| | |
| Thread Tools |
|
06-Dec-2006, 01:28 PM
#1 |
| downloader-zlob I know you guys are probably tired of answering this one..but I have downloader-zlob. Here is my HiackThis: Logfile of HijackThis v1.99.1 Scan saved at 12:16:56 PM, on 12/6/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\csrss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe F:\WINDOWS\system32\LEXBCES.EXE F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\system32\LEXPPS.EXE F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe F:\WINDOWS\System32\CTsvcCDA.exe F:\WINDOWS\System32\GEARSec.exe F:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe F:\PROGRA~1\McAfee\MSC\mclogsrv.exe F:\PROGRA~1\McAfee\MSC\mcupdmgr.exe f:\program files\common files\mcafee\mna\mcnasvc.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe F:\PROGRA~1\McAfee\MSC\mcpromgr.exe f:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe F:\PROGRA~1\McAfee\MSC\mctskshd.exe F:\PROGRA~1\McAfee\MSC\mcusrmgr.exe F:\WINDOWS\Explorer.EXE F:\PROGRA~1\mcafee.com\agent\mcagent.exe F:\Program Files\Norton Ghost\Agent\VProSvc.exe F:\WINDOWS\system32\nvsvc32.exe F:\Program Files\SiteAdvisor\4608\SAService.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe F:\Program Files\Common Files\Real\Update_OB\realsched.exe F:\WINDOWS\system32\wdfmgr.exe F:\WINDOWS\SM1BG.EXE F:\Program Files\Common Files\Symantec Shared\ccApp.exe F:\Program Files\Norton Ghost\Agent\GhostTray.exe F:\WINDOWS\System32\MsPMSPSv.exe F:\Program Files\iTunes\iTunesHelper.exe F:\Program Files\Canon\CAL\CALMAIN.exe F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe F:\PROGRA~1\DELLSU~1\DSAgnt.exe F:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe F:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe F:\Program Files\Microsoft Office\Office\FINDFAST.EXE F:\Program Files\iPod\bin\iPodService.exe F:\WINDOWS\System32\alg.exe F:\Program Files\Internet Explorer\iexplore.exe F:\Program Files\SiteAdvisor\4608\SiteAdv.exe F:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe f:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe F:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.insightbb.com/default.aspx R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://support.dell.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - f:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Lexmark X5100 Series] "F:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SM1BG] F:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Norton Ghost 10.0] "F:\Program Files\Norton Ghost\Agent\GhostTray.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpyHunter] F:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe O4 - HKCU\..\Run: [DellSupport] "F:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup O4 - HKCU\..\Run: [SMSystemAnalyzer] "F:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" O4 - Startup: Microsoft Find Fast.lnk = F:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Kaspersky Anti-Hacker.lnk = F:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: LimeShop Preferences - file://F:\Program Files\LimeShop\System\Temp\limeshop_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_2.2.2.89.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1155250172609 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1164289608109 O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - file://D:\WEBPULL\SUPPORT\DISC\ASP\TOOLS\EN\bin\npseatools.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{1E87E548-9706-47DD-A39A-EBACB4301795}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip\..\{D24B6384-2AF1-46E4-8951-75660C497EA2}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9D60177-2113-43C1-92A7-419F244FC766}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.110 85.255.112.113 O17 - HKLM\System\CS1\Services\Tcpip\..\{1E87E548-9706-47DD-A39A-EBACB4301795}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.110 85.255.112.113 O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O20 - Winlogon Notify: WgaLogon - F:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - F:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: GEARSecurity - GEAR Software - F:\WINDOWS\System32\GEARSec.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Lan Discover Agent (magaService) - Unknown owner - F:\Program Files\Sygate\SSA\maga\maga.exe (file missing) O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - F:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mclogsrv.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - f:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - f:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mctskshd.exe O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcusrmgr.exe O23 - Service: Norton Ghost - Symantec Corporation - F:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: SiteAdvisor Service - Unknown owner - F:\Program Files\SiteAdvisor\4608\SAService.exe O23 - Service: Symantec Core LC - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe Pls help.. |
| |
06-Dec-2006, 02:27 PM
#2 | |||||
| Hi, BigDude3 Welcome to TSG. There are signs that you are using two Antivirus programs. Anti-Virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash. If you choose to install more than one Anti-Virus program on your computer, then only one of them should be active in memory at a time. There are basically two types of these programs: On-Access and On-Demand On-Access Scanners As the name implies, are scanners that run in the background all the time the PC is turned on and running. The main function of an On-Access scanner is to monitor activity on your machine. On-Demand Scanners As the name implies, are scanners that only run when you ask them to. Such as: Online Scans and scanners that run on your machine but are not actively scanning your machine. If you are using more than one Antivirus programs, you must remove them all, except one. Please print out these instructions for reference, since you will have to restart your computer during the fix. Please download FixWareout from Here or Here.
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E87E548-9706-47DD-A39A-EBACB4301795}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip\..\{D24B6384-2AF1-46E4-8951-75660C497EA2}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip\..\{F9D60177-2113-43C1-92A7-419F244FC766}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.110 85.255.112.113 O17 - HKLM\System\CS1\Services\Tcpip\..\{1E87E548-9706-47DD-A39A-EBACB4301795}: NameServer = 85.255.116.110,85.255.112.113 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.110 85.255.112.113 Click FIX CHECKED. Close HijackThis.
ipconfig /flushdns (The space between g and / is needed) Exit Finally, please post the contents of the text file that opened earlier (you can find it at C:\fixwareout\report.txt ), along with a new HijackThis log into this topic.
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
|
06-Dec-2006, 03:06 PM
#3 |
| ok looks like that got it thanks..here's followup requested: Fixwareout Last edited 12/06/2006 Post this report in the forums please Reg Entries that were deleted ... Microsoft (R) Windows Script Host Version 5.6 Random Runs removed from HKLM ... PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Searching by size/names... »»»»» Search five digit cs, dm kd and jb files. This WILL/CAN also list Legit Files, Submit them at Virustotal Other suspects. Directory of F:\WINDOWS\system32 »»»»» Misc files. »»»»» Checking for older varients covered by the Rem3 tool. Logfile of HijackThis v1.99.1 Scan saved at 2:05:20 PM, on 12/6/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe F:\WINDOWS\system32\LEXBCES.EXE F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\system32\LEXPPS.EXE F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe F:\WINDOWS\System32\CTsvcCDA.exe F:\WINDOWS\System32\GEARSec.exe F:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe F:\PROGRA~1\McAfee\MSC\mclogsrv.exe F:\PROGRA~1\McAfee\MSC\mcupdmgr.exe F:\WINDOWS\Explorer.EXE f:\program files\common files\mcafee\mna\mcnasvc.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe F:\PROGRA~1\McAfee\MSC\mcpromgr.exe f:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe F:\Program Files\Lexmark X5100 Series\lxbabmgr.exe F:\Program Files\Lexmark X5100 Series\lxbabmon.exe F:\Program Files\Common Files\Real\Update_OB\realsched.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe F:\WINDOWS\SM1BG.EXE F:\Program Files\Common Files\Symantec Shared\ccApp.exe F:\PROGRA~1\McAfee\MSC\mctskshd.exe F:\Program Files\Norton Ghost\Agent\GhostTray.exe F:\PROGRA~1\McAfee\MSC\mcusrmgr.exe F:\Program Files\Norton Ghost\Agent\VProSvc.exe F:\Program Files\iTunes\iTunesHelper.exe F:\PROGRA~1\mcafee.com\agent\mcagent.exe F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe F:\WINDOWS\system32\nvsvc32.exe F:\PROGRA~1\DELLSU~1\DSAgnt.exe F:\Program Files\SiteAdvisor\4608\SAService.exe F:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe F:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe F:\Program Files\Microsoft Office\Office\FINDFAST.EXE F:\WINDOWS\System32\MsPMSPSv.exe F:\Program Files\Canon\CAL\CALMAIN.exe F:\Program Files\iPod\bin\iPodService.exe F:\Program Files\SiteAdvisor\4608\SiteAdv.exe F:\Program Files\Internet Explorer\iexplore.exe F:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://support.dell.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - f:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Lexmark X5100 Series] "F:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SM1BG] F:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Norton Ghost 10.0] "F:\Program Files\Norton Ghost\Agent\GhostTray.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [DellSupport] "F:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup O4 - HKCU\..\Run: [SMSystemAnalyzer] "F:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" O4 - Startup: Microsoft Find Fast.lnk = F:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Kaspersky Anti-Hacker.lnk = F:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: LimeShop Preferences - file://F:\Program Files\LimeShop\System\Temp\limeshop_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_2.2.2.89.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1155250172609 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1164289608109 O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - file://D:\WEBPULL\SUPPORT\DISC\ASP\TOOLS\EN\bin\npseatools.cab O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O20 - Winlogon Notify: WgaLogon - F:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - F:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: GEARSecurity - GEAR Software - F:\WINDOWS\System32\GEARSec.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Lan Discover Agent (magaService) - Unknown owner - F:\Program Files\Sygate\SSA\maga\maga.exe (file missing) O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - F:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mclogsrv.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - f:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - f:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mctskshd.exe O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcusrmgr.exe O23 - Service: Norton Ghost - Symantec Corporation - F:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: SiteAdvisor Service - Unknown owner - F:\Program Files\SiteAdvisor\4608\SAService.exe O23 - Service: Symantec Core LC - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ![]() |
06-Dec-2006, 07:17 PM
#4 | |||||
| Hi, BigDude3. Wareout never travels alone. Lets take a deeper look. Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
For Technical Support, double-click the e-mail address located at the bottom of each menu. Download AVG Anti-Spyware from HERE and save that file to your desktop. This is a 30 day trial of the program
Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode. Boot into Safe Mode: Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. Perform the following steps in safe mode:
Please go HERE to run Panda's ActiveScan
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
|
07-Dec-2006, 06:57 PM
#5 |
| Round 2 OK did as asked..one problem thogh is I had already run AVG before I got your post. It did indeed locate another downloader-zlob but this time it was able to quarintine it...but I did not gemerate a report from it. When I ran AVG again this time it was clean..so here are the pandascan and hijack runs: Logfile of HijackThis v1.99.1 Scan saved at 5:42:02 PM, on 12/7/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe F:\WINDOWS\system32\LEXBCES.EXE F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\system32\LEXPPS.EXE F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe F:\WINDOWS\System32\CTsvcCDA.exe F:\WINDOWS\System32\GEARSec.exe F:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe F:\PROGRA~1\McAfee\MSC\mclogsrv.exe F:\PROGRA~1\McAfee\MSC\mcupdmgr.exe f:\program files\common files\mcafee\mna\mcnasvc.exe F:\WINDOWS\Explorer.EXE F:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe F:\PROGRA~1\McAfee\MSC\mcpromgr.exe f:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe F:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe F:\PROGRA~1\McAfee\MSC\mctskshd.exe F:\PROGRA~1\McAfee\MSC\mcusrmgr.exe F:\Program Files\Norton Ghost\Agent\VProSvc.exe F:\PROGRA~1\mcafee.com\agent\mcagent.exe F:\Program Files\Lexmark X5100 Series\lxbabmgr.exe F:\Program Files\Lexmark X5100 Series\lxbabmon.exe F:\Program Files\Common Files\Real\Update_OB\realsched.exe F:\WINDOWS\SM1BG.EXE F:\Program Files\Common Files\Symantec Shared\ccApp.exe F:\WINDOWS\system32\nvsvc32.exe F:\Program Files\SiteAdvisor\4608\SAService.exe F:\Program Files\Norton Ghost\Agent\GhostTray.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe F:\Program Files\iTunes\iTunesHelper.exe F:\WINDOWS\System32\MsPMSPSv.exe F:\Program Files\Canon\CAL\CALMAIN.exe F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe F:\PROGRA~1\DELLSU~1\DSAgnt.exe F:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe F:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe F:\Program Files\Microsoft Office\Office\FINDFAST.EXE F:\Program Files\Internet Explorer\iexplore.exe F:\Program Files\iPod\bin\iPodService.exe F:\Program Files\SiteAdvisor\4608\SiteAdv.exe F:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://support.dell.com/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - f:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Lexmark X5100 Series] "F:\Program Files\Lexmark X5100 Series\lxbabmgr.exe" O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SM1BG] F:\WINDOWS\SM1BG.EXE O4 - HKLM\..\Run: [ccApp] "F:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Norton Ghost 10.0] "F:\Program Files\Norton Ghost\Agent\GhostTray.exe" O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [DellSupport] "F:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup O4 - HKCU\..\Run: [SMSystemAnalyzer] "F:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe" O4 - Startup: Microsoft Find Fast.lnk = F:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Kaspersky Anti-Hacker.lnk = F:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe O8 - Extra context menu item: LimeShop Preferences - file://F:\Program Files\LimeShop\System\Temp\limeshop_script0.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/ca...C_2.2.2.89.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1155250172609 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1164289608109 O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools English Online) - file://D:\WEBPULL\SUPPORT\DISC\ASP\TOOLS\EN\bin\npseatools.cab O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - F:\Program Files\SiteAdvisor\4608\SiteAdv.dll O20 - Winlogon Notify: WgaLogon - F:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - F:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: GEARSecurity - GEAR Software - F:\WINDOWS\System32\GEARSec.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Lan Discover Agent (magaService) - Unknown owner - F:\Program Files\Sygate\SSA\maga\maga.exe (file missing) O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - F:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mclogsrv.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - f:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - f:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - F:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mctskshd.exe O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - F:\PROGRA~1\McAfee\MSC\mcusrmgr.exe O23 - Service: Norton Ghost - Symantec Corporation - F:\Program Files\Norton Ghost\Agent\VProSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: SiteAdvisor Service - Unknown owner - F:\Program Files\SiteAdvisor\4608\SAService.exe O23 - Service: Symantec Core LC - Symantec Corporation - F:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe continued.. |
07-Dec-2006, 07:08 PM
#7 | |||||
| Hi, BigDude3 Have the following lines fixed in Hijackthis: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = Let me see the ActiveSCan whenever possible. |
07-Dec-2006, 07:19 PM
#8 | |||||
| Hi, BigDude3 Seems that activescan found malware in both of your drives. Please download the Killbox by Option^Explicit. Note: In the event you already have Killbox, this is a new version that I need you to download.
O8 - Extra context menu item: LimeShop Preferences - file://F:\Program Files\LimeShop\System\Temp\limeshop_script0.htm Now close all windows and browsers, other than HiJackThis, then click Fix Checked. Close Hijackthis. Reboot into safe mode. Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present): MediaPipe LimeShop Please note any other programs that you dont recognize in that list in your next response Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these folders (if present): C:\Program Files\MediaPipe F:\Program Files\LimeShop
If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again. The rest of the log looks clear. How is the computer doing?
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
|
08-Dec-2006, 12:51 PM
#9 |
| Round3 (I think) Did as requested..computer is running great. One item I have is even though the "Limeshop" program was removed and is not listed when I look under F:\Programs" it still shows up as an entry in "Control Panel-Add/Remove programs"..as an entry but with no details or size...now when i try to "Remove" I get error message: "ERROR: Could not execute main : The system cannot find the file specified" Not a biggie I guess given other performance improvements. Thanks again for all your help and you can expect a little something from Santa. ![]() |
08-Dec-2006, 05:01 PM
#10 | |||||
| Hi, BigDude3 1. Launch Notepad, and copy/paste the contents of the quote box below into a new Notepad file. Save it with file name options.txt and save as file type: all files to your desktop. Quote:
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
|
08-Dec-2006, 07:56 PM
#11 |
| Round 4 Ok here 'tis: REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 12/8/2006 6:54:25 PM for strings: ; 'limeshop' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs] "F:\\Program Files\\LimeWire\\3.8.7\\limeshop.html"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lime shop.xml] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lime shop.xml] @="LimeShop" "DisplayName"="LimeShop" "UninstallString"="wjview /cp \"F:\\Program Files\\LimeShop\\System\\Code\" Main lp: \"F:\\Program Files\\LimeShop\" ls: deletefeature ld: feature=limeshop.xml"[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\Fi rewallPolicy\StandardProfile\AuthorizedApplications\List] "F:\\Program Files\\LimeShop\\LimeShop.exe"="F:\\Program Files\\LimeShop\\LimeShop.exe:*:Enabled:LimeShop" [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\Fi rewallPolicy\StandardProfile\AuthorizedApplications\List] "F:\\Program Files\\LimeShop\\LimeShop.exe"="F:\\Program Files\\LimeShop\\LimeShop.exe:*:Enabled:LimeShop" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameter s\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "F:\\Program Files\\LimeShop\\LimeShop.exe"="F:\\Program Files\\LimeShop\\LimeShop.exe:*:Enabled:LimeShop" [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache] "F:\\Program Files\\LimeShop\\LimeShop.exe"="LimeShop" [HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache] "F:\\Program Files\\LimeShop\\LimeShop.exe"="LimeShop" ; End Of The Log... |
09-Dec-2006, 11:43 AM
#12 | |||||
| Hi, BigDude3 The steps that I am about to suggest involve modifying the registry. Modifying the registry can be dangerous so we will make a backup of the registry first. Modification of the registry can be EXTREMELY dangerous if you do not know exactly what you are doing so follow the steps that are listed below EXACTLY. if you cannot preform some of these steps or if you have ANY questions please ask BEFORE proceeding. Backing Up Your Registry
Download the enclosed file. Save and extract its contents to the desktop. It is a folder containing a Registry Entries file, Regfix.reg . Once extracted, open the folder and double click on the Regfix.reg file and select Yes when prompted to merge it into the registry. Restart the computer. Let me know how is the computer doing and if Limeshop still present in the list of programs.
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
10-Dec-2006, 04:07 PM
#14 | |||||
| Hi, BigDude3 Go to Start->Run, type Regedit and click Ok. Select File from the menu, then Import. Locate the Regfix.reg file and double click on it. There will be a message if the information was successfuly merged into your registry. Close all windows. Restart the computer. Let me know the outcome.
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
|
10-Dec-2006, 05:42 PM
#15 |
| LimeShop Ok got it to take but still shows in "Add/Remove" (Limeshop) and again when I hit "remove" I get the same error message; here's info: REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 12/10/2006 4:38:00 PM for strings: ; 'limeshop' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lime shop.xml] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\lime shop.xml] @="LimeShop" "DisplayName"="LimeShop" "UninstallString"="wjview /cp \"F:\\Program Files\\LimeShop\\System\\Code\" Main lp: \"F:\\Program Files\\LimeShop\" ls: deletefeature ld: feature=limeshop.xml"; End Of The Log... |

|
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |

| Thread Tools | |
| |
| You Are Using: |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 01:22 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. | |

