Solved Question concerning an 010 entry

Hi,

I have a question concerning this entry in my sisters HijackThis log > O10 - Broken Internet access because of LSP provider 'c:\windows\system32\wshbth.dll' missing

This appeared after she re-installed her OS.

She has Vista Home Premium, SP2, IE8 and Firefox. Pretty much the same that I have but on a Dell laptop. She has no issues with her computer connecting nor running.

I looked it up on SystemLookup and it is Windows Bluetooth related.
See here > SystemLookup - O10 List

Could someone please tell me what this refers to? There is one entry in the 04's that is related to this. See here > O4 - Global Startup: Bluetooth.lnk = ?

Thank you,
bbbluz

Hello,

What prompted you to run HiJackThis? Can you please upload the entire log for me to look at?

The O4 - Global Startup is normal and there should be a "?". Ignore this, this is unrelated and fine.

Your O10 issue is a small issue. By itself it shows not a virus, but a small corruption. It is small and if you wish, can be left, but I would very strongly recommend trying the following steps, just for us to get an idea of what the situation is, and possibly fix this issue.

There are cases of this corruption simply causing problems with just the Bluetooth connection and nothing else, when WiFi and Ethernet are unaffected.

Please press the Windows Key + R top open the Run dialogue. Type "cmd" without the quotes and press enter. Go past the UAC prompt if necessary. In Command Prompt, type "sfc /scannow", again without the quotes and noting the space. Press enter and let it scan. It will take about 15 minutes.

Once it has finished, if integrity violations are found, run the scan one more time. If integrity violations are still found, upload the log files (preferably parsed). To parse the logs, follow the instructions in the top yellow box here, and upload the "sfcdetails.txt" file created on your Desktop: http://www.vistax64.com/tutorials/66978-system-files-sfc-command.html

In summary, all you have to do is enter "findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt" without the quotes (copy and paste) and press enter in your already open Command Prompt. The new "sfcdetails.txt" file will then be created, ready for upload here.

Richard

Hi niemiro,

Thanks for your response! This is going to be tedious for an expert such as yourself, and I hope I'm not wasting your time! But, my sister lives several miles from me and I won't see her again for a few weeks. I e-mailed the HjT log info below to myself so that I could study it. The 010 entry left me baffled, and I'm interested in Spyware/Malware, yet I haven't signed up for online classes yet. I am just above the novice level.


I scanned with HijackThis because she had re-installed her OS. She was getting lockups while performing full scans with Avast but not quick scans, and I wanted to ensure there were no residual files left over from pre-installed AV's. I went in and removed the entries listed below, and cleaned out the pre-installed software that the factory recovery disks re-installed. I also installed Microsoft Security Essentials for her. I am no expert here, and she is worse! She said she was messing around while I ran to the store, and that MSE had even locked up. But, it ran fine for me!

Please note I did restore this > O4 - Global Startup: Bluetooth.lnk = ?

I won't be able to follow through with the above procedure in your post till I can get back to her. And by then...well, I have no idea what I'll encounter on her machine!

If you decide to not follow through...I understand completely! I was just curious about the 010 entry for educational purposes! And why it would show up all of a sudden! Did she do something? As I said in my first post, she isn't having any trouble and the machine is running fine?!

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [dscactivate] c:\dell\dsca.exe 3
O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
04 - HKLM\..\Run: [OEM07Mon.exe] C:\Windows\OEM07Mon.exe
O4 - HKLM\..\Run: [MediaButtons] C:\Windows\System32\MediaButtons.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: SetPoint.lnk = C:\Program Files\SetPoint\SetPoint.exe

This is the full log after the deletions:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:23:46 AM, on 5/9/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2919484227-2429461363-3170138906-1000\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'IUSR_NMPR')
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\wshbth.dll' missing
O13 - Gopher Prefix:
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CarboniteService - Carbonite, Inc. (Online Backup, Computer Backup Software & Remote Backup – Carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: Intel(R) DHTrace Controller (DHTRACE) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) NMSCore (NMSCore) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe
O23 - Service: Intel(R) Quality Manager (QualityManager) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

--
End of file - 6743 bytes


bbbluz

Hello,

I will of coarse follow through with this issue even months later. I will not just give up. There is never any rush, in your own time.

I do not have time to look at the log now, that will have to wait until this evening

Also, I will be interested to hear back once you know more. Also, is it *ONLY* antivirus programs that are giving you problems, because depending on the age of the machine, a missing system file (file system corruption a possiblilty) and lock ups when scanning files (any virus scanner) *COULD* be caused by hard disk failure/failing. I will give you more details on this when at home this evening.

Richard

Hello,

When I give you instructions, just run them when you can, and do not worry if you cannot do them for several weeks/months. This is perfectly fine. Just keep me informed when you know!

Malware removal is good fun, and I try to pick these cases when I can. Good luck in participating in an online course, however, if you have any questions (even if they are completely unrelated to this thread) just ask them. I will do my best to answer!

There is nothing particularly nasty in this log. You are using an old version (2.0.2) of HiJackThis, so if possible, update to 2.0.4 next time, but believe me, not much has changed, so this will not cause a problem.

Just to test for hard disk failure, please download, install and run Seatools for Windows (NOT Seatools for DOS): | Seagate

Please start it and select the hard disk drive (top of the list) Then select BASIC TESTS and run the following:

SMART Test (may be unavailable - do not worry if this is the case)
Short Drive Self Test: Usually less than 1 minute
Short Generic: Usually less than 1 minute
Ideally, if either of these fail, run the long tests for each of these (may be from 30 minutes to 2 hours, and less important)

DO NOT RUN ADVANCED TESTS! This will wipe all data on the drive, and often does not provide any additional information!

This can be a common cause of computer lockups, and the only cure is drive replacement. I hope this is not the problem, but if it is, do investigate the warrantee, computer components are often under warrantee, and it is definitely worth a try.

Also, press the Windows Key + R to open the Run dialogue. Type "cmd" without the quotes and press enter. In Command Prompt, type "sfc /scannow" and press enter (without the quotes, noting the space) This scan will take about 15 minutes.

If integrity violations are found, please run it again if possible (not essential, but ideal) then if integrity violations are still found, parse the logs. To do this, follow the top, yellow box here: http://www.vistax64.com/tutorials/66978-system-files-sfc-command.html

In summary, all you have to do is type "findstr /c:"[SR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt" (copy and paste) without the quotes, press enter, and upload/post inline the new sfcdetails.txt file created on your Desktop.

If all this comes to nothing, I will continue to help you further. Again, as I said earlier, there is no rush, in your own time.

Richard

Hi niemiro,

Just a follow up here. I contacted my Sister and she gave her laptop to her Son in the U.S. AirForce in exchange for his desktop Compac Presario. Mobility was his need for the exchange. I sent him this link so he could follow through if he liked, though he is very computer literate!

I'd like to Thank You very much for your time on this matter.

You may close this thread if you like!

Again, Thanks for your time.

I'm disappointed it turned out this way! I really wanted to know more about that 010 entry for educational purposes!
bbbluz

You are most welcome. Since you have wanted to learn, I have incluided some more information. I would recommend not following through with LSPFix unless a problem develops as it could just break your normal, working internet.

O10 Section
This section corresponds to Winsock Hijackers or otherwise known as LSP (Layered Service Provider).

LSPs are a way to chain a piece of software to your Winsock 2 implementation on your computer. Since the LSPs are chained together, when Winsock is used, the data is also transported through each of the LSPs in the chain. Spyware and Hijackers can use LSPs to see all traffic being transported over your Internet connection.

You should use extreme caution when deleting these objects if it is removed without properly fixing the gap in the chain, you can have loss of Internet access.

Example Listing O10 - Broken Internet access because of LSP provider 'spsublsp.dll' missing Many Virus Scanners are starting to scan for Viruses, Trojans, etc at the Winsock level. The problem is that many tend to not recreate the LSPs in the right order after deleting the offending LSP. This can cause HijackThis to see a problem and issue a warning, which may be similar to the example above, even though the Internet is indeed still working. You should therefore seek advice from an experienced user when fixing these errors. It is also advised that you use LSPFix, see link below, to fix these.

Spybot can generally fix these but make sure you get the latest version as the older ones had problems. There is a tool designed for this type of issue that would probably be better to use, called LSPFix. For a great list of LSP and whether or not they are valid you can visit SystemLookup's LSP List Page.

Click to expand...

P.S. One of the really good things about this forum is that threads are never closed. They can be marked as solved, but never closed, so you can always come back and ask me for more information. I have included a quote for an experienced user, but DO tell me if you don't quite understand it, and I will rewrite it more simply.

Also, if you promise me not to ever post on someone else's Malware Removal thread without taking a degree in Malware Removal, I will link you to a few websites that will probably interest you very much. They are only guides, and not definitive. Read them in the order listed:

HijackThis Tutorial - How to use HijackThis to remove Browser Hijackers & Spyware

OTL Tutorial - How to use OldTimer ListIt

Windows Alternate Data Streams


If you want to print them, use this completely free website: Save paper & ink printing only what you want then chop off anything that is not necessary to print. Then save as and download as PDF and print. To save you this effort, I will upload the PDFs that I made when first learning. This method looks nice and includes all formatting. Sorry about the last page on my ADS PDF, you may want to copy it by hand as I did. Also, look out for empty pages at the end, and I could not remove the top half of the first page on OTL.

You may also be interested in this other current thread by me: http://www.vistax64.com/general-discussion/278882-user-profile-failed-logon.html

Finally, if you are interested at all in taking a self-paced, completely free Malware Removal degree, tell me and I will give you some information about it. There is never any payment or commitment, however, you should pay it back on the forums later (ie help others with your new knowledge) If you would like any information at all, even if you don't sign up, just ask.

Hope you are happier now, and I hope you see this.

Richard

In retrospect, the new LSPFix is better and should not be a problem if run. Therefore, you can if you want run LSPFix, however, it is up to you.