What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Backdoor.Flood

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
It appears I may have the same virus again.

Logfile of HijackThis v1.99.1
Scan saved at 7:05:53 PM, on 8/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\System32\hphmon03.exe
C:\Program Files\SpyStopper\spystopper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\RFA\rfagent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\TrojanHunter 4.5\THGuard.exe
C:\PROGRA~1\Zinio\ZDLM.exe
C:\Program Files\Weather Watcher\ww.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DynDNS Updater\DynDNS.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\MICROS~4\wcescomm.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\qnotes\qploader.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\stickies\stickies.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Documents and Settings\user\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://rd.yahoo.com/customize/sbcydsl/defa…hoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHealth\HelpCtr\System\panels\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WsftpBrowserHelper Class - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel® Active Monitor\imontray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
O4 - HKLM\..\Run: [SpyStopper] C:\Program Files\SpyStopper\spystopper.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series (from CARL)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P42 "EPSON Stylus Photo R300 Series (from CARL)" /O5 "TS003" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [MPNNET2] \\Frontdesk\MPN\ECLIPSENet32.exe
O4 - HKLM\..\Run: [StatusClient 2.6] C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe /auto
O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [rfagent] "C:\Program Files\RFA\rfagent.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - HKCU\..\Run: [Zinio DLM] C:\PROGRA~1\Zinio\ZDLM.exe /hide
O4 - HKCU\..\Run: [WeatherWatcher] C:\Program Files\Weather Watcher\ww.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [DynDNS Updater] "C:\Program Files\DynDNS Updater\DynDNS.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: qploader.lnk = C:\qnotes\qploader.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted Zone: *.sbcglobal.net
O15 - Trusted Zone: http://*.sbcglobal.net
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://www.acngroup.com/QM/charts/activexviewer.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144861236734
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E0D3CAB-06CD-410D-933A-36C2B3087511}: NameServer = 192.168.0.1,4.2.2.3
O17 - HKLM\System\CCS\Services\Tcpip\..\{BB25E87C-95AE-4E21-BFB2-0D97B8BB8587}: NameServer = 64.81.159.2,216.231.41.2
O18 - Protocol: bw+0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {B6B55469-17E0-4795-BC49-07DCA84E603F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Intel® Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel® Active Monitor\imonnt.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
Post #3 last edited
Here is my AVG log from today. Partition table (MBR),- OK -,Quick checked Boot sector of disk C:,- OK -,Quick checked System registry Software\Microsoft\Windows NT\CurrentVersion\Windows\Load,,Scanned System registry Software\Microsoft\Windows NT\CurrentVersion\Windows\Run,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\Run,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnceEx,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServices,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServicesOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\Run,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnceEx,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServices,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServicesOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\Winlogon\Userinit,,Scanned System registry SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell,,Scanned System registry exefile\shell\open\command,,Scanned System registry scrfile\shell\open\command,,Scanned System registry scrfile\shell\config\command,,Scanned System registry batfile\shell\open\command,,Scanned System registry cmdfile\shell\open\command,,Scanned System registry comfile\shell\open\command,,Scanned System registry piffile\shell\open\command,,Scanned System registry giffile\shell\open\command,,Scanned System registry htmlfile\shell\open\command,,Scanned System registry htafile\shell\open\command,,Scanned System registry jpegfile\shell\open\command,,Scanned System registry txtfile\shell\open\command,,Scanned System registry regfile\shell\open\command,,Scanned System registry cplfile\shell\cplopen\command,,Scanned System registry Word.Document.8\shell\open\command,,Scanned System registry WordPad.Document.1\shell\open\command,,Scanned System registry inffile\shell\open\command,,Scanned System registry vbsfile\shell\open\command,,Scanned System registry vbefile\shell\open\command,,Scanned C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe,- OK -,Quick checked C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe,- OK -,Quick checked C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE,- OK -,Quick checked C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe,- OK -,Quick checked C:\Program Files\Ahead\InCD\InCD.exe,- OK -,Quick checked C:\Program Files\Analog Devices\SoundMAX\SMax4.exe,- OK -,Quick checked C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe,- OK -,Quick checked C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe,- OK -,Quick checked C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe,- OK -,Quick checked C:\Program Files\Common Files\Real\Update_OB\realsched.exe,- OK -,Quick checked C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe,- OK -,Quick checked C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe,- OK -,Quick checked C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe,- OK -,Quick checked C:\Program Files\Intel\Intel® Active Monitor\imontray.exe,- OK -,Quick checked C:\Program Files\Internet Explorer\iexplore.exe,- OK -,Quick checked C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe,- OK -,Quick checked C:\Program Files\Logitech\Video\ISStart.exe,- OK -,Quick checked C:\Program Files\Logitech\Video\LogiTray.exe,- OK -,Quick checked C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE,- OK -,Quick checked C:\Program Files\QuickTime\qttask.exe,- OK -,Quick checked C:\Program Files\RFA\rfagent.exe,- OK -,Quick checked C:\Program Files\SpyStopper\SpyStopper.exe,- OK -,Quick checked C:\Program Files\TrojanHunter 4.5\THGuard.exe,- OK -,Quick checked C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe,- OK -,Quick checked C:\Program Files\ewido anti-spyware 4.0\ewido.exe,- OK -,Quick checked C:\Program Files\iTunes\iTunesHelper.exe,- OK -,Quick checked C:\WINDOWS\System32\hphmon03.exe,- OK -,Quick checked C:\WINDOWS\System32\mshta.exe,- OK -,Quick checked C:\WINDOWS\System32\shimgvw.dll,- OK -,Quick checked C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE,- OK -,Quick checked C:\WINDOWS\regedit.exe,- OK -,Quick checked C:\WINDOWS\system32\NeroCheck.exe,- OK -,Quick checked C:\WINDOWS\system32\bthprops.cpl,- OK -,Quick checked C:\WINDOWS\system32\rundll32.exe,- OK -,Quick checked C:\WINDOWS\system32\shell32.dll,- OK -,Quick checked C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe,- OK -,Quick checked C:\WINDOWS\system32\kernel32.dll,Change,Changed C:\WINDOWS\system32\wsock32.dll,- OK -,Quick checked C:\WINDOWS\system32\user32.dll,- OK -,Quick checked C:\WINDOWS\system32\shell32.dll,Change,Changed C:\WINDOWS\system32\ntoskrnl.exe,- OK -,Quick checked C:\WINDOWS\system32\drivers\etc\hosts,Reading error,Error C:\System Volume Information\_restore{61E36A40-5130-45D4-8E30-330535E15BC5}\RP6\A0000448.exe:\x\script.ini,Virus found IRC/BackDoor.Flood,"Infected, Embedded object" System registry Software\Microsoft\Windows NT\CurrentVersion\Windows\Load,,Scanned System registry Software\Microsoft\Windows NT\CurrentVersion\Windows\Run,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\Run,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnceEx,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServices,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServicesOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\Run,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunOnceEx,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServices,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\RunServicesOnce,,Scanned System registry Software\Microsoft\Windows\CurrentVersion\Winlogon\Userinit,,Scanned System registry SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell,,Scanned System registry exefile\shell\open\command,,Scanned System registry scrfile\shell\open\command,,Scanned System registry scrfile\shell\config\command,,Scanned System registry batfile\shell\open\command,,Scanned System registry cmdfile\shell\open\command,,Scanned System registry comfile\shell\open\command,,Scanned System registry piffile\shell\open\command,,Scanned System registry giffile\shell\open\command,,Scanned System registry htmlfile\shell\open\command,,Scanned System registry htafile\shell\open\command,,Scanned System registry jpegfile\shell\open\command,,Scanned System registry txtfile\shell\open\command,,Scanned System registry regfile\shell\open\command,,Scanned System registry cplfile\shell\cplopen\command,,Scanned System registry Word.Document.8\shell\open\command,,Scanned System registry WordPad.Document.1\shell\open\command,,Scanned System registry inffile\shell\open\command,,Scanned System registry vbsfile\shell\open\command,,Scanned System registry vbefile\shell\open\command,,Scanned C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe,- OK -,Quick checked C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe,- OK -,Quick checked C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE,- OK -,Quick checked C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe,- OK -,Quick checked C:\Program Files\Ahead\InCD\InCD.exe,- OK -,Quick checked C:\Program Files\Analog Devices\SoundMAX\SMax4.exe,- OK -,Quick checked C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe,- OK -,Quick checked C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe,- OK -,Quick checked C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe,- OK -,Quick checked C:\Program Files\Common Files\Real\Update_OB\realsched.exe,- OK -,Quick checked C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe,- OK -,Quick checked C:\Program Files\Hewlett-Packard\Toolbox\StatusClient\StatusClient.exe,- OK -,Quick checked C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe,- OK -,Quick checked C:\Program Files\Intel\Intel® Active Monitor\imontray.exe,- OK -,Quick checked C:\Program Files\Internet Explorer\iexplore.exe,- OK -,Quick checked C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe,- OK -,Quick checked C:\Program Files\Logitech\Video\ISStart.exe,- OK -,Quick checked C:\Program Files\Logitech\Video\LogiTray.exe,- OK -,Quick checked C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE,- OK -,Quick checked C:\Program Files\QuickTime\qttask.exe,- OK -,Quick checked C:\Program Files\RFA\rfagent.exe,- OK -,Quick checked C:\Program Files\SpyStopper\SpyStopper.exe,- OK -,Quick checked C:\Program Files\TrojanHunter 4.5\THGuard.exe,- OK -,Quick checked C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe,- OK -,Quick checked C:\Program Files\ewido anti-spyware 4.0\ewido.exe,- OK -,Quick checked C:\Program Files\iTunes\iTunesHelper.exe,- OK -,Quick checked C:\WINDOWS\System32\hphmon03.exe,- OK -,Quick checked C:\WINDOWS\System32\mshta.exe,- OK -,Quick checked C:\WINDOWS\System32\shimgvw.dll,- OK -,Quick checked C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE,- OK -,Quick checked C:\WINDOWS\regedit.exe,- OK -,Quick checked C:\WINDOWS\system32\NeroCheck.exe,- OK -,Quick checked C:\WINDOWS\system32\bthprops.cpl,- OK -,Quick checked C:\WINDOWS\system32\rundll32.exe,- OK -,Quick checked C:\WINDOWS\system32\shell32.dll,- OK -,Quick checked C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe,- OK -,Quick checked C:\System Volume Information\_restore{61E36A40-5130-45D4-8E30-330535E15BC5}\RP6\A0000448.exe,,"Moved to Vault, Archive"
Post #4
Go to:

Start –> All programs –> Accessories –> System Tools –> System Restore

Create a restore point.

Now, go to:

Start –> All programs –> Accessories –> System Tools –> Disk Cleanup

Select C:

Then select these only:

Temporary Internet Files

Recycle bin

Temporary Files

Click the "More Options" tab

At the bottom there's an option to cleanup System restore.

This cleans all but the latest restore point.

Click the "Cleanup" button.

OK any prompts and let it cleanup the selected items.

Reboot.

Scan again.
:)
Post #6
De nada
:wavey:

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI