Can't Remove Bho Entries[INACTIVE]

Krazypal · August 30, 2007

Well... I'm trying to fix my moms comp here. Since she didn't have any firewall or antivirus program - it was a mess here. I've cleaned up a couple of hundred spyware, rojans and stuff but I have one prob... the BHO entries won't be deleted.

I've tried in safe mode and some programs like xptools, adaware and asquared without success.

Help!

Here's the logfile:

Logfile of HijackThis v1.99.1

Scan saved at 19:55:11, on 2007-08-30

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program\Alwil Software\Avast4\aswUpdSv.exe

C:\Program\Alwil Software\Avast4\ashServ.exe

C:\Program\a-squared Free\a2service.exe

C:\WINDOWS\System32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program\ALWILS~1\Avast4\ashDisp.exe

C:\Program\Lavasoft\Ad-Aware 2007\AAWTray.exe

C:\Program\Java\jre1.5.0_06\bin\jusched.exe

C:\Program\Opera\Opera.exe

C:\Program\WinUtilities\WO.exe

C:\Documents and Settings\Ã„garen\Skrivbord\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {02B010E6-F55E-18F9-AFDC-5F03CBD884E6} - (no file)

O2 - BHO: (no name) - {07B26288-C681-0065-E065-8201DD28A761} - (no file)

O2 - BHO: (no name) - {30E404C8-9E52-6BCC-07B7-75B62569A989} - (no file)

O2 - BHO: (no name) - {3675715F-7D53-0434-2B54-B10B3458B832} - (no file)

O2 - BHO: (no name) - {37D770DC-7684-506E-506F-B70AAFEB6F95} - (no file)

O2 - BHO: (no name) - {3B54F794-786F-0118-4FF7-2319A73AE336} - (no file)

O2 - BHO: (no name) - {42B4125A-8456-E674-1EAB-F008B3833B7C} - (no file)

O2 - BHO: (no name) - {44E34F5D-DD47-7872-AC46-520661BABE29} - (no file)

O2 - BHO: (no name) - {48014569-86A0-09D2-B74C-68DFC89AB093} - (no file)

O2 - BHO: (no name) - {5367AF43-53A3-260E-9D79-0CDB4035A008} - (no file)

O2 - BHO: (no name) - {5F4C15AC-0058-5C3E-822D-742B4125A084} - (no file)

O2 - BHO: (no name) - {61BA9713-4C7D-321C-7CDA-2D19B793429D} - (no file)

O2 - BHO: (no name) - {7060FA14-0E29-B33B-569A-AC425430C19B} - (no file)

O2 - BHO: (no name) - {77E75C18-2847-DA08-D856-8452824004C7} - (no file)

O2 - BHO: (no name) - {7CDBEDA5-3DCB-A735-5055-0A014758ED6B} - (no file)

O2 - BHO: (no name) - {7DD85366-D791-988B-E591-E8766F46FA72} - (no file)

O2 - BHO: (no name) - {7E35BA92-B311-70A1-8E0E-EE430F0CC372} - (no file)

O2 - BHO: (no name) - {822904F6-6515-F4CA-FCA6-3DD79347C0E0} - (no file)

O2 - BHO: (no name) - {847C1672-FB03-7621-DD34-036D3E8460FD} - (no file)

O2 - BHO: (no name) - {8A211D0F-A737-38A0-EA0A-D2480CDBEF01} - (no file)

O2 - BHO: (no name) - {9D6A4232-5595-7E6F-2779-C942DCAB8455} - (no file)

O2 - BHO: (no name) - {A66DF143-F487-E2C9-232E-3D99CC47A72F} - (no file)

O2 - BHO: (no name) - {B756513C-B2A5-1805-60FF-E40570DBC936} - (no file)

O2 - BHO: (no name) - {BCC63C42-67AA-A5DB-877D-963D27AD9AFA} - (no file)

O2 - BHO: (no name) - {BE39619D-2F5C-5C5D-24AA-44CE33AF3E2B} - (no file)

O2 - BHO: (no name) - {E66F4233-2A70-2CDE-18E8-550B593208D5} - (no file)

O2 - BHO: (no name) - {F322A8AF-EF0E-13F8-1E57-1BF7314624F9} - (no file)

O2 - BHO: (no name) - {F82406AA-AA26-0FEF-2943-600622AB7AB5} - (no file)

O2 - BHO: (no name) - {FD4A74BF-5712-24E2-4DA7-6711D4FD291B} - (no file)

O4 - HKLM\..\Run: [Zone Labs Client] C:\Program\Zone Labs\ZoneAlarm\zlclient.exe

O4 - HKLM\..\Run: [sBDrvDet] C:\Program\Creative\SB Drive Det\SBDrvDet.exe /r

O4 - HKLM\..\Run: [avast!] C:\Program\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [AAWTray] C:\Program\Lavasoft\Ad-Aware 2007\AAWTray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [XP Tools] C:\Program\XP Tools\xptools.exe /min

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program\a-squared Free\a2service.exe

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program\Alwil Software\Avast4\ashServ.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hope someone out there can help me with this.

Thanx in advance

Krazy

jwbirdsong · August 30, 2007

Is this a non english OS correct???

Well we can get rid of these entires if they won't go w/ HJT.

So just for my sake, so I can see it for my self plz do the following

You NEED to print this out or save a copy to Notepad for reading because you can NOT have IE/FF or any browser open while doing the fix.

Open HijackThis and click on Do a system scan only. Place a check mark next to the following: