What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] savetheinformation pop-ups

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello guys I am new here and really need your help. First of all, this is my first time at a forum like this with treads etc. so I may have some trouble with how this work. Second, I’m from Sweden and may also have some trouble with the language, spellings and the time factor. I hope things will work out fine anyway. However, I’ve studied some other simular cases on your forum that was resolved, (especially with LDTate) so now I’m sending my hope to you. For the past few days I have been getting constant pop-ups telling me I have spy-ware and should download their recommended software, Bestsellerantivirus. I also get pop-ups from savetheinformation.com, security warnings from spybot@MXt, trojan alerts, System Alert: Malware treaths etc etc. At the same time Live Safety Center and Online Security Guide appears as Icons on my desktop that look like legitimate security icons and that little annoying blinking yellow warning triangle down at the bar on the right. First I’ve scanned with Norton, Eset Nod32 and Lavasoft Ad-Aware without any satisfied result. Then I’ve downloaded and scanned with ATF Cleaner, Spybot and ATG Spy-ware . Fore a little while everything seamed to work out well but now “the stuff have hit the fan” again. Okay, the bottom line. Can you please help me? Wiremode
Post #2
Hi, and Welcome to What The Tech :)

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
As I am still training here, my posts to you will be checked by an Expert member. This will ensure that all advice and instructions I give you are accurate and safe. This may mean that my replies may take a little longer.


If you still need help:

Show all hidden files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
Please do not delete anything unless instructed to.


Please follow this link: HijackThis version 1.99.1 and click the Download HijackThis button. Click Save and save the file to your desktop.
Once the download is complete, double click the HJTsetup icon which should now be on your desktop. Click Next. Check that you are installing to C:\Program Files\Hijackthis, then click Next. Click Next again, then check the box that says Create a desktop icon and click Next, and then click Install to begin your installation, and then Finish.

Once HijackThis is open (double click the Hijackthis icon on your desktop if it doesn't open automatically) hit Do a System Scan and Save a Logfile and then copy and paste the log into a new reply, using the Add Reply button.


Then I will analyze your log and sort out a fix for you :)

Also please describe how your computer behaves at the moment.


jpshortstuff
Post #3
Hello jpshortstuff. Thank you for your reply. I'm at work for the moment and just red the reply. I will start all the suggested actions when I get home, later today. (I hardly can wait) Just got one question. I've seen that there is a later version of HiJackThis (2.0.0). Should I use the one you recommended or the later version? wiremode
Post #4
Although it does not matter too much, I would prefer if you went with the version I suggested (1.99.1) for now.

Thanks,

jpshortstuff
Post #5
Hi jpshortstuff.

My computer is running quite okey for the moment. No pop-ups or warning triangles i the desktop bar, so far. But I still think I need some help. The fake shield icons are still there, on the desktop. It seems like the problem/infection comes and goes from time to time. At one startup it's running smooth at the next it's a mess. Although I,ve got some warning messeges at startup about mmc.exe, MSN desktop serch, Logithec desktop manager, eg. These messeges and content also seems to vary from time to time. Now I have unistalld MSN Desktop Search and the logitech aplications.

For further info I can't start Lavasoft Ad-Aware (Aplication error: Exception EInvalidOp in module hiqyhryq.dll at 0000162A. Invalid floating point operation.) and I've got the same problem with Ad-Shield and Ashampoo Win Optimizer. I've unistalld Norton Internet Security 2007 and only running Nod 32 as virus program. Nod 32 seems to work well and gives me some intruder warnings at startup along with the info that it's been taken care of. AVG Anti-Spyware is also working without any troubble..

Finally, I've got my OS on G:\ but placed HiJackThis in C:\Program Files\Hijackthis as you told me.

OK. Here is my HiJackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 23:12:07, on 2007-10-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\CTHELPER.EXE
G:\Program\DAEMON Tools\daemon.exe
G:\Program\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
G:\Program\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
G:\Program\Java\jre1.5.0_11\bin\jusched.exe
G:\Program\Delade filer\Real\Update_OB\realsched.exe
G:\WINDOWS\system32\iid.exe
G:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
G:\Program\Eset\nod32kui.exe
G:\Program\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
G:\WINDOWS\system32\ctfmon.exe
G:\DOCUME~1\HENRIC~1\APPLIC~1\RACLE~1\mmc.exe
G:\Program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
G:\Program\Logitech\SetPoint\SetPoint.exe
G:\Program\Delade filer\Logitech\khalshared\KHALMNPR.EXE
G:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
G:\Program\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
G:\WINDOWS\ATKKBService.exe
G:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
G:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\Program\Bonjour\mDNSResponder.exe
G:\Program\WIDCOMM\Bluetooth-programvara\bin\btwdins.exe
G:\WINDOWS\system32\CTsvcCDA.exe
G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
G:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\Program\Nero\Nero8\Nero BackItUp\NBService.exe
G:\Program\Eset\nod32krn.exe
G:\Program\CyberLink\Shared files\RichVideo.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\MsPMSPSv.exe
G:\WINDOWS\System32\svchost.exe
G:\Program\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - G:\WINDOWS\system32\olhkuczp.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "G:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UpdReg] G:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SBDrvDet] G:\Program\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [CTSysVol] G:\Program\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] G:\Program\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "G:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Net iD] G:\WINDOWS\system32\iid.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "G:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] G:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NBKeyScan] "G:\Program\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "G:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] G:\Program\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [NI.UGA6P_0001_N119M1510] "G:\DOCUME~1\HENRIC~1\LOKALA~1\Temp\qrjatydi.exe"
O4 - HKLM\..\Run: [NI.UGA6P_0001_N120M1710] "G:\DOCUME~1\HENRIC~1\LOKALA~1\Temp\urclqecd.exe" -nag
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "G:\WINDOWS\system32\hjqyhryq.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "G:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Hpbb] "G:\DOCUME~1\HENRIC~1\APPLIC~1\RACLE~1\mmc.exe" –ru -vt yazb
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Program\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = G:\Program\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma.lnk = G:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = G:\Program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Skicka till &Bluetooth - G:\Program\WIDCOMM\Bluetooth-programvara\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program\WIDCOMM\Bluetooth-programvara\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program\WIDCOMM\Bluetooth-programvara\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: g:\program\bonjour\mdnsnsp.dll
O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - http://www.podb.se/podb/elev/arview2.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - G:\Program\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - G:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - G:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Unknown owner - G:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - G:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - G:\Program\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - G:\WINDOWS\ATKKBService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - G:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Automatisk LiveUpdate-schemaläggare - Symantec Corporation - G:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - G:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - G:\Program\WIDCOMM\Bluetooth-programvara\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - G:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - G:\Program\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - G:\Program\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - G:\Program\Delade filer\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - G:\Program\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - G:\Program\Delade filer\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Program\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - G:\Program\CyberLink\Shared files\RichVideo.exe

————————-
wiremode :wacko:
Post #6 last edited
Hi Wiremode

Please rename HijackThis.exe to scanner.exe and post a new log. This will reveal some new infections.

Also, I'd just like you to confirm that this is now the only place you are being helped? I noticed you had a thread at SpywareInfo that was closed, just want to make sure this is the only one left…


Thanks,

jpshortstuff
Post #7
Hi,again, jpshortstuff.

Opps! Just joking. I haven't unistalld Logitech Desktop Messenger after all.
By the way, other programs like e.g. Adobe Design Premium CS3 and MS Office is workin' well.
I don't know if this is relevant info but still…

wiremode :blush:
Post #10
Here is the log:

Logfile of HijackThis v1.99.1
Scan saved at 00:47:47, on 2007-10-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\Ati2evxx.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\CTHELPER.EXE
G:\Program\DAEMON Tools\daemon.exe
G:\Program\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
G:\Program\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
G:\Program\Java\jre1.5.0_11\bin\jusched.exe
G:\Program\Delade filer\Real\Update_OB\realsched.exe
G:\WINDOWS\system32\iid.exe
G:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
G:\Program\Eset\nod32kui.exe
G:\WINDOWS\system32\ctfmon.exe
G:\DOCUME~1\HENRIC~1\APPLIC~1\RACLE~1\mmc.exe
G:\Program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
G:\Program\Logitech\SetPoint\SetPoint.exe
G:\Program\Delade filer\Logitech\khalshared\KHALMNPR.EXE
G:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe
G:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
G:\Program\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
G:\WINDOWS\ATKKBService.exe
G:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
G:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
G:\Program\Bonjour\mDNSResponder.exe
G:\Program\WIDCOMM\Bluetooth-programvara\bin\btwdins.exe
G:\WINDOWS\system32\CTsvcCDA.exe
G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
G:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\Program\Nero\Nero8\Nero BackItUp\NBService.exe
G:\Program\Eset\nod32krn.exe
G:\Program\CyberLink\Shared files\RichVideo.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\system32\MsPMSPSv.exe
G:\WINDOWS\System32\svchost.exe
G:\Program\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe
G:\WINDOWS\system32\NOTEPAD.EXE
G:\Program\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HijackThis\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - G:\Program\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {559A1BF9-87C8-4348-854F-97B2E1DBF3F7} - G:\WINDOWS\system32\jkhhi.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - G:\WINDOWS\system32\cougortq.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - G:\WINDOWS\system32\olhkuczp.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - G:\WINDOWS\system32\olhkuczp.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "G:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UpdReg] G:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SBDrvDet] G:\Program\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [CTSysVol] G:\Program\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] G:\Program\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "G:\Program\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "G:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Net iD] G:\WINDOWS\system32\iid.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "G:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] G:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NBKeyScan] "G:\Program\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [nod32kui] "G:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "G:\Program\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] G:\Program\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [NI.UGA6P_0001_N119M1510] "G:\DOCUME~1\HENRIC~1\LOKALA~1\Temp\qrjatydi.exe"
O4 - HKLM\..\Run: [NI.UGA6P_0001_N120M1710] "G:\DOCUME~1\HENRIC~1\LOKALA~1\Temp\urclqecd.exe" -nag
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "G:\WINDOWS\system32\hjqyhryq.dll",sitypnow
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "G:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Hpbb] "G:\DOCUME~1\HENRIC~1\APPLIC~1\RACLE~1\mmc.exe" –ru -vt yazb
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Program\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = G:\Program\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma.lnk = G:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = G:\Program\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://G:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Skicka till &Bluetooth - G:\Program\WIDCOMM\Bluetooth-programvara\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program\WIDCOMM\Bluetooth-programvara\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - G:\Program\WIDCOMM\Bluetooth-programvara\btsendto_ie.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: g:\program\bonjour\mdnsnsp.dll
O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - http://www.podb.se/podb/elev/arview2.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - G:\Program\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ljjjheb - G:\WINDOWS\SYSTEM32\ljjjheb.dll
O20 - Winlogon Notify: olhkuczp - G:\WINDOWS\SYSTEM32\olhkuczp.dll
O20 - Winlogon Notify: WgaLogon - G:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - G:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - G:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - G:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS3 - Unknown owner - G:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe" -win32service (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - G:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AshampooDefragService - - G:\Program\Ashampoo\Ashampoo Magical Defrag\bin\aDefragService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - G:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - G:\WINDOWS\ATKKBService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - G:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Automatisk LiveUpdate-schemaläggare - Symantec Corporation - G:\Program\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - G:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - G:\Program\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - G:\Program\WIDCOMM\Bluetooth-programvara\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - G:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - G:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - G:\Program\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - G:\Program\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - G:\Program\Delade filer\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "G:\Program\Delade filer\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - G:\Program\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - G:\Program\Delade filer\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Program\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - G:\Program\CyberLink\Shared files\RichVideo.exe

wiremode
Post #11
Hi wiremode


You need to disable TeaTimer, so that it doesn't interfere with our fix.
  • Run Spybot-S&D
  • Go to the Mode menu, and make sure "Advanced Mode" is selected
  • On the left hand side, choose Tools -> Resident
  • Uncheck "Resident TeaTimer" and OK any prompts.
Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HijackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.


Thanks,

jpshortstuff
Post #14
Hi

It's in swedish but I'll try to translate. It's someting like this:

Spyboot S&D run to a problem and have to shut down.
Describe the error for MS etc. etc.

wiremode

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI