Member Avatar for PcNerd_007

I Have A Suspicious Little Task Running In My Taskmanager Name bows hold.exe Any Ideas On How To Remove It? I have tried searching my pc for it never found it and no matches on the web! Also I Have Been Having Problems With My Windows Explorer. At Times After 1 Hour Or So After My Computer Being On It Starts To Stop Letting Programmes Open, Doesnt Let Me Open My Favourites Or Download With My Internet Explorer And Doesnt Let Me Open Task Manager If You Can Help Me With Either Of These Problems It Would Be Apreciated.!! :cheesy:

Logfile of HijackThis v1.98.2
Scan saved at 11:10:03 PM, on 1/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
F:\Program Files\Messenger Plus! 3\MsgPlus.exe
F:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Documents and Settings\All Users\Application Data\curbinsidedatecreative\bows hold.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
F:\Program Files\Steam\Steam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lukas Bernard\Desktop\Desktop\Security\HijackThis.exe

  • 3 Contributors
  • 6 Replies
  • 122 Views
  • 17 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Good thread so far — described an unknown task plus Explorer/IE instability and responders and have given solid starting advice. Before removing a bunch of entries, follow a short investigative workflow so changes are deliberate and reversible: isolate network activity, confirm what the running file actually is, then remove only proven startup hooks.

Immediate, practical steps you can apply now:

  • Isolate the machine (unplug or block outbound traffic) to stop possible callbacks.
  • Inspect the running process with Process Explorer to see the executable path, parent process, loaded modules, signature and any active network connections. (Process Explorer: https://learn.microsoft.com/sysinternals/downloads/process-explorer)
  • Use Autoruns to locate the exact startup/registry/BHO entries, export the current configuration, then disable suspicious items rather than deleting them outright. (Autoruns: https://learn.microsoft.com/sysinternals/downloads/autoruns)
  • Submit the file or its hash to a multi‑engine scanner to confirm maliciousness before permanent removal. If the file resists deletion while Windows is running, perform an offline scan or use rescue media. (VirusTotal: https://www.virustotal.com/)

After cleanup: verify browser proxy/hosts/DNS have been restored to normal, run a full updated AV scan, and export a fresh diagnostic log so responders can confirm nothing was missed. Back up the registry before manual edits; if uncertainty remains, backing up user data and doing a clean OS reinstall is the most reliable way to remove hidden components.

Recommended Answers

All 6 Replies

Member Avatar for crunchie

You have posted only half of the log :). Uninstall Messenger Plus as it comes bundled with LOP, the infection you currently enjoy :). You can reinstall Messenger Plus without the sponsor.

Click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', '', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run this uninstaller:

You need to update hijackthis to version 1.99. Run hijackthis & go to *Config\Misc Tools\Check for update on-line*. If the site is down, go Remove the old version by opening the program, going to config\misc tools, then uninstall & exit. You then have to delete the file manually. Unzip the new version into the hijackthis folder.

Member Avatar for PcNerd_007

hi thanx for the help but it didnt work lop dot com was not located in the add/remove programs. how do i reinstall msg plus 3.4 without spyware. and the lop dot com uninstaller i think didnt do much because i still have a search spybar in my internet explorer. thx

Member Avatar for PcNerd_007

my full log :mrgreen:

Logfile of HijackThis v1.98.2
Scan saved at 11:10:03 PM, on 1/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
F:\Program Files\Messenger Plus! 3\MsgPlus.exe
F:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
F:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Documents and Settings\All Users\Application Data\curbinsidedatecreative\bows hold.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
F:\Program Files\Steam\Steam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lukas Bernard\Desktop\Desktop\Security\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R3 - Default URLSearchHook is missing
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - F:\Program Files\iMesh Light\iMeshBHO.dll (file missing)
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - F:\Program Files\DAP\DAPBHO.dll
O2 - BHO: (no name) - {9F5B4594-8BE1-2066-2058-2D7A0CF69187} - C:\DOCUME~1\LUKASB~1\APPLIC~1\32BURN~1\peak meet.exe
O4 - HKLM\..\Run: [MessengerPlus3] "F:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [Microsoft System Checkup] libsysmgr.exe
O4 - HKCU\..\Run: [MessengerPlus3] "F:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [SpySweeper] "F:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: &Download with &DAP - F:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - F:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - F:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.bigpond.com/
O16 - DPF: Yahoo! Chat -
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) -
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - http://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} -
O16 - DPF: {C96E4911-9087-44F2-908B-5AD05155560D} (WDSConfiguration Control) -
O16 - DPF: {D03A1C33-1913-4533-A8C1-F2C8D13045DE} -
O16 - DPF: {DA9CE862-0242-4ECD-9D45-00E2C8B9CDF1} (ParsMailSimpleVoice.pmVchat) - http://www.sinasoft.net/vchat/pmvoice4.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2C65F79-16D6-4E64-BE9A-0C23070F31F0}: NameServer =

Member Avatar for caperjack

I suggest this!
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
First use Spybot S&D. (Version 1.3)
Spybot
Unzip, and update. Install the updates and run. Delete all that it marks in red.
Reboot

Then it’s time for Ad-Aware

Install and update by using the globe icon. Restart your computer and run Ad-Aware.
Press scan now and select drives and/or partitions to be scanned. When done select all and click next. Remove all checked items and then reboot your computer.

Please go to this page and read the instructions for how to configure Spybot S&D & Ad-Aware
How To Setup Spybot SD and Ad-Aware

Then post a HJT log as a reply to this topic.

Member Avatar for caperjack

hi thanx for the help but it didnt work lop dot com was not located in the add/remove programs. how do i reinstall msg plus 3.4 without spyware. and the lop dot com uninstaller i think didnt do much because i still have a search spybar in my internet explorer. thx

When you are installing MSG Plus you are asked if you want to install it with supported software or without, choose without .

Member Avatar for crunchie

If that doesn't work, Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

R3 - Default URLSearchHook is missing

O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - F:\Program Files\iMesh Light\iMeshBHO.dll (file missing)

O2 - BHO: (no name) - {9F5B4594-8BE1-2066-2058-2D7A0CF69187} - C:\DOCUME~1\LUKASB~1\APPLIC~1\32BURN~1\peak meet.exe

Reboot into safe mode following the instructions and navigate to and delete the following if found:

C:\DOCUME~1\LUKASB~1\APPLIC~1\32BURN~1<----folder

In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Reboot normally after doing the above, rescan with hijackthis, then post that log here please.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.