[thahamer]

Ive been gettinga rediculus amount of Popups. A lot from 0dp.com. I know theres atleast a few things running on my computer.. heres my hijack this log


Logfile of HijackThis v1.99.1
Scan saved at 11:22:02 PM, on 7/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\RUNDLL32.exe
C:\WINDOWS\system32\vidctrl\vidctrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ricads.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\renst.exe
C:\Program Files\Network ICE\BlackICE\blackice.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\Network ICE\BlackICE\blackd.exe
C:\Program Files\VPNClient\cvpnd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\oehp\mceu.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Ernie\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R3 - Default URLSearchHook is missing
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [stratas] xmconfig.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [mscin] C:\WINDOWS\system32\m190309.EXE
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [4F7V3pV] ricads.exe
O4 - HKLM\..\RunServices: [stratas] xmconfig.exe
O4 - HKCU\..\Run: [stratas] xmconfig.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Loo9RfZ7W] renst.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\VPNClient\vpngui.exe
O4 - Global Startup: RealSecure Desktop Protector.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121865670546
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/...nnerInstall.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = bbh.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = bbh.com
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\rrched32.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: BlackICE - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\blackd.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\VPNClient\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\RapApp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe




I also noticed whenever i start my comp i get a "loader could not be intitialized" window. Two popup. not sure whyy

Edited by thahamer, 26 July 2005 - 09:24 PM.

[Advertisements]

Welcome to GTG.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Make sure you downloaded, installed, updated and ran these programs already - Ad-aware, Spybot and Microsoft AntiSpyware. If you didn't, do them now. For more information, go to http://www.greyknigh...com/spyware.htm

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R3 - Default URLSearchHook is missing
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O4 - HKLM\..\Run: [stratas] xmconfig.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [mscin] C:\WINDOWS\system32\m190309.EXE
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [4F7V3pV] ricads.exe
O4 - HKLM\..\RunServices: [stratas] xmconfig.exe
O4 - HKCU\..\Run: [stratas] xmconfig.exe
O4 - HKCU\..\Run: [Loo9RfZ7W] renst.exe
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/...nnerInstall.cab
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\rrched32.dll

Uninstall VBouncer from the Add/Remove panel if listed.

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\system32\ricads.exe
C:\WINDOWS\system32\renst.exe
C:\Program Files\oehp\
C:\WINDOWS\cfgmgr52.dll
xmconfig.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\cfgmgr52.dll
AUNPS2.DLL
C:\PROGRA~1\VBouncer\
C:\WINDOWS\system32\wintask.exe
C:\WINDOWS\system32\m190309.EXE
C:\WINDOWS\system32\vidctrl\
E6F1873B.DLL
xmconfig.exe
C:\WINDOWS\system32\rrched32.dll

Restart and run a new HijackThis scan. Save the log file and post it here.

Give me this log also:

Download L2MFix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so!

[greyknight17]

Welcome to GTG.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked. If you have Windows XP, the search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that 'Search system folders', 'Search hidden files and folders', and 'Search subfolders' are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Make sure you downloaded, installed, updated and ran these programs already - Ad-aware, Spybot and Microsoft AntiSpyware. If you didn't, do them now. For more information, go to http://www.greyknigh...com/spyware.htm

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Make sure to close any open browsers. Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\system32\Searchx.htm
R3 - Default URLSearchHook is missing
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\cfgmgr52.dll
O4 - HKLM\..\Run: [stratas] xmconfig.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [mscin] C:\WINDOWS\system32\m190309.EXE
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [4F7V3pV] ricads.exe
O4 - HKLM\..\RunServices: [stratas] xmconfig.exe
O4 - HKCU\..\Run: [stratas] xmconfig.exe
O4 - HKCU\..\Run: [Loo9RfZ7W] renst.exe
O16 - DPF: {F919FBD3-A96B-4679-AF26-F551439BB5FD} - http://winfixer.com/...nnerInstall.cab
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\rrched32.dll

Uninstall VBouncer from the Add/Remove panel if listed.

Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:

C:\WINDOWS\system32\ricads.exe
C:\WINDOWS\system32\renst.exe
C:\Program Files\oehp\
C:\WINDOWS\cfgmgr52.dll
xmconfig.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\cfgmgr52.dll
AUNPS2.DLL
C:\PROGRA~1\VBouncer\
C:\WINDOWS\system32\wintask.exe
C:\WINDOWS\system32\m190309.EXE
C:\WINDOWS\system32\vidctrl\
E6F1873B.DLL
xmconfig.exe
C:\WINDOWS\system32\rrched32.dll

Restart and run a new HijackThis scan. Save the log file and post it here.

