Member Avatar for pimpwack

Today i just found this new folder , i dont know how it got in myprograms files but i def didnt install it... its some Liveupdate.exe and i did a hijack log..and sure enough it shows.. do i get rid of the sucker in " safe -boot"?
and get rid of this digi-chat too.. thanks agian?


is CT helper a threat?


Logfile of HijackThis v1.99.0
Scan saved at 7:09:39 AM, on 3/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\jc\My Documents\hijackthis\HijackThis.exe

O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\edonkey2000.exe" -t
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: DigiChat Applet -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) -
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

  • 4 Contributors
  • 3 Replies
  • 185 Views
  • 2 Years Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Short, cautious cleanup notes that build on and without repeating the HijackThis lines: treat an unexpected LiveUpdate folder or helper process as removable but verify first. A safe, reversible workflow prevents accidental damage to the system and makes it easy to roll back changes if something unexpected happens.

  • Create a restore point and export the registry before changing startup items or deleting program folders.
  • Identify the running image and its signer (file Properties or a process inspector) so legitimate vendor components are not removed by mistake.
  • Use a thorough autorun manager (not just Task Manager or a one‑click cleaner) to find and disable/remove startup entries and browser add‑ons; then uninstall or remove the program folder and leftover entries.
  • After cleanup, run a current anti‑malware scan to catch bundled PUPs or remnants, and re-check autoruns/scheduled tasks to confirm nothing restarts.

The steps above are intentionally conservative: disable an entry first and reboot to confirm impact before deleting files or registry keys. One‑click “fix” functions in older tools can break things if used without a backup; keep a note of every change so it can be reversed. For the same reason, prefer an autorun tool that shows the exact file path and digital signature before removing items. (support.microsoft.com)

Common symptoms mentioned in this thread — multiple media player instances or added toolbars — are often the result of bundled installers. A dedicated PUP/adware scanner plus the autorun cleanup method above usually clears the extras; if uncertainty remains, keep the original HijackThis log and list actions taken so later responders (or a removal guide) can give targeted advice. (help.malwarebytes.com)

Recommended Answers

All 3 Replies

Member Avatar for DMR

1. Openware's LiveUpdate component comes bundled with a few different programs, so I can't tell you exactly what program that you installed may have put it on your system. LiveUpdate does what it's name implies: it provides auto-update functionality via the Internet for the programs that use it. It isn't malicious, and it's not essential either; it's up to you whether to have it running or not.

2. cthelper.exe is a component of some Creative Labs soundcard programs. It is not malicious, but it's also not essential; you can safely disable it if you wish.

3. DigiChat is also an optional program; remove it if you want.

4. qttask.exe and realsched.exe are two other non-essential components that don't need to be run at startup.


That said, you can safely have HijackThis fix the following:

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Openwares LiveUpdate] C:\Program Files\LiveUpdate\LiveUpdate.exe
O16 - DPF: DigiChat Applet -

Member Avatar for demonica61

I am a bit curious about the 4 instances of Media Player-that has got to have hung your screen and given you a Not responding for a while right?

You also picked up a little bit of adware that comes automatically with the real player called the realbar.dll-this is the part of real player that sends information to real player about you and you can remove it without comprimising the basic version of the real one player.

Member Avatar for crunchie

Please refrain from resurrecting these ancient threads for no purpose that I can see.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.