Chaslang: Reformat - new hijackthis log

KM1 · Jun 21, 2005

Chaslang,

I have done the reformat of my smaller computer and updated all of my software. Ran these updated scans all in normal mode first:

Mcafee Viruscan
Panda free online virus & spyware scan
Adaware se
Adaware VX2 addin
Microsoft Antispyware Beta1
Xcleaner
CWshredder
CCleaner
Spyware Blaster - Loaded & Enabled all
Spybot S&D - immunized & scanned

No threats were found with any of these scans

Included is a hijackthis log (run with hidden files, extensions, and protected system files unchecked). There are two BHO items I have never seen before with no name. Have no idea what they are? Do you and should they be removed? Is there anything else that needs removal or indicates the need for some other type of scan? Any help would be appreciated.

Brandon · Jun 21, 2005

Did you read NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

controlmind

KM1 · Jun 21, 2005

Yes I have read this many times. This hijackthis log is something I had discussed in a much earlier post to chaslang several weeks ago. I did not reference that post because of the time laps. If it necessary, I will repost this in that old post, if I can find it. Just let me know.

KM1

KM1 · Jun 21, 2005

Am pretty sure that this:

BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Is for Microsoft Money which I do have on my machine but have yet to run. Found this exact listing at Castle Cops BHO listings.

However, this:

BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

has been much more difficult to find. Was some reference to it in the broadband security forums to it being something associated with Adobe Reader which I did update from version 7.00 to 7.01 then to 7.02. Still not sure though.

Chaslang, anything on the above and on my new hijackthis log would be appreciated.

KM1

chaslang · Jun 21, 2005

KM1 said:

Am pretty sure that this:

BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

Is for Microsoft Money which I do have on my machine but have yet to run. Found this exact listing at Castle Cops BHO listings.

However, this:

BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

has been much more difficult to find. Was some reference to it in the broadband security forums to it being something associated with Adobe Reader which I did update from version 7.00 to 7.01 then to 7.02. Still not sure though.

Chaslang, anything on the above and on my new hijackthis log would be appreciated.

KM1
Click to expand...

You log is basically clean as expected. Some people would recommend dumping the dell4me items since they are relatives of MyWay and noone wants to see them. In addition, very few people leave their default pages set as the manufacturer ships them.

Yes this FDD3B846-8D59-4ffb-8758-209B6AD74ACC is from MS Money but it is not properly installed if the file is missing.

The other item could be something from a hijacker. I have no specific info on it. It does show up a lot with no file. Fix it, but it may not remain fixed. This does happen quite often with BHO's. You could also search the registry for it to see if any other additional info can be determined about it.
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

KM1 · Jun 21, 2005

OK, great info.

If I want my machine to be as clean as possible from the begining then would you recomend I remove all of these, including the my way from dell. If so what exactly are the procedures so I don't mess anything up.

KM1

PS - you know my original hijackthis log from this machine before the reformat did not contain either of those BHO's and the software is identical Here is the old post:

http://forums.majorgeeks.com/showthread.php?t=63632&page=1

Post #3 contains the log for this computer before the reformat.

chaslang · Jun 21, 2005

KM1 said:

If I want my machine to be as clean as possible from the begining then would you recomend I remove all of these, including the my way from dell. If so what exactly are the procedures so I don't mess anything up.
Click to expand...

That's up to you! Do you want the dell stuff or not?

KM1 · Jun 22, 2005

I have switched my main page like most so I do not need the myway from dell. Also, want to eliminate those BHO's. Do I just run hijackthis in normal mode / check the appropriate boxes and click fix or are there other steps I need to take before and/or after to try and eliminate these item?

If a legitimate program needs the two no name BHO's latter will it recreate them when I try to run the program?

Your help is appreciated
KM1

chaslang · Jun 22, 2005

KM1 said:

I have switched my main page like most so I do not need the myway from dell. Also, want to eliminate those BHO's. Do I just run hijackthis in normal mode / check the appropriate boxes and click fix or are there other steps I need to take before and/or after to try and eliminate these item?
Click to expand...

Yes but make sure NO browsers are running before clicking Fix.

But be aware that sometimes, there are problems trying to get BHO lines to go away even though the files are already missing. We have seen this many times.

KM1 said:

If a legitimate program needs the two no name BHO's latter will it recreate them when I try to run the program?
Click to expand...

Probably not! You may or may not even need them (like the MS Money BHO). It may depend on what features and things you use.

KM1 · Jun 22, 2005

Ok, BHO's appear to be gone. I have done a restart and a cold start and then did run hijackthis. The log is attached. Decided that dell4.com/myway was not hurting anything as is so I did leave it alone. If these BHO's have not come back after restarting is it unlikely they will come back on their own???

KM1

PS - Will be back in a couple weeks with the log from my larger computer once I reformat this. This machine came with problems right out of the box so I do not think that it will be as clean as the log from this computer. Thanks for all your help so far.

chaslang · Jun 23, 2005

KM1 said:

Ok, BHO's appear to be gone. I have done a restart and a cold start and then did run hijackthis. The log is attached. Decided that dell4.com/myway was not hurting anything as is so I did leave it alone. If these BHO's have not come back after restarting is it unlikely they will come back on their own???

KM1

PS - Will be back in a couple weeks with the log from my larger computer once I reformat this. This machine came with problems right out of the box so I do not think that it will be as clean as the log from this computer. Thanks for all your help so far.
Click to expand...

Actually please only comeback to post logs if you are having malware issues. And obviously only post logs after running the READ ME FIRST and getting approval. We do not really have time to check logs users doing new installs just for the heck of it. If you have software issues (not malware issues), those should be discussed in the Software Forum.

Log in or Sign up

Chaslang: Reformat - new hijackthis log

KM1 Private First Class

Attached Files:

hijackthis.log

Brandon controlmind

KM1 Private First Class

KM1 Private First Class

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

KM1 Private First Class

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

KM1 Private First Class

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

KM1 Private First Class

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member