Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Problem with Winfixer 2005 popups and Trojan Vundo in computer! [C

Started by retrochronix , Nov 18 2005 01:22 AM

  • This topic is locked This topic is locked

#1
retrochronix
Posted 18 November 2005 - 01:22 AM

retrochronix

    New Member

  • Member
  • Pip
  • 3 posts
Hello, my computer somehow is infected by Trojan Vundo and always has the winfixer 2005 opoups aroud, making it super slow in running all programs. Please try to save my computer!! Thanks in advance for the help!

Here is the HJT log file.

Logfile of HijackThis v1.99.1
Scan saved at 1:07:31 AM, on 18/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\ssqpo.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\RunOnce: [!CleanupNetMeetingDispDriver] "C:\WINDOWS\system32\rundll32.exe" msconf.dll,CleanupNetMeetingDispDriver 0
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Windows.hta
O4 - Global Startup: Post-itR Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab30149.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab30149.cab
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://scpwib.ops.pl...quicksilver.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1094440077296
O16 - DPF: {88D758A3-D33B-45FD-91E3-67749B4057FA} (Sinstaller Class) - http://dm.screensave.../sinstaller.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab30149.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab30149.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab31267.cab
O18 - Protocol: bw+0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: ssqpo - C:\WINDOWS\system32\ssqpo.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\altera\quartus50\bin\JTAGServer.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WUSB54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe (file missing)
  • 0

Advertisements

#2
John_L
Posted 18 November 2005 - 07:21 AM

John_L

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,398 posts
Hello retrochronix and welcome to Geeks To Go. :tazz:

Please run this tool and lets see what it does for us.

Please download WebRoot SpySweeper from HERE (It's a 2 week trial):
  • Click the Free Trial link under to "SpySweeper" to download the program.
  • Install it. Once the program is installed, it will open.
  • It will prompt you to update to the latest definitions, click Yes.
  • Once the definitions are installed, click Options on the left side.
  • Click the Sweep Options tab.
  • Under What to Sweep please put a check next to the following:
    • Sweep Memory
    • Sweep Registry
    • Sweep Cookies
    • Sweep All User Accounts
    • Enable Direct Disk Sweeping
    • Sweep Contents of Compressed Files
    • Sweep for Rootkits
    • Please UNCHECK Do not Sweep System Restore Folder.
  • Click Sweep Now on the left side.
  • Click the Start button.
  • When it's done scanning, click the Next button.
  • Make sure everything has a check next to it, then click the Next button.
  • It will remove all of the items found.
  • Click Session Log in the upper right corner, copy everything in that window.
  • Click the Summary tab and click Finish.
  • Paste the contents of the session log you copied into your next reply.
Whne finished show me the spysweeper log and a new hijack log please. :)
  • 0

#3
retrochronix
Posted 18 November 2005 - 07:21 PM

retrochronix

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Hello, thanks for helping me out on my computer problem. I've used the spysweeper and got the following logfile:

