Messenger Block Checker Removal - Suggest A Fix PC Support Forums

Messenger Block Checker Removal, Is this program malicious?

Ref	Aug 22 2005, 01:23 PM Post #1
Group: Members Posts: 72 Joined: 4-June 05 Member No.: 10,671	Hi all My son clicked on an advert for something called block checker while in MSN Messenger. It automatically loaded without asking and it does not appear in the Add/remove programs so I can't remove it by the usual methods. I've found a folder c:\Program files\Block Checker which has two applications in it - one called block-checker and one called csrss. I've removed Messenger from the PC but that has done nothing. All in all it has the look and feel of spyware to me but i've no way of removing it (spybot and adware don't seem to be able to find it). Here is my HijackThis - have I got a problem? If so, can you tell me how to fix it please? Thanks in advance Ref Logfile of HijackThis v1.99.1 Scan saved at 20:58:09, on 22/08/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Sophos\Remote Update\cachemgr.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\dla\tfswctrl.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\Voyager100Test\fts.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\System32\gsicon.exe C:\WINDOWS\System32\dslagent.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Block Checker\block-checker.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\explorer.exe C:\Program Files\Sophos\Remote Update\imonitor.exe C:\WINDOWS\System32\wisptis.exe C:\Program Files\Sophos SWEEP for XP\SWEEPSRV.SYS C:\Program Files\Sophos SWEEP for XP\SWNETSUP.EXE C:\Program Files\Sophos SWEEP for XP\ICMON.EXE C:\Program Files\AOL 9.0\waol.exe C:\Program Files\AOL 9.0\shellmon.exe C:\Program Files\Common Files\AOL\aoltpspd.exe c:\Program Files\Microsoft Money\System\urlmap.exe C:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk6.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ihnqq.dll/sp.html#28129 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ihnqq.dll/sp.html#28129 R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] c:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Voyager100Test\fts.exe" O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [WinTimer] "C:\WINDOWS\system32\msupdate.cmd" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\quicktime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [waol.exe] C:\Program Files\AOL 9.0\waol.exe O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center7903\Program\BackWeb-137903.exe O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for XP\ICMON.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Remote Update Monitor.lnk = C:\Program Files\Sophos\Remote Update\imonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrc...kr.cab31267.cab O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} - http://17.sharedsource.org/html/NrsgroupUD...D_1.0.0.3ie.cab? O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computerchec...kup/qdiagcc.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - https://mysupport.nai.com/amiuptodate/bin/1...pdatePortal.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntr...ro.cab32846.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Banks...ot.cab31267.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zylom...gamesplayer.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game13.zylomgames.com/activex/zylomloader.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.com/games/popcaploader_v6.cab O16 - DPF: {E154E3CC-0C3A-4101-91D8-6B4876F0FD64} (PrintScreen Class) - http://www.mydisplayimage.com/create/Flash2Image.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess...ss.cab31267.cab O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{885DFB3A-18DF-4181-BD1A-6FB852B27C85}: NameServer = 205.188.146.145 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\aolserv.exe O23 - Service: Sophos Cache Manager (CacheMgr) - SOPHOS Plc - C:\Program Files\Sophos\Remote Update\cachemgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for XP\SWNETSUP.EXE O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for XP\SWEEPSRV.SYS

HKEd

Aug 22 2005, 06:52 PM

Post #2

Carbon-Based Life Form

Group: Administrator
Posts: 12,098
Joined: 9-August 01
From: Hong Kong
Member No.: 192

Hi Ref...first thing to do is click on 'Tools' > 'Internet Options' > Advanced tab in IE and uncheck both instances of 'Enable Install on Demand' if it's not already set to that. Click on 'Apply' and OK. At least that will prompt you when something tries to install itself without your knowledge or consent.

To fix this, you'll need to know how to boot to safe mode. Use either of the methods detailed here to get there.

You'll also need to make all files and folders visible as per these instructions:

QUOTE

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Click Yes to confirm.
* Click OK.

Close all open windows and run a HijackThis scan. Put checks in the boxes next to these lines:

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ihnqq.dll/sp.html#28129

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ihnqq.dll/sp.html#28129

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [WinTimer] "C:\WINDOWS\system32\msupdate.cmd"

O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe

Click on 'Fix checked'.

Boot to safe mode and make all files and folders visible.

Locate and delete these:

C:\WINDOWS\ihnqq.dll

C:\WINDOWS\system32\msupdate.cmd

C:\Program Files\Block Checker << Folder

Run a full system scan with Spybot/AdAware. Run Disk Cleanup to empty temp and temp internet files folders.

Post back with a fresh HijackThis log from normal mode and let us know how you got on.

--------------------

If I've helped you, please pass it on and help someone else.

SPAM is not tolerated here. New members posting SPAM will be banned with no warning.

Ref	Aug 23 2005, 02:19 PM Post #3
Group: Members Posts: 72 Joined: 4-June 05 Member No.: 10,671	Hi Many thanks for the reply. I followed the instructions you gave. Only difference is that I could not find the two files you suggested I delete (C:\WINDOWS\ihnqq.dll and C:\WINDOW\system32\msupdate.cmd) either in the folders you suggested or by doing a full search. The Spybot scan found nothing while Adware found a tracking cookie (though I was not using the latest adware files as the download kept failing at 5% complete) Here is the new Hijack This log. Grateful for any further advice you can provide. Ref Logfile of HijackThis v1.99.1 Scan saved at 22:08:34, on 23/08/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Sophos\Remote Update\cachemgr.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sophos SWEEP for XP\SWNETSUP.EXE C:\Program Files\Sophos SWEEP for XP\SWEEPSRV.SYS C:\WINDOWS\Explorer.EXE C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Common Files\AOL\ACS\AOLDial.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe C:\Program Files\Voyager100Test\fts.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\WINDOWS\System32\gsicon.exe C:\WINDOWS\System32\dslagent.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Sophos SWEEP for XP\ICMON.EXE C:\Program Files\Sophos\Remote Update\imonitor.exe C:\Program Files\SpywareGuard\sgmain.exe c:\Program Files\Microsoft Money\System\urlmap.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\WINDOWS\System32\wuauclt.exe C:\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk6.hpwis.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] c:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe" O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\Voyager100Test\fts.exe" O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\quicktime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [waol.exe] C:\Program Files\AOL 9.0\waol.exe O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe" O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe O4 - Global Startup: hp center.lnk = C:\Program Files\hp center7903\Program\BackWeb-137903.exe O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for XP\ICMON.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Remote Update Monitor.lnk = C:\Program Files\Sophos\Remote Update\imonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrc...kr.cab31267.cab O16 - DPF: {12E5E9D9-4366-45D9-BA41-D0BCD55AD8CF} - http://17.sharedsource.org/html/NrsgroupUD...D_1.0.0.3ie.cab? O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computerchec...kup/qdiagcc.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - https://mysupport.nai.com/amiuptodate/bin/1...pdatePortal.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse...pdownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntr...ro.cab32846.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Banks...ot.cab31267.cab O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game13.zylomgames.com/activex/zylom...gamesplayer.cab O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game13.zylomgames.com/activex/zylomloader.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://utu.popcap.com/games/popcaploader_v6.cab O16 - DPF: {E154E3CC-0C3A-4101-91D8-6B4876F0FD64} (PrintScreen Class) - http://www.mydisplayimage.com/create/Flash2Image.cab O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess...ss.cab31267.cab O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\aolserv.exe O23 - Service: Sophos Cache Manager (CacheMgr) - SOPHOS Plc - C:\Program Files\Sophos\Remote Update\cachemgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for XP\SWNETSUP.EXE O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for XP\SWEEPSRV.SYS

HKEd

Aug 23 2005, 06:41 PM

Post #4

Carbon-Based Life Form

Group: Administrator
Posts: 12,098
Joined: 9-August 01
From: Hong Kong
Member No.: 192

The log looks clean now, Ref. Are there any problems? If so, download SilentRunners.vbs to the desktop and run it from there. If Sophos protests at running a VBS file, just allow it to run. Wait a couple of minutes until the full log is generated (you may see the log, but it is being written to constantly while SilentRunners exports items from the registry to it).

QUOTE

Grateful for any further advice you can provide.

You have a lot of unnecessary programs running at startup. I'd use Msconfig to disable the startups for these programs:

[UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

[Microsoft Works Update Detection] c:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[%FP%Friendly fts.exe] "C:\Program Files\Voyager100Test\fts.exe"

[mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe

[TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe

[QuickTime Task] "C:\program files\quicktime\qttask.exe" -atboottime

[iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

[MoneyAgent] "c:\Program Files\Microsoft Money\System\Money Express.exe"

[Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe

hp center.lnk = C:\Program Files\hp center7903\Program\BackWeb-137903.exe

Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

They're all available as needed. No need for them to be running all the time.

If you need help with using Msconfig, just let us know.

BTW, the Real Update startup will re-enable itself once Real Player is opened. You may have to disable it within Real itself, or even rename the update file.

--------------------

If I've helped you, please pass it on and help someone else.

SPAM is not tolerated here. New members posting SPAM will be banned with no warning.

Ref	Aug 24 2005, 11:29 AM Post #5
Group: Members Posts: 72 Joined: 4-June 05 Member No.: 10,671	I've unchecked all of those you suggested in the startup tab of msconfig and rebooted. A window appeared asking if I wanted to revert to the normal startup so I checked the box which says 'Do not show me this at startup and do not change my startup configuration' (or something like that). Let me know if I should have done something different. I do still have one weird thing happening at startup (and has been for a little while now). An empty folder called AOL opens up and just sits there. I close it and continue as normal. It doesn't seem to do anything and is more of an irritant than anything else. I contacted AOL who clearly didn't have a clue and said I need to uninstall and reinstall AOL and I just haven't got round to it yet. Would silentrunners help with that? Otherwise I'm OK - thanks very much for your help. Ref

HKEd	Aug 24 2005, 07:49 PM Post #6
Carbon-Based Life Form Group: Administrator Posts: 12,098 Joined: 9-August 01 From: Hong Kong Member No.: 192	Hi Ref...yes, it's normal for Msconfig to remind you you've made changes. Putting the check in the box will stop it from reminding you each time the system boots. Is there any info as to what program it is on the title bar of the AOL folder that opens? You could try unchecking these two in Msconfig: [waol.exe] C:\Program Files\AOL 9.0\waol.exe AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe You could also make a shortcut for this one and disable its startup in Mconfig: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe Put the shortcut on the desktop and drag it to the QuickLaunch bar for easy access, then delete the desktop shortcut. All these changes can be undone if you don't like them. SilentRunners shows hidden malware startups that don't show in HijackThis. It's not needed for a glitch like this. You're welcome for the help. Let us know how it goes. -------------------- If I've helped you, please pass it on and help someone else. SPAM is not tolerated here. New members posting SPAM will be banned with no warning.

Ref

Aug 25 2005, 02:01 PM

Post #7

Group: Members
Posts: 72
Joined: 4-June 05
Member No.: 10,671

HKE'd

I've done part of what you've suggested -

QUOTE

You could try unchecking these two in Msconfig:

[waol.exe] C:\Program Files\AOL 9.0\waol.exe

AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe

but I haven't followed your other suggestion

QUOTE

You could also make a shortcut for this one and disable its startup in Mconfig:

[AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

Put the shortcut on the desktop and drag it to the QuickLaunch bar for easy access, then delete the desktop shortcut.

as I think the rest of the family wouldn't like it.

This seems to have done the trick though - much easier than uninstalling and reinstalling the software!

To answer your other question -

QUOTE

Is there any info as to what program it is on the title bar of the AOL folder that opens?

It was just a folder that opened, the same as if I opened My Computer and navigated my way to it. By clicking on the 'folders' option at the top it is C:\Program files\AOL It has AOL in the title bar but is completely empty - even with hidden and system files on view.

Thanks again for your help

Ref

tf_hutton	Aug 25 2005, 03:08 PM Post #8
Group: Star Member Posts: 120 Joined: 5-January 03 Member No.: 3,148	I would like to make a suggestion. HKed has helped me on several occasions. While looking at your HJT logs, I noticed you didn't have Service Pack 1 or 2 installed. Do you run Windows Updates? It would be a good idea to patch your system with these updates. They protect against several threats.

HKEd	Aug 25 2005, 05:22 PM Post #9
Carbon-Based Life Form Group: Administrator Posts: 12,098 Joined: 9-August 01 From: Hong Kong Member No.: 192	Oops...I hadn't noticed that. I think I'm starting to lose the plot. Thanks tf_hutton. -------------------- If I've helped you, please pass it on and help someone else. SPAM is not tolerated here. New members posting SPAM will be banned with no warning.

Ref	Aug 26 2005, 11:25 AM Post #10
Group: Members Posts: 72 Joined: 4-June 05 Member No.: 10,671	Thank you both for your replies. I load and install all Windows updates - with the exception of SP2. I tried some time ago to load SP2. I followed all of the instructions on the Microsoft website and spent ages downloading and installing the updates HP say I need for the PC and then SP2 itself. The PC wouldn't do anything so I had to restore. I assumed I'd done something wrong and was going to wait until i'd mustered the courage to give it another go, but if I need to load SP1 first then that may explain the failure of my SP2 attempt! I've never given SP1 a thought. How can you tell I haven't got SP1 loaded? Do you know the correct link to download it - i've just tried looking on the microsoft website and there seems to be a lot to choose from! Perhaps I should put this question on a new thread in a different part of the forum? Ref

LF from MC

Aug 26 2005, 11:45 AM

Post #11

Group: SAF Moderator
Posts: 14,634
Joined: 22-February 03
From: Michigan
Member No.: 3,388

QUOTE (Ref @ Aug 26 2005, 02:25 PM)

How can you tell I haven't got SP1 loaded? Do you know the correct link to download it -

by looking at your HijackThis log..

This one has the SP2 in it..Look at the bottom line, in this one, and yours.

Logfile of HijackThis v1.99.1
Scan saved at 1:54:10 PM, on 8/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Now this one is yours...it would show SP1 if it was there.

Logfile of HijackThis v1.99.1
Scan saved at 20:58:09, on 22/08/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

By the way Ref, Hi

Someone will be along to help you out, on where to get the SP1

Lorraine

--------------------

Ana needs our help

To all Members and Guest!!
We have a 'Members' Lounge' and a 'Lounge Game' inside there, so come on in, and have a look around, and when you have the spare time, please join in.

Also, check out the Pinned Topics at the top. Show & Tell Pictures, YouTube Videos, & other links.

Coppermine ~ My Website ~ Home Page ~ Help for your Garden

Ref	Aug 26 2005, 01:49 PM Post #12
Group: Members Posts: 72 Joined: 4-June 05 Member No.: 10,671	Hi Lorraine Thanks, I've a lot to learn! Ref

LF from MC	Aug 26 2005, 07:23 PM Post #13
Group: SAF Moderator Posts: 14,634 Joined: 22-February 03 From: Michigan Member No.: 3,388	You're welcome Ref To get SP1... go to 'Windows Up Date' You can get there by going to 'Tools> Windows Update' Boy!! I had better get there, and do some updates myself Lorraine -------------------- Ana needs our help To all Members and Guest!! We have a 'Members' Lounge' and a 'Lounge Game' inside there, so come on in, and have a look around, and when you have the spare time, please join in. Also, check out the Pinned Topics at the top. Show & Tell Pictures, YouTube Videos, & other links. Coppermine ~ My Website ~ Home Page ~ Help for your Garden

Ref	Aug 27 2005, 12:34 PM Post #14
Group: Members Posts: 72 Joined: 4-June 05 Member No.: 10,671	Done that - it is only suggesting XP SP 2 as a required update (though I did update my office software while I was there). Is it OK to go straight to SP 2 without installing SP1 first? The microsoft website didn't specify. Should I start a new thread under Windows XP? Ref

HKEd	Aug 27 2005, 06:11 PM Post #15
Carbon-Based Life Form Group: Administrator Posts: 12,098 Joined: 9-August 01 From: Hong Kong Member No.: 192	Hi Ref...there was an option for SP1a when I last checked, but that was a while ago. SP2 includes SP1 and it's been on release for quite some time now, so all the initial problems have been ironed out (there were some compatability issues). I haven't installed it myself because of the rather useless firewall bundled with it. Although it's a good good idea to have a firewall for added protection, I prefer to use a 'proper' firewall like ZoneAlarm or Sygate Personal Firewall. But the MS firewall is better than none at all. My advice is to go ahead and install SP2. -------------------- If I've helped you, please pass it on and help someone else. SPAM is not tolerated here. New members posting SPAM will be banned with no warning.

Ref	Aug 28 2005, 12:25 PM Post #16
Group: Members Posts: 72 Joined: 4-June 05 Member No.: 10,671	Hi HKEd I linked to the SP 1a update via a link pinned to the security forum. I chose to download this update but the first thing it does is check which updates your PC needs and it came back with SP2. I currently have a McAfee firewall (which you get for free with AOL). I've asked them what if there are any issues with it and SP 2 and once I get a reply i'm going to download and install SP2. Thanks to you, tf_hutton and LF for your help (once again!) No doubt i'll be posting on here again if something goes wrong with my SP2 upgrade! Regards Ref

HKEd	Aug 28 2005, 06:40 PM Post #17
Carbon-Based Life Form Group: Administrator Posts: 12,098 Joined: 9-August 01 From: Hong Kong Member No.: 192	I guess there's no alternative other than to install SP2. You can disable the MS firewall. You're welcome for the help. -------------------- If I've helped you, please pass it on and help someone else. SPAM is not tolerated here. New members posting SPAM will be banned with no warning.

« Next Oldest · Malicious Code: Viruses, Trojans, Spyware and Browser HiJacking · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members: