Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Im about to crack, Need help badly. [resolved]


  • This topic is locked This topic is locked

#1
Tommiebuoy

Tommiebuoy

    Member

  • Member
  • PipPip
  • 31 posts
For the last few weeks this has been making my internet surfing a nightmare. I have run spysweeper, avg, spybot, spydoctor, adaware and the CWS shredder. I have used hijack this to remove a few obvious culprits but this doesnt help. I really need help. The symptoms are as followed

While searching google spotresults or blazefind sends a popup using their own search engine
Popupts while surfing from ad-w-a-r-e including blazefind and spotresults.
Popups advertising free sms, that stupid frog ringtone and a casino.
My recycle bin wont work (not sure if this is connected)
A process called rundll32.exe that appears to have no function but sucks up memory and restarts itself if I try to close (this appeared the same time as the popups)

The popups appear as long as I am connected to the internet. I really need help. These are my hjt logs.

Logfile of HijackThis v1.99.0
Scan saved at 21:54:46, on 22/03/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Tom\Hijackthis\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19....es/MsnPUpld.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://spgame.com/infogame/msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7B20DEF-0663-4E5E-BD4E-603390F7DE17}: NameServer = 62.241.162.200 158.43.240.3
O23 - Service: TrueVector Internet Monitor - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Any help would be much appreciated, thank you.
  • 0

Advertisements


#2
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.
  • 0

#3
Tommiebuoy

Tommiebuoy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Ah, I've had problem with that update. The last time I tried it froze while updating and I almost had to format, Ill fix the update and post a fresh hjt log as soon as possible.
  • 0

#4
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
You'll be reinfected almost immediately without it's installation.
  • 0

#5
Tommiebuoy

Tommiebuoy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Hi, thanks for waiting.

I have fully upgraded XP with the new service patches and updates from windows automatic update.

Here is the fresh hijack this log

Logfile of HijackThis v1.99.0
Scan saved at 16:16:52, on 23/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Tom\Hijackthis\HijackThis.exe

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19....es/MsnPUpld.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://spgame.com/infogame/msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7B20DEF-0663-4E5E-BD4E-603390F7DE17}: NameServer = 62.241.162.200 158.43.240.3
O23 - Service: TrueVector Internet Monitor - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  • 0

#6
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
  • 0

#7
Tommiebuoy

Tommiebuoy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Hi, done.

L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Themes]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\h24mlch11f4.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{B314A4E0-9104-E2BD-5A38-38932A3D7863}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"="TrojanHunter Menu Shell Extension"
"{4C2F8D89-1073-43F9-B150-0FEF967E600E}"=""
"{7F78812E-82C7-4D69-92FC-FE9324B07C29}"=""
"{6EE51AA0-77A0-11D7-B4E1-000347126E46}"="Window Washer Shredding Utility"
"{5FE13A91-62E2-40CF-8AC1-62D781194460}"=""
"{FE3C44A3-756B-47B5-BA74-77A01DE98F90}"=""
"{CEAF3E34-5791-42A0-BCE3-78A58C3E8F39}"=""
"{87FCC9E0-C268-4665-B8E0-D0851E9E9209}"=""
"{6FE71B54-5937-4B8F-A956-4880C32DA68B}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4C2F8D89-1073-43F9-B150-0FEF967E600E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4C2F8D89-1073-43F9-B150-0FEF967E600E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4C2F8D89-1073-43F9-B150-0FEF967E600E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4C2F8D89-1073-43F9-B150-0FEF967E600E}\InprocServer32]
@="C:\\WINDOWS\\system32\\dfwsock.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7F78812E-82C7-4D69-92FC-FE9324B07C29}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7F78812E-82C7-4D69-92FC-FE9324B07C29}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7F78812E-82C7-4D69-92FC-FE9324B07C29}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7F78812E-82C7-4D69-92FC-FE9324B07C29}\InprocServer32]
@="C:\\WINDOWS\\system32\\muvcr71.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5FE13A91-62E2-40CF-8AC1-62D781194460}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5FE13A91-62E2-40CF-8AC1-62D781194460}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5FE13A91-62E2-40CF-8AC1-62D781194460}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5FE13A91-62E2-40CF-8AC1-62D781194460}\InprocServer32]
@="C:\\WINDOWS\\system32\\dqmodemx.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FE3C44A3-756B-47B5-BA74-77A01DE98F90}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FE3C44A3-756B-47B5-BA74-77A01DE98F90}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FE3C44A3-756B-47B5-BA74-77A01DE98F90}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FE3C44A3-756B-47B5-BA74-77A01DE98F90}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{CEAF3E34-5791-42A0-BCE3-78A58C3E8F39}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CEAF3E34-5791-42A0-BCE3-78A58C3E8F39}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CEAF3E34-5791-42A0-BCE3-78A58C3E8F39}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CEAF3E34-5791-42A0-BCE3-78A58C3E8F39}\InprocServer32]
@="C:\\WINDOWS\\system32\\wW2topl.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{87FCC9E0-C268-4665-B8E0-D0851E9E9209}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{87FCC9E0-C268-4665-B8E0-D0851E9E9209}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{87FCC9E0-C268-4665-B8E0-D0851E9E9209}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{87FCC9E0-C268-4665-B8E0-D0851E9E9209}\InprocServer32]
@="C:\\WINDOWS\\system32\\mw4ql9h51.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6FE71B54-5937-4B8F-A956-4880C32DA68B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6FE71B54-5937-4B8F-A956-4880C32DA68B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6FE71B54-5937-4B8F-A956-4880C32DA68B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6FE71B54-5937-4B8F-A956-4880C32DA68B}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is FCC3-AEB6

Directory of C:\WINDOWS\System32

24/03/2005 09:43 233,525 guard.tmp
24/03/2005 09:34 233,525 mw4ql9h51.dll
23/03/2005 21:01 233,525 mvp4l97q1.dll
23/03/2005 21:00 233,525 mwcomput.dll
23/03/2005 19:18 233,525 h24mlch11f4.dll
23/03/2005 19:15 233,525 majint40.dll
23/03/2005 19:13 233,248 i0lo0a33ed.dll
23/03/2005 18:34 233,248 auivtmxx.dll
23/03/2005 17:49 233,248 vns_ps.dll
23/03/2005 16:10 233,248 hr6o05j3e.dll
23/03/2005 15:47 <DIR> dllcache
23/03/2005 15:29 233,248 jtl6073se.dll
22/03/2005 21:28 233,248 wznetmgr.dll
22/03/2005 19:18 233,248 dfwsock.dll
21/03/2005 20:16 233,248 f4l00e3meh.dll
21/03/2005 19:32 233,248 medrv.dll
21/03/2005 19:15 233,248 nflanman.dll
21/03/2005 13:52 233,248 m4po0e73eh.dll
21/03/2005 12:59 233,248 k280lclm1fqa.dll
21/03/2005 12:56 233,248 hrd.dll
21/03/2005 12:55 233,248 u0rula991d.dll
21/03/2005 12:17 233,248 qcgrprxy.dll
20/03/2005 22:32 233,248 mv4ql9h51.dll
20/03/2005 22:31 233,248 kldcr.dll
20/03/2005 21:25 233,248 kwdlv1.dll
20/03/2005 20:09 233,248 ltl0273mg.dll
20/03/2005 20:06 233,248 eaentcls.dll
20/03/2005 17:38 233,248 e8020idoe80c0.dll
20/03/2005 15:27 233,248 k2080cduef080.dll
20/03/2005 15:24 233,248 dqmodemx.dll
20/03/2005 10:39 233,248 muvcr71.dll
03/07/2004 15:55 <DIR> Microsoft
30 File(s) 6,999,102 bytes
2 Dir(s) 16,776,826,880 bytes free
  • 0

#8
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log, and we'll clean up what's left. :tazz:

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
  • 0

#9
Tommiebuoy

Tommiebuoy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Hi, sorry for the late reply. Here are both sets of logs and thanks again for all the help.

-----------------------------

L2Mfix 1.03

Running From:
C:\Documents and Settings\Thomas\Desktop\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Thomas\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Thomas\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 220 'explorer.exe'
Killing PID 220 'explorer.exe'
Killing PID 220 'explorer.exe'
Killing PID 220 'explorer.exe'
Killing PID 220 'explorer.exe'
Killing PID 220 'explorer.exe'
Killing PID 220 'explorer.exe'
Killing PID 220 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 312 'rundll32.exe'
Killing PID 312 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\auivtmxx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dfwsock.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dOtime.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dqmodemx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\e8020idoe80c0.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\eaentcls.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\f4l00e3meh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr6o05j3e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hrd.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\i0lo0a33ed.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ilxwan.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jtl6073se.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\k2080cduef080.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\k280lclm1fqa.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kldcr.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kwdlv1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\l0r00a9med.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ltl0273mg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\m264lcjq1foe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\m4po0e73eh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\majint40.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\medrv.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\muvcr71.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mv4ql9h51.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mw4ql9h51.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mwcomput.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nflanman.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\qcery.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\qcgrprxy.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\u0rula991d.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\vns_ps.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wonntbbu.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wxaservc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wznetmgr.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\auivtmxx.dll
Successfully Deleted: C:\WINDOWS\system32\auivtmxx.dll
deleting: C:\WINDOWS\system32\dfwsock.dll
Successfully Deleted: C:\WINDOWS\system32\dfwsock.dll
deleting: C:\WINDOWS\system32\dOtime.dll
Successfully Deleted: C:\WINDOWS\system32\dOtime.dll
deleting: C:\WINDOWS\system32\dqmodemx.dll
Successfully Deleted: C:\WINDOWS\system32\dqmodemx.dll
deleting: C:\WINDOWS\system32\e8020idoe80c0.dll
Successfully Deleted: C:\WINDOWS\system32\e8020idoe80c0.dll
deleting: C:\WINDOWS\system32\eaentcls.dll
Successfully Deleted: C:\WINDOWS\system32\eaentcls.dll
deleting: C:\WINDOWS\system32\f4l00e3meh.dll
Successfully Deleted: C:\WINDOWS\system32\f4l00e3meh.dll
deleting: C:\WINDOWS\system32\hr6o05j3e.dll
Successfully Deleted: C:\WINDOWS\system32\hr6o05j3e.dll
deleting: C:\WINDOWS\system32\hrd.dll
Successfully Deleted: C:\WINDOWS\system32\hrd.dll
deleting: C:\WINDOWS\system32\i0lo0a33ed.dll
Successfully Deleted: C:\WINDOWS\system32\i0lo0a33ed.dll
deleting: C:\WINDOWS\system32\ilxwan.dll
Successfully Deleted: C:\WINDOWS\system32\ilxwan.dll
deleting: C:\WINDOWS\system32\jtl6073se.dll
Successfully Deleted: C:\WINDOWS\system32\jtl6073se.dll
deleting: C:\WINDOWS\system32\k2080cduef080.dll
Successfully Deleted: C:\WINDOWS\system32\k2080cduef080.dll
deleting: C:\WINDOWS\system32\k280lclm1fqa.dll
Successfully Deleted: C:\WINDOWS\system32\k280lclm1fqa.dll
deleting: C:\WINDOWS\system32\kldcr.dll
Successfully Deleted: C:\WINDOWS\system32\kldcr.dll
deleting: C:\WINDOWS\system32\kwdlv1.dll
Successfully Deleted: C:\WINDOWS\system32\kwdlv1.dll
deleting: C:\WINDOWS\system32\l0r00a9med.dll
Successfully Deleted: C:\WINDOWS\system32\l0r00a9med.dll
deleting: C:\WINDOWS\system32\ltl0273mg.dll
Successfully Deleted: C:\WINDOWS\system32\ltl0273mg.dll
deleting: C:\WINDOWS\system32\m264lcjq1foe.dll
Successfully Deleted: C:\WINDOWS\system32\m264lcjq1foe.dll
deleting: C:\WINDOWS\system32\m4po0e73eh.dll
Successfully Deleted: C:\WINDOWS\system32\m4po0e73eh.dll
deleting: C:\WINDOWS\system32\majint40.dll
Successfully Deleted: C:\WINDOWS\system32\majint40.dll
deleting: C:\WINDOWS\system32\medrv.dll
Successfully Deleted: C:\WINDOWS\system32\medrv.dll
deleting: C:\WINDOWS\system32\muvcr71.dll
Successfully Deleted: C:\WINDOWS\system32\muvcr71.dll
deleting: C:\WINDOWS\system32\mv4ql9h51.dll
Successfully Deleted: C:\WINDOWS\system32\mv4ql9h51.dll
deleting: C:\WINDOWS\system32\mw4ql9h51.dll
Successfully Deleted: C:\WINDOWS\system32\mw4ql9h51.dll
deleting: C:\WINDOWS\system32\mwcomput.dll
Successfully Deleted: C:\WINDOWS\system32\mwcomput.dll
deleting: C:\WINDOWS\system32\nflanman.dll
Successfully Deleted: C:\WINDOWS\system32\nflanman.dll
deleting: C:\WINDOWS\system32\qcery.dll
Successfully Deleted: C:\WINDOWS\system32\qcery.dll
deleting: C:\WINDOWS\system32\qcgrprxy.dll
Successfully Deleted: C:\WINDOWS\system32\qcgrprxy.dll
deleting: C:\WINDOWS\system32\u0rula991d.dll
Successfully Deleted: C:\WINDOWS\system32\u0rula991d.dll
deleting: C:\WINDOWS\system32\vns_ps.dll
Successfully Deleted: C:\WINDOWS\system32\vns_ps.dll
deleting: C:\WINDOWS\system32\wonntbbu.dll
Successfully Deleted: C:\WINDOWS\system32\wonntbbu.dll
deleting: C:\WINDOWS\system32\wxaservc.dll
Successfully Deleted: C:\WINDOWS\system32\wxaservc.dll
deleting: C:\WINDOWS\system32\wznetmgr.dll
Successfully Deleted: C:\WINDOWS\system32\wznetmgr.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: auivtmxx.dll (140 bytes security) (deflated 4%)
adding: dfwsock.dll (140 bytes security) (deflated 4%)
adding: dOtime.dll (140 bytes security) (deflated 4%)
adding: dqmodemx.dll (140 bytes security) (deflated 4%)
adding: e8020idoe80c0.dll (140 bytes security) (deflated 4%)
adding: eaentcls.dll (140 bytes security) (deflated 4%)
adding: f4l00e3meh.dll (140 bytes security) (deflated 4%)
adding: hr6o05j3e.dll (140 bytes security) (deflated 4%)
adding: hrd.dll (140 bytes security) (deflated 4%)
adding: i0lo0a33ed.dll (140 bytes security) (deflated 4%)
adding: ilxwan.dll (140 bytes security) (deflated 4%)
adding: jtl6073se.dll (140 bytes security) (deflated 4%)
adding: k2080cduef080.dll (140 bytes security) (deflated 4%)
adding: k280lclm1fqa.dll (140 bytes security) (deflated 4%)
adding: kldcr.dll (140 bytes security) (deflated 4%)
adding: kwdlv1.dll (140 bytes security) (deflated 4%)
adding: l0r00a9med.dll (140 bytes security) (deflated 4%)
adding: ltl0273mg.dll (140 bytes security) (deflated 4%)
adding: m264lcjq1foe.dll (140 bytes security) (deflated 4%)
adding: m4po0e73eh.dll (140 bytes security) (deflated 4%)
adding: majint40.dll (140 bytes security) (deflated 4%)
adding: medrv.dll (140 bytes security) (deflated 4%)
adding: muvcr71.dll (140 bytes security) (deflated 4%)
adding: mv4ql9h51.dll (140 bytes security) (deflated 4%)
adding: mw4ql9h51.dll (140 bytes security) (deflated 4%)
adding: mwcomput.dll (140 bytes security) (deflated 4%)
adding: nflanman.dll (140 bytes security) (deflated 4%)
adding: qcery.dll (140 bytes security) (deflated 4%)
adding: qcgrprxy.dll (140 bytes security) (deflated 4%)
adding: u0rula991d.dll (140 bytes security) (deflated 4%)
adding: vns_ps.dll (140 bytes security) (deflated 4%)
adding: wonntbbu.dll (140 bytes security) (deflated 4%)
adding: wxaservc.dll (140 bytes security) (deflated 5%)
adding: wznetmgr.dll (140 bytes security) (deflated 4%)
adding: guard.tmp (140 bytes security) (deflated 4%)
adding: clear.reg (140 bytes security) (deflated 61%)
adding: echo.reg (140 bytes security) (deflated 9%)
adding: desktop.ini (140 bytes security) (deflated 15%)
adding: direct.txt (140 bytes security) (stored 0%)
adding: lo2.txt (140 bytes security) (deflated 85%)
adding: readme.txt (140 bytes security) (deflated 49%)
adding: report.txt (140 bytes security) (deflated 68%)
adding: test.txt (140 bytes security) (deflated 81%)
adding: test2.txt (140 bytes security) (deflated 41%)
adding: test3.txt (140 bytes security) (deflated 41%)
adding: test5.txt (140 bytes security) (deflated 41%)
adding: xfind.txt (140 bytes security) (deflated 76%)
adding: backregs/4C2F8D89-1073-43F9-B150-0FEF967E600E.reg (140 bytes security) (deflated 70%)
adding: backregs/5FE13A91-62E2-40CF-8AC1-62D781194460.reg (140 bytes security) (deflated 70%)
adding: backregs/6FE71B54-5937-4B8F-A956-4880C32DA68B.reg (140 bytes security) (deflated 70%)
adding: backregs/7F78812E-82C7-4D69-92FC-FE9324B07C29.reg (140 bytes security) (deflated 70%)
adding: backregs/87FCC9E0-C268-4665-B8E0-D0851E9E9209.reg (140 bytes security) (deflated 70%)
adding: backregs/CEAF3E34-5791-42A0-BCE3-78A58C3E8F39.reg (140 bytes security) (deflated 70%)
adding: backregs/FE3C44A3-756B-47B5-BA74-77A01DE98F90.reg (140 bytes security) (deflated 70%)
adding: backregs/shell.reg (140 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: auivtmxx.dll
deleting local copy: dfwsock.dll
deleting local copy: dOtime.dll
deleting local copy: dqmodemx.dll
deleting local copy: e8020idoe80c0.dll
deleting local copy: eaentcls.dll
deleting local copy: f4l00e3meh.dll
deleting local copy: hr6o05j3e.dll
deleting local copy: hrd.dll
deleting local copy: i0lo0a33ed.dll
deleting local copy: ilxwan.dll
deleting local copy: jtl6073se.dll
deleting local copy: k2080cduef080.dll
deleting local copy: k280lclm1fqa.dll
deleting local copy: kldcr.dll
deleting local copy: kwdlv1.dll
deleting local copy: l0r00a9med.dll
deleting local copy: ltl0273mg.dll
deleting local copy: m264lcjq1foe.dll
deleting local copy: m4po0e73eh.dll
deleting local copy: majint40.dll
deleting local copy: medrv.dll
deleting local copy: muvcr71.dll
deleting local copy: mv4ql9h51.dll
deleting local copy: mw4ql9h51.dll
deleting local copy: mwcomput.dll
deleting local copy: nflanman.dll
deleting local copy: qcery.dll
deleting local copy: qcgrprxy.dll
deleting local copy: u0rula991d.dll
deleting local copy: vns_ps.dll
deleting local copy: wonntbbu.dll
deleting local copy: wxaservc.dll
deleting local copy: wznetmgr.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\auivtmxx.dll
C:\WINDOWS\system32\dfwsock.dll
C:\WINDOWS\system32\dOtime.dll
C:\WINDOWS\system32\dqmodemx.dll
C:\WINDOWS\system32\e8020idoe80c0.dll
C:\WINDOWS\system32\eaentcls.dll
C:\WINDOWS\system32\f4l00e3meh.dll
C:\WINDOWS\system32\hr6o05j3e.dll
C:\WINDOWS\system32\hrd.dll
C:\WINDOWS\system32\i0lo0a33ed.dll
C:\WINDOWS\system32\ilxwan.dll
C:\WINDOWS\system32\jtl6073se.dll
C:\WINDOWS\system32\k2080cduef080.dll
C:\WINDOWS\system32\k280lclm1fqa.dll
C:\WINDOWS\system32\kldcr.dll
C:\WINDOWS\system32\kwdlv1.dll
C:\WINDOWS\system32\l0r00a9med.dll
C:\WINDOWS\system32\ltl0273mg.dll
C:\WINDOWS\system32\m264lcjq1foe.dll
C:\WINDOWS\system32\m4po0e73eh.dll
C:\WINDOWS\system32\majint40.dll
C:\WINDOWS\system32\medrv.dll
C:\WINDOWS\system32\muvcr71.dll
C:\WINDOWS\system32\mv4ql9h51.dll
C:\WINDOWS\system32\mw4ql9h51.dll
C:\WINDOWS\system32\mwcomput.dll
C:\WINDOWS\system32\nflanman.dll
C:\WINDOWS\system32\qcery.dll
C:\WINDOWS\system32\qcgrprxy.dll
C:\WINDOWS\system32\u0rula991d.dll
C:\WINDOWS\system32\vns_ps.dll
C:\WINDOWS\system32\wonntbbu.dll
C:\WINDOWS\system32\wxaservc.dll
C:\WINDOWS\system32\wznetmgr.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{4C2F8D89-1073-43F9-B150-0FEF967E600E}"=-
"{7F78812E-82C7-4D69-92FC-FE9324B07C29}"=-
"{5FE13A91-62E2-40CF-8AC1-62D781194460}"=-
"{FE3C44A3-756B-47B5-BA74-77A01DE98F90}"=-
"{CEAF3E34-5791-42A0-BCE3-78A58C3E8F39}"=-
"{87FCC9E0-C268-4665-B8E0-D0851E9E9209}"=-
"{6FE71B54-5937-4B8F-A956-4880C32DA68B}"=-
[-HKEY_CLASSES_ROOT\CLSID\{4C2F8D89-1073-43F9-B150-0FEF967E600E}]
[-HKEY_CLASSES_ROOT\CLSID\{7F78812E-82C7-4D69-92FC-FE9324B07C29}]
[-HKEY_CLASSES_ROOT\CLSID\{5FE13A91-62E2-40CF-8AC1-62D781194460}]
[-HKEY_CLASSES_ROOT\CLSID\{FE3C44A3-756B-47B5-BA74-77A01DE98F90}]
[-HKEY_CLASSES_ROOT\CLSID\{CEAF3E34-5791-42A0-BCE3-78A58C3E8F39}]
[-HKEY_CLASSES_ROOT\CLSID\{87FCC9E0-C268-4665-B8E0-D0851E9E9209}]
[-HKEY_CLASSES_ROOT\CLSID\{6FE71B54-5937-4B8F-A956-4880C32DA68B}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{ED36F3F8-C31B-4BAF-9944-E2029FA9461F}</IDone>
<IDtwo>VT00</IDtwo>
<VERSION>200</VERSION>
****************************************************************************

------------------------------------------------

Logfile of HijackThis v1.99.0
Scan saved at 11:16:02, on 25/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Tom\Hijackthis\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [rpnuwxo] c:\windows\system32\rpnuwxo.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19....es/MsnPUpld.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://spgame.com/infogame/msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7B20DEF-0663-4E5E-BD4E-603390F7DE17}: NameServer = 62.241.162.200 158.43.240.3
  • 0

#10
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
OK. Set your restore points.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb;en-us;310405


Run Hijack This and put a check mark next to these:


O4 - HKLM\..\Run: [rpnuwxo] c:\windows\system32\rpnuwxo.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE<<resource hog

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)


Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following file (if found):

c:\windows\system32\rpnuwxo.exe

Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin

Click OK and Disk Cleanup will delete those files for you.


Reboot and post a new log. (Please use the latest version of Hijack This. You are using an old version and it might not be catching everything. ) :tazz: Let me know how it's running.
  • 0

Advertisements


#11
Tommiebuoy

Tommiebuoy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Hi, I followed your instructions, and I have not seen any popups in a while. Hopefully, you got it. I couldn't find rpnuwxo.exe in system32, but a search found RPNUWXO.EXE-3120BA7F.pf in C:\Windows\prefetch. Here is the newest Hijack this log.

Logfile of HijackThis v1.99.0
Scan saved at 19:58:06, on 25/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Tom\Hijackthis\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19....es/MsnPUpld.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://spgame.com/infogame/msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  • 0

#12
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
Don't know if it will make that much of a difference, but there is a newer version of hijack this. I may pick up something else. Just to be sure -- download it - 1.99.1, run it and post the log. :tazz:
  • 0

#13
Tommiebuoy

Tommiebuoy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Hm, Im sure this was the latest version, can you give me a link to the newest? I can't seem to find it.......
  • 0

#14
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
Hijack This
  • 0

#15
Tommiebuoy

Tommiebuoy

    Member

  • Topic Starter
  • Member
  • PipPip
  • 31 posts
Got it,

Logfile of HijackThis v1.99.1
Scan saved at 23:21:14, on 25/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Tom\Hijackthis\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19....es/MsnPUpld.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://spgame.com/infogame/msxml4.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7B20DEF-0663-4E5E-BD4E-603390F7DE17}: NameServer = 62.241.162.200 158.43.240.3
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP