[Closed] Analysis of a Hijack Log.....please.....:-)

Hi All,

Machine just running slower and slower! Anti V up to date and Scanned with Malaware and Spybot. One of the "quirks" is that I don't have MSN Messenger installed (according to add/remove panel) but every now and then it pops up in my tool bar!

Any assistance on deciding what is good or bad about below greatly appreciated

br

Paul


Index % of PCs with item Code Data
1 0.0% O16 {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl- esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586.cab
2 0.0% O16 {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase6662.cab
3 0.0% O17 Domain = benson.local
4 0.0% O17 DomainName = benson.local
5 0.0% O2 Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
6 0.0% O2 scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
7 0.0% O2 (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
8 0.0% O2 btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
9 0.0% O2 SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
10 0.0% O2 AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
11 0.0% O2 (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
12 0.0% O23 Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
13 0.0% O23 Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
14 0.0% O23 McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
15 0.0% O23 McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
16 0.0% O23 McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
17 0.0% O23 SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
18 0.0% O23 lxdxCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe
19 0.0% O23 lxdx_device - - C:\WINDOWS\system32\lxdxcoms.exe
20 0.0% O3 Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
21 0.0% O4 [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
22 0.0% O4 [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
23 0.0% O4 [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
24 0.0% O4 [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
25 0.0% O4 [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
26 0.0% O4 [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
27 0.0% O4 [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
28 0.0% O4 [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User '?')
29 0.0% O4 [phc700] C:\WINDOWS\vphc700.exe
30 0.0% O4 [acerWireless] C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
31 0.0% O4 c-program files-filemap by bb v405-bootalert.LNK = C:\Program Files\FileMap By BB v405\Bootalert.exe
32 0.0% O4 [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
33 0.0% O4 [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S (User '?')
34 0.0% O4 [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10a.exe
35 0.0% O8 &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
36 0.0% O8 &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
37 0.0% O8 Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
38 0.0% O8 Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
39 0.0% O9 Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
40 0.0% O9 Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
41 0.0% O9 Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
42 0.0% O9 Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
43 0.0% O9 (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
44 0.0% O9 Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
45 0.0% O9 PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
46 0.0% O9 (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
47 0.0% O9 @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
48 0.0% O9 (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
49 0.0% O9 Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
50 0.0% P01 C:\WINDOWS\Explorer.EXE
51 0.0% P01 C:\WINDOWS\system32\svchost.exe
52 0.0% P01 C:\WINDOWS\system32\lsass.exe
53 0.0% P01 C:\WINDOWS\system32\winlogon.exe
54 0.0% P01 C:\WINDOWS\system32\services.exe
55 0.0% P01 C:\WINDOWS\System32\smss.exe
56 0.0% P01 C:\WINDOWS\system32\spoolsv.exe
57 0.0% P01 C:\WINDOWS\system32\ctfmon.exe
58 0.0% P01 C:\Program Files\Messenger\msmsgs.exe
59 0.0% P01 C:\WINDOWS\System32\hkcmd.exe
60 0.0% P01 C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
61 0.0% P01 C:\PROGRA~1\MI3AA1~1\rapimgr.exe
62 0.0% P01 C:\WINDOWS\system32\SearchIndexer.exe
63 0.0% P01 C:\Acer\eManager\anbmServ.exe
64 0.0% P01 C:\Program Files\McAfee\Common Framework\FrameworkService.exe
65 0.0% P01 C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
66 0.0% P01 C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
67 0.0% P01 C:\WINDOWS\vphc700.exe
68 0.0% P01 C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exe
69 0.0% P01 C:\Program Files\acer\Wireless\Utility\WlanUtil.exe
70 0.0% P01 C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
71 0.0% P01 C:\WINDOWS\system32\lxdxcoms.exe
72 0.0% P01 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdxserv.exe
73 0.0% P01 C:\Program Files\Adobe\Reader 9.0\Reader\LogTransport2.exe
74 0.0% R0 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
75 0.0% R0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
76 0.0% R1 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
77 0.0% R1 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
78 0.0% R1 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

Hello Paul

Welcome to the Whatthetech Malware Removal Forum,

All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.


Sorry for the delay but the forums are extremely busy.

I need to see a Hijackthis log.

• Open HJT Scan and Save a Log File, it will open in Notepad
• Go to Format and make sure Wordwrap is Unchecked
• Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Submit Reply and not start a New Thread.

DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log