********
6:52 PM: | Start of Session, November 18, 2005 |
6:52 PM: Spy Sweeper started
6:52 PM: Sweep initiated using definitions version 574
6:52 PM: Starting Memory Sweep
6:53 PM: Found Adware: virtumonde
6:53 PM: Detected running threat: C:\WINDOWS\system32\ssqpo.dll (ID = 77)
6:53 PM: Memory Sweep Complete, Elapsed Time: 00:01:21
6:53 PM: Starting Registry Sweep
6:54 PM: Found Adware: screensavers
6:54 PM: HKCR\clsid\{722d2939-a14a-41a9-9eac-ab8f4e295819}\ (2 subtraces) (ID = 140550)
6:54 PM: HKCR\clsid\{88d758a3-d33b-45fd-91e3-67749b4057fa}\ (2 subtraces) (ID = 140551)
6:54 PM: HKLM\software\classes\clsid\{722d2939-a14a-41a9-9eac-ab8f4e295819}\ (2 subtraces) (ID = 140555)
6:54 PM: HKLM\software\classes\clsid\{88d758a3-d33b-45fd-91e3-67749b4057fa}\ (2 subtraces) (ID = 140556)
6:54 PM: HKLM\software\microsoft\code store database\distribution units\{88d758a3-d33b-45fd-91e3-67749b4057fa}\ (9 subtraces) (ID = 140566)
6:54 PM: HKLM\software\screensavers.com\ (ID = 140569)
6:54 PM: Found Trojan Horse: trojan-backdoor-zubox
6:54 PM: HKCR\typelib\{5e2121e1-0300-11d4-8d3b-444553540000}\ (9 subtraces) (ID = 484124)
6:54 PM: HKLM\software\classes\typelib\{5e2121e1-0300-11d4-8d3b-444553540000}\ (9 subtraces) (ID = 484210)
6:54 PM: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpo\ (5 subtraces) (ID = 954600)
6:54 PM: Found Adware: showbehind
6:54 PM: HKU\S-1-5-21-3707667370-3829723195-3849906145-1003\software\showbehind\ (1 subtraces) (ID = 980567)
6:54 PM: Registry Sweep Complete, Elapsed Time:00:00:45
6:54 PM: Starting Cookie Sweep
6:54 PM: Found Spy Cookie: sandboxer cookie
6:54 PM: [email protected][2].txt (ID = 3281)
6:54 PM: Found Spy Cookie: 216.221.138 cookie
6:54 PM: [email protected][2].txt (ID = 1947)
6:55 PM: Found Spy Cookie: 3 cookie
6:55 PM: owner@3[1].txt (ID = 1959)
6:55 PM: owner@3[2].txt (ID = 1959)
6:55 PM: owner@3[3].txt (ID = 1959)
6:55 PM: Found Spy Cookie: 5 cookie
6:55 PM: owner@5[1].txt (ID = 1979)
6:55 PM: owner@5[3].txt (ID = 1979)
6:55 PM: owner@5[4].txt (ID = 1979)
6:55 PM: Found Spy Cookie: 64.62.232 cookie
6:55 PM: [email protected][2].txt (ID = 1987)
6:55 PM: Found Spy Cookie: 888 cookie
6:55 PM: owner@888[1].txt (ID = 2019)
6:55 PM: owner@888[2].txt (ID = 2019)
6:55 PM: Found Spy Cookie: 91338698 cookie
6:55 PM: owner@91338698[2].txt (ID = 2025)
6:55 PM: Found Spy Cookie: websponsors cookie
6:55 PM: [email protected][2].txt (ID = 3665)
6:55 PM: Found Spy Cookie: go.com cookie
6:55 PM: [email protected][1].txt (ID = 2729)
6:55 PM: Found Spy Cookie: about cookie
6:55 PM: owner@about[2].txt (ID = 2037)
6:55 PM: Found Spy Cookie: accoona cookie
6:55 PM: owner@accoona[1].txt (ID = 2041)
6:55 PM: Found Spy Cookie: ad-rotator cookie
6:55 PM: owner@ad-rotator[2].txt (ID = 2051)
6:55 PM: Found Spy Cookie: yieldmanager cookie
6:55 PM: [email protected][1].txt (ID = 3751)
6:55 PM: Found Spy Cookie: adknowledge cookie
6:55 PM: owner@adknowledge[1].txt (ID = 2072)
6:55 PM: Found Spy Cookie: adlegend cookie
6:55 PM: owner@adlegend[1].txt (ID = 2074)
6:55 PM: Found Spy Cookie: hbmediapro cookie
6:55 PM: [email protected][2].txt (ID = 2768)
6:55 PM: Found Spy Cookie: precisead cookie
6:55 PM: [email protected][1].txt (ID = 3182)
6:55 PM: Found Spy Cookie: specificclick.com cookie
6:55 PM: [email protected][1].txt (ID = 3400)
6:55 PM: Found Spy Cookie: nextag cookie
6:55 PM: [email protected][1].txt (ID = 5015)
6:55 PM: Found Spy Cookie: cc214142 cookie
6:55 PM: [email protected][1].txt (ID = 2367)
6:55 PM: Found Spy Cookie: cd freaks cookie
6:55 PM: [email protected][1].txt (ID = 2371)
6:55 PM: Found Spy Cookie: askmen cookie
6:55 PM: owner@askmen[1].txt (ID = 2247)
6:55 PM: Found Spy Cookie: ask cookie
6:55 PM: owner@ask[1].txt (ID = 2245)
6:55 PM: Found Spy Cookie: atlas dmt cookie
6:55 PM: owner@atdmt[1].txt (ID = 2253)
6:55 PM: Found Spy Cookie: belnk cookie
6:55 PM: [email protected][2].txt (ID = 2293)
6:55 PM: Found Spy Cookie: atwola cookie
6:55 PM: owner@atwola[1].txt (ID = 2255)
6:55 PM: Found Spy Cookie: azjmp cookie
6:55 PM: owner@azjmp[2].txt (ID = 2270)
6:55 PM: Found Spy Cookie: a cookie
6:55 PM: owner@a[1].txt (ID = 2027)
6:55 PM: owner@a[2].txt (ID = 2027)
6:55 PM: owner@a[3].txt (ID = 2027)
6:55 PM: [email protected][1].txt (ID = 2038)
6:55 PM: Found Spy Cookie: banner cookie
6:55 PM: owner@banner[1].txt (ID = 2276)
6:55 PM: owner@belnk[1].txt (ID = 2292)
6:55 PM: Found Spy Cookie: bizrate cookie
6:55 PM: owner@bizrate[2].txt (ID = 2308)
6:55 PM: Found Spy Cookie: burstnet cookie
6:55 PM: owner@burstnet[2].txt (ID = 2336)
6:55 PM: Found Spy Cookie: enhance cookie
6:55 PM: [email protected][1].txt (ID = 2614)
6:55 PM: Found Spy Cookie: gostats cookie
6:55 PM: [email protected][2].txt (ID = 2748)
6:55 PM: [email protected][2].txt (ID = 2748)
6:55 PM: [email protected][1].txt (ID = 2748)
6:55 PM: Found Spy Cookie: cassava cookie
6:55 PM: owner@cassava[1].txt (ID = 2362)
6:55 PM: owner@cdfreaks[1].txt (ID = 2370)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: Found Spy Cookie: megago cookie
6:55 PM: [email protected][1].txt (ID = 2983)
6:55 PM: [email protected][2].txt (ID = 2371)
6:55 PM: Found Spy Cookie: 2o7.net cookie
6:55 PM: [email protected][2].txt (ID = 1958)
6:55 PM: Found Spy Cookie: cnt cookie
6:55 PM: owner@cnt[1].txt (ID = 2422)
6:55 PM: [email protected][1].txt (ID = 2038)
6:55 PM: Found Spy Cookie: tickle cookie
6:55 PM: [email protected][1].txt (ID = 3530)
6:55 PM: Found Spy Cookie: counter cookie
6:55 PM: owner@counter[1].txt (ID = 2477)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: Found Spy Cookie: clickzs cookie
6:55 PM: [email protected][1].txt (ID = 2413)
6:55 PM: Found Spy Cookie: touchclarity cookie
6:55 PM: [email protected][1].txt (ID = 3566)
6:55 PM: Found Spy Cookie: dealtime cookie
6:55 PM: owner@dealtime[2].txt (ID = 2505)
6:55 PM: [email protected][2].txt (ID = 2729)
6:55 PM: [email protected][1].txt (ID = 2293)
6:55 PM: Found Spy Cookie: howstuffworks cookie
6:55 PM: [email protected][1].txt (ID = 2806)
6:55 PM: Found Spy Cookie: exitexchange cookie
6:55 PM: owner@exitexchange[1].txt (ID = 2633)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: [email protected][1].txt (ID = 2729)
6:55 PM: Found Spy Cookie: fe.lea.lycos.com cookie
6:55 PM: [email protected][1].txt (ID = 2660)
6:55 PM: [email protected][2].txt (ID = 2660)
6:55 PM: Found Spy Cookie: gamespy cookie
6:55 PM: owner@gamespy[1].txt (ID = 2719)
6:55 PM: Found Spy Cookie: gaytrafficbroker cookie
6:55 PM: owner@gaytrafficbroker[1].txt (ID = 2724)
6:55 PM: owner@gostats[1].txt (ID = 2747)
6:55 PM: Found Spy Cookie: gotoast cookie
6:55 PM: owner@gotoast[1].txt (ID = 2751)
6:55 PM: [email protected][1].txt (ID = 2038)
6:55 PM: owner@go[1].txt (ID = 2728)
6:55 PM: [email protected][1].txt (ID = 2038)
6:55 PM: Found Spy Cookie: clickandtrack cookie
6:55 PM: [email protected][1].txt (ID = 2397)
6:55 PM: [email protected][1].txt (ID = 2729)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: owner@howstuffworks[1].txt (ID = 2805)
6:55 PM: Found Spy Cookie: hypertracker.com cookie
6:55 PM: owner@hypertracker[1].txt (ID = 2817)
6:55 PM: Found Spy Cookie: screensavers.com cookie
6:55 PM: [email protected][1].txt (ID = 3298)
6:55 PM: Found Spy Cookie: ic-live cookie
6:55 PM: owner@ic-live[1].txt (ID = 2821)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: Found Spy Cookie: kmpads cookie
6:55 PM: owner@kmpads[1].txt (ID = 2909)
6:55 PM: Found Spy Cookie: kount cookie
6:55 PM: owner@kount[2].txt (ID = 2911)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: [email protected][2].txt (ID = 1958)
6:55 PM: Found Spy Cookie: metareward.com cookie
6:55 PM: owner@metareward[1].txt (ID = 2990)
6:55 PM: [email protected][2].txt (ID = 1958)
6:55 PM: Found Spy Cookie: mygeek cookie
6:55 PM: owner@mygeek[1].txt (ID = 3041)
6:55 PM: owner@nextag[2].txt (ID = 5014)
6:55 PM: Found Spy Cookie: offeroptimizer cookie
6:55 PM: owner@offeroptimizer[2].txt (ID = 3087)
6:55 PM: Found Spy Cookie: outster cookie
6:55 PM: owner@outster[1].txt (ID = 3103)
6:55 PM: [email protected][1].txt (ID = 3567)
6:55 PM: Found Spy Cookie: partypoker cookie
6:55 PM: owner@partypoker[2].txt (ID = 3111)
6:55 PM: Found Spy Cookie: passion cookie
6:55 PM: owner@passion[1].txt (ID = 3113)
6:55 PM: Found Spy Cookie: rc cookie
6:55 PM: owner@rc[1].txt (ID = 3231)
6:55 PM: Found Spy Cookie: rednova cookie
6:55 PM: owner@rednova[2].txt (ID = 3245)
6:55 PM: Found Spy Cookie: reunion cookie
6:55 PM: owner@reunion[2].txt (ID = 3255)
6:55 PM: Found Spy Cookie: rightmedia cookie
6:55 PM: owner@rightmedia[2].txt (ID = 3259)
6:55 PM: Found Spy Cookie: adjuggler cookie
6:55 PM: [email protected][1].txt (ID = 2071)
6:55 PM: Found Spy Cookie: domain sponsor cookie
6:55 PM: [email protected][2].txt (ID = 2534)
6:55 PM: Found Spy Cookie: web-stat cookie
6:55 PM: [email protected][2].txt (ID = 3649)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: [email protected][1].txt (ID = 1958)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: Found Spy Cookie: starware.com cookie
6:55 PM: owner@starware[1].txt (ID = 3441)
6:55 PM: [email protected][2].txt (ID = 2506)
6:55 PM: Found Spy Cookie: statstracking cookie
6:55 PM: owner@stats-tracking[1].txt (ID = 3453)
6:55 PM: Found Spy Cookie: reliablestats cookie
6:55 PM: [email protected][1].txt (ID = 3254)
6:55 PM: [email protected][2].txt (ID = 1958)
6:55 PM: [email protected][1].txt (ID = 2038)
6:55 PM: Found Spy Cookie: uproar cookie
6:55 PM: owner@uproar[2].txt (ID = 3612)
6:55 PM: Found Spy Cookie: upspiral cookie
6:55 PM: owner@upspiral[1].txt (ID = 3614)
6:55 PM: Found Spy Cookie: videodome cookie
6:55 PM: owner@videodome[1].txt (ID = 3638)
6:55 PM: [email protected][1].txt (ID = 2038)
6:55 PM: Found Spy Cookie: techtarget cookie
6:55 PM: [email protected][1].txt (ID = 3500)
6:55 PM: [email protected][2].txt (ID = 2038)
6:55 PM: [email protected][1].txt (ID = 2042)
6:55 PM: Found Spy Cookie: affiliatefuel.com cookie
6:55 PM: [email protected][1].txt (ID = 2202)
6:55 PM: Found Spy Cookie: burstbeacon cookie
6:55 PM: [email protected][2].txt (ID = 2335)
6:55 PM: Found Spy Cookie: freepassbucks cookie
6:55 PM: [email protected][1].txt (ID = 2702)
6:55 PM: [email protected][2].txt (ID = 3298)
6:55 PM: Found Spy Cookie: seeq cookie
6:55 PM: [email protected][1].txt (ID = 3332)
6:55 PM: Found Spy Cookie: try games cookie
6:55 PM: [email protected][1].txt (ID = 3594)
6:55 PM: Found Spy Cookie: tshirthell cookie
6:55 PM: [email protected][1].txt (ID = 3596)
6:55 PM: [email protected][2].txt (ID = 3615)
6:55 PM: [email protected][1].txt (ID = 3649)
6:55 PM: [email protected][1].txt (ID = 3332)
6:55 PM: Found Spy Cookie: xiti cookie
6:55 PM: owner@xiti[1].txt (ID = 3717)
6:55 PM: Found Spy Cookie: yadro cookie
6:55 PM: owner@yadro[1].txt (ID = 3743)
6:55 PM: owner@yieldmanager[2].txt (ID = 3749)
6:55 PM: Cookie Sweep Complete, Elapsed Time: 00:00:24
6:55 PM: Starting File Sweep
6:57 PM: c:\windows\sbnet (ID = -2147480327)
6:59 PM: Found Adware: comet cursor
6:59 PM: cc_43.pnf (ID = 53470)
7:03 PM: inst43.exe (ID = 53579)
7:05 PM: cc_43.inf (ID = 53469)
7:31 PM: sinstaller.inf (ID = 74756)
7:34 PM: Warning: Unhandled Archive Type
7:34 PM: Warning: Unhandled Archive Type
7:34 PM: Warning: Unhandled Archive Type
7:34 PM: Warning: Unhandled Archive Type
7:34 PM: Warning: Invalid file - not a PKZip file
7:34 PM: Warning: Invalid file - not a PKZip file
7:34 PM: Warning: Unhandled Archive Type
7:36 PM: Warning: Unhandled Archive Type
7:36 PM: Warning: Unhandled Archive Type
7:38 PM: Warning: Unhandled Archive Type
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: Warning: Invalid file - not a PKZip file
7:40 PM: File Sweep Complete, Elapsed Time: 00:45:38
7:40 PM: Full Sweep has completed. Elapsed time 00:48:18
7:40 PM: Traces Found: 187
7:47 PM: Removal process initiated
7:47 PM: Quarantining All Traces: trojan-backdoor-zubox
7:47 PM: Quarantining All Traces: virtumonde
7:47 PM: virtumonde is in use. It will be removed on reboot.
7:47 PM: C:\WINDOWS\system32\ssqpo.dll is in use. It will be removed on reboot.
7:47 PM: Quarantining All Traces: comet cursor
7:47 PM: Quarantining All Traces: screensavers
7:47 PM: Quarantining All Traces: showbehind
7:47 PM: Quarantining All Traces: 216.221.138 cookie
7:47 PM: Quarantining All Traces: 2o7.net cookie
7:47 PM: Quarantining All Traces: 3 cookie
7:47 PM: Quarantining All Traces: 5 cookie
7:47 PM: Quarantining All Traces: 64.62.232 cookie
7:47 PM: Quarantining All Traces: 888 cookie
7:47 PM: Quarantining All Traces: 91338698 cookie
7:47 PM: Quarantining All Traces: a cookie
7:47 PM: Quarantining All Traces: about cookie
7:47 PM: Quarantining All Traces: accoona cookie
7:47 PM: Quarantining All Traces: adjuggler cookie
7:47 PM: Quarantining All Traces: adknowledge cookie
7:47 PM: Quarantining All Traces: adlegend cookie
7:47 PM: Quarantining All Traces: ad-rotator cookie
7:47 PM: Quarantining All Traces: affiliatefuel.com cookie
7:47 PM: Quarantining All Traces: ask cookie
7:47 PM: Quarantining All Traces: askmen cookie
7:47 PM: Quarantining All Traces: atlas dmt cookie
7:47 PM: Quarantining All Traces: atwola cookie
7:47 PM: Quarantining All Traces: azjmp cookie
7:47 PM: Quarantining All Traces: banner cookie
7:47 PM: Quarantining All Traces: belnk cookie
7:47 PM: Quarantining All Traces: bizrate cookie
7:47 PM: Quarantining All Traces: burstbeacon cookie
7:47 PM: Quarantining All Traces: burstnet cookie
7:47 PM: Quarantining All Traces: cassava cookie
7:47 PM: Quarantining All Traces: cc214142 cookie
7:47 PM: Quarantining All Traces: cd freaks cookie
7:47 PM: Quarantining All Traces: clickandtrack cookie
7:47 PM: Quarantining All Traces: clickzs cookie
7:47 PM: Quarantining All Traces: cnt cookie
7:47 PM: Quarantining All Traces: counter cookie
7:47 PM: Quarantining All Traces: dealtime cookie
7:47 PM: Quarantining All Traces: domain sponsor cookie
7:47 PM: Quarantining All Traces: enhance cookie
7:48 PM: Quarantining All Traces: exitexchange cookie
7:48 PM: Quarantining All Traces: fe.lea.lycos.com cookie
7:48 PM: Quarantining All Traces: freepassbucks cookie
7:48 PM: Quarantining All Traces: gamespy cookie
7:48 PM: Quarantining All Traces: gaytrafficbroker cookie
7:48 PM: Quarantining All Traces: go.com cookie
7:48 PM: Quarantining All Traces: gostats cookie
7:48 PM: Quarantining All Traces: gotoast cookie
7:48 PM: Quarantining All Traces: hbmediapro cookie
7:48 PM: Quarantining All Traces: howstuffworks cookie
7:48 PM: Quarantining All Traces: hypertracker.com cookie
7:48 PM: Quarantining All Traces: ic-live cookie
7:48 PM: Quarantining All Traces: kmpads cookie
7:48 PM: Quarantining All Traces: kount cookie
7:48 PM: Quarantining All Traces: megago cookie
7:48 PM: Quarantining All Traces: metareward.com cookie
7:48 PM: Quarantining All Traces: mygeek cookie
7:48 PM: Quarantining All Traces: nextag cookie
7:48 PM: Quarantining All Traces: offeroptimizer cookie
7:48 PM: Quarantining All Traces: outster cookie
7:48 PM: Quarantining All Traces: partypoker cookie
7:48 PM: Quarantining All Traces: passion cookie
7:48 PM: Quarantining All Traces: precisead cookie
7:48 PM: Quarantining All Traces: rc cookie
7:48 PM: Quarantining All Traces: rednova cookie
7:48 PM: Quarantining All Traces: reliablestats cookie
7:48 PM: Quarantining All Traces: reunion cookie
7:48 PM: Quarantining All Traces: rightmedia cookie
7:48 PM: Quarantining All Traces: sandboxer cookie
7:48 PM: Quarantining All Traces: screensavers.com cookie
7:48 PM: Quarantining All Traces: seeq cookie
7:48 PM: Quarantining All Traces: specificclick.com cookie
7:48 PM: Quarantining All Traces: starware.com cookie
7:48 PM: Quarantining All Traces: statstracking cookie
7:48 PM: Quarantining All Traces: techtarget cookie
7:48 PM: Quarantining All Traces: tickle cookie
7:48 PM: Quarantining All Traces: touchclarity cookie
7:48 PM: Quarantining All Traces: try games cookie
7:48 PM: Quarantining All Traces: tshirthell cookie
7:48 PM: Quarantining All Traces: uproar cookie
7:48 PM: Quarantining All Traces: upspiral cookie
7:48 PM: Quarantining All Traces: videodome cookie
7:48 PM: Quarantining All Traces: websponsors cookie
7:48 PM: Quarantining All Traces: web-stat cookie
7:48 PM: Quarantining All Traces: xiti cookie
7:48 PM: Quarantining All Traces: yadro cookie
7:48 PM: Quarantining All Traces: yieldmanager cookie
7:48 PM: Removal process completed. Elapsed time 00:01:22
********
6:44 PM: | Start of Session, November 18, 2005 |
6:44 PM: Spy Sweeper started
6:44 PM: Sweep initiated using definitions version 574
6:44 PM: Starting Memory Sweep
6:45 PM: Sweep Canceled
6:46 PM: Memory Sweep Complete, Elapsed Time: 00:01:41
6:46 PM: Traces Found: 0
********
6:38 PM: | Start of Session, November 18, 2005 |
6:38 PM: Spy Sweeper started
6:42 PM: Your spyware definitions have been updated.
6:44 PM: | End of Session, November 18, 2005 |





and the new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:05:58 PM, on 18/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\ssqpo.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Windows.hta
O4 - Global Startup: Post-itR Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://scpwib.ops.pl...quicksilver.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1094440077296
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O18 - Protocol: bw+0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: ssqpo - C:\WINDOWS\system32\ssqpo.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\altera\quartus50\bin\JTAGServer.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WUSB54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe (file missing)
  • 0

#4
John_L
Posted 19 November 2005 - 03:28 PM

John_L

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,398 posts
Hello again retrochronix :)

Good job in getting that done :tazz:

We still have some junk to remove, so with that being said fire up hijack this, press scan only and place checks next to these.

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: MSEvents Object - {FC148228-87E1-4D00-AC06-58DCAA52A4D1} - C:\WINDOWS\system32\ssqpo.dll (file missing)
O18 - Protocol: bw+0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {F24ED4DE-EC19-419E-B1B0-6A8805297576} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: ssqpo - C:\WINDOWS\system32\ssqpo.dll (file missing)

Close all browsers and click fix on hijack this.

Reboot and send me a new hijack log please. :)
  • 0

#5
retrochronix
Posted 20 November 2005 - 02:44 PM

retrochronix

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Hello, thanks again for all your help!

I fixed the files in Hijackthis as described, however I did not see the line:
O20 - Winlogon Notify: ssqpo - C:\WINDOWS\system32\ssqpo.dll (file missing) anymore
when I was trying to fixup the problem...

Here is the new log file:

Logfile of HijackThis v1.99.1
Scan saved at 3:36:10 PM, on 20/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Windows.hta
O4 - Global Startup: Post-itR Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://scpwib.ops.pl...quicksilver.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1094440077296
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Altera JTAG Server (JTAGServer) - Unknown owner - C:\altera\quartus50\bin\JTAGServer.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WUSB54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe (file missing)
  • 0

#6
John_L
Posted 20 November 2005 - 03:10 PM

John_L

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,398 posts
Hello again :tazz:

Were getting there, but still have a couple things to do.

Fire up hijack this, press scan only and place checks next to these.

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - Global Startup: Microsoft Windows.hta

Close all browsers and click fix on hijack this.

Reboot and show me a new log please. :)
  • 0

#7
John_L
Posted 27 November 2005 - 01:35 AM

John_L

    Visiting Staff

  • Member
  • PipPipPipPip
  • 1,398 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP