dll Tue Nov 8 2005 7:52:20p A.... 46,592 45.50 K

    51 items found: 51 files (23 H/S), 0 directories.
    Total of file sizes: 28,767,225 bytes 27.43 M
    Locate .tmp files:

    C:\WINDOWS\SYSTEM32\
    aswe6.tmp Sat Nov 12 2005 3:59:18p A.... 473,600 462.50 K
    avae9.tmp Sat Nov 12 2005 3:52:46p A.... 90,112 88.00 K
    guard.tmp Mon Nov 28 2005 9:33:08p ..S.R 235,963 230.43 K

    3 items found: 3 files (1 H/S), 0 directories.
    Total of file sizes: 799,675 bytes 780.93 K
    **********************************************************************************
    Directory Listing of system files:
    Disken i drev C er COCA-COLA
    Diskens serienummer er 6804-85C4

    Indhold af C:\WINDOWS\System32

    11/28/2005 10:18 PM <DIR> ..
    11/28/2005 10:18 PM <DIR> .
    11/28/2005 09:33 PM 235,963 guard.tmp
    11/28/2005 03:23 PM 235,963 fnl0213mg.dll
    11/27/2005 10:27 PM 235,963 dn4q01h5e.dll
    11/27/2005 07:49 PM 235,963 irl6l53s1.dll
    11/26/2005 11:22 AM 235,963 vzr.dll
    11/25/2005 05:36 PM 235,963 ucicows.dll
    11/24/2005 10:12 PM 235,963 rhvpmsg.dll
    11/24/2005 08:54 PM 234,215 r86ulij918o.dll
    11/24/2005 08:42 PM 234,215 wchisn.dll
    11/24/2005 06:40 AM 234,215 ktpol7731.dll
    11/24/2005 06:38 AM 234,824 lv0609dse.dll
    11/23/2005 10:53 PM 234,215 davx_xx0c.dll
    11/23/2005 10:49 PM 234,215 mjvcp60.dll
    11/23/2005 10:37 PM 234,215 en0ml1d11.dll
    11/23/2005 10:32 PM 234,215 ebentprf.dll
    11/23/2005 10:32 PM 234,215 g4lmle311h.dll
    11/23/2005 10:30 PM 234,215 wbnhttp.dll
    11/23/2005 10:30 PM 235,501 m682lglo16qc.dll
    11/22/2005 03:32 PM 236,131 m0820aloedqc0.dll
    11/22/2005 03:08 PM 235,123 n82ulif9182.dll
    11/21/2005 08:10 PM 235,781 l40uled91h0.dll
    11/13/2005 07:06 PM 233,795 fpr2039oe.dll
    11/13/2005 01:37 PM 233,795 dglayx.dll
    11/13/2005 03:25 AM 236,276 dn2o01f3e.dll
    11/09/2005 03:22 PM <DIR> dllcache
    06/29/2005 12:07 AM 56 86FD35AB8B.sys
    12/30/2004 09:06 AM <DIR> Microsoft
    25 fil(er) 5,640,958 byte
    4 mappe(r) 3,663,593,472 byte ledig
  • TroganTrogan London, UK
    edited November 2005
    Close any open browsers and programs you have open since this step requires a reboot.

    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot. After the reboot notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

    IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
    If after the reboot the log does not open double click on it in the l2mfix folder.
  • Ca$quall
    edited November 2005
    It prompts me with this:
    shell.reg cant be eksported: There was an error when opening the file. There may be errors on the disk or in the file.
    (its translated from danish)
  • TroganTrogan London, UK
    edited November 2005
    Post a new HJT log please. Lets remove the other junk first :)
  • Ca$quall
    edited November 2005
    What junk?
    And the lm2fix Did reboot my pc but didnt show me any log
  • Ca$quall
    edited November 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 10:45:47 PM, on 11/28/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
    C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Acer\eManager\anbmServ.exe
    C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programmer\Alwil Software\Avast4\ashServ.exe
    C:\Programmer\Intel\Wireless\Bin\OProtSvc.exe
    C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
    C:\Programmer\Spyware Doctor\sdhelp.exe
    D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\acer\epm\epm-dm.exe
    C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
    C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
    C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
    C:\Programmer\MessengerPlus! 3\MsgPlus.exe
    C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    D:\Winamp\winampa.exe
    C:\Programmer\QuickTime\qttask.exe
    C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Programmer\DAEMON Tools\daemon.exe
    C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe
    C:\windows\system32\mdms.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
    C:\Programmer\Google\Google Talk\googletalk.exe
    C:\WINDOWS\system32\rundll32.exe
    D:\D-L\AveDesk\AveDesk.exe
    C:\Programmer\Skype\Phone\Skype.exe
    C:\Programmer\Mozilla Firefox\firefox.exe
    D:\BitLord\BitLord.exe
    C:\Programmer\Spyware Doctor\swdoctor.exe
    C:\Programmer\Clock Tray Skins\ClockTraySkins.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
    C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
    C:\Programmer\Logitech\SetPoint\KEM.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
    C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
    C:\Programmer\Rainlendar\Rainlendar.exe
    D:\Stardock\KLP\Keys.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Documents and Settings\Casper Behrndtz\Skrivebord\HijackThis.exe

    O1 - Hosts: gic.com
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmer\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [WB5Hack] HackIt.cmd
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [rtf32.exe] rtf32.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [IntelWireless] C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [EOUApp] C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe
    O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system32\mdms.exe
    O4 - HKLM\..\Run: [RegistryMechanic] C:\Programmer\Registry Mechanic\RegMech.exe /QS
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [googletalk] "C:\Programmer\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [AIM] D:\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [AVEDESK] "D:\D-L\AveDesk\AveDesk.exe"
    O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [BitComet] "D:\BitLord\BitLord.exe"
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programmer\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [SkinClock] C:\Programmer\Clock Tray Skins\ClockTraySkins.exe
    O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
    O4 - Startup: Adobe Gamma.lnk = ?
    O4 - Startup: Rainlendar.lnk = C:\Programmer\Rainlendar\Rainlendar.exe
    O4 - Startup: Stardock Keyboard Launchpad.lnk = D:\Stardock\KLP\Keys.exe
    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: officejet 6100.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Casper Behrndtz\Application Data\Mozilla\Firefox\Profiles\ergwwekc.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
    O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Casper Behrndtz\Application Data\Mozilla\Firefox\Profiles\ergwwekc.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O18 - Protocol: bw+0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: offline-8876480 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - AppInit_DLLs: wbsys.dll MsgPlusLoader.dll
    O20 - Winlogon Notify: URL - C:\WINDOWS\system32\irl6l53s1.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: EvtEng - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\OProtSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programmer\Spyware Doctor\sdhelp.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
  • TroganTrogan London, UK
    edited November 2005
    Please move HJT to its own folder on your C: so backups can be created. Do this before continuing.
    ===


    Run HiJackThis then:

    1. Click "Open the Misc Tools Section"
    2. Click "Open Process manager"

    -

    Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

    C:\windows\system32\mdms.exe

    Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.
    ===


    Check the following in HJT and click 'Fix Checked'

    O1 - Hosts: gic.com

    O4 - HKLM\..\Run: [WB5Hack] HackIt.cmd
    O4 - HKLM\..\Run: [rtf32.exe] rtf32.exe
    O4 - HKLM\..\Run: [SysMemory manager] c:\windows\system32\mdms.exe
    ===


    View hidden files and folders - explained here
    ===


    Find and Delete:

    c:\windows\system32\mdms.exe << this file
    ===


    Download Ewido Security Suite
    1. Install ewido security suite
    2. When installing the program, under "Additonal Options" uncheck..
      • Install background guard
      • Install scan via context menu
    3. Launch ewido, there should now be an icon on your desktop, double-click it.
    4. The program will now open to the main screen.
    5. When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
    6. You will need to update ewido to the latest definition files:
      • On the left hand side of the main screen click update.
      • Then click on Start Update.
    7. The update will start and a progress bar will show the updates being installed.
      (the status bar at the bottom will display "Update successful")

    If you are having problems with the updater, you can use this link to manually update ewido.
    Ewido Manual Updates

    Once the updates are installed, do the following:
    1. Click on scanner.
    2. Click on Complete System Scan, the scan will now begin.
    3. While the scan is in progress you will be promted to clean files, click OK.
    4. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says "Perform action on all infections", then choose clean and click OK.
    5. Once the scan has completed, there will be a button located at the bottom of the screen named Save Report.
    6. Click Save Report.
    7. Now save the report .txt file to your desktop.
    ===


    Reboot and post a new HJT log :)
  • Ca$quall
    edited November 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 11:45:45 PM, on 11/28/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
    C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Acer\eManager\anbmServ.exe
    C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    C:\Programmer\Alwil Software\Avast4\ashServ.exe
    C:\acer\epm\epm-dm.exe
    C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
    C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
    C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
    C:\Programmer\MessengerPlus! 3\MsgPlus.exe
    C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    D:\Winamp\winampa.exe
    C:\Programmer\ewido\security suite\ewidoctrl.exe
    C:\Programmer\iTunes\iTunesHelper.exe
    C:\Programmer\QuickTime\qttask.exe
    C:\Programmer\DAEMON Tools\daemon.exe
    C:\Programmer\Intel\Wireless\Bin\OProtSvc.exe
    C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe
    C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Programmer\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Programmer\Google\Google Talk\googletalk.exe
    D:\AIM\aim.exe
    D:\D-L\AveDesk\AveDesk.exe
    C:\Programmer\Skype\Phone\Skype.exe
    D:\BitLord\BitLord.exe
    C:\Programmer\Spyware Doctor\swdoctor.exe
    C:\Programmer\Clock Tray Skins\ClockTraySkins.exe
    D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
    C:\WINDOWS\system32\svchost.exe
    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    C:\Programmer\Logitech\SetPoint\KEM.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Programmer\Rainlendar\Rainlendar.exe
    D:\Stardock\KLP\Keys.exe
    C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
    C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Programmer\iPod\bin\iPodService.exe
    C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe
    C:\Programmer\Alwil Software\Avast4\ashWebSv.exe
    C:\Programmer\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Documents and Settings\Casper Behrndtz\Skrivebord\HijackThis\HijackThis.exe

    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Programmer\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programmer\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [WinampAgent] D:\Winamp\winampa.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [IntelWireless] C:\Programmer\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [EOUApp] C:\Programmer\Intel\Wireless\Bin\EOUWiz.exe
    O4 - HKLM\..\Run: [RegistryMechanic] C:\Programmer\Registry Mechanic\RegMech.exe /QS
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [googletalk] "C:\Programmer\Google\Google Talk\googletalk.exe" /autostart
    O4 - HKCU\..\Run: [AIM] D:\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [AVEDESK] "D:\D-L\AveDesk\AveDesk.exe"
    O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [BitComet] "D:\BitLord\BitLord.exe"
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programmer\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [SkinClock] C:\Programmer\Clock Tray Skins\ClockTraySkins.exe
    O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
    O4 - Startup: Adobe Gamma.lnk = ?
    O4 - Startup: Rainlendar.lnk = C:\Programmer\Rainlendar\Rainlendar.exe
    O4 - Startup: Stardock Keyboard Launchpad.lnk = D:\Stardock\KLP\Keys.exe
    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programmer\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: officejet 6100.lnk = ?
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open Link Target in Firefox - file://C:\Documents and Settings\Casper Behrndtz\Application Data\Mozilla\Firefox\Profiles\ergwwekc.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
    O8 - Extra context menu item: View This Page in Firefox - file://C:\Documents and Settings\Casper Behrndtz\Application Data\Mozilla\Firefox\Profiles\ergwwekc.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
    O18 - Protocol: bw+0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Protocol: offline-8876480 - {22FD7B15-A181-4107-81BE-E69C95D5FF86} - C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - AppInit_DLLs: wbsys.dll MsgPlusLoader.dll
    O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\en40l1hm1.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmer\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmer\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: EvtEng - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
    O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programmer\Fælles filer\Macromedia Shared\Service\Macromedia Licensing.exe
    O23 - Service: OwnershipProtocol - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\OProtSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programmer\Spyware Doctor\sdhelp.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
  • TroganTrogan London, UK
    edited November 2005
    Can you try running option #2 again from the l2mfix.bat.


    Close all Browsers and Programs before proceeding.


    Let me know what happens. :)
  • Ca$quall
    edited November 2005
    Wont work, said the same thing.
    And the Ewido program didnt say Database could not be found, when i opened it the first time if that helps.
  • TroganTrogan London, UK
    edited November 2005
    No problem. Let's do this the manual way.


    Download and run VX2Finder(.exe).
    http://www.downloads.subratam.org/VX2Finder.exe

    Open the program and click the 'Click to Find VX2.aBetterInternet' button. This will attempt to find all VX2 related files and registry keys and when present display them in its logfile. To create a logfile, click the button named: 'Make Log'. This will open logfile using Notepad. Please post (copy/paste) the results and post them in this topic.

    Download these two tools:

    http://www.downloads.subratam.org/DllCompare.exe
    &
    http://www.downloads.subratam.org/KillBox.exe

    Run Dllcompare by clicking the "Run Locate.com" then click Compare button... when done post that log here. Do not reboot once you have posted the logs because all the filenames will change otherwise.
  • Ca$quall
    edited November 2005
    Log for VX2.BetterInternet File Finder (ALL)

    Files Found---

    Additional Files---

    Keys Under Notify---
    Syncmgr


    Guardian Key--- is called:

    Guardian Key--- :

    User Agent String---
    {562D5722-2D16-659C-3001-B8D4225F435F}
  • Ca$quall
    edited November 2005
    * DLLCompare Log version()
    Files Found that Windows does not See or cannot Access
    *Not everything listed here means you are infected!
    ________________________________________________

    C:\WINDOWS\SYSTEM32\en40l1~1.dll Mon Nov 28 2005 9:33:08p ..S.R 235,963 230.43 K
    C:\WINDOWS\SYSTEM32\hr4s05~1.dll Mon Nov 28 2005 11:39:06p ..S.R 235,963 230.43 K
    C:\WINDOWS\SYSTEM32\nticdm~1.dll Thu Dec 30 2004 9:20:18a ...HR 1,024 1.00 K
    C:\WINDOWS\SYSTEM32\ntiembed.dll Thu Dec 30 2004 9:20:48a A..HR 1,024 1.00 K
    C:\WINDOWS\SYSTEM32\ntimpeg2.dll Thu Dec 30 2004 9:20:18a A..HR 1,024 1.00 K
    ________________________________________________

    1,355 items found: 1,355 files (5 H/S), 0 directories.
    Total of file sizes: 289,553,963 bytes 276.14 M

    Administrator Account = True

    AppInit_DLLs value = wbsys.dll MsgPlusLoader.dll (not hidden)
    End log
  • TroganTrogan London, UK
    edited November 2005
    Go here and in the box provided, type the following one at a time. Then press SUBMIT

    C:\WINDOWS\SYSTEM32\en40l1~1.dll
    C:\WINDOWS\SYSTEM32\hr4s05~1.dll
    C:\WINDOWS\SYSTEM32\nticdm~1.dll
    C:\WINDOWS\SYSTEM32\ntiembed.dll
    C:\WINDOWS\SYSTEM32\ntimpeg2.dll

    The files will be scanned by various Anti-Virus scanners. Please post the results for them here.
  • Ca$quall
    edited November 2005
    Trogan_1000 wrote:
    Go here and in the box provided, type the following one at a time. Then press SUBMIT

    C:\WINDOWS\SYSTEM32\en40l1~1.dll
    1.C:\WINDOWS\SYSTEM32\hr4s05~1.dll
    2.C:\WINDOWS\SYSTEM32\nticdm~1.dll
    3.C:\WINDOWS\SYSTEM32\ntiembed.dll
    4.C:\WINDOWS\SYSTEM32\ntimpeg2.dll

    The files will be scanned by various Anti-Virus scanners. Please post the results for them here.
    1.The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file
    2. Service load:
    0% 100%
    File: nticdm~1.dll_
    Status:
    OK
    MD5 690dabbff457541250872260ea2e3bd1
    Packers detected:
    -
    Scanner results
    AntiVir
    Found nothing
    ArcaVir
    Found nothing
    Avast
    Found nothing
    AVG Antivirus
    Found nothing
    BitDefender
    Found nothing
    ClamAV
    Found nothing
    Dr.Web
    Found nothing
    F-Prot Antivirus
    Found nothing
    Fortinet
    Found nothing
    Kaspersky Anti-Virus
    Found nothing
    NOD32
    Found nothing
    Norman Virus Control
    Found nothing
    UNA
    Found nothing
    VBA32
    Found nothing

    3. Service load:
    0% 100%
    File: ntiembed.dll_
    Status:
    OK
    MD5 dabc864e4c9618d979bf48bc993b6160
    Packers detected:
    -
    Scanner results
    AntiVir
    Found nothing
    ArcaVir
    Found nothing
    Avast
    Found nothing
    AVG Antivirus
    Found nothing
    BitDefender
    Found nothing
    ClamAV
    Found nothing
    Dr.Web
    Found nothing
    F-Prot Antivirus
    Found nothing
    Fortinet
    Found nothing
    Kaspersky Anti-Virus
    Found nothing
    NOD32
    Found nothing
    Norman Virus Control
    Found nothing
    UNA
    Found nothing
    VBA32
    Found nothing

    4. Service load:
    0% 100%
    File: ntimpeg2.dll
    Status:
    OK
    MD5 3450db76e3769f8494ed9d7d1c36aad9
    Packers detected:
    -
    Scanner results
    AntiVir
    Found nothing
    ArcaVir
    Found nothing
    Avast
    Found nothing
    AVG Antivirus
    Found nothing
    BitDefender
    Found nothing
    ClamAV
    Found nothing
    Dr.Web
    Found nothing
    F-Prot Antivirus
    Found nothing
    Fortinet
    Found nothing
    Kaspersky Anti-Virus
    Found nothing
    NOD32
    Found nothing
    Norman Virus Control
    Found nothing
    UNA
    Found nothing
    VBA32
    Found nothing
  • TroganTrogan London, UK
    edited November 2005
    Stay offline when doing the following fix.

    Open killbox and paste in C:\WINDOWS\SYSTEM32\en40l1~1.dll

    With the full path to the file name in the topmost textbox, click the option *replace on reboot* and *Use Dummy* which will create a numbered dummy file instantly for you.

    Click the Red X ...and for the confirmation message that will appear, you will need to click Yes
    A second message will ask to Reboot now? you will need to click No (since you are not finished adding all related files in yet)

    Repeat the above for each of these;

    C:\WINDOWS\SYSTEM32\hr4s05~1.dll

    On that last file, close all programs and Reboot your computer.

    Post another log from dllcompare please
  • Ca$quall
    edited November 2005
    Pocket Killbox version 2.0.0.473
    Running on Windows XP As an Administrator
    was started @ Tuesday, November 29, 2005, 12:08 AM

    Killbox Closed(Exit) @ 12:08:09 AM
    __________________________________________________

    Pocket Killbox version 2.0.0.473
    Running on Windows XP As an Administrator
    was started @ Tuesday, November 29, 2005, 12:24 AM

    # 1 [Replace on Delete]
    Path = C:\WINDOWS\SYSTEM32\en40l1~1.dll
    *Replaced with C:\Documents and Settings\Casper Behrndtz\Lokale indstillinger\Temp\kbdummy.0

    # 2 [Replace on Delete]
    Path = C:\WINDOWS\SYSTEM32\hr4s05~1.dll
    *Replaced with C:\Documents and Settings\Casper Behrndtz\Lokale indstillinger\Temp\kbdummy.1

    I Rebooted @ 12:26:04 AM
    Killbox Closed(Exit) @ 12:26:10 AM
    __________________________________________________

    Pocket Killbox version 2.0.0.473
    Running on Windows XP As an Administrator
    was started @ Tuesday, November 29, 2005, 12:31 AM
  • Ca$quall
    edited November 2005
    Trogan_1000 wrote:
    Stay offline when doing the following fix.

    Open killbox and paste in C:\WINDOWS\SYSTEM32\en40l1~1.dll

    With the full path to the file name in the topmost textbox, click the option *replace on reboot* and *Use Dummy* which will create a numbered dummy file instantly for you.

    Click the Red X ...and for the confirmation message that will appear, you will need to click Yes
    A second message will ask to Reboot now? you will need to click No (since you are not finished adding all related files in yet)

    Repeat the above for each of these;

    C:\WINDOWS\SYSTEM32\hr4s05~1.dll

    On that last file, close all programs and Reboot your computer.

    Post another log from dllcompare please
    Log about what??
  • Ca$quall
    edited November 2005
    * DLLCompare Log version(1.0.0.127)
    Files Found that Windows does not See or cannot Access
    *Not everything listed here means you are infected!
    ________________________________________________

    C:\WINDOWS\SYSTEM32\nticdm~1.dll Thu Dec 30 2004 9:20:18a ...HR 1,024 1.00 K
    C:\WINDOWS\SYSTEM32\ntiembed.dll Thu Dec 30 2004 9:20:48a A..HR 1,024 1.00 K
    C:\WINDOWS\SYSTEM32\ntimpeg2.dll Thu Dec 30 2004 9:20:18a A..HR 1,024 1.00 K
    ________________________________________________

    1,353 items found: 1,353 files (3 H/S), 0 directories.
    Total of file sizes: 288,846,130 bytes 275.46 M

    Administrator Account = True

    AppInit_DLLs value = wbsys.dll MsgPlusLoader.dll (not hidden)
    End log
  • TroganTrogan London, UK
    edited November 2005
    Its late here and I gotta go to bed. I'l check this thread later...


    How are things so far?
  • Ca$quall
    edited November 2005
    Trogan_1000 wrote:
    Its late here and I gotta go to bed. I'l check this thread later...


    How are things so far?
    nothings changed with the ads
  • Ca$quall
    edited November 2005
    I gotta go to bed also, but thanks for the help so far :D .
  • TroganTrogan London, UK
    edited November 2005
    If you can hold on for a little while, i'l be back with some instructions... :)
  • Ca$quall
    edited November 2005
    alright
    You'll post them now?
  • TroganTrogan London, UK
    edited November 2005
    No, I'l post them tomorrow.

    I just need to get something checked out for you :)
  • Ca$quall
    edited November 2005
    Cool G'night
  • TroganTrogan London, UK
    edited November 2005
    Post a new HJT log please quickly :)
Sign In or Register to comment.