Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

karenram

22 Posts

1582

June 23rd, 2006 14:00

Unable to edit Registry: HijackThis log - please help

Since getting my XPS M140 laptop I have been unable to edit my registry. Whenever I delete or edit a key, either the key keeps coming back or the original value(s) return. I also cannot uncheck items for a selective startup -- they, too, keep coming back checked. Before I do a PC Restore this weekend, I thought I'd give it one last shot to get some kind of resolution to my problems. So, here is my HijackThis log. If someone can help, I'd really appreciate it. Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 9:42:18 AM, on 6/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Webshots\webshots.scr
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PccGuide.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ShowLOMControl] 1
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [AWMON] "C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Watch.exe"
O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://barkway.serveftp.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www3.ca.com/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1145720244750
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

1972vet

3.3K Posts

June 24th, 2006 04:00

Your Ad-Watch is preventing the Registry edit. Before you can edit the Registry, and for HijackThis to work for that matter, you must disable the Lavasoft Ad-Watch.

Run HijackThis again and put a check in the box next to this entry:
O15 - Trusted Zone: http://barkway.serveftp.com

Close all windows except for HijackThis before clicking "Fix Checked".

Reboot to record the changes. The rest of your log looks fine.

1972vet

3.3K Posts

June 24th, 2006 15:00

You are most assuredly welcome. Glad we could help.

Warm regards,

karenram

22 Posts

June 24th, 2006 15:00

Maybe I spoke too soon. I just rebooted with Ad-Watch loaded and all the keys that I deleted when Ad-Watch wasn't running are back! Any idea what could be causing this?

And I also rebooted with Ad-Watch not loaded and the keys came back.... Woe is me.

Message Edited by karenram on 06-24-200611:02 AM

karenram

22 Posts

June 24th, 2006 15:00

1972vet:
THANK YOU, THANK YOU, THANK YOU!!!!!!!! After two months of countless message-board posts, hours on the phone with tech support reps from Microsoft, Real, and Dell, continual online research, and a stress level that almost warranted hospitalization, YOU HAVE SOLVED MY PROBLEM!!!!!!!!! I posted my Hijack logs elsewhere and multiple people suggested that there probably was some kind of third-party program, spyware, or virus that was restoring my registry, but no one else noticed that I had Ad-Aware/Ad-Watch installed!!! But you did. And it certainly never dawned on me that Ad-Watch could be the culprit. Now I do not have to do a PC Restore, and for that I am eternally grateful!

Thank you, again, 1972vet.

Karen

Message Edited by karenram on 06-24-200610:36 AM

1972vet

3.3K Posts

June 24th, 2006 16:00

It would be better if you tell me exactly what starting processes that you are trying to delete and what programs they are that are no longer installed that are causing you grief (eg. Some of the Symantec products, Back-Web,...)

There are legitimate processes running that will add startup keys to your registry (examples are quicktime/realplayer) etc. These processes check to see if the registry key is there when they are run and if not they are added. Some programs can do this with a certain time delay, eg. every 5 minutes.

If something of the above is the case here, it would be best if you were to open the application and by using the software's built in tools, (you may have to navigate the software to find them) and make the appropriate changes to your preferences to prevent the software from running at start up.

The other thought is in line with what you said you were previously told. A virus can also certainly behave this same way.

Have you been infected with any malware in the past?

karenram

22 Posts

June 24th, 2006 16:00

There was an Ad-Watch option to "Lock Start-up" that was checked. I unchecked it and am now testing to see if that was the problem. One moment, please....

1972vet

3.3K Posts

June 24th, 2006 16:00

Tell me what it is that you are trying to delete and why.

karenram

22 Posts

June 24th, 2006 16:00

I am trying to remove startup items, some for programs that I have uninstalled but are still showing up.

karenram

22 Posts

June 24th, 2006 16:00

I am trying to delete the keys for MusicMatch, a program that was bundled with my laptop and which I uninstalled; RealTray, which is a leftover key from the legacy version of RealPlayer that also came bundled (and kept producing an error message when I tried to upgrade to the current version); and NetWaiting, another bundled application. I have gone into the settings for this particular program and unchecked "load on startup," but the settings don't get saved.

karenram

22 Posts

June 24th, 2006 17:00

Also, I have antivirus and spyware/adware/malware programs running that constantly monitor my computer, so I don't think I have any of these.

New info: There were additional Ad-Watch settings that I unchecked, and that allowed me to change my IE home page. The registry keys also stayed deleted. But I still can't figure out why there still are startup items for keys that have been deleted (but now they remain unchecked, thank goodness).

Message Edited by karenram on 06-24-200612:08 PM

1972vet

3.3K Posts

June 24th, 2006 18:00

Please do this:
Click start-->control panel-->add/remove programs
Scroll down the list and see if you can locate the program names for
RealPlayer
MusicMatch JukeBox
NetWaiting

If located, click Remove for each. When the uninstallation completes, reboot the system.

Navigate to and delete the below folders/files indicated in Bold Text:
C:\Program Files\ Real\RealPlayer\RealPlay.exe
C:\PROGRAM FILES\ MUSICMATCH\MUSICMATCH JUKEBOX\mimboot.exe
C:\Program Files\ NetWaiting\netWaiting.exe

Reboot when finished to properly record the changes to your Hard Disk.

I know you said you uninstalled them, but the plain and simple fact is, that if that were so, they could not possibly run...the software would be gone. For the software to run, two things are needed. The executable file, and it's associated Registry keys. Either one being absent, the other that remains is simply useless strays that should be removed manually.

In the case of malware, the above is not always true. Some malicious software can re-spawn itself (especially from within the windows xp "System Restore" ).

However, that is not the case here. Those programs are still installed and running. Uninstalling is the best way to remove software, so we need to first investigate the reason for these programs still being present on your system if you can indeed vouch for having performed the uninstallation as per the above instructions. Depending on your level of expertise, you will consider this a dumb question, but I have to ask:
Since uninstalling those programs, have you performed a system restore?

Other items I would suspect that may interfere with System configuration changes:

Your log does not show Spybot Search and Destroy Administrative lock down being used, which might also have been a suspect.
However, there is a setting under the advanced mode of Spybot S&D:
tools-->IE tweaks-->"Lock IE start page setting against user changes (current user)"

This entry here:
O4 - HKLM\..\Run: C:\Program Files\Dell\QuickSet\quickset.exe
indicates a start up item for Dell's taskbar icon to the QuickSet software giving you the ability to quickly change settings. Being unfamiliar with this software, I would have to ask YOU to check it to see if there has been any configuration changes made to it's preferences that would prohibit you from making any other Registry changes...if indeed there is even such an option, but as I said, I am unfamiliar with this software. Just because of it's named function, I would have to suspect this entry as well.



Next, please don't forget to disable Ad-Watch

Please run HijackThis again and put a check in the box next to these entries:
O4 - HKLM\..\Run: C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKCU\..\Run: C:\Program Files\NetWaiting\netWaiting.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

My first post to you, I instructed you to remove this, so it may be gone if you performed that action already. However, I listed it here to explain...You can put anything you want into your trusted zone, but doing so is equal to leaving the front door keys in the lock and going away on vacation. If you agree that's a bad idea, then this entry is gone already:
O15 - Trusted Zone: http://barkway.serveftp.com

Next, please close all windows except for Hijackthis then click Fix Checked.

Reboot the computer and post back a new HijackThis log. Thanks!

karenram

22 Posts

June 24th, 2006 21:00

Yes, as a matter of fact, I did do a System Restore subsequent to uninstalling. So maybe something got restored that shouldn't have been? And I should clarify that I did not uninstall NetWaiting, since it's something that I might have a need to use in the future. But I played around with the Ad-Watch settings and got everything to work.

- Registry keys are gone
- New home page set successfully
- NetWaiting doesn't load on startup.

Funny thing, though. These exact same settings are active on my desktop computer and have absolutely no effect on the registry or on Startup. Maybe it's the way Dell configured the laptop at the factory. Who knows....

So, I definitely will follow your latest instructions the next time I use the laptop.

Thank you so much for your continued assistance.

Karen

1972vet

3.3K Posts

June 24th, 2006 22:00

Edited to include:
NetWaiting by the way is a utility useful only if you use a dial up connection to the web. It provides a means to allow a user to suspend their internet (net) connection on the modem line while the user uses the line for a voice communication. At the end of the voice call, the net connections can be restored. If you use dsl for example, this utility would have no useful purpose.

Yes, when you do a system restore, everything that was on your system on the date that you selected from the restore point, is restored. So...if you uninstalled anything on June 3rd for example, then later on in the month, June 20th let's say, you decide to perform a system restore (for whatever reason) and you select the restore point dated June 1st, everything from the 1st returns.

Since the item you uninstalled on June 3rd was of course, still present on June 1st, then you can expect that the restore point of June 1st will contain that software.

Your restore points are pictures of your hard drive from a given date in time. When you direct your computer to restore itself to one of those dates, everything that was stored in the picture will return...and that includes malware if that was also present.

It is important now that your system is running the way you want to create a new restore point that you can refer back to...one that will contain only those items of software and of course, your system's settings that you chose.

To do that, click Start > Programs > Accessories > System Tools > System Restore
In the new window, check the 'Create a restore point' in the right pane and click "Next".
In the "Restore point description" textbox, name your restore point to something you will easily recognize. I recommend something like yyyymmdd_Clean (ex. today's date_Clean)

I hope that you find that helpful.
Warm regards, and happy surfing.
Click "Create" and reboot your computer.

Message Edited by 1972vet on 06-24-200606:31 PM

karenram

22 Posts

June 25th, 2006 15:00

I know what NetWaiting is. I kept it because you never know when dial-up will be the only way to connect! Also, I didn't uninstall RealPlayer because I now am running the latest version and I want to keep it. (I was, however, able to delete the leftover SYSTEMBOOTHIDEPLAYER registry key (and it still hasn't come back).


Thanks for your suggestion to create a clean restore point. That's the next thing I'll do.

I checked my Add/Remove Programs list and none of the offending programs were listed there. I also checked all /Application Data folders for remnants of the programs, and deleted the leftover folders. I searched the registry for mimboot.exe and nothing was found.

Also ran another Hijack and compared it to the original one. None of the entries you listed in your previous post were there (yeah!), so there wasn't anything to fix.

So, the question still remains: Why are there still startup items for MusicMatch and the old legacy version of RealPlayer (SYSTEMBOOTHIDEPLAYER)? One answer may be that at one point when I unchecked those items duplicates got created (that weren't checked) and the original items got re-checked. The originals are finally gobe, but the duplicates remain. Any ideas?

1972vet

3.3K Posts

June 25th, 2006 17:00

The two statements below seem to conflict:
Quote:
Also ran another Hijack and compared it to the original one. None of the entries you listed in your previous post were there (yeah!), so there wasn't anything to fix.

So, the question still remains: Why are there still startup items for MusicMatch and the old legacy version of RealPlayer (SYSTEMBOOTHIDEPLAYER)? One answer may be that at one point when I unchecked those items duplicates got created (that weren't checked) and the original items got re-checked. The originals are finally gobe, but the duplicates remain. Any ideas?

You must mean, in your system's windows program files tree?
If so, just right click those folders and delete them.
If not, then how can these entries appear in your HijackThis log if you say you ran another log, compared it, and found that the items I listed for you to remove are not there. If they are there, then run HijackThis again and check them like my instructions indicate.
Please clarify this for me. If you're ok with your current status, I would like to close this thread. Thanks!

View More

View All

No Events found!

Top