What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Stud.a (adware.stud.a), Kbdusr32.dll, Raddrv.dll

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello!

I`d be very happy if someone could check my HijackThis-Logfile.

First Spybot couldn`t remove "Stud.A" Adware. Now it finally worked fine
but I`m curious now if there could be something left …

Apart from that I have a different problem occurring with bitdefender.
It gives me the spyware-alert for "r_server.exe" and "raddrv.dll" (both in system32) which
I think belong to the application "Remote Administrator (short: Radmin)
which is installed on my system but momentary not started as a service.

Well, about the first issue I got first notice from bitdefender too
alerting "kbdusr32.dll" in system32 as a adware-threat (Adware.Stud.A).
That made me run Spybot and Adaware.
Ccleaner`s Reg-Scan found an ActiveX/Com problem with "InProcServer32" (system32\kbdusr32.dll)
- no wonder , bitdefender quarantined the fiel before.
I didn`t delete it so far - could still remove it from bitdefenders Quarantine.


So, as I said it would be very nice if someone`s got the time
to look over my logfile.

regards ringen00



HijachThis Logfile :






Logfile of HijackThis v1.99.1
Scan saved at 10:45:52, on 27.08.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\TCMMOU~1\MouseDrv.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Compaq\EAB\EABSERVR.EXE
C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Programme\WDC\SetIcon.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Programme\z2 Remote2PC\R2PCSH.exe
C:\Programme\Softwin\BitDefender10\bdmcon.exe
C:\Programme\Softwin\BitDefender10\bdagent.exe
C:\Programme\MSGTAG\MSGTAG.exe
C:\Programme\Microsoft ActiveSync\wcescomm.exe
C:\Programme\Shelltoys\Access Folders\afolders.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Programme\ANYCOM\Blue USB-200-250\bin\btwdins.exe
C:\WINDOWS\system32\gearsec.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\CAPRPCSK.EXE
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\Programme\ANYCOM\Blue USB-200-250\BTTray.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\JetToolBar\JetTB.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Programme\Express ClickYes\ClickYes.exe
C:\Programme\XPwinExit\TrayExit3.exe
C:\PROGRA~1\ANYCOM\BLUEUS~1\BTSTAC~1.EXE
C:\Programme\UPHClean\uphclean.exe
C:\Programme\UltraVNC\WinVNC.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender

Communicator\xcommsvr.exe
C:\Programme\z2 Remote2PC\R2PCServ.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update

Service\livesrv.exe
C:\Programme\DynDNS Updater\DynDNS.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programme\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Programme\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Programme\FireTrust\MailWasher Pro\MailWasher.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan

Server\bdss.exe
C:\Programme\Softwin\BitDefender10\vsserv.exe
C:\Programme\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.ringe-saito.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL

= http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://search.presario.net/scripts/redirec…/srchredir2.dll?

c=1c02&lc=0407&s=search&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =

about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,AutoConfigURL = file://C:\Programme\WinSweep\ws.js
O1 - Hosts: 66.199.231.171 astalavista.com
O1 - Hosts: 66.199.231.171 www.astalavista.com
O1 - Hosts: 66.199.231.171 astalavista.box.sk
O1 - Hosts: 66.199.231.171 www.astalavista.box.sk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-

784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0

\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2E048050-65BB-8B28-9062-FAFBCA5B5B32} - (no file)
O2 - BHO: (no name) - {38FA0A1A-BD4E-4843-8055-8E70A8086369} -

C:\WINDOWS\system32\kbdusr32.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6747781e-d68c-420e-a8ce-590484cd5d9d} - (no file)
O2 - BHO: WebSpeechBHO Class - {83A30C59-3A50-49E6-9DAF-

4923C4EA3C23} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0

\LgxIEBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-

CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-

CE66B5AD205D} -

C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: D-Info - {CB736FF0-1D72-11D6-BF3C-005056303009} -

C:\Programme\D\D-Info\dinfoband.dll
O3 - Toolbar: &WINSWEEP Toolbar - {E915E62E-41DA-40D0-8106-

3438B4D24394} - C:\Programme\WinSweep\SurfBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -

c:\programme\google\googletoolbar3.dll
O4 - HKLM\..\Run: [TCMMouse ] C:\PROGRA~1\TCMMOU~1

\MouseDrv.exe
O4 - HKLM\..\Run: [SynTPLpr]

C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh]

C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32

\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32

\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32

\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1

\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [eabconfg.cpl]

C:\Programme\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2

Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [Seticons] "\Programme\WDC\SetIcon.exe"
O4 - HKLM\..\Run: [WD Button Manager] "WDBtnMgr.exe"
O4 - HKLM\..\Run: [SystemTray] %windir%\system32\systray.exe
O4 - HKLM\..\Run: [z2 R2PC Server Helper] "C:\Programme\z2

Remote2PC\R2PCSH.exe"
O4 - HKLM\..\Run: [WinVNC] "C:\Programme\UltraVNC\WinVNC.exe" -

servicehelper
O4 - HKLM\..\Run: [BDMCon] "C:\Programme\Softwin\BitDefender10

\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Programme\Softwin\BitDefender10

\bdagent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSGTAG] "C:\Programme\MSGTAG\MSGTAG.exe"

/startup
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft

ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Access Folders] C:\Programme\Shelltoys\Access

Folders\afolders.exe
O4 - HKCU\..\Run: [swg]

C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Active Desktop Calendar]

C:\Programme\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - Startup: Camsplitter.lnk.disabled
O4 - Startup: ClickYes.lnk = C:\Programme\Express ClickYes\ClickYes.exe
O4 - Startup: Mp3tag Quick Pick.lnk.disabled
O4 - Startup: XPwinExit.LNK = C:\Programme\XPwinExit\TrayExit3.exe
O4 - Global Startup: Acrobat Assistant.lnk.disabled
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: IP Monitor.lnk.disabled
O4 - Global Startup: jetToolBar.lnk = C:\Programme\JetToolBar\JetTB.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Schnellstart.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: Server4PC.lnk.disabled
O4 - Global Startup: Sunnysoft Backup Manager.lnk.disabled
O4 - Global Startup: UltimateZip Quick Start.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions

present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel

present
O8 - Extra context menu item: Advanced Email Extractor -

res://C:\Programme\Advanced%20Email%20Extractor%

20PRO\AeePMsie.dll/page.html
O8 - Extra context menu item: Druid: Download All Files -

C:\Programme\XemiComputers\Download Druid\Druid.html
O8 - Extra context menu item: Druid: Download Highlighted Files -

C:\Programme\XemiComputers\Download Druid\DruidHighLighted.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: pdaConverter - C:\Programme\pdaConverter

1.3\convert_url.htm
O8 - Extra context menu item: Scan link with AEE -

res://C:\Programme\Advanced%20Email%20Extractor%

20PRO\AeePMsie.dll/link.html
O8 - Extra context menu item: Senden an &Bluetooth -

C:\Programme\ANYCOM\Blue USB-200-250\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5

-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-

AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0

\LgxIEBar.dll
O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) -

{1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame

Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra button: BINGOOO - {2067FDE0-415A-43F4-B136-3E6A29C1A571} -

C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-

00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -

C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen… - {2EAF5BB2-070F-

11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: D-Info - {5baf1db0-1d34-11d6-bf3c-005056303009} -

C:\Programme\D\D-Info\dinfoband.dll
O9 - Extra 'Tools' menuitem: D-Info - {5baf1db0-1d34-11d6-bf3c-

005056303009} - C:\Programme\D\D-Info\dinfoband.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-

3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Druid Bar - {A6B25D86-CB76-44C1-8E35-328EE8F4BEF0} -

C:\Programme\XemiComputers\Download Druid\DruidBar.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-

5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-200-250

\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-

5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-200-250

\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

(no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %

windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7

-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144

- {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: Email Extractor - {AFA7DB99-3E4D-4396-94F8-

B0B135BCB472} - res://C:\Programme\Advanced%20Email%20Extractor%

20PRO\AeePMsie.dll/page.html (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Advanced Email Extractor - {AFA7DB99-3E4D-

4396-94F8-B0B135BCB472} - res://C:\Programme\Advanced%20Email%

20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://cgi5.ebay.de
O15 - Trusted Zone: http://www.ebay.de
O15 - Trusted Zone: http://www.freenet.de
O15 - Trusted Zone: http://www.richi-juggler.de
O15 - Trusted Zone: http://de.srichinmoy.org
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control)

- http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine

Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} -

http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep)

- https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl

Class) -

http://update.microsoft.com/windowsupdate/…x86/client/wuwe

b_site.cab?1120143816389
O16 - DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} (PlayerOCX Control) -

http://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-

Kontrolle) -

http://a840.g.akamai.net/7/840/537/2004061…dmicro.com/hous

ecall/xscan53.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader

Control) -

http://asp08.photoprintit.de/microsite/111…ageUploader3.ca

b
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} -

http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F4BDAA9-2840-4B1F-9148

-B1FCBD4EF47F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{70A7792B-E626-4717-9643-

9FF20E3CC02E}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis -

C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner -

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner -

C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan

Server\bdss.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. -

C:\Programme\ANYCOM\Blue USB-200-250\bin\btwdins.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent

(CpqDfwWebAgent) - Compaq Computer Corporation -

C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana

Solution - C:\Programme\DynDNS Updater\DynDNS.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project -

C:\Programme\FileZilla Server\FileZilla Server.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32

\gearsec.exe
O23 - Service: GoogleDesktopManager - Google -

C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google -

C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation

- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32

\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Nero\Nero

7\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -

C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown

owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update

Service\livesrv.exe" /service (file missing)
O23 - Service: OTi Card Reader Service - Unknown owner -

C:\Programme\CardReader2.0\OTiReader.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development

Corporation - C:\Programme\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect Helper - Dantz Development Corporation -

C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development

Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) -

Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%

ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Administrator Service (r_server) - Unknown owner -

C:\WINDOWS\system32\r_server.exe" /service (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) -

Analog Devices, Inc. - C:\Programme\Analog

Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division

Software - C:\Programme\Alcohol Soft\Alcohol 120

\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) -

TuneUp Software GmbH - C:\Programme\TuneUp Utilities 2004

\WinStylerThemeSvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner -

C:\Programme\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner -

C:\Programme\UltraVNC\WinVNC.exe" -service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner -

C:\Programme\Gemeinsame Dateien\Softwin\BitDefender

Communicator\xcommsvr.exe" /service (file missing)
O23 - Service: z2 Remote2PC Server (z2 R2PC Server) - Unknown owner -

C:\Programme\z2 Remote2PC\R2PCServ.exe" -service (file missing)



End of logfile.
Post #2
Hello and welcome to the forum

Open Note Pad, Click Format and uncheck Word Wrap.


Please follow the steps below exactly in the order they are written:

Step #1

1. Please download ATF Cleaner by Atribune.


2. Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

If you are unable to run scan with AVG Anti-Spyware in Safe Mode, Click the next link http://fileserver.ewido.net/public.cgi?id=20990 and download AVG_Anti-Spyware_7.5.1.36_Safe_Mode_Registry_Patch.reg to your desktop. It should look like this -> [external image: Posted Image] double click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
Answer "Yes" and wait for a message to appear similar to "Merged Successfully".

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      [external image: Posted Image]
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
Post #3
Hi LDTate! thanks so far for your reply and your instructions to resolve my problems! Just it`s like I am not really sure what kinda problem I`m having so I would start to do the action. It would be kind of you to give me a hint that I`d be able to improve the performance of my machine. Please don`t get me wrong. What does your recommended action have to do with the description I entered in my first post? I mean, is there spyware on my machine? Or is your action just for making sure that it isn`t? By the way I getting afraid that if I should catch that easily spyware on my device that it would happen next time the same. Although Spybot and Adaware installed. regards Nik
Post #4

Just it`s like I am not really sure
what kinda problem I`m having so I would
start to do the action.

It will be hard to help you if you can't tell me the problem you're having.

The fix I posted will remove temporary files that aren't needed that will slow the computer down.

You also posted you had adware / spyware on your PC. Not all infections are visible. The AVG scan will tell us if you still have infections.
Post #5
Hi LDTate! First of all thanks very much for your help !! I did what you said and in fact - AVG AntiSpyware could find a couple more threats. Now, I didn`t delete one of them because: They all were from apps which I installed by myself. I think almost everything which is only half interesting for me it "detected" as a threat for me - only vnc-server wasn`t curious. Well I am not sure but I have a pretty good feeling why Spybot and Adaware do not detect those files. So , there were lots of tracking coockies (spybot found them too) two low and two high threats. Both, the low and the high threats I am using since about 5 years now. I don`t feel I should start panic now :-) ATF-Cleaner is really nice - first cleaner for me which includes Opera. Let me know what you think: -some files which definetely belong to "Radmin" -kbdusr32.dll which is a part of an activeX/Com thing which is not working anyway - think I can get rid of this -revelation.exe -PantsOffHk.dll -star_syn_client.dll think that alcohol 120 wouldn`t work without it -ijl15.dll in my Winamp folder - no I won`t touch this - last one patch I need for running 4music I think that AVG since they are selling AntiVirus-products is far too sensible in determining what is spyware and what not. By the way the programfolder needs more than 20 MB of space . . . and the best is it produces a contextmenuentry which is only good for opening the app not scanning the accessed file - you cannot get rid of it in the programs settings! Well, not your fault :-) Tell me how you`d behave in my case and thanks a lot so far! regards Nik
Post #7
that`s easyly done . . .


Logfile of HijackThis v1.99.1
Scan saved at 13:10:27, on 05.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Programme\ANYCOM\Blue USB-200-250\bin\btwdins.exe
C:\WINDOWS\system32\gearsec.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Dantz\Retrospect\retrorun.exe
C:\WINDOWS\system32\CAPRPCSK.EXE
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\Programme\z2 Remote2PC\R2PCSH.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\UPHClean\uphclean.exe
C:\Programme\UltraVNC\WinVNC.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\z2 Remote2PC\R2PCServ.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe
C:\PROGRA~1\TCMMOU~1\MouseDrv.exe
C:\Programme\DynDNS Updater\DynDNS.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\WDC\SetIcon.exe
C:\Programme\Compaq\EAB\EABSERVR.EXE
C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Programme\Softwin\BitDefender10\bdmcon.exe
C:\Programme\Softwin\BitDefender10\bdagent.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\MSGTAG\MSGTAG.exe
C:\Programme\Microsoft ActiveSync\wcescomm.exe
C:\Programme\XemiComputers\Active Desktop Calendar\ADC.exe
C:\Programme\Shelltoys\Access Folders\afolders.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Programme\ANYCOM\Blue USB-200-250\BTTray.exe
C:\Programme\JetToolBar\JetTB.exe
C:\Programme\Express ClickYes\ClickYes.exe
C:\PROGRA~1\ANYCOM\BLUEUS~1\BTSTAC~1.EXE
C:\Programme\phonostar\ps_radio.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Programme\phonostar\ps_agent.exe
C:\Programme\phonostar\ps_olect.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\Programme\Softwin\BitDefender10\vsserv.exe
C:\Programme\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ringe-saito.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirec…rch&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\Programme\WinSweep\no-ads.pac
O1 - Hosts: 66.199.231.171 astalavista.com
O1 - Hosts: 66.199.231.171 www.astalavista.com
O1 - Hosts: 66.199.231.171 astalavista.box.sk
O1 - Hosts: 66.199.231.171 www.astalavista.box.sk
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WebSpeechBHO Class - {83A30C59-3A50-49E6-9DAF-4923C4EA3C23} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: D-Info - {CB736FF0-1D72-11D6-BF3C-005056303009} - C:\Programme\D\D-Info\dinfoband.dll
O3 - Toolbar: &WINSWEEP Toolbar - {E915E62E-41DA-40D0-8106-3438B4D24394} - C:\Programme\WinSweep\SurfBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [z2 R2PC Server Helper] "C:\Programme\z2 Remote2PC\R2PCSH.exe"
O4 - HKLM\..\Run: [WinVNC] "C:\Programme\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [WD Button Manager] "WDBtnMgr.exe"
O4 - HKLM\..\Run: [TCMMouse ] C:\PROGRA~1\TCMMOU~1\MouseDrv.exe
O4 - HKLM\..\Run: [SystemTray] %windir%\system32\systray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Seticons] "\Programme\WDC\SetIcon.exe"
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programme\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Programme\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Programme\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSGTAG] "C:\Programme\MSGTAG\MSGTAG.exe" /startup
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Programme\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [Access Folders] C:\Programme\Shelltoys\Access Folders\afolders.exe
O4 - Startup: Camsplitter.lnk.disabled
O4 - Startup: ClickYes.lnk = C:\Programme\Express ClickYes\ClickYes.exe
O4 - Startup: Mp3tag Quick Pick.lnk.disabled
O4 - Global Startup: Acrobat Assistant.lnk.disabled
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk.disabled
O4 - Global Startup: Adobe Reader Synchronizer.lnk.disabled
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: IP Monitor.lnk.disabled
O4 - Global Startup: jetToolBar.lnk = C:\Programme\JetToolBar\JetTB.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Schnellstart.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: Server4PC.lnk.disabled
O4 - Global Startup: Sunnysoft Backup Manager.lnk.disabled
O4 - Global Startup: UltimateZip Quick Start.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Advanced Email Extractor - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Druid: Download All Files - C:\Programme\XemiComputers\Download Druid\Druid.html
O8 - Extra context menu item: Druid: Download Highlighted Files - C:\Programme\XemiComputers\Download Druid\DruidHighLighted.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: pdaConverter - C:\Programme\pdaConverter 1.3\convert_url.htm
O8 - Extra context menu item: Scan link with AEE - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/link.html
O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\ANYCOM\Blue USB-200-250\btsendto_ie_ctx.htm
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra button: BINGOOO - {2067FDE0-415A-43F4-B136-3E6A29C1A571} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: D-Info - {5baf1db0-1d34-11d6-bf3c-005056303009} - C:\Programme\D\D-Info\dinfoband.dll
O9 - Extra 'Tools' menuitem: D-Info - {5baf1db0-1d34-11d6-bf3c-005056303009} - C:\Programme\D\D-Info\dinfoband.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Druid Bar - {A6B25D86-CB76-44C1-8E35-328EE8F4BEF0} - C:\Programme\XemiComputers\Download Druid\DruidBar.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-200-250\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-200-250\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Advanced Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://cgi5.ebay.de
O15 - Trusted Zone: http://www.ebay.de
O15 - Trusted Zone: http://www.freenet.de
O15 - Trusted Zone: http://www.richi-juggler.de
O15 - Trusted Zone: http://de.srichinmoy.org
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120143816389
O16 - DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} (PlayerOCX Control) - http://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp08.photoprintit.de/microsite/111…geUploader3.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F4BDAA9-2840-4B1F-9148-B1FCBD4EF47F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{70A7792B-E626-4717-9643-9FF20E3CC02E}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\ANYCOM\Blue USB-200-250\bin\btwdins.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Programme\DynDNS Updater\DynDNS.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Programme\FileZilla Server\FileZilla Server.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: OTi Card Reader Service - Unknown owner - C:\Programme\CardReader2.0\OTiReader.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Programme\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programme\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programme\UltraVNC\WinVNC.exe" -service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
O23 - Service: z2 Remote2PC Server (z2 R2PC Server) - Unknown owner - C:\Programme\z2 Remote2PC\R2PCServ.exe" -service (file missing)
Post #9
Astalavista must be one of these cracksearch-sites. I don`t know to which place these "hosts" belong. I only know that spybot and spyware-blaster do put lots of it in the "forbidden hosts - lis" in e.g. IE. So if they belong to this list it`s ok, but otherwise . . . let me know regards Nik
Post #10
I don't like them. If they showed something like: 127.0.0.1, I'd say OK.

I don't like the trusted zones either. That's like giving out Administrator rights.

Please download HostsXpert from the link below.

http://www.funkytoad.com/download/HostsXpert.zip

Unzip HostsXpert.zip
Open HostsXpert.exe.

you have to click: ''make hosts writable'' in the top right corner, then press the ''restore'' option

Close program when complete.


Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

O15 - Trusted Zone: http://cgi5.ebay.de
O15 - Trusted Zone: http://www.ebay.de
O15 - Trusted Zone: http://www.freenet.de
O15 - Trusted Zone: http://www.richi-juggler.de
O15 - Trusted Zone: http://de.srichinmoy.org

Close ALL windows and browsers except HijackThis and click "Fix checked"


Reboot and "copy/paste" a new HijackThis log file into this thread.
Post #11 last edited
Ok, here it is!


Logfile of HijackThis v1.99.1
Scan saved at 19:27:35, on 08.09.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\ANYCOM\Blue USB-200-250\bin\btwdins.exe
C:\WINDOWS\system32\gearsec.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\CAPRPCSK.EXE
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\UPHClean\uphclean.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Programme\UltraVNC\WinVNC.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\z2 Remote2PC\R2PCServ.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe
C:\Programme\DynDNS Updater\DynDNS.exe
C:\Programme\z2 Remote2PC\R2PCSH.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\PROGRA~1\TCMMOU~1\MouseDrv.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\WDC\SetIcon.exe
C:\Programme\Compaq\EAB\EABSERVR.EXE
C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Programme\Softwin\BitDefender10\bdmcon.exe
C:\Programme\Softwin\BitDefender10\bdagent.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programme\MSGTAG\MSGTAG.exe
C:\Programme\XemiComputers\Active Desktop Calendar\ADC.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Programme\Shelltoys\Access Folders\afolders.exe
C:\Programme\ANYCOM\Blue USB-200-250\BTTray.exe
C:\Programme\Express ClickYes\ClickYes.exe
C:\PROGRA~1\ANYCOM\BLUEUS~1\BTSTAC~1.EXE
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\JetToolBar\JetTB.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Microsoft ActiveSync\wcescomm.exe
C:\Programme\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Programme\WinSweep\winjam.exe
C:\Programme\WinSweep\WSProxy.Exe
C:\Programme\Message-Bob\Message-Bob.exe
c:\programme\multires\multires.exe
C:\Programme\TuneUp Utilities 2007\MemOptimizer.exe
C:\Programme\stickies\stickies.exe
C:\Programme\AnalogX\Atomic TimeSync\ats.exe
C:\Programme\Quicknote\Quicknote.exe
C:\Programme\BWMeter\crack\BWMeter.exe
C:\Programme\DeskClock\DeskClock.exe
C:\Programme\KeyCounter\keycounter.exe
C:\Programme\TitleTime\TiTime.exe
C:\Programme\XPwinExit\TrayExit3.exe
C:\Programme\TitleTime\TiTimeDD.exe
C:\Programme\DeskTask\DeskTask.exe
C:\Programme\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\mmc.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\Programme\Softwin\BitDefender10\vsserv.exe
C:\Programme\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ringe-saito.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirec…rch&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = file://C:\Programme\WinSweep\no-ads.pac
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: WebSpeechBHO Class - {83A30C59-3A50-49E6-9DAF-4923C4EA3C23} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar3.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: D-Info - {CB736FF0-1D72-11D6-BF3C-005056303009} - C:\Programme\D\D-Info\dinfoband.dll
O3 - Toolbar: &WINSWEEP Toolbar - {E915E62E-41DA-40D0-8106-3438B4D24394} - C:\Programme\WinSweep\SurfBar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [z2 R2PC Server Helper] "C:\Programme\z2 Remote2PC\R2PCSH.exe"
O4 - HKLM\..\Run: [WinVNC] "C:\Programme\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [WD Button Manager] "WDBtnMgr.exe"
O4 - HKLM\..\Run: [TCMMouse ] C:\PROGRA~1\TCMMOU~1\MouseDrv.exe
O4 - HKLM\..\Run: [SystemTray] %windir%\system32\systray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Seticons] "\Programme\WDC\SetIcon.exe"
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programme\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Programme\Softwin\BitDefender10\bdagent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSGTAG] "C:\Programme\MSGTAG\MSGTAG.exe" /startup
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Programme\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [Access Folders] C:\Programme\Shelltoys\Access Folders\afolders.exe
O4 - HKCU\..\Run: [WINJAM - Konfiguration] C:\Programme\WinSweep\WSPopup.exe /STEP1 /SOUND
O4 - Startup: Camsplitter.lnk.disabled
O4 - Startup: ClickYes.lnk = C:\Programme\Express ClickYes\ClickYes.exe
O4 - Startup: Mp3tag Quick Pick.lnk.disabled
O4 - Startup: XPwinExit.LNK = C:\Programme\XPwinExit\TrayExit3.exe
O4 - Global Startup: Acrobat Assistant.lnk.disabled
O4 - Global Startup: Adobe Acrobat - Schnellstart.lnk.disabled
O4 - Global Startup: Adobe Reader Synchronizer.lnk.disabled
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: IP Monitor.lnk.disabled
O4 - Global Startup: jetToolBar.lnk = C:\Programme\JetToolBar\JetTB.exe
O4 - Global Startup: Microsoft Office OneNote 2003 Schnellstart.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: Server4PC.lnk.disabled
O4 - Global Startup: Sunnysoft Backup Manager.lnk.disabled
O4 - Global Startup: UltimateZip Quick Start.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Advanced Email Extractor - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Druid: Download All Files - C:\Programme\XemiComputers\Download Druid\Druid.html
O8 - Extra context menu item: Druid: Download Highlighted Files - C:\Programme\XemiComputers\Download Druid\DruidHighLighted.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: pdaConverter - C:\Programme\pdaConverter 1.3\convert_url.htm
O8 - Extra context menu item: Scan link with AEE - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/link.html
O8 - Extra context menu item: Senden an &Bluetooth - C:\Programme\ANYCOM\Blue USB-200-250\btsendto_ie_ctx.htm
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll
O9 - Extra button: BINGOOO - {2067FDE0-415A-43F4-B136-3E6A29C1A571} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: D-Info - {5baf1db0-1d34-11d6-bf3c-005056303009} - C:\Programme\D\D-Info\dinfoband.dll
O9 - Extra 'Tools' menuitem: D-Info - {5baf1db0-1d34-11d6-bf3c-005056303009} - C:\Programme\D\D-Info\dinfoband.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Druid Bar - {A6B25D86-CB76-44C1-8E35-328EE8F4BEF0} - C:\Programme\XemiComputers\Download Druid\DruidBar.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-200-250\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\ANYCOM\Blue USB-200-250\btsendto_ie.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Advanced Email Extractor - {AFA7DB99-3E4D-4396-94F8-B0B135BCB472} - res://C:\Programme\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1120143816389
O16 - DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} (PlayerOCX Control) - http://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp08.photoprintit.de/microsite/111…geUploader3.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F4BDAA9-2840-4B1F-9148-B1FCBD4EF47F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{70A7792B-E626-4717-9643-9FF20E3CC02E}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\ANYCOM\Blue USB-200-250\bin\btwdins.exe
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
O23 - Service: DynDNS Updater Service (DynDNS_Updater_Service) - Kana Solution - C:\Programme\DynDNS Updater\DynDNS.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Programme\FileZilla Server\FileZilla Server.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: gearsec - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: GoogleDesktopManager - Google - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: OTi Card Reader Service - Unknown owner - C:\Programme\CardReader2.0\OTiReader.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Programme\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\rthlpsvc.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programme\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programme\UltraVNC\WinVNC.exe" -service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
O23 - Service: z2 Remote2PC Server (z2 R2PC Server) - Unknown owner - C:\Programme\z2 Remote2PC\R2PCServ.exe" -service (file missing)

Hope this time it`s ok.
I deleted the "astalavista"-stuff via Spybot "Hostlist" and the trusted zones with
HijackThis.
Is it recommended to use WinJam and Spybot at the same time?
They both write something in the hostslist if it is the same - I don`t know!
What do you think?

Did "astalavista" hijack my hostslist, or what happened there?
The trusted zones entries I did myself once.

In HostsXpert there I have entries with 0.0.0.0 instead of 127.0.0.1 .
What do they mean?
The ones with localhost are from Spybot (it says "end of spybot entries" in the end).
Is it possible that tey come from WinJam?

regrds
Nik
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI