What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] IE Defender help (Vista)

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hello…I am running Windows Vista..have Trend Micro Antivirus..installed and ran Spybot and AVG (contents of scan below). New HiJack This log also below. Please advise how to get this off of my computer. Thank you! Sue

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 10:44:29 AM 11/4/2007

+ Scan result:



C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@adbrite.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@anheuserbusch.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@brightcove.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@buycom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@cbs.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@clubmom.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@cnn.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@educationmanagementllc.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@ford.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@geosign.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@harpo.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@kelleybluebook.112.2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@livenation.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@metacafe.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@microsoftwlmailmkt.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@microsoftwlsearchcrm.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@msnportalbeetdriving.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@msnportalbeetoffice2007.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@nike.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@poweronemedia.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@realnetworks.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@serif.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@shopping.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@snapfish.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@sonycorporate.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@ticketsnow.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@viacomedycentralrl.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@viamtvnvideo.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Aavalue : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@adviva[1].txt -> TrackingCookie.Adviva : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@bluemountain[1].txt -> TrackingCookie.Bluemountain : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Bridgetrack : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Clickzs : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Coremetrics : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Dealtime : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Esomniture : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Euroclick : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@fortunecity[1].txt -> TrackingCookie.Fortunecity : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Information : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][4].txt -> TrackingCookie.Liveperson : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Masterstats : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Msn : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][2].txt -> TrackingCookie.Netflame : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Onestat : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Overture : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@real[1].txt -> TrackingCookie.Real : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Realtracker : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][3].txt -> TrackingCookie.Revsci : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed]-sys[1].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Valuead : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@web-stat[2].txt -> TrackingCookie.Web-stat : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@weborama[1].txt -> TrackingCookie.Weborama : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Webtrends : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\[removed][1].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Users\Hunt\AppData\Roaming\Microsoft\Windows\Cookies\Low\hunt@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.


::Report end
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:49 AM, on 11/4/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\kbd.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hewlett-Packard\HP Advisor\SSDK04.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\Windows\System32\XunLeiBHO_Now.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Trend Micro AntiVirus 2007] C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe -1 –delay 15
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O13 - Gopher Prefix:
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro AntiVirus Protection Service (tavsvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 8079 bytes
Post #2
Welcome to the forum.

Lets see if RVAXO gets it……….

1. Download RVAXO.exe to your desktop.

2. Double click on RVAXO.exe and choose unzip.
It will install to a folder called Rvaxo.

3. Now open up the Rvaxo folder and double click on RVAXO.cmd

You will see a small window pop up, and quickly some lines will run , then the window will close by itself, this is normal behavior.
Then it is possible for an uninstaller of some roque scanner to start up, do not close this but follow all prompts there, and let it run its course.

4. When it's done the computer will reboot…..press any key to reboot.

5. After reboot RVAXO will run again, let it finish

6. After it's done it will create a file called RVAXO-results.log in C:\RVAXO-results.log

7. Copy and paste it back here with a fresh HJT log.

MrC
Post #3
MrC… I keep trying to run this but in the black box that pops up it says Access is denied and then A duplicate file name exists or file cannot be found. I see folders of the same name that were created prior to today. Should I uninstall them and retry this because it doesn't seem to be doing anything. Thanks.
Post #4 last edited
Here's what to…

Use Uninstall.cmd to remove everything from RVAXO, it will be found in the RVAXO-folder on your desktop.

Then delete the RVAXO folder and the RVAXO.exe that you downloaded.

Download a fresh copy and try the procedure again.

If it doesn't want to run…stop and get back to me…we'll try a different way, MrC
Post #5
I'm sorry, but it's not letting me uninstall or do anything with this. I've tried everything I know (which isn't alot) and nothing's working with this file. Sue
Post #6
OK…Please do this using HJT….

————-

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..

Place a check against the following items if found:

O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\Windows\System32\XunLeiBHO_Now.dll

Click on Fix Checked and exit HijackThis.

——————

Delete this file if found:
C:\Windows\System32\XunLeiBHO_Now.dll

Reboot and post a fresh HJT log, MrC
Post #7
OK..I hope I did everything correctly. Here's the HJT logfile… Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:49 AM, on 11/4/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\kbd.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hewlett-Packard\HP Advisor\SSDK04.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\Windows\System32\XunLeiBHO_Now.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Trend Micro AntiVirus 2007] C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe -1 –delay 15
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O13 - Gopher Prefix:
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro AntiVirus Protection Service (tavsvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 8079 bytes
Post #8
No it's still there…Spybot may be stopping the fix though.

Please do this first:

Please disable TeaTimer and SDHelper by opening Spybot SD, click Mode>Advanced>and on the left menu choose Tools and then Resident. In the right hand pane you will see a check box for TeaTimer and for SDHelper . Please uncheck both boxes and then close Spybot. You can reinstate it later but we don't want it interfering with what we need to do. Reboot when done

——————-

After the reboot……..Please do this using HJT….

————-

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..

Place a check against the following items if found:

O2 - BHO: RealMedia - {0EEDB911-C5FA-486F-8334-57288578C627} - C:\Windows\System32\XunLeiBHO_Now.dll

Click on Fix Checked and exit HijackThis.

——————

Delete this file if found:
C:\Windows\System32\XunLeiBHO_Now.dll

Reboot and post a fresh HJT log, MrC
Post #9
OK..done. Here's the HJT log. So far I'm not seeing the pop-up anymore, but I still see the shortcut on my desktop and listed in my programs. Can I just right click and delete that? Thanks. Sue

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:12:27 PM, on 11/4/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\kbd.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Trend Micro AntiVirus 2007] C:\Program Files\Trend Micro\AntiVirus 2007\tavui.exe -1 –delay 15
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\tmlsp.dll
O13 - Gopher Prefix:
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Trend Micro AntiVirus Protection Service (tavsvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\tavsvc.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\AntiVirus 2007\Components\tmproxy.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

–
End of file - 7602 bytes
Post #10

OK..done. Here's the HJT log. So far I'm not seeing the pop-up anymore, but I still see the shortcut on my desktop and listed in my programs. Can I just right click and delete that? Thanks. Sue


Yes you can, if we could get RVAXO to work it would have taken care of all of that but I guess it doesn't like your computer. :(

If IE Defender is listed in your program files…please uninstall it and delete this folder if found:
C:\Program Files\IE Defender

————————–

Good Luck, MrC
Post #11
I uninstalled but it's still listed in program and features in the control panel where I uninstalled it but I can't find it in program files. It's no longer on my desktop either. I'm not seeing the pop-ups though so I guess it's not affecting anything. I want to thank you immensely for all your help. I don't know what I would do without this site to come to! Thanks again! Sue
Post #13
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI