help removing cmdservice

Question

hi,   can anyone help me removing this spyware ive tried running numerous virus scans. I see from previous posts that it is necessary to run hijack this and post the results which are below.   TIA Barry   Logfile of HijackThis v1.99.1 Scan saved at 19:34:09, on 22/08/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files
tl
tl Netguard\fws.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\Command Software\dvpapi.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32	cpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\mHotkey.exe C:\Program Files\Xerox\NWWia\XrxFTPLt.exe C:\Program Files\Xerox One Touch\OneTouchMon.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE C:\Program Files\SoftDisc\softdisc.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files
tl
tl Netguard\RPS.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\Barry\Local Settings\Temp\wzf23b\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.co.uk R3 - Default URLSearchHook is missing O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file) O4 - HKLM\..\Run: [CHotkey] mHotkey.exe O4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe' O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe' O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe' O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [OneTouch Monitor] 'C:\Program Files\Xerox One Touch\OneTouchMon.exe' O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe O4 - HKLM\..\Run: [SoftDisc] 'C:\Program Files\SoftDisc\softdisc.exe' -hide O4 - HKLM\..\Run: [Rmmqejbp] C:\Program Files\Bnpzy\Samcmk.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] 'C:\Program Files\D-Tools\daemon.exe' -lang 1033 -noicon O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe O4 - HKLM\..\Run: [ntl Netguard] 'C:\Program Files
tl
tl Netguard\RPS.exe' O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\RunServices: [p2p networking] p2pnetworking.exe O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LangSupportEx] mspmspv.exe O4 - HKCU\..\Run: [United Alerts] C:\Program Files\United Alerts\UnitedAlerts.exe O4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealPlayerealplay.exe' /RunUPGToolCommandReBoot O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O12 - Plugin for ¸æ : C:\Program Files\Internet Explorer\PLUGINS
pqtplugin4.dll O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130758019015 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 'C:\PROGRA~1\MSNMES~1\msgrapp.dll' (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - C:\Program Files
tl
tl Netguard\fws.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor
etmon.exe (file missing) O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

1972vet · Answer

Please Move HijackThis! To A Permanent Folder When you installed HijackThis, it installed to a temporary folder. Creating a permanent folder will ensure that HijackThis is not accidentally deleted when we clean out these directories. 1. Click on 'My Computer -> C:'. Under the File menu, please click 'New -> Folder' 2. Rename the new folder (for example, type 'HJT' without the quotes) and move the HijackThis.exe file into the new directory. Please follow these steps to remove older version Java components 1. Close any open programs you may have running, especially your web browser. 2. Click Start-->Control Panel-->Add or Remove Programs. For those just reading this thread:Depending on your OS, you may have to click Start-->Settings-->Control Panel-->Add or Remove Programs. 3. Click once on any item listing Java Runtime Environment in the name (to highlight it) then click the 'Remove' or 'Change/Remove' button. Not every version of Java will begin with 'Java' so be sure to read each entry in the list. Repeat step 3 as many times as necessary to remove all versions of Java. **If you are asked to reboot at any point during the uninstallations, please do so. Then go back to Add/Remove and continue with the rest of the removals...when finished uninstalling all of them, reboot the computer. 4. Navigate to and delete: C:\Program Files\ Java =this folder if found 5. Then go to this page. Scroll down to where it says 'The J2SE Runtime Environment (JRE) allows end-users to run Java applications'and click the 'Download' button to the right. 6. Check the box that says: 'Accept License Agreement' the page will refresh and click on the link to download Windows Offline Installation with or without Multi-language. Save it to your desktop. Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version. You are running more than one antivirus scanners. By doing so, you actually reduce your level of protection. As well, you run the risk of data loss from a system crash that can result from the system instability that it can cause. Please decide which to keep and uninstall the others. Please download the KILLBOX, extract it to your desktop. Do Nothing With It Yet. Download Ewido anti-spyware to your desktop. This is a 30 day free trial. At the end of the 30-day trial period the full version features (active guard, automatic updates...) will be deactivated and the program will become a feature-limited freeware version...You can still keep it and use it for 'On Demand' scanning. Double click the icon on the desktop to launch the set up program. Select Change state to inactivate 'Resident Shield' and 'Automatic Updates'. Right click on ewido in the system tray and uncheck 'Start with Windows'. Once the setup is complete you will need to update the definition files. On the main screen select the icon Update then click the Start Update button. The update will start and a progress bar will show the updates being installed. Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab. Once in the Settings screen click on Recommended actions and then select Quarantine. Under Reports Select Automatically generate report after every scan Un-Select Only if threats were found Close ewido anti-spyware. Please boot into Safe mode: Restart the computer and immediately begin tapping the F8 key (or F5 on some Dell machines). Use the arrow keys to highlight Safe Mode and press the Enter key. Once in safe mode, continue with the instructions below: Launch ewido anti-spyware by double-clicking the icon on your desktop. Select the Scanner icon at the top, then the Scan tab then click on Complete System Scan. ewido will now begin the scanning process, be patient this may take some time. When prompted of an infection, please select Apply all actions Once the scan is complete do the following: Next select the Reports icon at the top. Select the Save report as button in the lower left hand of the screen and save it to your Desktop. Now close ewido anti-spyware. Open killbox.exe. First click on Tools>Delete Temp Files. A box will open with a list of all user profiles. Check the following boxes at a minimum for each profile by clicking on the drop down and checking the boxes that are enabled. Some will not apply and those boxes will not be available to check. Make sure you do this for all the profiles listed. Temporary Internet Files Temp Files XP Prefetch If you want to clean your cookies, history, and list of recent files run you may check those boxes as well. Then, click on the Button titled 'Delete Selected Temp Files'. Exit by clicking the Button titled 'Exit(Save Settings)'. Once back into the main killbox program, check the box: Delete on Reboot Highlight all the entries below in Bold text and then copy them. C:\Program Files\Bnpzy\Samcmk.exeC:\Windows\System32\p2pnetworking.exeC:\Windows\System32\mspmspv.exeC:\Program Files\Network Monitor
etmon.exe Then in killbox click File>>Paste from Clipboard At this point click the 'All Files' button. Then click the Red X ...and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No for now. Note: Killbox will let you know if a file does not exist. If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the 'Single File' button. Then click the Red X ...and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until you've completed the instructions below. Please run HijackThis again and check the following that may still exist: R3 - Default URLSearchHook is missingO3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - (no file)O4 - HKLM\..\Run: C:\Program Files\Bnpzy\Samcmk.exeO4 - HKLM\..\RunServices: p2pnetworking.exeO4 - HKCU\..\Run: mspmspv.exeO23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor
etmon.exe (file missing) Now close all windows except for HijackThis then click Fix Checked. Reboot the computer and post the Ewido scan log along with a new HijackThis log. Thanks!

barry16 · Answer

I followed all the instructions that you gave me.   my virus scan told me a couple of minutes ago that cmdservice was present and it could not delete it.   ewido would not allow me to save a copy of the log, the save button was 'greyed out'.   my latest hijack this log is posted below.   thank you for your help it is much appreciated.     Logfile of HijackThis v1.99.1 Scan saved at 17:19:48, on 25/08/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files
tl
tl Netguard\fws.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32	cpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\mHotkey.exe C:\Program Files\Xerox\NWWia\XrxFTPLt.exe C:\Program Files\Xerox One Touch\OneTouchMon.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE C:\Program Files\SoftDisc\softdisc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe C:\Program Files
tl
tl Netguard\RPS.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Documents and Settings\Barry\Desktop\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.co.uk O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files
tl
tl Netguard\pkR.dll O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files
tl
tl Netguard\FBHR.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O4 - HKLM\..\Run: [CHotkey] mHotkey.exe O4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe' O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe' O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe' O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [OneTouch Monitor] 'C:\Program Files\Xerox One Touch\OneTouchMon.exe' O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe O4 - HKLM\..\Run: [SoftDisc] 'C:\Program Files\SoftDisc\softdisc.exe' -hide O4 - HKLM\..\Run: [DAEMON Tools-1033] 'C:\Program Files\D-Tools\daemon.exe' -lang 1033 -noicon O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe' O4 - HKLM\..\Run: [ntl Netguard] 'C:\Program Files
tl
tl Netguard\RPS.exe' O4 - HKLM\..\Run: [Zone Labs Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [United Alerts] C:\Program Files\United Alerts\UnitedAlerts.exe O4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealPlayerealplay.exe' /RunUPGToolCommandReBoot O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O12 - Plugin for ¸æ : C:\Program Files\Internet Explorer\PLUGINS
pqtplugin4.dll O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130758019015 O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://ebanking.northernbank.co.uk/html/activex/e-Safekey/NB/e-Safekey.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - 'C:\PROGRA~1\MSNMES~1\msgrapp.dll' (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - C:\Program Files
tl
tl Netguard\fws.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

1972vet · Answer

Well...I don't see cmdservice running in the log. Were you infected with it some time in the past? It may be that your antivirus scanner is finding it inside an archived file from one of your other antivirus applications (You have 3 running). Nonetheless, it is important for the secure and stable running of your system to uninstall two of the antivirus scanners...keeping just one.

If you have problems removing the remnants of the old Symantec application that you had (the antivirus service is still running), you can click here and use the Norton Removal Tool.

The other two applications are ntl antivirus and Authentium antivirus.
Of those two, please decide which to keep and uninstll the other.

Reboot when the uninstall completes and see if you still get the cmdservice warning from your antivirus scanner. If the problem persists, let's see if we can force a surrender:

Please click "My Computer", then double click on the C:\ drive.
In the menu bar, click File->New->Folder.
This will create a folder which you should rename to "BFU"

Please download Brute Force Uninstaller to your desktop.

Right click the BFU folder on your desktop, and choose Extract All
Click "Next"
In the box to choose where to extract the files to,
Click "Browse"
Click on the + sign next to "My Computer"
Click on "Local Disk (C: ) or whatever your primary drive is
Click "Make New Folder"
Type in BFU
Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

3. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As" ) in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

Do not run the Uninstaller and the Remover yet.

Please boot into Safe mode:
Restart the computer and immediately begin tapping the F8 key (or F5 on some Dell machines).
Use the arrow keys to highlight Safe Mode and press the Enter key.
Once in safe mode, continue with the instructions below:

Open My Computer and navigate to the c:\BFU folder. Start the Brute Force Uninstaller by doubleclicking BFU.exe

Behind the scriptline to execute field click the folder icon and select alcanshorty.bfu

Press execute and wait for the complete script execution box to pop up then press OK.
Press exit to terminate the BFU program.

Close all windows except for HijackThis before clicking Fix Checked.

Reboot into your normal windows user mode and post a new HiJackThis log. Please advise how the computer is now performing. Thanks!

barry16 · Answer

I have yet to get the cmdservice message from my virus scanner (ntl netguard) since removing the remainder of norton av.   as for Authentium antivirus i have never to my knowledge installed this on my computer and it is not present in my add/remove programs list, what do you recommend?   Thanks, Barry     Logfile of HijackThis v1.99.1 Scan saved at 11:56:33, on 26/08/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files
tl
tl Netguard\fws.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Common Files\Command Software\dvpapi.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32	cpsvcs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\mHotkey.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Xerox\NWWia\XrxFTPLt.exe C:\Program Files\Xerox One Touch\OneTouchMon.exe C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe C:\Program Files\SoftDisc\softdisc.exe C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\United Alerts\UnitedAlerts.exe C:\WINDOWS\system32\msiexec.exe C:\Documents and Settings\Barry\Desktop\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.co.uk O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files
tl
tl Netguard\pkR.dll O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files
tl
tl Netguard\FBHR.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O4 - HKLM\..\Run: [CHotkey] mHotkey.exe O4 - HKLM\..\Run: [RoxioEngineUtility] 'C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe' O4 - HKLM\..\Run: [RoxioDragToDisc] 'C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe' O4 - HKLM\..\Run: [RoxioAudioCentral] 'C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe' O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe O4 - HKLM\..\Run: [XeroxScannerDaemon] C:\Program Files\Xerox\NWWia\XrxFTPLt.exe O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe O4 - HKLM\..\Run: [OneTouch Monitor] 'C:\Program Files\Xerox One Touch\OneTouchMon.exe' O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\Monitor.exe O4 - HKLM\..\Run: [SoftDisc] 'C:\Program Files\SoftDisc\softdisc.exe' -hide O4 - HKLM\..\Run: [DAEMON Tools-1033] 'C:\Program Files\D-Tools\daemon.exe' -lang 1033 -noicon O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [OCAudioIni] C:\Program Files\One-click Audio Converter\OCAudioIni.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] 'C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe' O4 - HKLM\..\Run: [ntl Netguard] 'C:\Program Files
tl
tl Netguard\RPS.exe' O4 - HKLM\..\Run: [Zone Labs Client] 'C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe' O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [United Alerts] C:\Program Files\United Alerts\UnitedAlerts.exe O4 - HKCU\..\Run: [RealPlayer] 'C:\Program Files\Real\RealPlayerealplay.exe' /RunUPGToolCommandReBoot O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS
pqtplugin3.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O12 - Plugin for ¸æ : C:\Program Files\Internet Explorer\PLUGINS
pqtplugin4.dll O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab O16 - DPF: {38D63471-E630-4492-A986-B8C48B79F2F8} (CVideoEgg_ActiveXCtl Object) - http://update.videoegg.com/wintel/VideoEggPublisher.exe O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1130758019015 O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Radialpoint Service (FWS) - Radialpoint Inc. - C:\Program Files
tl
tl Netguard\fws.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

1972vet · Answer

These two entries in your log are related to the free antivirus "Authentium":
C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe

From what I have found on it, the impression is that it's offered as a free service from some of the ISP vendors (Earthlink's dsl for example).

You can check in your add/remove programs list for something named "Command Software" and click Remove.

Otherwise, your log looks clean. How's the Computer running now? Are you having any other issues?

barry16 · Answer

i done a quick search on the file name dvpapi.exe, it seems to come bundled with antivirus and firewall programs to test if they are working. im assuming it came with ntl netguard which i have only started using this week.   everything else is running perfectly now.   Thank you very much for your help.

Virus & Spyware

help removing cmdservice

Was this post helpful?