Hijack This Follow up

Apreciar

Following loads of help from "Closed" my pc is running much better.
The advise to delete Google updater has been tried but they just will not go. Have changed from Avira to Avast'

Task Manager
Total 364
Limit 1736340
Peak 654392

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:25:45, on 23/11/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 SP2 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\FsUsbExService.Exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Macrium\Reflect\ReflectService.exe
C:\Program Files\TalkTalk\bin\sprtsvc.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Supportsoft\bin\tgsrvc.exe
C:\Program Files\KeePass Password Safe\KeePass.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://dts.search-results.com/sidebar.html?src=ssb&appid=179&systemid=406&sr=0
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com/sr?src=ieb&appid=179&systemid=406&sr=0&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com/sr?src=ieb&appid=179&systemid=406&sr=0&q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://omega-search.com/find/panel_search.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\Datamngr\ToolBar\searchqudtx.dll
O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~1\WI371A~1\Datamngr\BROWSE~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WI371A~1\Datamngr\ToolBar\searchqudtx.dll
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\RunOnce: [AvgRemover] C:\Documents and Settings\Marshall\Local Settings\Temporary Internet Files\Content.IE5\QZA6OITK\avg_remover_stf_x86_2012_1796[1].exe /run_number=2 /avgdir="C:\Program Files\AVG\AVG2012\" /avgdatadir="C:\Documents and Settings\All Users\Application Data\AVG2012\" /ndis_nextstep=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Free History Cleaner - {ECC5778A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Free History Cleaner - {ECC5778A-6E88-BFCE-13CE-81F134789E7B} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O20 - AppInit_DLLs: C:\PROGRA~1\WI371A~1\Datamngr\datamngr.dll C:\PROGRA~1\WI371A~1\Datamngr\IEBHO.dll
O23 - Service: Avira Upgrade Service (AntiVirUpgradeService) - Unknown owner - C:\DOCUME~1\Marshall\LOCALS~1\Temp\AVSETUP_49c00419\basic\avupgsvc.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FsUsbExService - Teruten - C:\WINDOWS\system32\FsUsbExService.Exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - C:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: SupportSoft Sprocket Service (TalkTalk) (sprtsvc_TalkTalk) - SupportSoft, Inc. - C:\Program Files\TalkTalk\bin\sprtsvc.exe
O23 - Service: SupportSoft Repair Service (TalkTalk) (tgsrvc_TalkTalk) - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\tgsrvc.exe
--
End of file - 6963 bytes

espresso

Apreciar wrote: »

The advise to delete Google updater has been tried but they just will not go.

Interesting read here

Apreciar

espresso wrote: »

Interesting read here

Read it but don't understand, can you explain it simply?

espresso

Apreciar wrote: »

Read it but don't understand, can you explain it simply?

Basically they have made it difficult to remove but can be done e.g. from the link:

GoogleUpdate = Bloatware/Malware/Garbage.

After disabling the Scheduled Tasks, disabling the service and rebooting, even with Google Earth set to not download updates, googleupdate.exe was still coming up in Task manager. No option to uninstall from anywhere.

Not too easy to get rid of this, but possible.

1. Kill the process from Task Manager.
2. Go to C:\Program Files\Google\Update and delete the contents of this directory
3. Set the NTFS Security on C:\Program Files\Google\Update to "Everyone > Deny > Full Control" (this prevents Google applications re-installing Google Update)
4. Delete the Scheduled Tasks for Google (there may be more than one)
5. Open Services and locate Google Update Service, open this service up and note the "Service Name"
6. Open Regedit and remove HKLM\SYSTEM\CurrentControlSet\Services\"Service Name" that you found in step 5
7. Reboot.

Did this a few weeks ago and no sign of googleupdate.exe or any other variants since and I have not had any problems with Google apps (Earth and Chrome) that I run.

This posting is provided As Is and anything that happens to your PC from following these instructions is on you.

Apreciar

Ana advice on Hijack This log??

closed

It's harder to follow progress with so many threads, things I keep mentioning are still there, if you are having trouble removing please explain what you are trying, and what is happening

http://forums.moneysavingexpert.com/showpost.php?p=48680409&postcount=18

you've install searchqu toolbar/datamgr since the last one, I'd uninstall it.

and tick and fix the references to avg and avira

is there old printer software on this machine?

Apreciar

you've install searchqu toolbar/datamgr since the last one, I'd uninstall it.

I noticed that ,it became my default page on the browswes I use, couldn't fid the file anywhere, so just deleted the directories in Program folder.

and tick and fix the references to avg and avira

I keep ticking the references in the Hijack this log but they just keep coming back

is there old printer software on this machine

Idont think so, I have three printers in use HP laser, HP deskjet and Brother laser.

closed

you should really attempt to uninstall things, deleting files doesn't delete everything. watch what you install, otherwise it will just get full up with bloat/infections again

ok, saw brother and hp and assumed one might be old.

tick and fix?

uninstall the supportsoft (talk talk)

disable the google services, delete the update task under c:\windowa\tasks, or uninstall the software that put them there.

fix the proxy in IE

Apreciar

Just to be clear, if I tck the box in HijackThis log and press the fix checked button, this should delete the, is that so? This is what I have been doing bit they are not deleted. Am I missing a trick here:mad::mad:

closed

that's what should happen

Apreciar

closed wrote: »

that's what should happen

This what I have been doing, I have just tried to delete one item at a time and then rescan, I thing this is working, can I repost you a new log for your last and very patient andvise.