Hijackthis log

foreign_correspondent

Hello folks,

My laptop is running slow and I have a ton of work to get through - could anyone have a look at my hijackthis log and advise please?:o


Logfile of Trend MicroHijackThis v2.0.4

Scan saved at 12:56:39,on 17/11/2012

Platform: Windows 7 SP1(WinNT 6.00.3505)

MSIE: Internet Explorerv9.00 (9.00.8112.16455)

Boot mode: Normal




Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\ProgramFiles\Trusteer\Rapport\bin\RapportService.exe

C:\ProgramFiles\Synaptics\SynTP\SynTPEnh.exe

C:\ProgramFiles\IDT\WDM\sttray.exe

C:\ProgramFiles\Hewlett-Packard\HP QuickWeb\hpqwutils.exe

C:\ProgramFiles\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

C:\Program Files\CommonFiles\Adobe\ARM\1.0\AdobeARM.exe

C:\ProgramFiles\Hewlett-Packard\HP On Screen Display\HPOSD.exe

C:\ProgramFiles\Hewlett-Packard\HP CoolSense\CoolSense.exe

C:\Program Files\CommonFiles\Java\Java Update\jusched.exe

C:\ProgramFiles\Synaptics\SynTP\SynTPHelper.exe

C:\ProgramFiles\Brother\ControlCenter3\brccMCtl.exe

C:\ProgramFiles\Hewlett-Packard\HP LaunchBox\HPTaskBar1.exe

C:\ProgramFiles\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe

C:\ProgramFiles\Browny02\Brother\BrStMonW.exe

C:\ProgramFiles\Microsoft Security Client\msseces.exe

C:\ProgramFiles\WIDCOMM\Bluetooth Software\BTTray.exe

C:\ProgramFiles\OpenOffice.org 3\program\soffice.exe

C:\ProgramFiles\OpenOffice.org 3\program\soffice.bin

C:\Windows\system32\taskeng.exe

C:\ProgramFiles\CyberLink\YouCam\YCMMirage.exe

C:\Program Files\ATITechnologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\ATITechnologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\CommonFiles\Java\Java Update\jucheck.exe

C:\ProgramFiles\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Users\Jbloggs\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\ProgramFiles\Internet Explorer\iexplore.exe

C:\ProgramFiles\Internet Explorer\iexplore.exe

C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

C:\ProgramFiles\Internet Explorer\iexplore.exe




R1 -HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://g.uk.msn.com/HPNOT/2

R1 -HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896

R0 -HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://www.google.co.uk/

R1 -HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://g.uk.msn.com/HPNOT/2

R1 -HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896

R1 -HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896

R0 -HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://g.uk.msn.com/HPNOT/2

R0 -HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 -HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 -HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini:UserInit=C:\Windows\system32\userinit.exe

O2 - BHO:AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -C:\Program Files\CommonFiles\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO:LinkAirBrowserHelper HistoryTriggerBHO -{21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files\LGElectronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll

O2 - BHO: Windows LiveID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} -C:\Program Files\Common Files\Microsoft Shared\WindowsLive\WindowsLiveLogin.dll

O2 - BHO: WebrootBrowser Helper Object - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -C:\ProgramData\WRData\pkg\LPBar.dll (file missing)

O2 - BHO: Java(tm)Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: WebrootToolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} -C:\ProgramData\WRData\pkg\LPBar.dll (file missing)

O4 - HKLM\..\Run:[StartCCC] "C:\Program Files\ATITechnologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run:[SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run:[SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe

O4 - HKLM\..\Run:[HPQuickWebProxy] "C:\Program Files\Hewlett-Packard\HPQuickWeb\hpqwutils.exe"

O4 - HKLM\..\Run: [HPQuick Launch] C:\Program Files\Hewlett-Packard\HP QuickLaunch\HPMSGSVC.exe

O4 - HKLM\..\Run:[Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader10.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run:[Adobe ARM] "C:\Program Files\CommonFiles\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run:[HPOSD] C:\Program Files\Hewlett-Packard\HP On ScreenDisplay\HPOSD.exe

O4 - HKLM\..\Run: [HPCoolSense] C:\Program Files\Hewlett-Packard\HPCoolSense\CoolSense.exe -byrunkey

O4 - HKLM\..\Run:[Easybits Recovery] C:\Program Files\EasyBits For Kids\ezRecover.exe

O4 - HKLM\..\Run:[SunJavaUpdateSched] "C:\Program Files\Common Files\Java\JavaUpdate\jusched.exe"

O4 - HKLM\..\Run:[SetDefault] C:\Program Files\Hewlett-Packard\HPLaunchBox\SetDefault.exe

O4 - HKLM\..\Run:[ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe/autorun

O4 - HKLM\..\Run:[BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN

O4 - HKLM\..\Run: [MSC]"c:\Program Files\Microsoft Security Client\msseces.exe"-hide -runkey

O4 - HKCU\..\Run:[Google Update]"C:\Users\Jbloggs\AppData\Local\Google\Update\GoogleUpdate.exe"/c

O4 - HKCU\..\Run: [LGLinkAir] C:\Program Files\LG Electronics\LG PC SuiteIV\LinkAir\LinkAir.exe

O4 -HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\WindowsSidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 -HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe(User 'LOCAL SERVICE')

O4 -HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\WindowsSidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 -HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe(User 'NETWORK SERVICE')

O4 - Startup:Dropbox.lnk = Jbloggs\AppData\Roaming\Dropbox\bin\Dropbox.exe

O4 - Startup:OpenOffice.org 3.4.1.lnk = C:\Program Files\OpenOffice.org3\program\quickstart.exe

O4 - Global Startup:Bluetooth.lnk = ?

O8 - Extra context menuitem: LG Air Sync (R-Click) - Save as Mobile Image - res://C:\ProgramFiles\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/206

O8 - Extra context menuitem: LG Air Sync (R-Click) - Save as Mobile Memo - res://C:\ProgramFiles\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/208

O8 - Extra context menuitem: LG Air Sync (R-Click) - Save as Mobile Text file -res://C:\Program Files\LG Electronics\LG PC SuiteIV\LinkAir\IEContextMenu.dll/210

O8 - Extra context menuitem: LG Air Sync (R-Click) - Set as Mobile Wallpaper -res://C:\Program Files\LG Electronics\LG PC SuiteIV\LinkAir\IEContextMenu.dll/205

O8 - Extra context menuitem: LG Air Sync Option - res://C:\Program Files\LG Electronics\LGPC Suite IV\LinkAir\IEContextMenu.dll/209

O8 - Extra context menuitem: Send image to &Bluetooth Device... - C:\ProgramFiles\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menuitem: Send page to &Bluetooth Device... - C:\ProgramFiles\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button:@C:\Program Files\WindowsLive\Writer\WindowsLiveWriterShortcuts.dll,-1004 -{219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\WindowsLive\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools'menuitem: @C:\Program Files\WindowsLive\Writer\WindowsLiveWriterShortcuts.dll,-1003 -{219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\WindowsLive\Writer\WriterBrowserExtension.dll

O9 - Extra button:@C:\Program Files\Evernote\Evernote\Resource.dll,-101 -{A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\ProgramFiles\Evernote\Evernote\EvernoteIE.dll/204 (file missing)

O9 - Extra 'Tools'menuitem: @C:\Program Files\Evernote\Evernote\Resource.dll,-101 -{A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\ProgramFiles\Evernote\Evernote\EvernoteIE.dll/204 (file missing)

O9 - Extra button:@C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 -{CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\ProgramFiles\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools'menuitem: @C:\Program Files\WIDCOMM\BluetoothSoftware\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} -C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O10 - Unknown file inWinsock LSP: c:\program files\common files\microsoft shared\windowslive\wlidnsp.dll

O10 - Unknown file inWinsock LSP: c:\program files\common files\microsoft shared\windowslive\wlidnsp.dll

O11 - Options group:[ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: wlpg -{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\WindowsLive\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: AdobeAcrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: AdobeFlash Player Update Service (AdobeFlashPlayerUpdateSvc) - AdobeSystems Incorporated -C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: AndreaST Filters Service (AESTFilters) - Andrea Electronics Corporation -C:\Program Files\IDT\WDM\aestsrv.exe

O23 - Service: AMDExternal Events Utility - AMD - C:\Windows\system32\atiesrxx.exe

O23 - Service: BrYNSvc- Brother Industries, Ltd. - C:\Program Files\Browny02\BrYNSvc.exe

O23 - Service:Bluetooth Service (btwdins) - Broadcom Corporation. - C:\ProgramFiles\WIDCOMM\Bluetooth Software\btwdins.exe

O23 - Service: EasybitsServices for Windows (ezSharedSvc) - EasyBits Software AS -C:\Windows\System32\ezSharedSvcHost.exe

O23 - Service: HPSupport Assistant Service - Unknown owner - C:\ProgramFiles\Hewlett-Packard\HP Support Framework\hpsa_service.exe (filemissing)

O23 - Service: HPClient Services (HPClientSvc) - Hewlett-Packard Company - C:\ProgramFiles\Hewlett-Packard\HP Client Services\HPClientServices.exe

O23 - Service: HPSoftware Framework Service (hpqwmiex) - Hewlett-Packard Company -C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe

O23 - Service: HPService (hpsrv) - Hewlett-Packard Company -C:\Windows\system32\Hpservice.exe

O23 - Service: HPWMISVC- Hewlett-Packard Development Company, L.P. - C:\ProgramFiles\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

O23 - Service: RapportManagement Service (RapportMgmtService) - Trusteer Ltd. - C:\ProgramFiles\Trusteer\Rapport\bin\RapportMgmtService.exe

O23 - Service:@%SystemRoot%\system32\stlang.dll,-10101 (STacSV) - IDT, Inc. -C:\Program Files\IDT\WDM\STacSV.exe




--

End of file - 10515bytes

foreign_correspondent

bumping.. can anyone advise? cheers :-)

closed

uninstall rapport, webroot, mse

replace with avast free

scan with malwarebytes

stop these running at startup using msconfig

O4 - HKLM\..\Run:[HPQuickWebProxy] "C:\Program Files\Hewlett-Packard\HPQuickWeb\hpqwutils.exe"

O4 - HKLM\..\Run: [HPQuick Launch] C:\Program Files\Hewlett-Packard\HP QuickLaunch\HPMSGSVC.exe

O4 - HKLM\..\Run:[Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader10.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run:[Adobe ARM] "C:\Program Files\CommonFiles\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run:[Easybits Recovery] C:\Program Files\EasyBits For Kids\ezRecover.exe

O4 - HKLM\..\Run:[SunJavaUpdateSched] "C:\Program Files\Common Files\Java\JavaUpdate\jusched.exe"

O4 - HKLM\..\Run:[ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe/autorun

O4 - HKLM\..\Run:[BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN

O4 - HKLM\..\Run: [MSC]"c:\Program Files\Microsoft Security Client\msseces.exe"-hide -runkey

O4 - HKCU\..\Run:[Google Update]"C:\Users\Jbloggs\AppData\Local\Google\Update\Goog leUpdate.exe"/c

O4 - HKCU\..\Run: [LGLinkAir] C:\Program Files\LG Electronics\LG PC SuiteIV\LinkAir\LinkAir.exe

O4 -HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\WindowsSidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 -HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe(User 'LOCAL SERVICE')

O4 -HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\WindowsSidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 -HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe(User 'NETWORK SERVICE')


O4 - Startup:Dropbox.lnk = Jbloggs\AppData\Roaming\Dropbox\bin\Dropbox.exe

O4 - Startup:OpenOffice.org 3.4.1.lnk = C:\Program Files\OpenOffice.org3\program\quickstart.exe

O4 - Global Startup:Bluetooth.lnk = ?

O23 - Service: AdobeAcrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: AdobeFlash Player Update Service (AdobeFlashPlayerUpdateSvc) - AdobeSystems Incorporated -C:\Windows\system32\Macromed\Flash\FlashPlayerUpda teService.exe

failing that create a new user profile or backup and factory restore.

foreign_correspondent

cheers, running through that now, fingers crossed!