aftermath of virus

[rwhit45673]

I recently suffered a virus. Afterwords, several things have happened.

1) My sound won't work.

2) I can't go back and restore from a prevous day (it fails.)

3) When I reboot, I get a message that CH Helper has failed.

Are all of these connected? When I run all of my virus/adware/spyware software, they tell me that I no longer have a virus or anything.

 

[cybertech]

You should post a log for us to review.
Click on this link: http://www.thespykiller.co.uk/files/HJTsetup.exe Double click on the file and it will install to C:\program files\hijackthis and create an entry in the start menu and an optional shortcut on desktop.

Close out any open browsers and launch the program.
Click on "Do a system scan and save a logfile.
The log will open in Notepad
Go to Edit,Select All, Edit, Copy
Come back to this thread
And press Ctrl+V to paste the log into the thread.

 

[rwhit45673]

Sorry about creating two posts. I really am new at this. Here is the result of running hijack

Logfile of HijackThis v1.99.1
Scan saved at 8:15:27 AM, on 6/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\STOPzilla!\szntsvc.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\System32\Ati2evxx.exe
F:\WINDOWS\system32\cisvc.exe
F:\WINDOWS\System32\CTsvcCDA.exe
f:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
F:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\WINDOWS\System32\MsPMSPSv.exe
F:\WINDOWS\system32\svchost.exe
f:\PROGRA~1\mcafee.com\vso\mcshield.exe
F:\WINDOWS\System32\alg.exe
F:\WINDOWS\system32\ctfmon.exe
F:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
f:\progra~1\mcafee.com\vso\mcvsescn.exe
F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
f:\program files\mcafee.com\agent\mcagent.exe
F:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
F:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
F:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\STOPzilla!\Stopzilla.exe
F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
F:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\McAfee\McAfee QuickClean\Plguni.exe
F:\Program Files\Spyware Doctor\swdoctor.exe
F:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
F:\Program Files\MSN Messenger\MsnMsgr.Exe
F:\Program Files\Digital Line Detect\DLG.exe
F:\Palm\HOTSYNC.EXE
F:\Program Files\Microsoft Office\Office\1033\msoffice.exe
F:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
f:\progra~1\mcafee.com\vso\mcvsftsn.exe
F:\Program Files\Messenger\msmsgs.exe
F:\WINDOWS\system32\cidaemon.exe
F:\WINDOWS\system32\uWDF.exe
F:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - {8773CDC6-F80D-D1F5-4021-3165C6E16D71688} - (no file)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O2 - BHO: ICOOExternal Class - {0519A9C9-064A-4cbc-BC47-D0EACD581477} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ICOODManager Class - {465A59EC-20E5-4fca-A38A-E5EC3C480218} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - F:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - F:\WINDOWS\system32\SZIEBHO.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - f:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: (no name) - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O4 - HKLM\..\Run: [MCUpdateExe] F:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "f:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [CTSysVol] F:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] F:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "F:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [VSOCheckTask] "f:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] F:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [abu] abu.exe
O4 - HKLM\..\Run: [STOPzilla] "F:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
O4 - HKLM\..\Run: [Microsoft Works Update Detection] F:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MPFExe] F:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] f:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [CleanUp] F:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKLM\..\Run: [clfmon.exe] clfmon.exe
O4 - HKLM\..\Run: [DellTouch] F:\WINDOWS\MMKeybd.exe
O4 - HKLM\..\Run: [Media Access] F:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [SysEntry] syspanel.exe
O4 - HKLM\..\Run: [System backup] F:\WINDOWS\system32\soft.exe
O4 - HKLM\..\Run: [zantu] killall.exe
O4 - HKLM\..\RunOnce: [*Restore] F:\WINDOWS\system32\restore\rstrui.exe -i
O4 - HKLM\..\RunOnce: [SpybotSnD] "F:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [McAfee QuickClean Imonitor] F:\Program Files\McAfee\McAfee QuickClean\Plguni.exe /START
O4 - HKCU\..\Run: [Spyware Doctor] "F:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [PPWebCap] F:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [MsnMsgr] "F:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Tracks Eraser] F:\Program Files\Tracks Eraser\te.exe min
O4 - HKCU\..\Run: [MoneyAgent] "F:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Tracks Eraser Pro] F:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] "F:\Program Files\Creative\SBAudigy2\Program\Startup Menu\Audigy.EXE" /L:ENG
O4 - HKCU\..\Run: [updateMgr] F:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_1
O4 - HKCU\..\Run: [Creative MediaSource Go] F:\Program Files\Creative\MediaSource\Go\CTCMSGo.exe /SCB
O4 - HKCU\..\Run: [DCC_send] Dest068.exe
O4 - HKCU\..\Run: [defect08] vxdman.exe
O4 - HKCU\..\Run: [HistoryKill] F:\Program Files\HistoryKill\histkill.exe /startup
O4 - HKCU\..\Run: [Serviceprocess] NSYSCPLSTR.exe
O4 - HKCU\..\Run: [System backup] F:\WINDOWS\system32\soft.exe
O4 - HKCU\..\Run: [WareOut] "F:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\RunOnce: [DelayShred] "F:\Program Files\McAfee\McAfee Shared Components\Shredder 5\SHRED32.EXE" /q F:\DOCUME~1\Owner\LOCALS~1\TEMPOR~1\Content.SH! F:\DOCUME~1\Owner\LOCALS~1\History\History.SH!
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HotSync Manager.lnk = F:\Palm\HOTSYNC.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = F:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://f:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://f:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://f:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://f:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://f:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - F:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - F:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.morwillsearch.com
O16 - DPF: {11111111-1111-1111-1111-111111111123} - http://crazy-toolbar.com/angel/61/soft.exe
O16 - DPF: {527196A4-B1A3-4647-931D-37BA5AF23037} - http://crazy-toolbar.com/angel/62/soft.exe
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O18 - Protocol: bw+0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {CD805849-7F39-447D-9ACB-8CF35E56B0D9} - F:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O23 - Service: Ati HotKey Poller - Unknown owner - F:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - F:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - f:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - F:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - f:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - F:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - F:\WINDOWS\Nhksrv.exe
O23 - Service: STOPzilla Local Service - International Software Systems Solutions - F:\Program Files\STOPzilla!\szntsvc.exe

 

[cybertech]

Click this link to download and install CCleaner.
http://www.filehippo.com/download_ccleaner.html
Don't run it yet!

Go to add/remove programs and remove Logitech Desktop Messenger. It's not necessary and is not working properly. You can add it back on later if you want to.

Also remove Media Access and WareOut.

Run HJT again and put a check in the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) - {8773CDC6-F80D-D1F5-4021-3165C6E16D71688} - (no file)
O2 - BHO: ICOOExternal Class - {0519A9C9-064A-4cbc-BC47-D0EACD581477} - (no file)
O2 - BHO: ICOODManager Class - {465A59EC-20E5-4fca-A38A-E5EC3C480218} - (no file)
O3 - Toolbar: (no name) - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - (no file)
O4 - HKLM\..\Run: [abu] abu.exe
O4 - HKLM\..\Run: [clfmon.exe] clfmon.exe
O4 - HKLM\..\Run: [Media Access] F:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [SysEntry] syspanel.exe
O4 - HKLM\..\Run: [System backup] F:\WINDOWS\system32\soft.exe
O4 - HKLM\..\Run: [zantu] killall.exe
O4 - HKCU\..\Run: [LDM] \Program\
O4 - HKCU\..\Run: [DCC_send] Dest068.exe
O4 - HKCU\..\Run: [defect08] vxdman.exe
O4 - HKCU\..\Run: [Serviceprocess] NSYSCPLSTR.exe
O4 - HKCU\..\Run: [System backup] F:\WINDOWS\system32\soft.exe
O4 - HKCU\..\Run: [WareOut] "F:\Program Files\WareOut\WareOut.exe"
O4 - HKCU\..\RunOnce: [DelayShred] "F:\Program Files\McAfee\McAfee Shared Components\Shredder 5\SHRED32.EXE" /q F:\DOCUME~1\Owner\LOCALS~1\TEMPOR~1\Content.SH! F:\DOCUME~1\Owner\LOCALS~1\History\History.SH!
O4 - Global Startup: Logitech Desktop Messenger.lnk = F:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O15 - Trusted Zone: *.morwillsearch.com
O16 - DPF: {11111111-1111-1111-1111-111111111123} - http://crazy-toolbar.com/angel/61/soft.exe
O16 - DPF: {527196A4-B1A3-4647-931D-37BA5AF23037} - http://crazy-toolbar.com/angel/62/soft.exe

Close all applications and browser windows before you click "fix checked".


Restart in Safe Mode

Open Windows Explorer. Go to Tools, Folder Options and click on the View tab.
Make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files".
Now click "Apply to all folders", Click "Apply" then "OK"


Delete these folders:
F:\Program Files\Media Access
F:\Program Files\WareOut

Delete these files:
abu.exe
clfmon.exe
syspanel.exe
killall.exe
Dest068.exe
vxdman.exe
NSYSCPLSTR.exe
F:\WINDOWS\system32\uWDF.exe
F:\WINDOWS\system32\soft.exe


Start Ccleaner and click Run Cleaner.


Reboot.

Go here and do an online virus scan.

Be sure and put a check in the box by "Auto Clean" before you do the scan. If it finds anything that it cannot clean have it delete it or make a note of the file location so you can delete it yourself.

Reboot and post another log.