Forum Home
Press F1
Thread ID: 82859	2007-09-10 11:31:00	AVG: Virus Found	spaceman8815 (4112)	Press F1

Post ID	Timestamp	Content	User
590037	2007-09-10 11:31:00	Hi, A day or two ago AVG said "virus found BAT/BWG" I Healed it with AVG but when i restarted and AVG scanned again the virus was still there . It says it is located in my recycling bin as the file $RM56AUY . rar and now AVG says that an error occurred while healing this file . When i go to my recycling bin in C drive there are no files in it . I've tried CCleaner, turning off system restore, trojan remover and below is a HiJack this log . What should i do to get rid of this OS: windows vista Home premium Logfile of Trend Micro HijackThis v2 . 0 . 2 Scan saved at 11:00:27 p . m . , on 10/09/2007 Platform: Windows Vista (WinNT 6 . 00 . 1904) MSIE: Internet Explorer v7 . 00 (7 . 00 . 6000 . 16512) Boot mode: Normal Running processes: C:\Windows\system32\Dwm . exe C:\Windows\Explorer . EXE C:\Program Files\Windows Defender\MSASCui . exe C:\Program Files\Synaptics\SynTP\SynTPEnh . exe C:\Acer\Empowering Technology\eDataSecurity\eDSloader . exe C:\Program Files\KMaestro\Kmaestro . exe C:\Program Files\Common Files\InstallShield\UpdateService\issch . exe C:\Windows\vsnpstd . exe C:\Program Files\Java\jre1 . 6 . 0_02\bin\jusched . exe C:\Program Files\Grisoft\AVG7\avgcc . exe C:\Program Files\Windows Sidebar\sidebar . exe C:\Program Files\APOD\apod . exe C:\Program Files\Occult Watcher\OccultWatcher . exe C:\Program Files\Xnet Usage Monitor\XNetUsage . exe C:\Program Files\ATI Technologies\ATI . ACE\Core-Static\MOM . EXE C:\Program Files\Windows Sidebar\sidebar . exe C:\Program Files\ATI Technologies\ATI . ACE\Core-Static\CCC . exe C:\Windows\system32\taskeng . exe C:\Windows\system32\wbem\unsecapp . exe C:\Program Files\Microsoft Office\Office12\WINWORD . EXE C:\Program Files\Mozilla Firefox\firefox . exe C:\Windows\system32\SearchFilterHost . exe C:\Program Files\Trend Micro\HijackThis\HijackThis . exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = . xtramsn . co . nz/0SEENNZ/SAOS01?FORM=TOOLBR" target="_blank">g . xtramsn . co . nz R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = . xtramsn . co . nz/0SEENNZ/SAOS01?FORM=TOOLBR" target="_blank">g . xtramsn . co . nz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www . google . co . nz/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en . nz . acer . yahoo . com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = . microsoft . com/fwlink/?LinkId=54896" target="_blank">go . microsoft . com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = . microsoft . com/fwlink/?LinkId=54896" target="_blank">go . microsoft . com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en . nz . acer . yahoo . com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = . xtramsn . co . nz/0SEENNZ/SAOS01?FORM=TOOLBR" target="_blank">g . xtramsn . co . nz R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = * . local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\ Yahoo! \Companion\Installs\cpn\yt . dll O1 - Hosts: ::1 localhost O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\ Yahoo! \Companion\Installs\cpn\yt . dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7 . 0\ActiveX\AcroIEHelper . dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin . dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper . dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1 . 6 . 0_02\bin\ssv . dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar . dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\ Yahoo! \Companion\Installs\cpn\yt . dll O4 - HKLM\ . . \Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui . exe -hide O4 - HKLM\ . . \Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh . exe O4 - HKLM\ . . \Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader . exe O4 - HKLM\ . . \Run: [BtcMaestro] "C:\Program Files\KMaestro\KMaestro . exe" O4 - HKLM\ . . \Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch . exe" -start O4 - HKLM\ . . \Run: [snpstd] C:\Windows\vsnpstd . exe O4 - HKLM\ . . \Run: [nod32kui] "C:\Program Files\Eset\nod32kui . exe" /WAITSERVICE O4 - HKLM\ . . \Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1 . 6 . 0_02\bin\jusched . exe" O4 - HKLM\ . . \Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc . exe /STARTUP O4 - HKCU\ . . \Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar . exe /autoRun O4 - HKCU\ . . \Run: [ehTray . exe] C:\Windows\ehome\ehTray . exe O4 - HKCU\ . . \Run: [FolderShare] "C:\Program Files\FolderShare\FolderShare . exe" /background O4 - HKCU\ . . \Run: [apod] C:\PROGRA~1\APOD\apod . exe O4 - HKCU\ . . \Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM . exe" -startup O4 - HKCU\ . . \Run: [StartCCC] C:\Program Files\ATI Technologies\ATI . ACE\Core-Static\CLIStart . exe O4 - HKCU\ . . \Run: [OccultWatcher] C:\Program Files\Occult Watcher\OccultWatcher . exe O4 - HKUS\S-1-5-19\ . . \Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar . exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\ . . \Run: [WindowsWelcomeCenter] rundll32 . exe oobefldr . dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\ . . \Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw . exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\ . . \Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar . exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\ . . \Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw . exe /RUNONCE (User 'SYSTEM') O4 - HKUS\ . DEFAULT\ . . \Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw . exe /RUNONCE (User 'Default user') O4 - Startup: OneNote 2007 Screen Clipper and Launcher . lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM . EXE O4 - Startup: Xnet Usage Monitor . lnk = C:\Program Files\Xnet Usage Monitor\XNetUsage . exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL . EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1 . 6 . 0_02\bin\ssv . dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1 . 6 . 0_02\bin\ssv . dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE . dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE . dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin . dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR . DLL O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\ Yahoo! \Common\yinsthelper . dll O18 - Protocol: bw+0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw+0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw-0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw-0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw00 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw00s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw10 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw10s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw20 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw20s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw30 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw30s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw40 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw40s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw50 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw50s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw60 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw60s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw70 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw70s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw80 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw80s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw90 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bw90s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwa0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwa0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwb0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwb0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwc0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwc0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwd0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwd0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwe0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwe0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwf0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwf0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480 . dll O18 - Protocol: bwg0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwg0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwh0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwh0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwi0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwi0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwj0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwj0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwk0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwk0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwl0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwl0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwm0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwm0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwn0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwn0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwo0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwo0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwp0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwp0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwq0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwq0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwr0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwr0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bws0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bws0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwt0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwt0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwu0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwu0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwv0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwv0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bww0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bww0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwx0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwx0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwy0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwy0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwz0 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: bwz0s - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: offline-8876480 - {5A4599A2-231B-4E2D-BB74-B8E21F52AFB3} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480 . dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1 . DLL O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf . dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc . exe O23 - Service: Ati External Event Utility - ATI Technologies Inc . - C:\Windows\system32\Ati2evxx . exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s . r . o . - C:\PROGRA~1\Grisoft\AVG7\avgamsvr . exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s . r . o . - C:\PROGRA~1\Grisoft\AVG7\avgupsvc . exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s . r . o . - C:\PROGRA~1\Grisoft\AVG7\avgrssvc . exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s . r . o . - C:\PROGRA~1\Grisoft\AVG7\avgemc . exe O23 - Service: ##Id_String1 . 6844F930_1628_4223_B5CC_5BB94B879762# # (Bonjour Service) - Apple Computer, Inc . - C:\Program Files\Bonjour\mDNSResponder . exe O23 - Service: eLock Service (eLockService) - Acer Inc . - C:\Acer\Empowering Technology\eLock\Service\eLockServ . exe O23 - Service: eNet Service - Acer Inc . - C:\Acer\Empowering Technology\eNet\eNet Service . exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc . - C:\Acer\Empowering Technology\eRecovery\eRecoveryService . exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv . exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd . - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService . exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc . exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService . exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn . exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo . exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc . exe O23 - Service: XAudioService - Conexant Systems, Inc . - C:\Windows\system32\DRIVERS\xaudio . exe -- End of file - 20884 bytes	spaceman8815 (4112)
590038	2007-09-10 13:29:00	Ouch! That is a truly awful log! I can't help you with a proper analysis, but one thing that leaps out as being a problem is OccultWatcher.exe :eek:	Greg (193)
590039	2007-09-10 14:10:00	Whats up with all these Logitech entries? Try and get Avast AV as it is far more effective than AVG and also Spybot-SD. Get them both and run full scans as soon as possible and see if that produces a different HJT log.	beeswax34 (63)
590040	2007-09-10 21:51:00	Also noticed you had / have Nod32 AV installed - O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe You can't run more than 1 antivirus at a time as often they pick up items in the other AV. Run only 1 AV - Avast or Nod32 -what ever you decide, remove the others.	wainuitech (129)
590041	2007-09-10 22:05:00	You can tick these entries then tick fix checked. Close browser/s. These are safe O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup This maybe nasty O4 - HKCU\..\Run: [apod] C:\PROGRA~1\APOD\apod.exe Yer not too sure whether that OccultWatcher.exe entry is good or not.	Speedy Gonzales (78)
590042	2007-09-10 22:49:00	Yer not too sure whether that OccultWatcher . exe entry is good or not . Occult Watcher is a program i installed, it gives me up to date information on when various asteroids will pass in front of stars . And APOD is my astronomy picture of the day wallpaper which downloads a new image every day . i also already have spybot and will try Avast I am also not sure where the all the logitech stuff comes from as the only logitech stuff i have is my USB mouse .	spaceman8815 (4112)
590043	2007-09-10 23:18:00	I am also not sure where the all the logitech stuff comes from as the only logitech stuff i have is my USB mouse. Its "junk" that installed with the mouse possibly - Here (www.fbmsoftware.com) Discribes it.	wainuitech (129)
590044	2007-09-11 03:18:00	I scanned with avast and it found it. It said that it was a worm virus of the description Win32:Kapucen-B. Funny that AVG was unable to remove it.	spaceman8815 (4112)
590045	2007-09-11 03:35:00	I scanned with avast and it found it . It said that it was a worm virus of the description Win32:Kapucen-B . Funny that AVG was unable to remove it . NArrrrrrrrr not surprised at all:lol: :groan:	wainuitech (129)
1