1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.


Discussion in 'Business Applications' started by Crowbar, Jun 10, 2005.

Thread Status:
Not open for further replies.
  1. Crowbar

    Crowbar Thread Starter

    Nov 1, 2003
    I have had this on my computer ever since I 'fixed it' (wiped my C drive). I tried asking for help but nobody seem to know/care/have time to answer, so maybe this time around somebody might stumble upon this. Only thing I have now is Ewido to keep my self clean of spyware, but I believe it's a trial, and I never used to need things like Ewido to protect my comp. Used to run for 4 years without popups or any problems, but once I wiped the drive, it's just nonesense.

    Main thing I think is neededware.com. How do I go about getting rid of this? I tried looking up online guides, but couldn't find anything that worked. If anyone has time, could you please help me out. I just want it to run how it used to, meaning no spyware problems what so ever. Thank you. :( (y)

    Below is my Hijack log if anyone would like to take a look :eek:

    Logfile of HijackThis v1.99.1
    Scan saved at 5:28:20 PM, on 6/10/2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    C:\Program Files\ewido\security suite\ewidoctrl.exe
    C:\Program Files\ewido\security suite\ewidoguard.exe
    C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)
    O2 - BHO: WinStat - {F007E221-018D-4baf-924A-B0E9092F3853} - C:\WINDOWS\System32\WinStat11.dll (file missing)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [wdpyls] C:\WINDOWS\System32\wdpyls.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O15 - Trusted Zone: http://www.neededware.com
    O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1629B235-C9FD-44CA-BF3B-CEF1F9B8110C}: NameServer =,
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1629B235-C9FD-44CA-BF3B-CEF1F9B8110C}: NameServer =,
    O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
    O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
  2. EBSchrader


    Jan 28, 2001
    It seems that neither neededware URL is functional. I ran a Google search for neededware and there are many *offers* to remove it. I'd check them out, if I were you. By the way, you seem to have some missing files in that listing. You might want to check that out, too.
  3. Crowbar

    Crowbar Thread Starter

    Nov 1, 2003
    I followed one of those things to remove neededware.com, but it didn't work again. I really don't know what to do anymore :(
  4. Cheeseball81

    Cheeseball81 Retired Moderator

    Mar 3, 2004
    Hi Crowbar

    Important!: First thing we need to do is have Hijack This in a permanent folder on your hard drive. That way it can create the necessary backups.

    Please do this -
    Click here to redownload Hijack This: http://thespykiller.co.uk/files/hijackthis_sfx.exe

    Let it extract to C:\Program Files

    Now, once it's in its new location...
    With IE closed, run Hijack This again.
    Put a checkmark on these entries and hit "fix checked":

    O2 - BHO: WinStat - {EE02B99B-1D55-48bc-B8DB-649A42CE45F6} - C:\WINDOWS\System32\WinStat12.dll (file missing)

    O2 - BHO: WinStat - {F007E221-018D-4baf-924A-B0E9092F3853} - C:\WINDOWS\System32\WinStat11.dll (file missing)

    O4 - HKLM\..\Run: [wdpyls] C:\WINDOWS\System32\wdpyls.exe

    O15 - Trusted Zone: http://www.neededware.com

    O16 - DPF: NDWCab - http://www.neededware.com/ndw3.cab

    Boot into Safe Mode (start tapping the F8 key at Startup, before the Windows logo screen)

    Because XP will not always show you hidden files and folders by default,
    Go to Start > Search and under "More advanced search options".
    Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

    Next click on My Computer.
    Go to Tools > Folder Options.
    Click on the View tab and make sure that "Show hidden files and folders" is checked.
    Also uncheck "Hide protected operating system files" and "Hide extensions for known file types."
    Now click "Apply to all folders"
    Click "Apply" then "OK"

    Find and delete this file: C:\WINDOWS\System32\wdpyls.exe

    Also in safe mode navigate to the C:\Windows\Temp folder.
    Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

    Go to Start > Run and type %temp% in the Run box.
    The Temp folder will open. Click Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

    Finally go to Control Panel > Internet Options.
    On the General tab under "Temporary Internet Files" Click "Delete Files".
    Put a check by "Delete Offline Content" and click OK.
    Click on the Programs tab then click the "Reset Web Settings" button.
    Click Apply then OK.

    Empty the Recycle Bin.

    Reboot, post a new log.
  5. Ronfra


    Jun 21, 2005
    This neededware is just not needed and I got rid of it very simply, Might want to try this...

    #1 Go to start button and open search

    #2 Click search all files and folders

    #3 Leave file name blank and proceed to next box below to a word or phrase in the file and type

    #4 Proceed to search and see if that hits a target and then delete that file..

    I found a file in my document and settings with a file name description.ini configuration settings The icon looks like the notepad with a gear on side.

    This might had been pure luck but I no longer see the neededware.com turning up in my Trusted Sites area.... :rolleyes:
  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/370442

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice