MSN Messenger 7.5 problem

[Trip]

Whenever I try to sign into msn messenger 7.5 it just continually says signing in and never stops even after an hour :? Sometimes it will come up with the "you have 3 new emails" sign, and it will say converstaion could not be started with "name" but it will still keep signing in. Sometimes if i exit msn messenger, restart, sign in, cancel and then sign in again it can work. It hasn't worked at all recently so I decided to post. Windows Messenger works fine.

 

 

 

 

 

 

 

At first I thought it was zone alarms IM security, but after disabling zone alarm and restarting, it didn't work.

 

 

 

I then assumed it was my wireless router mucking around, but after connecting straight to my DSL no routers involved it still happens :shock:

 

 

 

 

 

 

 

Any help would be appreciated, thanks.

[jammy316]

Uninstall, Delete any remaining files, re-install.

 

 

 

 

 

 

 

If it doesn't work, come back. Most the time when I get MSN problems its telling me my routers being a pain and I need to sort out the box =x.

[Trip]

Uninstall, Delete any remaining files, re-install.

 

 

 

 

 

 

 

If it doesn't work, come back. Most the time when I get MSN problems its telling me my routers being a pain and I need to sort out the box =x.

 

 

 

 

 

 

 

Tried that a few times, I've even tried getting older versions (6.2) but it won't allow me to sign in without updating :P

[Bubsa]

Well remember MSN 7.5 is the leaked beta version, so don't expect it to be reliable.

[Trip]

Well remember MSN 7.5 is the leaked beta version, so don't expect it to be reliable.

 

 

 

 

 

 

 

Are you sure? when I download off msn.com I get this version :?

[Rhys]

Well remember MSN 7.5 is the leaked beta version, so don't expect it to be reliable.

 

 

 

 

 

 

 

MSN 7.5 was released about a month ago now. :P

 

 

 

 

 

 

 

If Windows Messenger is working fine, I can only assume it's something to do with your MSN. A virus maybe? Could be corrupting your installation or something, so everytime you reinstall, it still doesn't work. Try scanning for viruses and spyware.

 

 

 

 

 

 

 

I'd also check your connection settings in MSN (I'd tell you how but I'm not using MSN). Could be something to do with that.

 

 

 

 

 

 

 

Edit: Post a Hijackthis Log.

 

 

 

 

 

 

 

Another edit: Can you log into their website? (http://www.hotmail.com) and do you get any error messages?

[Trip]

Hotmail works fine..

 

 

 

 

 

 

 

Heres a hijack this log

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

.

Logfile of HijackThis v1.99.1



Scan saved at 9:12:11 PM, on 13/11/2005



Platform: Windows XP SP2 (WinNT 5.01.2600)



MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)







Running processes:



C:\WINDOWS\System32\smss[Caution: ExecutableFile]



C:\WINDOWS\system32\winlogon[Caution: ExecutableFile]



C:\WINDOWS\system32\services[Caution: ExecutableFile]



C:\WINDOWS\system32\lsass[Caution: ExecutableFile]



C:\WINDOWS\system32\svchost[Caution: ExecutableFile]



C:\WINDOWS\System32\svchost[Caution: ExecutableFile]



C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile]



C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile]



C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile]



C:\WINDOWS\Explorer[Caution: ExecutableFile]



C:\WINDOWS\system32\igfxtray[Caution: ExecutableFile]



C:\WINDOWS\system32\hkcmd[Caution: ExecutableFile]



C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution: ExecutableFile]



C:\Program Files\Synaptics\SynTP\SynTPEnh[Caution: ExecutableFile]



C:\SYSINFO\CyberLink\PowerDVD\PDVDServ[Caution: ExecutableFile]



C:\Program Files\Acer\Notebook Manager\almxptray[Caution: ExecutableFile]



C:\WINDOWS\SOUNDMAN[Caution: ExecutableFile]



C:\Program Files\Launch Manager\LaunchAp[Caution: ExecutableFile]



C:\Program Files\Launch Manager\PowerKey[Caution: ExecutableFile]



C:\Program Files\Launch Manager\HotkeyApp[Caution: ExecutableFile]



C:\Program Files\Launch Manager\OSDCtrl[Caution: ExecutableFile]



C:\Program Files\Launch Manager\CtrlVol[Caution: ExecutableFile]



C:\Program Files\Launch Manager\Wbutton[Caution: ExecutableFile]



C:\WINDOWS\AGRSMMSG[Caution: ExecutableFile]



C:\Program Files\ltmoh\Ltmoh[Caution: ExecutableFile]



C:\Program Files\Winamp\winampa[Caution: ExecutableFile]



C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]



C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]



C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]



C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile]



C:\WINDOWS\system32\rundll32[Caution: ExecutableFile]



C:\Program Files\Zone Labs\ZoneAlarm\zlclient[Caution: ExecutableFile]



C:\Program Files\webHancer\Programs\whAgent[Caution: ExecutableFile]



C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]



C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]



C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM[Caution: ExecutableFile]



C:\Program Files\Stardock\ObjectDock\ObjectDock[Caution: ExecutableFile]



C:\WINDOWS\system32\ZoneLabs\isafe[Caution: ExecutableFile]



C:\WINDOWS\system32\svchost[Caution: ExecutableFile]



C:\WINDOWS\system32\ZONELABS\vsmon[Caution: ExecutableFile]



C:\Program Files\Bonjour\mDNSResponder[Caution: ExecutableFile]



C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]



C:\WINDOWS\system32\WISPTIS[Caution: ExecutableFile]



C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile]



C:\Program Files\Internet Explorer\iexplore[Caution: ExecutableFile]



C:\Documents and Settings\Mic\My Documents\HijackThis[Caution: ExecutableFile]



C:\WINDOWS\system32\NOTEPAD[Caution: ExecutableFile]







R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com/



R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/



R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/



O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll



O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program files\NavShExt.dll (file missing)



O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll



O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program files\NavShExt.dll (file missing)



O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL[Caution: ExecutableFile]



O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray[Caution: ExecutableFile]



O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd[Caution: ExecutableFile]



O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution: ExecutableFile]



O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh[Caution: ExecutableFile]



O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ[Caution: ExecutableFile]



O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray[Caution: ExecutableFile]



O4 - HKLM\..\Run: [soundMan] SOUNDMAN[Caution: ExecutableFile]



O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG[Caution: ExecutableFile]" /Spoil /RemAdvDef /Migration32



O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst[Caution: ExecutableFile] /SYNC



O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: ExecutableFile] /SYNC



O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: ExecutableFile] /IMEName



O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp[Caution: ExecutableFile]



O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp[Caution: ExecutableFile]



O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl[Caution: ExecutableFile]



O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol[Caution: ExecutableFile]



O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG[Caution: ExecutableFile]



O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh[Caution: ExecutableFile]



O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa[Caution: ExecutableFile]



O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon[Caution: ExecutableFile]



O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime



O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile]



O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32[Caution: ExecutableFile] bthprops.cpl,,BluetoothAuthenticationAgent



O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]"  -osboot



O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]" /background



O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock[Caution: ExecutableFile]



O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM[Caution: ExecutableFile]



O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL[Caution: ExecutableFile]/3000



O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll



O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll



O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL



O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]



O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]



O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab



O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)



O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll



O20 - Winlogon Notify: WB - C:\PROGRA~1\STARDOCK\OBJECT~2\WINDOW~1\fastload.dll



O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder[Caution: ExecutableFile]



O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe[Caution: ExecutableFile]



O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile]



O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc[Caution: ExecutableFile]



O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile]



O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT[Caution: ExecutableFile]



O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]



O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - D:\Program files\navapsvc[Caution: ExecutableFile] (file missing)



O23 - Service: SAVScan - Unknown owner - D:\Program files\SAVScan[Caution: ExecutableFile] (file missing)



O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ[Caution: ExecutableFile]



O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc[Caution: ExecutableFile]



O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon[Caution: ExecutableFile]

 

 

 

 

 

 

 

Thanks for all your help

[coltm4carbine]

ok before anyone even thinks about fixing the o10's please DON'T thats gonna rip apart the lsp chain and make the user unable to connect to the internet.

 

 

 

 

 

 

 

heres a quick tip:

 

 

 

 

 

 

 

Please download Spybot Search & Destroy and AdAware.

 

 

 

 

 

 

 

then run a scan with both of these softwares. Those programs should get rid of most of the webhancer things.

[Vape]

Start -> Control Panel -> Add/Remove Programs. Uninstall Webhancer.

 

 

 

 

 

 

 

Shutdown, mash the f8 key during startup, select safe mode, run hijackthis, delete the following entries:

 

 

 

 

 

 

 

Edit: I've not had any trouble with deleting O10 entries, I have none listed in a hijackthis log of my own computer... if it stuffs up your internet then you can of course simply use hijackthis to restre the entries back to where they were.

 

 

 

 

 

 

 

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program files\NavShExt.dll (file missing)



O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll



O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program files\NavShExt.dll (file missing)







O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey[Caution: ExecutableFile]"







O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer



O10 - Hijacked Internet access by WebHancer







O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)











O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - D:\Program files\navapsvc[Caution: ExecutableFile] (file missing)



O23 - Service: SAVScan - Unknown owner - D:\Program files\SAVScan[Caution: ExecutableFile] (file missing)

 

 

 

 

 

 

 

Restart your pc in regular mode, run hijackthis again, post your log back here.

[coltm4carbine]

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) <- You don't have to fix this. The program is msn messenger 7.5 but very often incorrectly listed by HijackThis as missing.

 

 

 

 

 

 

 

ok i might get banned for this but if you are ever gonna fix an o10 make sure 1) you know how to restore a backup.

 

 

 

 

 

 

 

(To restore the backups:

• 
   
   
   
  [*:30h23xrl]Open HiJackThis
   
   
   
  [*:30h23xrl]Click Open the Misc Tools section
   
   
   
  [*:30h23xrl]Click the Backups button
   
   
   
  [*:30h23xrl]Place a check mark next to everything in that window
   
   
   
  [*:30h23xrl]Click Restore
   
   
   
  [*:30h23xrl]Click Yes
   
   
   
  [*:30h23xrl]Reboot your computer
   
   
   
  [*:30h23xrl]Re-open HiJackThis and post a new logfile for review.

)

 

 

 

 

 

 

 

2) ok using canned speech for new.net same priciple just change all new.net to webhancer.:

 

 

 

 

 

 

 

First, Download LSPFix[Caution: ExecutableFile] to a convenient location. Do NOT run this program. This is only to be used if you lose Internet Access after removing NewDotNet

 

 

 

 

 

 

 

In the event that you lose Internet access after removing New.Net, please double-click LSPFix[Caution: ExecutableFile] that you downloaded earlier. You will see 2 panels. If there is any file listed in the "Remove" panel on the right-side, leave it as is and just click "Finish>>" then reboot your computer and you should now have access to the Internet. If nothing is listed under the "Remove Panel", do NOT do anything - just close the program.

[Trip]

Before i fix any of the o10's I'd just like to know what the o10s do and if it is worth the trouble.

 

 

 

I know it's simple but things tend to go wrong for me.

 

 

 

 

 

 

 

Logfile after running search and destroy and ad aware

 

 

 

 

 

 

 

Logfile of HijackThis v1.99.1



Scan saved at 9:16:51 PM, on 14/11/2005



Platform: Windows XP SP2 (WinNT 5.01.2600)



MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)







Running processes:



C:\WINDOWS\System32\smss[Caution: ExecutableFile]



C:\WINDOWS\system32\winlogon[Caution: ExecutableFile]



C:\WINDOWS\system32\services[Caution: ExecutableFile]



C:\WINDOWS\system32\lsass[Caution: ExecutableFile]



C:\WINDOWS\system32\svchost[Caution: ExecutableFile]



C:\WINDOWS\System32\svchost[Caution: ExecutableFile]



C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile]



C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile]



C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile]



C:\WINDOWS\Explorer[Caution: ExecutableFile]



C:\WINDOWS\system32\ZoneLabs\isafe[Caution: ExecutableFile]



C:\WINDOWS\system32\svchost[Caution: ExecutableFile]



C:\WINDOWS\system32\ZONELABS\vsmon[Caution: ExecutableFile]



C:\Program Files\Bonjour\mDNSResponder[Caution: ExecutableFile]



C:\WINDOWS\system32\igfxtray[Caution: ExecutableFile]



C:\WINDOWS\system32\hkcmd[Caution: ExecutableFile]



C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution: ExecutableFile]



C:\Program Files\Synaptics\SynTP\SynTPEnh[Caution: ExecutableFile]



C:\SYSINFO\CyberLink\PowerDVD\PDVDServ[Caution: ExecutableFile]



C:\Program Files\Acer\Notebook Manager\almxptray[Caution: ExecutableFile]



C:\WINDOWS\SOUNDMAN[Caution: ExecutableFile]



C:\Program Files\Launch Manager\LaunchAp[Caution: ExecutableFile]



C:\Program Files\Launch Manager\PowerKey[Caution: ExecutableFile]



C:\Program Files\Launch Manager\HotkeyApp[Caution: ExecutableFile]



C:\Program Files\Launch Manager\OSDCtrl[Caution: ExecutableFile]



C:\Program Files\Launch Manager\CtrlVol[Caution: ExecutableFile]



C:\Program Files\Launch Manager\Wbutton[Caution: ExecutableFile]



C:\WINDOWS\AGRSMMSG[Caution: ExecutableFile]



C:\Program Files\ltmoh\Ltmoh[Caution: ExecutableFile]



C:\Program Files\Winamp\winampa[Caution: ExecutableFile]



C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]



C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]



C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]



C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile]



C:\WINDOWS\system32\rundll32[Caution: ExecutableFile]



C:\Program Files\Zone Labs\ZoneAlarm\zlclient[Caution: ExecutableFile]



C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]



C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM[Caution: ExecutableFile]



C:\Program Files\Stardock\ObjectDock\ObjectDock[Caution: ExecutableFile]



C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]



C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile]



C:\Documents and Settings\Mic\Desktop\HijackThis[Caution: ExecutableFile]







R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://global.acer.com/



R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/



R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/



O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll



O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll



O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program files\NavShExt.dll (file missing)



O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program files\NavShExt.dll (file missing)



O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL[Caution: ExecutableFile]



O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray[Caution: ExecutableFile]



O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd[Caution: ExecutableFile]



O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution: ExecutableFile]



O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh[Caution: ExecutableFile]



O4 - HKLM\..\Run: [RemoteControl] C:\SYSINFO\CyberLink\PowerDVD\PDVDServ[Caution: ExecutableFile]



O4 - HKLM\..\Run: [AcerNotebookManager] C:\Program Files\Acer\Notebook Manager\almxptray[Caution: ExecutableFile]



O4 - HKLM\..\Run: [soundMan] SOUNDMAN[Caution: ExecutableFile]



O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG[Caution: ExecutableFile]" /Spoil /RemAdvDef /Migration32



O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst[Caution: ExecutableFile] /SYNC



O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: ExecutableFile] /SYNC



O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: ExecutableFile] /IMEName



O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp[Caution: ExecutableFile]



O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp[Caution: ExecutableFile]



O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl[Caution: ExecutableFile]



O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol[Caution: ExecutableFile]



O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG[Caution: ExecutableFile]



O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh[Caution: ExecutableFile]



O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa[Caution: ExecutableFile]



O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon[Caution: ExecutableFile]



O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime



O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile]



O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32[Caution: ExecutableFile] bthprops.cpl,,BluetoothAuthenticationAgent



O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey[Caution: ExecutableFile]"



O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]"  -osboot



O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]" /background



O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock[Caution: ExecutableFile]



O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM[Caution: ExecutableFile]



O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL[Caution: ExecutableFile]/3000



O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll



O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll



O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL



O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]



O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]



O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll



O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab



O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)



O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll



O20 - Winlogon Notify: WB - C:\PROGRA~1\STARDOCK\OBJECT~2\WINDOW~1\fastload.dll



O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder[Caution: ExecutableFile]



O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe[Caution: ExecutableFile]



O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile]



O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc[Caution: ExecutableFile]



O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile]



O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT[Caution: ExecutableFile]



O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]



O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Unknown owner - D:\Program files\navapsvc[Caution: ExecutableFile] (file missing)



O23 - Service: SAVScan - Unknown owner - D:\Program files\SAVScan[Caution: ExecutableFile] (file missing)



O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ[Caution: ExecutableFile]



O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc[Caution: ExecutableFile]



O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZONELABS\vsmon[Caution: ExecutableFile]

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Thanks again for all help!

[coltm4carbine]

o10s- This section corresponds to Winsock Hijackers or otherwise known as LSP (Layered Service Provider).

 

 

 

 

 

 

 

LSPs are a way to chain a piece of software to your Winsock 2 implementation on your computer. Since the LSPs are chained together, when Winsock is used, the data is also transported through each of the LSPs in the chain. Spyware and Hijackers can use LSPs to see all traffic being transported over your Internet connection.

 

 

 

 

 

 

 

You should use extreme caution when deleting these objects if it is removed without properly fixing the gap in the chain, you can have loss of Internet access.

 

 

 

Example Listing "O10 - Broken Internet access because of LSP provider 'spsublsp.dll' missing"

 

 

 

 

 

 

 

Many Virus Scanners are starting to scan for Viruses, Trojans, etc at the Winsock level. The problem is that many tend to not recreate the LSPs in the right order after deleting the offending LSP (for example Norton). This can cause HijackThis to see a problem and issue a warning, which may be similar to the example above, even though the Internet is indeed still working. It is also advised that you use LSPFix to fix these.

 

 

 

 

 

 

 

Spybot can generally fix these but make sure you get the latest version as the older ones had problems. There is a tool designed for this type of issue that would probably be better to use, called LSPFix.

 

 

 

 

 

 

 

for exmaple if i remove new.net then while removing it i might lose my internet connection. if i do then i will use lspfix to fix the lsp chain.

 

 

 

 

 

 

 

Edit: I've not had any trouble with deleting O10 entries, I have none listed in a hijackthis log of my own computer... if it stuffs up your internet then you can of course simply use hijackthis to restre the entries back to where they were.

 

 

 

 

 

 

 

you don't often see these in logs because most of the time they are bad (exept for norton etc).

 

 

 

 

 

 

 

 

 

 

 

Hopefully someone will give you a better explaination on the o10s.

 

 

 

 

 

 

 

*edit again* Don't fix the o10 you have (O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll )- its a legit one.

[Bubsa]

 

Well remember MSN 7.5 is the leaked beta version, so don't expect it to be reliable.

 

 

 

 

 

 

 

MSN 7.5 was released about a month ago now. :P

 

 

 

 

 

 

 

Pah, shows what I know/care :P

 

 

 

Personally, though, I've had it for about 3ish months and not had a problem. Touch wood.

[Trip]

thanks very much colt :D

[coltm4carbine]

you might also wanna fix this if it's still here (don't worry if it's not spybot might of got rid of it already)

 

 

 

 

 

 

 

 

 

 

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.e3e (CAUTION - executable file)"

[mc_cheda_x]

aaah, i am pretty sure whats happened here (sorry if im wrong)

 

 

 

ok, i have done this before on a computer,

 

 

 

if you have a spyware removal tool, you could have removed some data that lets you sign in o.O

 

 

 

on the computer stated above i removed ALL the spyware on that computer, this computers anti-virus was out of date by years (norton anti-virus, it sucks) and it had no adware removal tool or a spyware remover so it was complety open to browser hijackers, cookies, trojans, worms ect. and so i installed a trail spyware removal tool and removed all spyware, then, the IE browser didnt work! (this is windows xp home edition) and it was connecting to the internet but was just saying it couldnt find a connection!

 

 

 

 

 

 

 

so, if you have a good spyware removal tool, review the history to see where it went wrong :D

 

 

 

 

 

 

 

if this dosent help, i dont know :?

[coltm4carbine]

yeh you will have to be careful with rogue antispyware programs. Rogue gives you pop-ups/ adware/ spyware and loads of false possitives.

 

 

 

 

 

 

 

if a pop up tells you to buy a product don't. the worst thing is a reformate.

 

 

 

 

 

 

 

btw a typo in my last post.

 

 

 

 

 

 

 

you might also wanna fix this if it's still here (don't worry if it's not there, spybot might of fixed it already)

[yusuke888]

msn messenger 7.5 contains many bugs.

[runesmithie]

msn messenger 7.5 contains many bugs.

 

 

 

 

 

 

 

Anything to back that up? I've had it a while and it's been fine