Hjt log

[jornsen]

Hi TL

My thinkpad is a Z60m - and it is a great compromize in an old disagreement on physical placement of family PC... :-)

I disabled all as adviced except:
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe" /startup
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
because I actually use these...

I'm in doubt on some of the disabled (e.g. [BluetoothAuthenticationAgent]), but I guess (hope) I can just reenable in StartupControlPanel, .

I also disabled
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
"Steam" (no path!!??)
"IBM RcordNow!" with exactly the same path as "swg"!!!??? (C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\Go ogleToolbarNotifier.exe)

After reboot, a fresh ctfmon.exe appeared in StartupControlPanel. Named exactly as the old one, only in lower case - same path.

The last 3 things sound (ordered) increasingly disturbing to me....
There are 4 other users on the machine - I guess there may be more or less bad HKCU for them as well. Should i log in as each and repeat disable or.. a trick?

A fresh HJT log attached...

Best regards
/John

[PhilliePhan]

The last 3 things sound (ordered) increasingly disturbing to me....
There are 4 other users on the machine - I guess there may be more or less bad HKCU for them as well. Should i log in as each and repeat disable or.. a trick?

How about a HJT ScanLog from Each User Account?
I still have to look at the other logs (juggling a few threads in a few different forums) A quick glance looked OK, but I want to go over them again.

I am not particularly worried about ctfmon at the moment. But, I would like to look at another scan:

Download FindAWF by noahdfear and save it to your Desktop.

--Double click FindAWF.exe and follow the instructions.
-- When the tool has finished running, a log should pop up on your Desktop (awf.txt).
-- Please submit that log for us.

Be back as soon as I can
PP

[jornsen]

Hi again, PP

A bunch of logs.... :-)

I have to admit that my performance problems seem to be gone with the diabling of a lot of stuff in startup... embarrasing... :-(
Thanks, TL!!!

BUT, I guess I still have something that I'm definitely "better off without".... so.. :-)

Best regards
/John

[PhilliePhan]

Hi John,

I didn't really see much to worry about in the last set of logs. I am having a friend at another forum look at a couple entries and am waiting on her reply, but I think you are OK. Will look at new logs this evening, but judging by the PFind, I think you are probably in the clear.

I may want to have one more Rootkit Scanner and an ADS scan just to be thorough.
Will let you know.

-- AWF Log looks OK.

Cheers
PP

[jornsen]

Hi PP

OK - I'll "stay tuned".

BTW, LinkOptimizer has disappeared from Ad/Remove programs - no idea when. ConnectionServices is still there...!!??

/John

[PhilliePhan]

ConnectionServices is still there...!!??

Run this tool and post the log. It should remove "ConnectionServices."
The log should show it.
http://sarc.com/avcenter/venc/data/t...oval.tool.html

--Be sure to run it in Safe Mode and Run it TWICE, as per the instructions - Save logs for both runs and post them for me.

Otherwise, we'll rip it out manually....

PP

[jornsen]

OUPS!!!!

I thought that the program - now that instructions say "run twice" - preserved logfiles... I was wrong...

First execution found something - in C:\quarantine\...well, I don't remember..
Second execution was clean.

However, ConnectionServices is still in Ad/Remove...

sorry.. :-(

/John

[PhilliePhan]

However, ConnectionServices is still in Ad/Remove...

No worries - We'll remove it manually.

Download Bill James’ RegSrch

Extract it to your Desktop and DoubleClick regsrch.vbs
-- if your AV has script blocking, you’ll need to allow this to run
When the dialog box opens, type ConnectionServices and Click OK.

Do the same for LinkOptimizer so we can remove any leftovers....

-- You’ll need to save the logs that pop up in Wordpad and then submit them for me.


PP

[jornsen]

-- You’ll need to save the logs that pop up in Wordpad and then submit them for me.
PP

This time, I got it right...
...here you go...

/John

[PhilliePhan]

...here you go...

Great!

Please Download the attached FixIt.zip and extract FixIt.reg to your Desktop.
DoubleClick on FixIt.reg and Allow it to merge into the registry.
You can then delete FixIt.reg and FixIt.zip.
Reboot.

That should remove the last traces of LinkOptimizer & ConnectionServices.

Let me know if it remains.

I still want to run 1 more ADS scan and 1 more Rootkit scanner. I'm thinking of using GMER and HijackThis' ADS Spy utility (if you want to get a head start - time difference and all... )
I have all your scanlogs and all my Fix info on a different computer, so I'll have to check back later.

Best
PP