[Resolved] delete / fix O2BHO / O3Toolbar (nofile) ?

Hello,

my LOG show this entrys:
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) > google ?
O2 - BHO: (no name) - {CE000992-A58C-4441-8938-744CD72AB27F} - (no file) > verisign
O3 - Toolbar: (no name) - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file) > GDATA
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTSInstall…/info_rb3d.html

My question is: can I delete / fix this ?
I dont have google-, GDATA-toolbar or something from verisign(?) installed.
I dont know what the last entry is ? MS MediaPlayer ect. ?

Thanks for help.

Hi It would be better if you posted the full log for my quick perusal but yes they can all go.

The last entry is an Active X component from Viewpoint, makers of some dubious Media components. You only gave me the running processes of the HijackThis log. If you require assistance, post the whole log, and if not, let me know and close this topic.

You only gave me the running processes of the HijackThis log. If you require assistance, post the whole log, and if not, let me know and close this topic.

Sorry, the rest was in ignore list, here is what i exported from the registry:

R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157"
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896"
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896"
R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157"
R1 - HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,ProxyOverride = localhost"
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\\Programme\\Skype\\Toolbars\\Internet Explorer\\SkypeIEPlugin.dll"
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\\Programme\\Windows Desktop Search\\dsWebAllow.dll"
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\\Programme\\Java\\jre1.6.0_02\\bin\\ssv.dll"
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\\Programme\\Windows Live Toolbar\\msntb.dll"
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\\Programme\\Windows Live Toolbar\\msntb.dll"
O4 - HKLM\\..\\Run: [NVRTCLK] C:\\WINDOWS\\system32\\NVRTCLK\\NVRTClk.exe"
O4 - HKLM\\..\\Run: [NvCplDaemon] RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
O4 - HKLM\\..\\Run: [nwiz] nwiz.exe /install"
O4 - HKLM\\..\\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit"
O4 - HKLM\\..\\Run: [Dimension4] C:\\Programme\\Netz\\D4\\D4.exe"
O4 - HKLM\\..\\Run: [AVMWlanClient] C:\\Programme\\avmwlanstick\\wlangui.exe"
O4 - HKLM\\..\\Run: [TrueImageMonitor.exe] C:\\Programme\\System\\Acronis\\TrueImage\\TrueImageMonitor.exe"
O4 - HKLM\\..\\Run: [Acronis Scheduler2 Service] \"C:\\Programme\\Gemeinsame Dateien\\Acronis\\Schedule2\\schedhlp.exe\""
O4 - HKLM\\..\\Run: [LogitechQuickCamRibbon] \"C:\\Programme\\Logitech\\QuickCam10\\QuickCam10.exe\" /hide"
O4 - HKLM\\..\\Run: [LogitechCommunicationsManager] \"C:\\Programme\\Gemeinsame Dateien\\LogiShrd\\LComMgr\\Communications_Helper.exe\""
O4 - HKLM\\..\\Run: [TVBroadcast] C:\\Programme\\Media\\Bonavista\\Services\\ODSBC\\ODSBCApp.exe"
O4 - HKLM\\..\\Run: [Windows Defender] \"C:\\Programme\\System\\WinDefender\\MSASCui.exe\" -hide"
O4 - HKCU\\..\\Run: [TTP9Mixer] \"C:\\Programme\\TerraTec\\Aureon ControlPanel\\AureonSMixer.exe\" /minimize"
O4 - Startup: AUTOstart.lnk = E:\\Benutzer\\Matthias\\Batch\\AUTOstart.bat"
O4 - Global Startup: Logitech SetPoint.lnk = C:\\Programme\\Logitech\\SetPoint\\SetPoint.exe"
O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel present"
O8 - Extra context menu item: &Windows Live Search - res://C:\\Programme\\Windows Live Toolbar\\msntb.dll/search.htm"
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx"
O8 - Extra context menu item: In 1&&1 SoftPhone wählen - C:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\1&1\\1&1 SoftPhone\\ContextMenuHandler.html"
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\\PROGRA~1\\MICROS~3\\Office10\\EXCEL.EXE/3000"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Programme\\Java\\jre1.6.0_02\\bin\\ssv.dll"
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Programme\\Java\\jre1.6.0_02\\bin\\ssv.dll"
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\\Programme\\Skype\\Toolbars\\Internet Explorer\\SkypeIEPlugin.dll"
O9 - Extra button: KeePasser - {C8C06F74-3F06-44a3-BD56-75C39C44973F} - C:\\Programme\\Tools\\KeePass\\KeyPasser\\keepasser.htm"
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\\Network Diagnostic\\xpnetdiag.exe (file missing)"
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\\Network Diagnostic\\xpnetdiag.exe (file missing)"
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Programme\\Messenger\\msmsgs.exe"
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Programme\\Messenger\\msmsgs.exe"
O11 - Options group: [INTERNATIONAL] International*"
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) - "
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{12CEF1D3-3D0B-4D47-AE05-7A8221601BF3}: NameServer = 192.168.170.1"
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{1AEECAEF-0719-4BB5-AB8D-C0709438F374}: NameServer = 212.19.48.14"
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{A00B0813-47EE-4D31-B50E-ADCB85CD54E1}: NameServer = 192.168.170.1"
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{FAF1DEDE-8DFB-49C4-B742-46843E7C4277}: NameServer = 192.168.178.254"
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\\Programme\\Logitech\\Desktop Messenger\\8876480\\Program\\GAPlugProtocol-8876480.dll"
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\\Programme\\Gemeinsame Dateien\\Microsoft Shared\\Help\\hxds.dll"
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\\PROGRA~1\\GEMEIN~1\\Skype\\SKYPE4~1.DLL"
O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - C:\\WINDOWS\\Downloaded Program Files\\mimectl.dll"
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\\WINDOWS\\system32\\WPDShServiceObj.dll"
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\\Programme\\Gemeinsame Dateien\\Acronis\\Schedule2\\schedul2.exe"
O23 - Service: AVM IGD CTRL Service - AVM Berlin - C:\\Programme\\Netz\\FRITZ!DSL\\IGDCTRL.EXE"
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\\Programme\\avmwlanstick\\WlanNetService.exe"
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - C:\\Programme\\Gemeinsame Dateien\\AVM\\de_serv.exe"
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\\Programme\\Gemeinsame Dateien\\InstallShield\\Driver\\1050\\Intel 32\\IDriverT.exe"
O23 - Service: LVCOMSer - Logitech Inc. - C:\\Programme\\Gemeinsame Dateien\\LogiShrd\\LVCOMSER\\LVComSer.exe"
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\\Programme\\Gemeinsame Dateien\\LogiShrd\\LVMVFM\\LVPrcSrv.exe"
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\\Programme\\Gemeinsame Dateien\\LogiShrd\\SrvLnch\\SrvLnch.exe"
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\\Programme\\Microsoft SQL Server\\MSSQL.1\\MSSQL\\Binn\\sqlservr.exe\" -sSQLEXPRESS (file missing)"
O23 - Service: NoIPDUCService - Vitalwerks LLC - C:\\Programme\\Netz\\No-IP_Updater\\DUC20.exe"
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\\WINDOWS\\system32\\nvsvc32.exe"
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\\Programme\\System\\Sandboxie\\SbieSvc.exe"
O23 - Service: Sceneo PVR Service (srvcPVR) - Buhl Data Service GmbH - C:\\Programme\\Media\\Bonavista\\Services\\PVR\\PVRService.exe"
O23 - Service: Steganos VPN Starter Service (SVPNStarter) - Unknown owner - C:\\Programme\\Netz\\SteganosVPN\\SVPNStarter.exe"
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\\Programme\\Gemeinsame Dateien\\Ulead Systems\\DVD\\ULCDRSvr.exe"
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\\Programme\\Netz\\VNC\\WinVNC4.exe\" -service (file missing)"
O4 - HKLM\\..\\Run: [TotalRecorderScheduler] \"C:\\Programme\\Media\\TotalRec\\TotRecSched.exe\""
O10 - Unknown file in Winsock LSP: c:\\programme\\netz\\fritz!dsl\\sarah.dll"
O10 - Unknown file in Winsock LSP: c:\\programme\\netz\\fritz!dsl\\sarah.dll"
O10 - Unknown file in Winsock LSP: c:\\programme\\netz\\fritz!dsl\\sarah.dll"
O10 - Unknown file in Winsock LSP: c:\\programme\\netz\\fritz!dsl\\sarah.dll"
O10 - Unknown file in Winsock LSP: c:\\programme\\netz\\fritz!dsl\\sarah.dll"
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - "
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - (no file)"
O4 - HKLM\\..\\Run: [AVKTray] C:\\Programme\\System\\GDATA-IS2008\\AVKTray\\AVKTray.exe"
O4 - Startup: SwissVPN.lnk = ?"
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\\Programme\\Gemeinsame Dateien\\G DATA\\AVKProxy\\AVKProxy.exe"
O23 - Service: AVK Service (AVKService) - G DATA Software AG - C:\\Programme\\System\\GDATA-IS2008\\AVK\\AVKService.exe"
O23 - Service: AVK Wächter (AVKWCtl) - G DATA Software AG - C:\\Programme\\System\\GDATA-IS2008\\AVK\\AVKWCtl.exe"
O23 - Service: XPSMAZQSORW - Sysinternals - www.sysinternals.com - E:\\temp\\XPSMAZQSORW.exe"
O17 - HKLM\\System\\CCS\\Services\\Tcpip\\..\\{C7D6FEE6-02B6-45B8-B00B-07E18A87AD56}: NameServer = 80.254.79.157 80.254.77.39"
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\\Programme\\Java\\jre1.6.0_03\\bin\\ssv.dll"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Programme\\Java\\jre1.6.0_03\\bin\\ssv.dll"
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\\Programme\\Java\\jre1.6.0_03\\bin\\ssv.dll"

I have already fixed the 4 items now.
Thanks for your help.

Hi

The 06 is worth a query. Three reasons why it might be present..

# You set the restrictions on purpose.
# You used an anti-spyware program like Spybot S&D's Home Page and Option Lock down features in the Immunize section of Spybot.
# Your workplace administrator or network administrator set the restrictions.

If you answer no to any of the above, fix the line.

O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel present"

Are you having any problems, as your log looks clean?

The 06 is worth a query. Three reasons why it might be present..
# You set the restrictions on purpose.
# You used an anti-spyware program like Spybot S&D's Home Page and Option Lock down features in the Immunize section of Spybot.
# Your workplace administrator or network administrator set the restrictions.
If you answer no to any of the above, fix the line.
O6 - HKCU\\Software\\Policies\\Microsoft\\Internet Explorer\\Control Panel present"

I set IE to run as "Standard User" in lokal security / software.

Are you having any problems, as your log looks clean?

I have no problems at this time. I only want to get some information about the 4 logs in my first post.

P.S. offtopic: I dont get any email-notifications from this forum ? Do you ?

Hi

Yes I do. Up at the top of the page, you will see a tab called My Controls. A new window will open and in the left pane you will see email settings.

Well I hope Ive cleared things up for you. Some kindly advice first.

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

• Close any programmes you may have running, ESPECIALLY your web browser
• Click Start > Control Panel.
• Click Add/Remove Programs.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove all versions of Java.
• Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u3, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

Here are some free programs I recommend, although you will not need them all.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here


Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"


Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Up at the top of the page, you will see a tab called My Controls. A new window will open and in the left pane you will see email settings.

Of course I have already set this options, my email-address is correct, the spam filter is off - but I dont get any emails …

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

• Close any programmes you may have running, ESPECIALLY your web browser
• Click Start > Control Panel.
• Click Add/Remove Programs.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove all versions of Java.
• Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u3, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file.

I have already the latest version of java installed. Are older versions of java a security risk or why did you post this ?

Here are some free programs I recommend, although you will not need them all.
Spybot Search and Destroy
Install Spyware Guard
Install SpyWare Blaster
Install WinPatrol
Make sure your Windows is ALWAYS up to date!Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Installed: AdAware, Spybot, GDATA Antivirus, WindowsDefender, RootkitRevealer. Windows is up to date.

Hi

Post here about the no emails.
http://forums.whatthetech.com/Comments_Suggestions_f11.html

Java is now at 6u3. The updates are released because of security vulnerabilities. Your HJT log is showing 6u2.

ok. Thanks for help.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.