Computing.Net > Forums > Security and Virus > no task manager b.exe trojan

no task manager b.exe trojan

Reply to Message Icon

Original Message
Name: Abominable
Date: March 7, 2006 at 09:27:59 Pacific
Subject: no task manager b.exe trojan
OS: WinXP
CPU/Ram: 212 GB
Model/Manufacturer: Dell 8400
Comment:

For one day i have been without a task manager, no way whatsoever to access it. It started when i noticed that limewire (p2p) would not stay closed. it would repeatedly reopen. once i removed the program i would get prompts to why the system could not find limewire and orders to download again.

i also have a prompt whenever i start up which says b.exe has run into a problem and must close.

I have run norton, trojan hunter, and ms antispy (in safe mode) to no avail. i am still without a task manager and am getting worried

note task manager will open in safe mode..


Report Offensive Message For Removal


Response Number 1
Name: bofra
Date: March 7, 2006 at 09:53:13 Pacific
Reply: (edit)

have you tried system restore prior to error,
try system tools~ services, to disable b.exe if possible,
try searching for file and trash,
and search registry and delete file if found,

try link for help:
http://www.siena.edu/antivirus/viruses/realphx.htm



Report Offensive Follow Up For Removal

Response Number 2
Name: Abominable
Date: March 7, 2006 at 10:56:41 Pacific
Reply: (edit)

i did not have system restore on unfortunatly...when i click start - run - taskmgr i get a prompt which says 'another program is currently using this file.

where would i begin to find this in the registry?

thanks for the swift reply


Report Offensive Follow Up For Removal

Response Number 3
Name: Tufenuf
Date: March 7, 2006 at 11:12:15 Pacific
Reply: (edit)

Abmominable, You may want to go thru the links under "These viruses terminate regedit.exe / msconfig.exe / taskmgr.exe." where you may find a possible clue as to where in the registry is this problem occuring.

Task Manager Problems

Tufenuf



Report Offensive Follow Up For Removal

Response Number 4
Name: Abominable
Date: March 7, 2006 at 11:40:38 Pacific
Reply: (edit)

i have looked all over the web to find answers and i stumbled on this site

http://209.123.205.209/forum/remark,14413826?hilite=limewire+task+manager

the person had the same problem as i have now. he said that he got rid of it with killbox.exe. so i have tried that and now nothing has changed. limewire.exe still shows up in my system processes (after it was deleted) and no task manager or registry (through start-run-regedit, i can get to the registry from a shortcut i created a while back)


Report Offensive Follow Up For Removal

Response Number 5
Name: capt
Date: March 7, 2006 at 11:53:19 Pacific
Reply: (edit)

Can you enter the safe mode? If you can, you should be able to delete then. Be sure to select admin as you are entering the safe mode.


Report Offensive Follow Up For Removal


Response Number 6
Name: Abominable
Date: March 7, 2006 at 13:38:05 Pacific
Reply: (edit)

yes i will go back in and do updated scans...in the meantime here is my hijackthis log if anyone has the time

Logfile of HijackThis v1.99.1
Scan saved at 3:45:37 PM, on 3/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\svchost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\limewire\limewire.exe
C:\Program Files\Java\jre1.5.0_04\bin\javaw.exe
C:\Documents and Settings\Mike\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Advanced System Optimizer\IEHelper.dll
O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file)
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)
O3 - Toolbar: Copernic Desktop Search - {C5F7A735-70F1-477F-8C36-6FF3C736017B} - C:\Program Files\Copernic Desktop Search\CopernicDesktopSearchIntegration910.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Ad-watch] C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\Trojan Hunter\TrojanHunter 4.0\THGuard.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [Copernic Desktop Search] "C:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe" /tray
O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: svchost.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Decompiler - C:\Program Files\SourceTec\Sothink SWF Decompiler\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: SWFDecompiler - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\SourceTec\Sothink SWF Decompiler\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Decompiler - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\SourceTec\Sothink SWF Decompiler\InternetExplorer.htm
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4443/mcfscan.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DEFFD8E-8DA0-4A12-BA4F-62C5C9F7E4A1}: NameServer = 192.168.10.1
O18 - Protocol: bw+0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: offline-8876480 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe



Report Offensive Follow Up For Removal

Response Number 7
Name: Johnw
Date: March 7, 2006 at 15:33:28 Pacific
Reply: (edit)

All Users\Start Menu\Programs\Startup\svchost.exe
This entry is not running from the System32 folder, so it is probably nasty.
Svchost.exe ( also named Scvhost.exe ) can be a virus.
http://www.2-spyware.com/file-scvhost-exe.html
====================================
After above.
ActiveX Spyware & Adware Scanning
http://www.spywareinfo.com/xscan.php
This scanner is an ActiveX applet. After a short delay in which your browser downloads the control file, you will receive a "Warning Dialogue" requesting permission for the scanner to run. Click "Yes" and the applet will pop up and scan. You will be alerted if any spyware is found. When a spyware or malware is found, you will be alerted and asked if you want to remove it. If no spyware is found, the scanner will disappear on its own.
If nothing happens, or if you are using a browser other than Internet Explorer, click here and choose either "Open" or "Run this program from its current location". Do not choose "Download".
http://www.xblock.com/download/xclean_micro.exe
==================================
Malware Removal and Prevention: Introduction
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
Malware Removal and Prevention: Overview
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Overview
If Your PC is Infested w/ Spyware & Adware...
http://spywarewarrior.com/sww-help.htm
http://spywarewarrior.com/viewtopic.php?t=6914
http://spywarewarrior.com/viewtopic.php?t=10
http://spywarewarrior.com/viewforum.php?f=30
====================================
If possible run HJT in Normal mode ( not Safe ) with all your normal startup's working.
HijackThis Tutorial - How to Analyse your own log.
http://spywarewarrior.com/viewtopic.php?t=3624
HijackThis log file analysis ( online )
http://hijackthis.de/index.php?langselect=english
Or,
http://startup.networktechs.com/page-68.html
http://hjt.iamnotageek.com


Report Offensive Follow Up For Removal

Response Number 8
Name: jabuck
Date: March 7, 2006 at 15:49:48 Pacific
Reply: (edit)

Run HT again, close all windows and browsers except HT, place a check to the left of this item and press "fix checked":

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)

O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file)

O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file)

O4 - HKCU\..\Run: [LDM] \Program\

O4 - Global Startup: svchost.exe


Download killbox from this link Killbox
Double-click on Killbox.exe to run it.
Put a tick by Standard File Kill.
In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time.
Click on the button that has the red circle with the X in the middle after you enter each file.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\svchost.exe

It will ask for confimation to delete the file.
Click Yes.
Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box.

Run this free online scan from Panda

When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to the desktop, then copy/paste into the text editor and post it.



Report Offensive Follow Up For Removal

Response Number 9
Name: Abnormal
Date: March 7, 2006 at 21:08:24 Pacific
Reply: (edit)

http://www.broadbandreports.com/forum/remark,15632516



Report Offensive Follow Up For Removal

Response Number 10
Name: vika
Date: March 8, 2006 at 05:02:15 Pacific
Reply: (edit)

I would suggest you to delete limewire from your system (if it is still there) as it might be a cause of most of your problems, because Limewire can secretly get into the system from several malicious web sites or come along with free ad-supported software.
Please try Limewire removal instructions

Also reading:
Spyware News
Bleeping computer


Report Offensive Follow Up For Removal

Response Number 11
Name: Abominable
Date: March 8, 2006 at 23:52:24 Pacific
Reply: (edit)

thanks everyone i got rid of it with your help


Report Offensive Follow Up For Removal

Response Number 12
Name: pberardi
Date: March 21, 2006 at 17:12:24 Pacific
Reply: (edit)

I've encounter the exact same problem as you have however I cannot seem to get rid of it. Can you post how you went about doing it?


Report Offensive Follow Up For Removal

Response Number 13
Name: colquhoj
Date: March 26, 2006 at 17:34:36 Pacific
Reply: (edit)

Abominable, please tell us how you fixed it, what worked?


Report Offensive Follow Up For Removal

Response Number 14
Name: MrD
Date: March 28, 2006 at 01:48:43 Pacific
Reply: (edit)

ok i had the same problem and also my file sharing program kept opening and nothing i read here worked....right what you do is download system mechainic 6 its free for a 30 day trail(very good program) once you have downloaded it find incenerator on options add to desktop....now to get rid of the virus goto start look for folders type b.exe now drag it to incinerator. thats it problem fixed...pc also goto start look at your program list look at start and drag the thing that says ...carnt remember scghost or some thing, to the incenerator...then just on the safe side run virus scan again....very simple a.....if you have your own virus scan dont set up machanic 6 virus scan because it is only on trial unless you but the product...and less you wont to go the other way rond so do dont buy it but that my friend is a new bull game hope this helped.....MRD


Report Offensive Follow Up For Removal

Response Number 15
Name: MrD
Date: March 28, 2006 at 12:53:14 Pacific
Reply: (edit)

ok i will start that a again, i wrote the last reply when i was very tired. What you need to do,to remove the problem is, download system mechanic 6. It is free to download on a 30 day trial.
Once system mechanic is downloaded,install it on your pc.on install it on your pc,if you have antivirus already dont install the anti virus option,unless you are going to buy the product.
ok now you have system mechanic. open system mechanic. Goto the protect option,then you will see an icon that says permanentl delete files, add this to your desktop. Now goto start.search.search all files and folders.in the search box type b.exe. It will come up in the listings,drag b.exe to the icon you just put on your desktop. now goto start. all programs. move upto start and this should show you some thing that says something like sghost(can not remember the name sorry)now drag that to the same place.Now right click on the icon and delete...restart your pc a box will come up,close itthen goto start.all programes.start.and a document icon will be there.drag it to the same icon and delete..Thats it problem fixed.
I know this will work for because it worked for me..It works on all os as well...
Just to make sure can you post a link if it worked fou you. so all other people now they can remove the same viruse/spyware.


Report Offensive Follow Up For Removal

Response Number 16
Name: jasper
Date: April 2, 2006 at 19:35:19 Pacific
Reply: (edit)

thanks for all info so far... i to had to deal with the b.exe
trojan ... i did what Mr D recommends, (thanks :-) ) ...
and the b.exe file was incinerated, aswell as the svchost
thing, i incinerated that too.

now ... i get the same issue except with "2.exe" ... ! it
says it (the application, "2.exe") has had a problem.

and now there are no icons on the icon bar...

and then, no icon bar.

i get no start menu now. i did for a couple of restarts, but
now there is none.

i open up "My Computer" to do a search for 2.exe to
incinerate it, and the friendly dog comes up and sits down
but there is nothing else.

explorer had an issue and had to quit, one restart ago.

i am so upset, because this is a friend's pc (windows xp,
1.8 ghz pentium), and i don't know how to tell them that i
got a virus onto it. i really hope i can fix things. any help
will be greatly appreciated...


Report Offensive Follow Up For Removal

Response Number 17
Name: MrD
Date: April 5, 2006 at 11:23:44 Pacific
Reply: (edit)

i am afriad i have nver had a problem with 2.exe only with b.exe.
but if i come across the virus on my pc.
i will post a link with instructions on how to remove it.....
and thank you for the reply.....im sure very soon i will have the 2.exe..virus



Report Offensive Follow Up For Removal

Response Number 18
Name: MrD
Date: April 5, 2006 at 11:28:39 Pacific
Reply: (edit)

as i said befor i have never had the 2.exe file but i have heard that norton 2006 does remove it...the only other way is to download a file sharing program
and download windows on iso format..if you have a cd-writer. and reinstall..drastic measures and also you can get done for it. if not download norton antvirus..and get the serial...any way injoy lafe im of to take the dog for a walk



Report Offensive Follow Up For Removal

Response Number 19
Name: buzzkiller06
Date: April 10, 2006 at 15:39:32 Pacific
Reply: (edit)

MrD...In response number 15 you say to go into start-->All Programs-->Start. Where is this second start as I do not have it?


Report Offensive Follow Up For Removal

Response Number 20
Name: DKinstone
Date: May 22, 2006 at 14:25:47 Pacific
Reply: (edit)

Mr.D...you are a god as far as I'm concerned right now...I tryed to look it up in the registry and delete this virus, and what you said got it off in no time. Thank you!!

O and where you said "sghost(can not remember the name sorry)" did you mean svchost? cuase thats what I removed. Also it was in Start->All Programs->Startup->svchost.exe Also it was a 0 program that tryed to run.

Thats what I had to go through to get this stuff, if that helps anyone while they are looking. Thanks again guys!!

DKinstone@gmail.com


Report Offensive Follow Up For Removal

Response Number 21
Name: KPalicz
Date: May 30, 2006 at 18:34:22 Pacific
Reply: (edit)

Thank you MrD for figuring it out!!!

And thank you DKinstone for translating!

I have the same exact problem, and I think *holds breath* that its fixed now.

For the record, I know where it came from. I downloaded what I thought was Romance of the Three Kingdoms off of Limewire. I ran the file after it downloaded and it made a hidden folder in that directory with a blank file name, inside it was a program xzxzxzxzx.exe I saw it right away and sent it to the recycle bin. Too little too late I suppose.

But thanks, MrD, it worked great. :)


Report Offensive Follow Up For Removal






Use following form to reply to current message:

   Name: From My Computing.Net Settings
 E-Mail: From My Computing.Net Settings

Subject: no task manager b.exe trojan

Comments:

 


  Homepage URL (*): 
Homepage Title (*): 
         Image URL: 
 
Data Recovery Software




Have you ever used OpenOffice?

Yes, as my main suite.
Yes, occationally.
Yes, but only once.
No, never.


View Results

Poll Finishes In 5 Days.
Discuss in The Lounge