What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Multiple Trojans/Virtumonde files detected.

197 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-05-18 32768]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-02-22 921600]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-10-07 13574144]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-10-07 86016]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-07-22 C:\WINDOWS\KHALMNPR.Exe]
"nwiz"="nwiz.exe" [2008-10-07 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2004-11-03 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3IV2"= 3ivxVfWCodec.dll
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^KDE.BLACKBOX^Start Menu^Programs^Startup^Last.fm Helper.lnk]
path=C:\Documents and Settings\KDE.BLACKBOX\Start Menu\Programs\Startup\Last.fm Helper.lnk
backup=C:\WINDOWS\pss\Last.fm Helper.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 21:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI DeviceDetect]
–a—— 2004-09-22 23:16 69707 C:\Program Files\ATI Multimedia\main\atidtct.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Launchpad]
–a—— 2004-09-22 23:20 106573 C:\Program Files\ATI Multimedia\main\LaunchPd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATI Remote Control]
–a—— 2004-07-08 11:49 196608 C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
–a—— 2004-11-03 23:21 32768 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
–a—— 2006-10-26 23:47 31016 C:\!E DRIVE BACKUP\!PROGS\MS Office 2007 COMPLETE\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
–a—— 2004-11-02 22:24 32768 C:\!E DRIVE BACKUP\!PROGS\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSC_UserPrompt]
–a—— 2004-11-02 16:59 218240 C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wextract_cleanup0]
–a—— 2008-04-13 18:11 99840 C:\WINDOWS\system32\advpack.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2008-10-07 13:33 1630208 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"SPBBCSvc"=3 (0x3)
"SNDSrvc"=3 (0x3)
"SAVScan"=3 (0x3)
"NSCService"=3 (0x3)
"navapsvc"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccProxy"=2 (0x2)
"ccISPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"Symantec Core LC"=2 (0x2)
"StarWindService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\!E DRIVE BACKUP\\!PROGS\\Soulseek\\slsk.exe"=
"C:\\Games\\WoW\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=
"C:\\Games\\WoW\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.12.6546-enUS-downloader.exe"=
"C:\\Games\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Games\\Tiger Woods PGA Tour 06\\bin\\TW2006.exe"=
"C:\\Games\\Halo\\halo.exe"=
"C:\\Games\\Hellgate London\\Launcher.exe"=
"C:\\!E DRIVE BACKUP\\!PROGS\\MS Office 2007 COMPLETE\\Office12\\OUTLOOK.EXE"=
"C:\\!E DRIVE BACKUP\\!PROGS\\MS Office 2007 COMPLETE\\Office12\\GROOVE.EXE"=
"C:\\!E DRIVE BACKUP\\!PROGS\\MS Office 2007 COMPLETE\\Office12\\ONENOTE.EXE"=
"C:\\Games\\Star Wars-KoToR II\\swupdate.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\!E DRIVE BACKUP\\!PROGS\\utorrent\\utorrent.exe"=
"C:\\!E DRIVE BACKUP\\!PROGS\\Logitec G5 software\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Games\\Assassin's Creed [Director's Cut]\\AssassinsCreed_Dx9.exe"=
"C:\\Games\\Assassin's Creed [Director's Cut]\\AssassinsCreed_Dx10.exe"=
"C:\\Games\\Assassin's Creed [Director's Cut]\\AssassinsCreed_Launcher.exe"=
"C:\\Games\\Call of Duty 4\\iw3mp.exe"=
"C:\\!E DRIVE BACKUP\\!PROGS\\Firefox\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-27 152984]
S0 Spssys;Toshiba SPS Service;C:\WINDOWS\system32\drivers\spssys.sys [ ]
S3 ALLOW-IO;ALLOW-IO;D:\ALLOW-IO.sys [ ]
S3 StreamSurge;StreamSurge Driver (miniport);C:\WINDOWS\system32\DRIVERS\ss.sys [2005-06-17 19968]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5656aec2-3268-11dc-9c67-0016e65a2efa}]
\Shell\AutoRun\command - F:\LaunchU3.exe

*Newly Created Service* - COMHOST
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-03 19:46:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-03 19:48:47
ComboFix-quarantined-files.txt 2008-11-04 01:48:44
ComboFix2.txt 2008-11-02 18:22:37
ComboFix3.txt 2008-11-01 20:12:06

Pre-Run: 84,648,902,656 bytes free
Post-Run: 84,675,514,368 bytes free

9760 — E O F — 2008-11-03 14:20:18


Sorry about all those posts, it was too big for one post for some reason.. I'll have the HIjackThis one next.
Post #17
Logfile of HijackThis v1.99.1
Scan saved at 9:18:20 PM, on 11/3/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\SetPoint\SetPoint.exe
C:\!E DRIVE BACKUP\!PROGS\Process Explorer\procexp.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRAM FILES\JAVA\JRE6\BIN\JUSCHED.EXE
C:\WINDOWS\explorer.exe
C:\!E DRIVE BACKUP\!PROGS\Firefox\Mozilla Firefox\firefox.exe
C:\!E DRIVE BACKUP\!PROGS\bsplayer\bsplayer.exe
C:\!E DRIVE BACKUP\!PROGS\HijackThis\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [LDM] C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Keyboard.lnk = C:\WINDOWS\system32\main.cpl
O4 - Global Startup: Logitec Keyboard&Mouse.lnk = C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\SetPoint\SetPoint.exe
O4 - Global Startup: Shortcut to procexp.exe.lnk = C:\!E DRIVE BACKUP\!PROGS\Process Explorer\procexp.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1156037714468
O18 - Protocol: bw+0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: offline-8876480 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Norton Internet Security\comHost.exe (file missing)
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)



There you have it. I've noticed that I no longer get random browser popups, which is good. My pc still seems to be a bit on the sluggish side as opposed to what I'm used to, but other than that I haven't seen any other abnormal activity as of late. Let me know if there is anything more that needs to be done, and I'll do it. ( :
Post #18
Hi there.

Please locate and delete this file:
C:\WINDOWS\pl.exe

Logs are looking better. I've never used ESET, is there any way you can create a log of what it finds, e.g. run a scan and look for "Create logfile" options? Alternatively, just make a note of where the files it is detecting are. I think it is quite likely that it is picking up the backups ComboFix made, but it would nice to be sure.

You are using ESET AntiVirus, yet you have Symantec installed on your computer. Is there any reason for this? It may be a good idea to consider removing Norton/Symantec from your system if you are no longer using it.

Please post a new HijackThis log. Any remaining problems other than the slow computer?

Thanks.
Post #19
Hey JP, I'm running the scan from NOD32 as we speak, and I will post it here once it is finished. I had Symantec's Norton AV before I switched to NOD32. Norton still shows up in my Add/Remove Progs, and I've been trying for years to delete the folder/uninstall it but I can't get rid of it. It is not actively running. I did a search for that file using the search option within Windows, and was able to successfully delete pl.exe, which was recognized as a virus by NOD32 instantly when I searched for it. If you know of a way I can get rid of Norton I'd love to hear some suggestions. Every time I go to uninstall it from the Control Panel>Add/Remove Programs the screen freezes up and it doesn't do a thing.
Post #20
Here are both my NOD32 Log and HJT:

NOD32(This was just the On-Demand Scanner, not the In depth analysis):
Scanning Log
NOD32 version 3580 (20081103) NT
Checking CRC of NOD32.EXE: Status OK
Operating memory is OK.
Date: 5.11.2008 Time: 18:05:19
Scanned disks, folders and files: C:
C:\pagefile.sys - error opening (File locked) [4]
C:\Documents and Settings\KDE.BLACKBOX\ntuser.dat - error opening (File locked) [4]
C:\Documents and Settings\KDE.BLACKBOX\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\KDE.BLACKBOX\Application Data\Mozilla\Firefox\Profiles\6d41so2s.default\parent.lock - error opening (File locked) [4]
C:\Documents and Settings\KDE.BLACKBOX\Application Data\Mozilla\Firefox\Profiles\6d41so2s.default\places.sqlite-journal - error opening (File locked) [4]
C:\Documents and Settings\KDE.BLACKBOX\Application Data\SecuROM\UserData\???????????p????????? - error opening [4]
C:\Documents and Settings\KDE.BLACKBOX\Application Data\SecuROM\UserData\???????????p????????? - error opening [4]
C:\Documents and Settings\KDE.BLACKBOX\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\KDE.BLACKBOX\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\KDE.BLACKBOX\Local Settings\Temp\etilqs_BUJddxFUYwhBdwNefIhC - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\ntuser.dat - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\ntuser.dat.LOG - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - error opening (File locked) [4]
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - error opening (File locked) [4]
C:\found.000\dir0000.chk\KDE\Application Data\SecuROM\UserData\???????????p????????? - error opening [4]
C:\found.000\dir0000.chk\KDE\Application Data\SecuROM\UserData\???????????p????????? - error opening [4]
C:\System Volume Information\MountPointManagerRemoteDatabase - error opening (Access denied) [4]
C:\WINDOWS\system32\config\default - error opening (File locked) [4]
C:\WINDOWS\system32\config\default.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\SAM - error opening (File locked) [4]
C:\WINDOWS\system32\config\SAM.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\SECURITY - error opening (File locked) [4]
C:\WINDOWS\system32\config\SECURITY.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\software - error opening (File locked) [4]
C:\WINDOWS\system32\config\software.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\config\system - error opening (File locked) [4]
C:\WINDOWS\system32\config\system.LOG - error opening (File locked) [4]
C:\WINDOWS\system32\drivers\sptd.sys - error opening (File locked) [4]
Number of scanned files: 196361
Number of threats found: 0
Time of completion: 18:48:03 Total scanning time: 2564 sec (00:42:44)
Notes:
[4] File cannot be opened. It may be in use by another application or operating system.

—————————————————————————————————————————
Logfile of HijackThis v1.99.1
Scan saved at 6:49:00 PM, on 11/5/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\SetPoint\SetPoint.exe
C:\!E DRIVE BACKUP\!PROGS\Process Explorer\procexp.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRAM FILES\JAVA\JRE6\BIN\JUSCHED.EXE
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\!E DRIVE BACKUP\!PROGS\Foobar2000\foobar2000.exe
C:\!E DRIVE BACKUP\!PROGS\Trillian Pro\trillian.exe
C:\!E DRIVE BACKUP\!PROGS\Firefox\Mozilla Firefox\firefox.exe
C:\!E DRIVE BACKUP\!PROGS\HijackThis\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [LDM] C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Keyboard.lnk = C:\WINDOWS\system32\main.cpl
O4 - Global Startup: Logitec Keyboard&Mouse.lnk = C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\SetPoint\SetPoint.exe
O4 - Global Startup: Shortcut to procexp.exe.lnk = C:\!E DRIVE BACKUP\!PROGS\Process Explorer\procexp.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1156037714468
O18 - Protocol: bw+0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: offline-8876480 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: COM Host (comHost) - Unknown owner - C:\Program Files\Norton Internet Security\comHost.exe (file missing)
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #21
Hi :)

I think I must have just the thing for you.

Norton Removal Tool
  • Download the Norton Removal Tool and save it to your Desktop.
  • Close and applications and browsers that you may have open.
  • Double-click the Norton Removal Tool on your Desktop.
  • Follow the on-screen instructions, and reboot if and when necessary.

You don't appear to be running any third party Firewall software.

Install a firewall! Without a firewall you are very susceptible to being hacked, and people could gain access to your computer. If you don't have a firewall I strongly recommend you download ONE of the following:
1) Comodo
2) Agnitum
3) Sunbelt/Kerio

Reboot after all this, post a new HijacThis log. How are we running now, any more problems?

Thanks.
Post #22
Thanks again thus far JP for the help. I really appreciate the link to that Norton Removal Tool. It did the trick! Regarding the third party firewall, I've never personally found a need to use one, but as a person that is well versed in computer security, is the Windows firewall itself not enough? I am going to download one of these and use it, however, if it is unneeded and the OS firewall is sufficient let me know. ( : Let me know what you think of the logs once you've had a chance to review them.
Post #23
Hi :) Are you using a Router to connect to the internet? A router has a hardware Firewall built in, and so this combined with Windows Firewall is generally enough to keep you secure. If you aren't using a Router at all (or any sort of Hardware Firewall) then I would recommend a third party Firewall. Windows Firewall is better than nothing, but it isn't as comprehensive as the others. Hope that helps a bit with your decision. Please post a new HijackThis log and we'll see if we can't wrap this up :thumbup: Thanks.
Post #24
I see, I didn't even think about that. Very wise advice on your part, I appreciate that. Anyhow, here is the HJT log per your request:


Logfile of HijackThis v1.99.1
Scan saved at 6:47:04 PM, on 11/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\SetPoint\SetPoint.exe
C:\!E DRIVE BACKUP\!PROGS\Process Explorer\procexp.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRAM FILES\JAVA\JRE6\BIN\JUSCHED.EXE
C:\!E DRIVE BACKUP\!PROGS\Foobar2000\foobar2000.exe
C:\!E DRIVE BACKUP\!PROGS\Trillian Pro\trillian.exe
C:\!E DRIVE BACKUP\!PROGS\Firefox\Mozilla Firefox\firefox.exe
C:\!E DRIVE BACKUP\!PROGS\HijackThis\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe /waitservice
O4 - HKLM\..\Run: [OutpostFeedBack] C:\PROGRA~1\Agnitum\OUTPOS~1.0\feedback.exe /dump:os_startup
O4 - HKCU\..\Run: [LDM] C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Keyboard.lnk = C:\WINDOWS\system32\main.cpl
O4 - Global Startup: Logitec Keyboard&Mouse.lnk = C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\SetPoint\SetPoint.exe
O4 - Global Startup: Shortcut to procexp.exe.lnk = C:\!E DRIVE BACKUP\!PROGS\Process Explorer\procexp.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\ONBttnIE.dll
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\PROGRA~1\Agnitum\OUTPOS~1.0\Plugins\BrowserBar\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1156037714468
O18 - Protocol: bw+0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\!EDRIV~1\!PROGS\MSOFFI~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: offline-8876480 - {CC603FE8-2B7F-446B-9595-B010715E609B} - C:\!E DRIVE BACKUP\!PROGS\Logitec G5 software\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Agnitum\OUTPOS~1.0\wl_hook.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Outpost Firewall Service (OutpostFirewall) - Agnitum - C:\PROGRA~1\Agnitum\OUTPOS~1.0\outpost.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
Post #25
Hi m0tive

You can fix this item in HJT:
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

Log looks good :thumbup:

Click Start >> Run, and then type ComboFix /u and hit enter.
You can now delete any other tools I had you download and use, unless you wish to keep them.


Now that your system appears to be clean, theres just a few steps I'd like you to take to prevent any future infections.
  • Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis.

  • Make sure you update your Anti-Virus software regularly, new viruses are being developed all the time.

  • Some more programs that it would be useful to have [OPTIONAL but RECOMMENDED]:

    Download Spybot Search and Destroy 1.5 from here
    Check for Updates/ Immunize and run a Full System Scan on a regular basis.

    SpywareBlaster is another real-time scanner that prevents most spyware from even being installed.
    Freely available: Download SpywareBlaster

    Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.
Also, please read this great article by Tony Klein: So How Did I Get Infected In First Place

Glad we could be of assistance.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Stay Clean!

jpshortstuff
Post #26
It appears that way to me as well, JP. Thank you again for all your help and advice through all this. Should I ever encounter another problem, WhatTheTech will be the first place I will come back to. ( :
Post #27
Glad I could help :) I hope that you won't have the need to use our Malware removal services again, but if you do, then we will be more than happy to help. Have fun :thumbup:
Post #28
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI