|
|
|
no task manager b.exe trojan
|
Original Message
|
Name: Abominable
Date: March 7, 2006 at 09:27:59 Pacific
Subject: no task manager b.exe trojanOS: WinXPCPU/Ram: 212 GBModel/Manufacturer: Dell 8400 |
Comment: For one day i have been without a task manager, no way whatsoever to access it. It started when i noticed that limewire (p2p) would not stay closed. it would repeatedly reopen. once i removed the program i would get prompts to why the system could not find limewire and orders to download again. i also have a prompt whenever i start up which says b.exe has run into a problem and must close. I have run norton, trojan hunter, and ms antispy (in safe mode) to no avail. i am still without a task manager and am getting worried note task manager will open in safe mode..
Report Offensive Message For Removal
|
|
Response Number 1
|
Name: bofra
Date: March 7, 2006 at 09:53:13 Pacific
|
Reply: (edit)have you tried system restore prior to error, try system tools~ services, to disable b.exe if possible, try searching for file and trash, and search registry and delete file if found, try link for help: http://www.siena.edu/antivirus/viruses/realphx.htm
Report Offensive Follow Up For Removal
|
|
Response Number 2
|
Name: Abominable
Date: March 7, 2006 at 10:56:41 Pacific
|
Reply: (edit)i did not have system restore on unfortunatly...when i click start - run - taskmgr i get a prompt which says 'another program is currently using this file. where would i begin to find this in the registry? thanks for the swift reply
Report Offensive Follow Up For Removal
|
|
Response Number 3
|
Name: Tufenuf
Date: March 7, 2006 at 11:12:15 Pacific
|
Reply: (edit)Abmominable, You may want to go thru the links under "These viruses terminate regedit.exe / msconfig.exe / taskmgr.exe." where you may find a possible clue as to where in the registry is this problem occuring. Task Manager Problems Tufenuf
Report Offensive Follow Up For Removal
|
|
Response Number 4
|
Name: Abominable
Date: March 7, 2006 at 11:40:38 Pacific
|
Reply: (edit)i have looked all over the web to find answers and i stumbled on this site http://209.123.205.209/forum/remark,14413826?hilite=limewire+task+manager the person had the same problem as i have now. he said that he got rid of it with killbox.exe. so i have tried that and now nothing has changed. limewire.exe still shows up in my system processes (after it was deleted) and no task manager or registry (through start-run-regedit, i can get to the registry from a shortcut i created a while back)
Report Offensive Follow Up For Removal
|
|
Response Number 5
|
Name: capt
Date: March 7, 2006 at 11:53:19 Pacific
|
Reply: (edit)Can you enter the safe mode? If you can, you should be able to delete then. Be sure to select admin as you are entering the safe mode.
Report Offensive Follow Up For Removal
|
|
Response Number 6
|
Name: Abominable
Date: March 7, 2006 at 13:38:05 Pacific
|
Reply: (edit)yes i will go back in and do updated scans...in the meantime here is my hijackthis log if anyone has the time Logfile of HijackThis v1.99.1 Scan saved at 3:45:37 PM, on 3/7/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\Program Files\D-Tools\daemon.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\PeerGuardian2\pg2.exe C:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Documents and Settings\All Users\Start Menu\Programs\Startup\svchost.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\limewire\limewire.exe C:\Program Files\Java\jre1.5.0_04\bin\javaw.exe C:\Documents and Settings\Mike\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\Advanced System Optimizer\IEHelper.dll O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file) O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file) O3 - Toolbar: Copernic Desktop Search - {C5F7A735-70F1-477F-8C36-6FF3C736017B} - C:\Program Files\Copernic Desktop Search\CopernicDesktopSearchIntegration910.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [Ad-watch] C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\Trojan Hunter\TrojanHunter 4.0\THGuard.exe" O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [LDM] \Program\ O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [Copernic Desktop Search] "C:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe" /tray O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: svchost.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Sothink SWF Decompiler - C:\Program Files\SourceTec\Sothink SWF Decompiler\InternetExplorer.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: SWFDecompiler - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\SourceTec\Sothink SWF Decompiler\InternetExplorer.htm O9 - Extra 'Tools' menuitem: Sothink SWF Decompiler - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\SourceTec\Sothink SWF Decompiler\InternetExplorer.htm O15 - Trusted Zone: http://ny.contentmatch.net (HKLM) O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/insaniquarium/popcaploader_v6.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4443/mcfscan.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{4DEFFD8E-8DA0-4A12-BA4F-62C5C9F7E4A1}: NameServer = 192.168.10.1 O18 - Protocol: bw+0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: offline-8876480 - {E112A51E-DAF7-4EDE-83AF-60CCA87E073D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
Report Offensive Follow Up For Removal
|
|
Response Number 8
|
Name: jabuck
Date: March 7, 2006 at 15:49:48 Pacific
|
Reply: (edit)Run HT again, close all windows and browsers except HT, place a check to the left of this item and press "fix checked": R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file) O3 - Toolbar: (no name) - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - (no file)
O3 - Toolbar: (no name) - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - (no file) O4 - HKCU\..\Run: [LDM] \Program\ O4 - Global Startup: svchost.exe Download killbox from this link Killbox Double-click on Killbox.exe to run it. Put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time. Click on the button that has the red circle with the X in the middle after you enter each file.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\svchost.exe It will ask for confimation to delete the file. Click Yes. Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box. Run this free online scan from Panda When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to the desktop, then copy/paste into the text editor and post it.
Report Offensive Follow Up For Removal
|
|
Response Number 12
|
Name: pberardi
Date: March 21, 2006 at 17:12:24 Pacific
|
Reply: (edit)I've encounter the exact same problem as you have however I cannot seem to get rid of it. Can you post how you went about doing it?
Report Offensive Follow Up For Removal
|
|
Response Number 14
|
Name: MrD
Date: March 28, 2006 at 01:48:43 Pacific
|
Reply: (edit)ok i had the same problem and also my file sharing program kept opening and nothing i read here worked....right what you do is download system mechainic 6 its free for a 30 day trail(very good program) once you have downloaded it find incenerator on options add to desktop....now to get rid of the virus goto start look for folders type b.exe now drag it to incinerator. thats it problem fixed...pc also goto start look at your program list look at start and drag the thing that says ...carnt remember scghost or some thing, to the incenerator...then just on the safe side run virus scan again....very simple a.....if you have your own virus scan dont set up machanic 6 virus scan because it is only on trial unless you but the product...and less you wont to go the other way rond so do dont buy it but that my friend is a new bull game hope this helped.....MRD
Report Offensive Follow Up For Removal
|
|
Response Number 15
|
Name: MrD
Date: March 28, 2006 at 12:53:14 Pacific
|
Reply: (edit)ok i will start that a again, i wrote the last reply when i was very tired. What you need to do,to remove the problem is, download system mechanic 6. It is free to download on a 30 day trial. Once system mechanic is downloaded,install it on your pc.on install it on your pc,if you have antivirus already dont install the anti virus option,unless you are going to buy the product. ok now you have system mechanic. open system mechanic. Goto the protect option,then you will see an icon that says permanentl delete files, add this to your desktop. Now goto start.search.search all files and folders.in the search box type b.exe. It will come up in the listings,drag b.exe to the icon you just put on your desktop. now goto start. all programs. move upto start and this should show you some thing that says something like sghost(can not remember the name sorry)now drag that to the same place.Now right click on the icon and delete...restart your pc a box will come up,close itthen goto start.all programes.start.and a document icon will be there.drag it to the same icon and delete..Thats it problem fixed. I know this will work for because it worked for me..It works on all os as well... Just to make sure can you post a link if it worked fou you. so all other people now they can remove the same viruse/spyware.
Report Offensive Follow Up For Removal
|
|
Response Number 16
|
Name: jasper
Date: April 2, 2006 at 19:35:19 Pacific
|
Reply: (edit)thanks for all info so far... i to had to deal with the b.exe trojan ... i did what Mr D recommends, (thanks :-) ) ... and the b.exe file was incinerated, aswell as the svchost thing, i incinerated that too. now ... i get the same issue except with "2.exe" ... ! it says it (the application, "2.exe") has had a problem. and now there are no icons on the icon bar... and then, no icon bar. i get no start menu now. i did for a couple of restarts, but now there is none. i open up "My Computer" to do a search for 2.exe to incinerate it, and the friendly dog comes up and sits down but there is nothing else. explorer had an issue and had to quit, one restart ago. i am so upset, because this is a friend's pc (windows xp, 1.8 ghz pentium), and i don't know how to tell them that i got a virus onto it. i really hope i can fix things. any help will be greatly appreciated...
Report Offensive Follow Up For Removal
|
|
Response Number 17
|
Name: MrD
Date: April 5, 2006 at 11:23:44 Pacific
|
Reply: (edit)i am afriad i have nver had a problem with 2.exe only with b.exe. but if i come across the virus on my pc. i will post a link with instructions on how to remove it..... and thank you for the reply.....im sure very soon i will have the 2.exe..virus
Report Offensive Follow Up For Removal
|
|
Response Number 18
|
Name: MrD
Date: April 5, 2006 at 11:28:39 Pacific
|
Reply: (edit)as i said befor i have never had the 2.exe file but i have heard that norton 2006 does remove it...the only other way is to download a file sharing program and download windows on iso format..if you have a cd-writer. and reinstall..drastic measures and also you can get done for it. if not download norton antvirus..and get the serial...any way injoy lafe im of to take the dog for a walk
Report Offensive Follow Up For Removal
|
|
Response Number 20
|
Name: DKinstone
Date: May 22, 2006 at 14:25:47 Pacific
|
Reply: (edit)Mr.D...you are a god as far as I'm concerned right now...I tryed to look it up in the registry and delete this virus, and what you said got it off in no time. Thank you!! O and where you said "sghost(can not remember the name sorry)" did you mean svchost? cuase thats what I removed. Also it was in Start->All Programs->Startup->svchost.exe Also it was a 0 program that tryed to run. Thats what I had to go through to get this stuff, if that helps anyone while they are looking. Thanks again guys!! DKinstone@gmail.com
Report Offensive Follow Up For Removal
|
|
Response Number 21
|
Name: KPalicz
Date: May 30, 2006 at 18:34:22 Pacific
|
Reply: (edit)Thank you MrD for figuring it out!!! And thank you DKinstone for translating! I have the same exact problem, and I think *holds breath* that its fixed now. For the record, I know where it came from. I downloaded what I thought was Romance of the Three Kingdoms off of Limewire. I ran the file after it downloaded and it made a hidden folder in that directory with a blank file name, inside it was a program xzxzxzxzx.exe I saw it right away and sent it to the recycle bin. Too little too late I suppose. But thanks, MrD, it worked great. :)
Report Offensive Follow Up For Removal
|
Use following form to reply to current message:
|
|

|