Ravin,
I didn't mean to GET RID.. I meant can I remove it from my toolbar..it has never been there before. If it has to be there NO problem.

I don't want to do anymore till I'm told what to do next..on my own I'd probably do the wrong thing for sure.
Thanks for all the help so far.
Dar

Hi,

We are going to remove some 04 entries only , those are the programs that start up with windows. Do not make any changes uninstall, install any programs as we work here.

Close all windows, only have Hijackthis open, Double click the Hijackthis Icon on the Desktop. Do A System Scan Only Place a check mark in the following 04 entries only be sure to get them all and No others: here are the entries to check,

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: Event Planner Reminder.lnk = ?
O4 - Global Startup: Forget Me Not.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

Click Fix Checked.

Close Hijackthis Program.

Reboot The computer.

* Once the computer has rebooted please double click the Hijackthis Icon on the desktop. Do A System Scan and Save a Log file.

Post the new log generated in your next reply so we can see the 04 entries are removed.

Good morning,
I sure hope I got them all.. I checked over them a couple of times.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:48:53 AM, on 4/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - "3CA2F312-6F6E-4B53-A66E-4E65E497C8C0> - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - "601ED020-FB6C-11D3-87D8-0050DA59922B> - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: AVG Security Toolbar - "A057A204-BACC-4D26-9990-79A187E2698E> - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - "AF69DE43-7D58-4638-B6FA-CE66B5AD205D> - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll (file missing)
O2 - BHO: WOT Helper - "C920E44A-7F78-4E64-BDD7-A57026E7FEB7> - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - "DBC80044-A445-435b-BC74-9C25C1C588A9> - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - "E7E6F031-17CE-4C07-BC86-EABFE594F69C> - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - "71576546-354D-41c9-AAE8-31F2EC22BF0D> - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: (no name) - "A057A204-BACC-4D26-9990-79A187E2698E> - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O18 - Protocol: linkscanner - "F274614C-63F8-47D5-A4D1-FBDDE494F8D1> - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: wot - "C2A44D6B-CB9F-4663-88A6-DF2F26E4D952> - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - "438755C2-A8BA-11D1-B96B-00A0C90312E1> - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - "8C7461EF-2B13-11d2-BE35-3078302C2030> - C:\WINDOWS\system32\browseui.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5133 bytes

Zep,
I just noticed that THE WEATHER CHANNEL one is there. They must have discontinued that one as neither my sons or mine work anymore. before we finish maybe we can take that one off..doing nothing till U tell me to. I want weather watcher.

Talking about weather.. it is a beautiful day here 77* without a cloud in the sky.
Dar

See this 020 Entry below it says File Missing

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

This is a valid program that is required to run at startup.

This program is required to run on startup in order to benefit from its functionality or so that the program will work. The AVG Program that is......

Description: Related to the AVG Free antivirus software.

Usually when we see file missing it indicates the program has been removed. Not sure why that is like that but we need to address it, could that have resulted from the system restore?

Is your AVG Anti Virus working?

Bottom line looks like we will need to uninstall AVG and reinstall it. I will give detail directions for that.

Well I know I didn't delete that today by accident..if I accidentally did it would have been yesterday but we did an restore. I only did 04. Other than that I had no idea but lets fix it. My AVG seems to be scanning like it should. Now that we have to delete AVG do U think it would be best to put AVG back or install Avast? I'll do what ever U think is best.
Dar

Lets try Microsoft Security Essentials. Because it's very simple to install and use. I use it too.

Here is link below, look for download it's in blue on that page looks like this Download Microsoft Security Essentials now. Click it let it download.

Just Download it. Don't install it yet. Tell me when That's done and the set-up Icon is on the Desktop. I will give instruction for removing AVG next.

I have it downloaded now. It didn't go to the desktop. I thought it was set to do that. I think I can find it with search but wonder why it didn't go to the desktop & gave me no option.

What browser are you using? The option to set downloads is in the browser ok.

Tell me the browser you're using?

Tell me when you find the set up file for Microsoft Security Essentials. If you can't find it say so.

I use FireFox.. the only place I see it is in the download file. I did a search & it didn't find it. I can't find where to have downloads go. I know I have seen that before.

Lets set up Firefox to download everything to the desktop, it's going to much easier for you this way. Forget the other set up file for now.

At the very top of the Firefox Browser, by File, Edit, View, History, Bookmarks, Tools, Help.

Click Tools a window opens, at the bottom click Options when you click options the window opens, at the top click the General Tab it's the first one on left at top.

Once in there look down the window a bit for the word downloads.

Looks like this:
{{gwi:1472055}}

See the little circle where it says Save files to <?i>

Click it so a dot is in there, Then click browse and select desktop click ok, make sure desktop shows in the window. Everything will download to the desktop now.

Download Microsoft Security Essentials again. Take as much time as you need to figure this out.

should I try downloading it again? This is where I downloaded it from.
{{gwi:1472056}}

yes..I found where the setting to put it on the desktop is. I don't know how it got changed. it is now set.
Dar

Sugar, in firefox, go to tools,options, and click on main tab. In the middle you will see downloads. You will also see a browse button, click on the browse button, and set it to where you want your files to go, sounds like you want them to go to desktop, so make sure it says desktop. Good Luck :-) Cat

I just had a senior moment :(
Having to many lately..

Zep I have to leave for an hour or so.. I'll let U know when I get back.. I probably need to down load that file as I can't find it anywhere.. in tools it said it was in download but don't see it there..of course I changed it to desktop.
Thanks,
Dar

Yes download it again, let me know when it's on desktop, remember don't install yet, just download it. Then we will remove AVG.

Go here next click Here
and download the AVG Remover.

This is the one below to click on and download from the link given above where it says click here. It's the first one listed on the AVG page.

AVG Remover(32bit)
(avgremover.exe)

When that AVG Remover finishes, Double click the SET-UP file for Microsoft Security Essentials you downloaded to desktop and install it.

Post a fresh Hijackthis log when done.

I don't think anything comes easy for me.. the update FAILED..
{{gwi:1472057}}

forgot to say.. I can't get that message off my desktop.

Ok, we will see what that is. Did you remove AVG? If not do so.

Yes I ran the remover..it also rebooted

Ok Good job, on AVG Congratulations!

I am not going to fool around with this Microsoft Security Essentials error, the solution is to download Dial a fix. I'm not getting into all that this would go on another 17 follow ups.

So here's the deal Lets Download Avast Free here is link. Click the orange download tab on that page. Just download it to your desktop. Do not double click it and install it yet.

Now lets uninstall Microsoft Security Essentials:

to do that click Start > Control Panel > In there double click Add / Remove, once the list opens look for Microsoft Security Essentials and uninstall it.

Then double click the Avast Set up file you downloaded before and proceed to install it.

Take all the time you need here to do this. If your tired lets do it tomorrow.

I THINK I have it setup OK. It seems I only have a year registration.
I'm sure (I hope) that it works OK with things like ZoneAlarm & MWB. I basically left the setting as is. If that's not OK let me know.
Is there anything else I need to know about it?

By Add/remove I still have Windows resource kit tools what ever that is.

I know U are getting tired of me but if there is more we need to do we can work on it tomorrow..
THANKS,
Dar

I am in no way tired of you!

I need to see a fresh hijackthis log.

Do a System Scan and save a log file, then post it....

You are very kind.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 9:52:01 PM, on 4/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - (no file)
O2 - BHO: Ipswitch.WsftpBrowserHelper - (601ED020-FB6C-11D3-87D8-0050DA59922B) - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: AVG Security Toolbar - (A057A204-BACC-4D26-9990-79A187E2698E) - (no file)
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll (file missing)
O2 - BHO: WOT Helper - (C920E44A-7F78-4E64-BDD7-A57026E7FEB7) - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - (71576546-354D-41c9-AAE8-31F2EC22BF0D) - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: (no name) - (A057A204-BACC-4D26-9990-79A187E2698E) - (no file)
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - (no file)
O18 - Protocol: wot - (C2A44D6B-CB9F-4663-88A6-DF2F26E4D952) - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - (438755C2-A8BA-11D1-B96B-00A0C90312E1) - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - (8C7461EF-2B13-11d2-BE35-3078302C2030) - C:\WINDOWS\system32\browseui.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5171 bytes

Please BookMark this site for Avast help and instructions if needed. See link.. A good reference site for you.

Got it.. will check it out.

In that scan I see a few missing files but probably not important. I also see a AVG toolbar but don't see it under view.

Post the scan please, there probably left over files from removing avg and microsoft security.

Zep I did post it.. it was still in my taskbar so here it is again.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 9:52:01 PM, on 4/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - (no file)
O2 - BHO: Ipswitch.WsftpBrowserHelper - (601ED020-FB6C-11D3-87D8-0050DA59922B) - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: AVG Security Toolbar - (A057A204-BACC-4D26-9990-79A187E2698E) - (no file)
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll (file missing)
O2 - BHO: WOT Helper - (C920E44A-7F78-4E64-BDD7-A57026E7FEB7) - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - (71576546-354D-41c9-AAE8-31F2EC22BF0D) - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: (no name) - (A057A204-BACC-4D26-9990-79A187E2698E) - (no file)
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - (no file)
O18 - Protocol: wot - (C2A44D6B-CB9F-4663-88A6-DF2F26E4D952) - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - (438755C2-A8BA-11D1-B96B-00A0C90312E1) - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - (8C7461EF-2B13-11d2-BE35-3078302C2030) - C:\WINDOWS\system32\browseui.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5171 bytes

Beautiful, well Done!

The entries with no file are left overs. Lets remove them.

Close all windows only have hijackthis open, Do System Scan only. Place a check mark in the following entries make sure you get the all and No others.

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - (no file)

O2 - BHO: AVG Security Toolbar - (A057A204-BACC-4D26-9990-79A187E2698E) - (no file)

O3 - Toolbar: (no name) - (A057A204-BACC-4D26-9990-79A187E2698E) - (no file)

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - (no file)

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

Click Fix Checked.

Close Hijackthis.

Reboot

Tomorrow,

We will talk about Adobe, needs updated or get rid of it.

Maybe install Winpatrol So you can keep track of your Start up programs.

new scan
Zep I don't see the i or the a they are talking about in that tutorial..haven't read far yet.

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:58:21 PM, on 4/22/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Weather Watcher\ww.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Ipswitch.WsftpBrowserHelper - "601ED020-FB6C-11D3-87D8-0050DA59922B> - C:\Program Files\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: Google Toolbar Notifier BHO - "AF69DE43-7D58-4638-B6FA-CE66B5AD205D> - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll (file missing)
O2 - BHO: WOT Helper - "C920E44A-7F78-4E64-BDD7-A57026E7FEB7> - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - "DBC80044-A445-435b-BC74-9C25C1C588A9> - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - "E7E6F031-17CE-4C07-BC86-EABFE594F69C> - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - "71576546-354D-41c9-AAE8-31F2EC22BF0D> - C:\Program Files\WOT\WOT.dll
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SBAutoUpdate] "C:\Program Files\SpywareBlaster\sbautoupdate.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [WeatherWatcher] "C:\Program Files\Weather Watcher\ww.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O18 - Protocol: wot - "C2A44D6B-CB9F-4663-88A6-DF2F26E4D952> - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - "438755C2-A8BA-11D1-B96B-00A0C90312E1> - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - "8C7461EF-2B13-11d2-BE35-3078302C2030> - C:\WINDOWS\system32\browseui.dll
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4520 bytes

I won't have much time tomorrow till about 4:00. Should be free after that. Got a Mexican domino game & a few other things.
Thanks for all the help.
Dar

I must have to have the pay Avast to see a lot of the things in this tutorial..or am I missing something?

no that tutorial is for the free version of Avast.
did you do the registration? it will be good for one year then you just have to do another registration.
go to the link below and get the guides for the Avast free they are in pdf form so just download them to your pc and you can then have them handy to read, they handle all the various aspects of the newest version of Avast.

I only have a minute as I'm getting ready to go for therapy on my shoulder..
I don't see the I or A in my toolbar. I see I should have one. I don't remember but I wonder if I rebooted after finishing.. that is when it should come on. I don't see how I missed that message though. I did rebooted later. I do have the orange ball.
Be back later.
Dar

With the new version of Avast, the orange ball is all you will have in your toolbar.

Thanks Grams... fewer the better.

Zep if U have the time I am finally free to work on Adobe.
I think I'm gonna like Avast.
Dar

Ok,

Just go the link provided and click the Yellow Download Tab, that will install Adobe reader 9.3.

**** Pay Attention here, see the Free McAfee Security Scan. Uncheck the box. You don't want anything to do with this!

Once you uncheck the box then Download Adobe Reader.

Zep is the newest adobe better than Foxit? I think U or someone here recommended it to me.

No I like foxit better, it's smaller, but it adds a toolbar so you need to be careful downloading it and unslect any pre-checked items, always do a custom install if the option is there after you double click the set up file.

Here is link.

If this is what you're going to do, then uninstall Adobe from add / remove. You don't need Adobe for anything so uninstall everything called Adobe in the add / remove list.

I thought I already had Foxit.. it it not there & is adobe still there..I see adobe flash.. I need that don't I or is there something better

I know adobe can be a problem

I have a Java icon in my toolbar..but I think Java is up to date

Sorry keep Adobe flash.

Look in the add / remove programs list Foxit will be there if you have it.

This is what you have installed, Java(TM) 6 Update 19 . This is from the add / remove list that you provided me in a post way above.

Java is currently running at 6 Update 20, so you could up-date it to that version, up-date always include various fixes. You may be able to right click the Java Icon and gat the up- date that way.

I now have the latest version of Java.

Secunia says my foxit 3.1.4.1125 is a threat. I clicked solution & downloaded ..it gave me version 3.2.1.1401
it still says it is a threat. What is the latest version & where can I download it from?

I hope I have most things updated now.
Dar

Foxit Reader 3.2.1.0401

On that page look over to the right where it says Download Latest Version by the green arrow

Odd you got an out of date version from the other site.

I have that version of Foxit..I guess the problem is in Secunia..Wonder what is the latest version of Secunia is?

I have Acrobat.com
Adobe AIR
Flash player 10 ACTIVEX
Flash player 10 plugin

which ones do I remove?

Well stop wondering and use the resources available to you, such as google. Google latest version of Secunia surly one of the links would be a Secunia link.

I see no reason to remove anything at this time, unless an error is being generated, or it's running at start up and none of those are.

Is it possible to have a pc without any vulnerabilities?

See link

also they will give that warning when there is a known problem with the latest version of a program that has not yet been updated or patched, that may well be the case here. They know there is an issue with the latest version but there is not yet a new patched one out yet so they still let you know that what you have currently can be a security risk.
In those cases some people would choose to uninstall and wait others will just stay with what they have till the patched version is released.

Raven, Sorry I was so long answering.
The program in question is Foxit. I seem to have the same version (3.X is what it shows) that Zep does so I'll just let it be. I'm sure there is other weaknesses on the computer that I'm not aware of.
Thanks everyone for all the help. I'm sure in the near future I'll need more help.
Dar