Parse told me to post for help...

[Chengstah]

The text help pop up for this line:
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
is something like "Hijackthis filters out the good so this'll be marked bad. consult a hijackthis expert before cleaning..."

so I've attached the log that I hope will clarify some things and will wait 'till I hear from someone before I go ahead and delete that line. I also have ctfmon or whatever to worry about it seems...

I regularly scan my computer with AVG, ad-aware, spybot search & destroy- non of which have found anything out of the ordinary. spybot had several red entries today, but I usually get one or two anyways. I've ran window's malicious software removal tool before posting this. it didn't find anything.

any help would be appreciated, thanks!

[jholland1964]

The O21 line is fine; it refers to the Windows Portable Device Shell Service Object
The O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
is also fine. CTFMon is involved with the language/alternative input services in Office XP. CTFMON.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features.
Can you tell me why you ran HJT in the first place?

[Chengstah]

oh thanks for replying, how do I disable those features since I have no use of them?

I run HJT every once in a while just to make sure I've got nothing bad slowing down my computer. I used to have problems with spyware and the such before I discovered this website ^.^ Now I recommend to all my friends ad-aware, spybot, and AVG.

I was only alarmed by the numerous 018 entries HJT picked up. It has never happened before, so that combined with parse basically telling me there was something wrong made me make a thread for the log. False alarm hopefully?

[jholland1964]

To disable CTFMon go to Start, Control Panel, Text & Speech Services.
To get rid of those O18 entries;
These come from the Logitech Desktop Messenger. This is totally unnecessary and is listed as Malware on some malware scanners and websites because this "phones home" to Logitech for any updates or new products and it IS totally unnecessary. Go to Start, Control Panel, Add/Remove and Uninstall the Logitech Desktop Messenger and then reboot. Your O18 listings should also disappear from HJT. You can run it again to see if they are still there after the uninstall and if they are then place checkmarks next to those entries and then click the FIX button and exit HJT.
Reboot and they should be gone.

You do have other items running at Start Up which can easily be run manually. I recommend using Mike Lin's Start Up Control Panel to easily turn these off. This is a small FREE program that makes it extremely easy to start or stop items from running at Start Up.

These are the entries in your log which can easily be run manually with an explanation of what each is;

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
Windows XP Media_Center_Edition 2005. Enables the user to access Windows Messenger from within Media Center

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
System Tray icon used to change display settings, change the clock rate and memory speed for nVidia based graphics cards. This is unnecessary since you can easily configure these settings the way you want them in the Display Properties and not have to mess with them again.

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
System Tray icon used to manage settings for nVidia based graphics cards. May be required for some 3D applications to recognize your card correctly - such as the game "Everquest". Otherwise, settings can be changed manually via Display Properties

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
Associated with the newer versions of nVidia graphics cards drivers. Allows you to immensely improve desktop layouts by setting preferences and optimizations. However, this isn't necessary for the operation of your system

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
Realtek audio card related; probably adds the odd feature to one of the "Sounds" Control Panel applet tabs - doesn't appear to be required.

O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
Related to HP_QuickPlay brings your favorite music and movies to life with the touch of a button. Note: located in C:\Program Files\HP\QuickPlay\

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HP software updates, can easily be run manually without this running in the background

O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
InstallShield Update Service related; Automatically searches for and performs any updates to the software. Not required.

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
InstallShield Update Service Scheduler; automatically searches for and performs any updates to the software so you’re always working with the most current version. Not required.

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
Checks with Sun's Java updates site to see if newer Java versions are available.
You DO need to update your Java by the way. Uninstall any showing in your Add/Remove and then go to http://www.java.com/en/download/manual.jsp
I recommend the manual download. Once you have downloaded the file then install it manually. Once you have done the manual install then visit the verification page http://www.java.com/en/download/installed.jsp
to be certain the newest update is installed.

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
The above both refer to the Adobe Reader which can easily be run manually. Disable them from auto-start.

Your O21 entry is a perfectly legitimate entry and does not need to be disabled. Leave it alone.

[Chengstah]

Ah, thanks for the detailed feedback of my log. I've gone ahead and followed your suggestions- disabling whatever you listed, updated Java, and un-installed Logitech Desktop Messenger. I just could not find Text & Speech under my control panels, could you be more specific?

Thanks again

[jholland1964]

I couldn't find it on mine either
Did find this info about Office XP
To uninstall the alternative user input feature(CTFMon), set the installation state to Not Available in Office XP Setup.

OR

Microsoft Windows XP:
1.Quit all Office programs.

2.Click Start, point to Settings, and then click Control Panel. NOTE: In Windows XP, click Start and then click Control Panel.

3.In Control Panel, double-click Add/Remove Programs.NOTE: In Windows XP, click Add or Remove Programs.

4.In the Currently installed programs list, click to select Microsoft Office XP product, where Office XP product is the name of the specific Office product being used. If you are using a standalone version of one of the Office programs, click to select the appropriate product in the list. Click Change.

5.In the Maintenance Mode Options dialog box, select Add or Remove Features, and then click Next. This displays the Choose installation options for all Office applications and tools dialog box.

6.Click the plus sign (+) next to Office Shared Features to expand it.

7.Click the icon next to Alternative User Input, and then select Not Available.

8.Click Update.
If you have multiple Office XP products installed, for example, Office XP Professional and Publisher 2002, you must repeat the preceding steps for each installed product.

Step 2: Remove Alternative User Input Services from Text Services
1.Click Start, point to Settings, and then click Control Panel.
2.In the Control Panel, double-click Text Services.NOTE: In Windows XP, click Date, Time, Language, and Regional Options, and then click Regional and Language Options. On the Languages tab, click Details.

3.Under Installed Services, select each input item that is listed, and then click Remove to remove the item. All items must be removed, one by one, except the following input service:
English (United States)- default Keyboard United States 101

Step 3: Run Regsvr32 /U on the Msimtf.dll and Msctf.dll Files

1.Click Start and then click Run.

2.In the Run dialog box, type the following command:
Regsvr32.exe /u msimtf.dll

3.Click OK.

4.Repeat steps 1 through 3 for the Msctf.dll file.

For additional information about how to remove CTFMon.exe, click the article number below to view the article in the Microsoft Knowledge Base:
313176 (http://support.microsoft.com/kb/313176/EN-US/)

[Chengstah]

wow, thanks so much for looking so in-depth into this. I'll carry out these steps as soon as I find my Office CD. Changing the program seem to require it and I have the CD misplaced at the moment :-p

[TurcoLoco]

wow, thanks so much for looking so in-depth into this. I'll carry out these steps as soon as I find my Office CD. Changing the program seem to require it and I have the CD misplaced at the moment :-p

I always copy the entire contents of my MS Office CD into a new folder I create (also named MS Office or Office CD or whatever else you prefer) directly on the C drive (for easy locating). This way you do not need the CD, if it prompts you to insert the CD (cause it only checks the CD drives for certain files), simply browse to the folder where you copied MS Office files and voila!

I do the same with my Window CD, but with Windows you really only need the folder named i386, so you can simply copy that folder onto your local disk then change the path in the registry so you won't even have to browse for it when the Windows CD is needed for anything:

Let's say you copied the i386 folder directly on the C drive then this is how the related registry keys should read for Windows All versions:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Setup]
"SourcePath"="C:\\"

For XP, you will also need to do this:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion]
"RegDone"="1"
"SourcePath"="C:\\i386"

Just a little tip to make things easier.

~TL