Give me this log also:

Download L2MFix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so!

[thahamer]

thanks for the reply.. heres my new logs.


Logfile of HijackThis v1.99.1
Scan saved at 8:30:47 PM, on 7/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Network ICE\BlackICE\blackice.exe
c:\program files\Network ICE\BlackICE\blackd.exe
C:\Program Files\VPNClient\cvpnd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Documents and Settings\Ernie\Desktop\HijackThis.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\oehp\mceu.exe

O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\VPNClient\vpngui.exe
O4 - Global Startup: RealSecure Desktop Protector.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121865670546
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = bbh.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = bbh.com
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: policies - C:\WINDOWS\system32\rrched32.dll
O23 - Service: BlackICE - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\blackd.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\VPNClient\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\RapApp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe









L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"
"StartShell"="NavStartShellEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\policies]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\rrched32.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{65D683D3-6F1D-1098-B09D-926717069D64}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C}"=""
"{D75948F4-F073-4A0E-B2F7-844B9151E23D}"=""
"{19608543-68D8-41BC-A5A3-01F09D7DB4C4}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C}\InprocServer32]
@="C:\\WINDOWS\\system32\\derawex.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D75948F4-F073-4A0E-B2F7-844B9151E23D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D75948F4-F073-4A0E-B2F7-844B9151E23D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D75948F4-F073-4A0E-B2F7-844B9151E23D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D75948F4-F073-4A0E-B2F7-844B9151E23D}\InprocServer32]
@="C:\\WINDOWS\\system32\\tlolhelp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{19608543-68D8-41BC-A5A3-01F09D7DB4C4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{19608543-68D8-41BC-A5A3-01F09D7DB4C4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{19608543-68D8-41BC-A5A3-01F09D7DB4C4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{19608543-68D8-41BC-A5A3-01F09D7DB4C4}\InprocServer32]
@="C:\\WINDOWS\\system32\\sqlwapi.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
8mqlju9.dll Wed Jul 20 2005 10:03:48a ..SHR 566,796 553.51 K
ayvpack.dll Tue Jul 26 2005 11:11:56p ..S.R 417,792 408.00 K
browseui.dll Mon May 2 2005 4:52:34p A.... 1,019,904 996.00 K
cdfview.dll Mon May 2 2005 4:52:34p A.... 151,040 147.50 K
cdm.dll Thu May 26 2005 4:16:24a A.... 75,544 73.77 K
derawex.dll Wed Jul 27 2005 9:11:12a ..S.R 417,792 408.00 K
evpsrv.dll Mon Jul 25 2005 12:29:24p ..S.R 417,792 408.00 K
gccoll~1.dll Tue Jul 12 2005 3:35:14p A.... 126,680 123.71 K
gcunco~1.dll Tue Jul 12 2005 3:35:10p A.... 95,448 93.21 K
hashlib.dll Tue Jul 12 2005 3:35:14p A.... 117,976 115.21 K
hhsetup.dll Thu May 26 2005 10:04:28p A.... 41,472 40.50 K
icm32.dll Tue Jun 28 2005 9:46:00p A.... 254,976 249.00 K
iepeers.dll Mon May 2 2005 4:52:34p A.... 250,880 245.00 K
ihuv_32.dll Fri Jul 22 2005 8:02:14a ..S.R 417,792 408.00 K
inseng.dll Mon May 2 2005 4:52:34p A.... 96,256 94.00 K
itircl.dll Thu May 26 2005 10:04:28p A.... 155,136 151.50 K
itss.dll Thu May 26 2005 10:04:28p A.... 137,216 134.00 K
iuengine.dll Thu May 26 2005 4:16:24a A.... 198,424 193.77 K
mcpatcha.dll Thu Jul 21 2005 10:33:18a ..S.R 417,792 408.00 K
mfsign32.dll Wed Jul 20 2005 12:22:04a ..S.R 417,792 408.00 K
miihnd.dll Wed Jul 27 2005 9:01:12a ..... 417,792 408.00 K
mscms.dll Tue Jun 28 2005 9:46:00p A.... 74,240 72.50 K
mshtml.dll Mon May 2 2005 4:52:36p A.... 3,012,608 2.87 M
mshtmled.dll Mon May 2 2005 4:52:36p A.... 448,512 438.00 K
msi.dll Wed May 4 2005 2:45:32p A.... 2,890,240 2.75 M
msihnd.dll Wed May 4 2005 2:45:36p A.... 271,360 265.00 K
msimsg.dll Wed May 4 2005 2:45:36p A.... 884,736 864.00 K
msisip.dll Wed May 4 2005 2:45:36p A.... 15,360 15.00 K
msrating.dll Mon May 2 2005 4:52:36p A.... 146,432 143.00 K
msssc.dll Mon Jul 18 2005 6:25:18p A.... 44 0.04 K
mxxlegih.dll Mon Jul 25 2005 9:38:18a ..S.R 417,792 408.00 K
mzvbvm60.dll Wed Jul 20 2005 12:22:10a ..S.R 417,792 408.00 K
njdll.dll Thu Jul 21 2005 4:50:20p ..S.R 417,792 408.00 K
nrlanui.dll Thu Jul 21 2005 4:50:14p ..S.R 417,792 408.00 K
pngfilt.dll Mon May 2 2005 4:52:36p A.... 39,424 38.50 K
rrched32.dll Thu Jul 21 2005 6:20:26p ..S.R 417,792 408.00 K
shdocvw.dll Mon May 2 2005 4:52:36p A.... 1,483,776 1.41 M
shlwapi.dll Mon May 2 2005 4:52:36p A.... 473,600 462.50 K
sqlwapi.dll Wed Jul 27 2005 8:18:08p ..S.R 417,792 408.00 K
szbiop.dll Wed Jul 20 2005 9:13:32p ..S.R 417,792 408.00 K
tlolhelp.dll Wed Jul 27 2005 8:30:28p ..S.R 417,792 408.00 K
urlmon.dll Mon May 2 2005 4:52:36p A.... 607,744 593.50 K
wininet.dll Mon May 2 2005 4:52:36p A.... 657,920 642.50 K
wuapi.dll Thu May 26 2005 4:16:30a A.... 465,176 454.27 K
wuaueng.dll Thu May 26 2005 4:16:30a A.... 1,343,768 1.28 M
wuaueng1.dll Thu May 26 2005 4:16:30a A.... 194,328 189.77 K
wucltui.dll Thu May 26 2005 4:16:30a A.... 127,256 124.27 K
wups.dll Thu May 26 2005 4:16:30a A.... 41,240 40.27 K
wups2.dll Thu May 26 2005 4:16:30a A.... 18,200 17.77 K
wuweb.dll Thu May 26 2005 4:19:32a A.... 173,536 169.47 K
xpsp3res.dll Mon May 16 2005 8:25:36p A.... 15,360 15.00 K

51 items found: 51 files (15 H/S), 0 directories.
Total of file sizes: 22,939,488 bytes 21.88 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Wed Jul 20 2005 9:12:56a ..S.R 417,792 408.00 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 417,792 bytes 408.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is E812-F300

Directory of C:\WINDOWS\System32

07/27/2005 08:30 PM 417,792 tlolhelp.dll
07/27/2005 08:18 PM 417,792 sqlwapi.dll
07/27/2005 09:11 AM 417,792 derawex.dll
07/26/2005 11:11 PM 417,792 ayvpack.dll
07/25/2005 02:52 PM <DIR> dllcache
07/25/2005 12:29 PM 417,792 evpsrv.dll
07/25/2005 09:38 AM 417,792 mxxlegih.dll
07/22/2005 08:02 AM 417,792 ihuv_32.dll
07/21/2005 06:20 PM 417,792 rrched32.dll
07/21/2005 04:50 PM 417,792 njdll.dll
07/21/2005 04:50 PM 417,792 nrlanui.dll
07/21/2005 10:33 AM 417,792 mcpatcha.dll
07/21/2005 09:55 AM 401,408 m?config.exe
07/20/2005 09:13 PM 417,792 szbiop.dll
07/20/2005 10:11 AM 256,893 316zg.exe
07/20/2005 10:03 AM 353,512 3jjau.sys
07/20/2005 10:03 AM 566,796 8mqlju9.dll
07/20/2005 10:03 AM 237,795 tw0ke36.exe
07/20/2005 09:12 AM 417,792 guard.tmp
07/20/2005 12:22 AM 417,792 mzvbvm60.dll
07/20/2005 12:22 AM 417,792 mfsign32.dll
07/18/2005 06:06 PM <DIR> Microsoft
03/31/2003 08:00 AM 170,221 xmconfig.exe
21 File(s) 8,253,505 bytes
2 Dir(s) 174,851,170,304 bytes free

[greyknight17]

Just as I expected OK, let's get this thing fixed up.

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing Enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2MFix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new HijackThis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[thahamer]

The new log u told me to get:

L2Mfix 1.03a

Running From:
C:\Documents and Settings\Ernie\Desktop\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Ernie\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Ernie\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1664 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1860 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\ayvpack.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ayvpack.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\derawex.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\derawex.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\evpsrv.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\evpsrv.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ihuv_32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ihuv_32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mcpatcha.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mcpatcha.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mfsign32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mfsign32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\miihnd.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\miihnd.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mxxlegih.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mxxlegih.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mzvbvm60.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mzvbvm60.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\njdll.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\njdll.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\njlanman.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\njlanman.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nrlanui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nrlanui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rrched32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rrched32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sqlwapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sqlwapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\szbiop.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\szbiop.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\tlolhelp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\tlolhelp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\ayvpack.dll
Successfully Deleted: C:\WINDOWS\system32\ayvpack.dll
deleting: C:\WINDOWS\system32\ayvpack.dll
Successfully Deleted: C:\WINDOWS\system32\ayvpack.dll
deleting: C:\WINDOWS\system32\derawex.dll
Successfully Deleted: C:\WINDOWS\system32\derawex.dll
deleting: C:\WINDOWS\system32\derawex.dll
Successfully Deleted: C:\WINDOWS\system32\derawex.dll
deleting: C:\WINDOWS\system32\evpsrv.dll
Successfully Deleted: C:\WINDOWS\system32\evpsrv.dll
deleting: C:\WINDOWS\system32\evpsrv.dll
Successfully Deleted: C:\WINDOWS\system32\evpsrv.dll
deleting: C:\WINDOWS\system32\ihuv_32.dll
Successfully Deleted: C:\WINDOWS\system32\ihuv_32.dll
deleting: C:\WINDOWS\system32\ihuv_32.dll
Successfully Deleted: C:\WINDOWS\system32\ihuv_32.dll
deleting: C:\WINDOWS\system32\mcpatcha.dll
Successfully Deleted: C:\WINDOWS\system32\mcpatcha.dll
deleting: C:\WINDOWS\system32\mcpatcha.dll
Successfully Deleted: C:\WINDOWS\system32\mcpatcha.dll
deleting: C:\WINDOWS\system32\mfsign32.dll
Successfully Deleted: C:\WINDOWS\system32\mfsign32.dll
deleting: C:\WINDOWS\system32\mfsign32.dll
Successfully Deleted: C:\WINDOWS\system32\mfsign32.dll
deleting: C:\WINDOWS\system32\miihnd.dll
Successfully Deleted: C:\WINDOWS\system32\miihnd.dll
deleting: C:\WINDOWS\system32\miihnd.dll
Successfully Deleted: C:\WINDOWS\system32\miihnd.dll
deleting: C:\WINDOWS\system32\mxxlegih.dll
Successfully Deleted: C:\WINDOWS\system32\mxxlegih.dll
deleting: C:\WINDOWS\system32\mxxlegih.dll
Successfully Deleted: C:\WINDOWS\system32\mxxlegih.dll
deleting: C:\WINDOWS\system32\mzvbvm60.dll
Successfully Deleted: C:\WINDOWS\system32\mzvbvm60.dll
deleting: C:\WINDOWS\system32\mzvbvm60.dll
Successfully Deleted: C:\WINDOWS\system32\mzvbvm60.dll
deleting: C:\WINDOWS\system32\njdll.dll
Successfully Deleted: C:\WINDOWS\system32\njdll.dll
deleting: C:\WINDOWS\system32\njdll.dll
Successfully Deleted: C:\WINDOWS\system32\njdll.dll
deleting: C:\WINDOWS\system32\njlanman.dll
Successfully Deleted: C:\WINDOWS\system32\njlanman.dll
deleting: C:\WINDOWS\system32\njlanman.dll
Successfully Deleted: C:\WINDOWS\system32\njlanman.dll
deleting: C:\WINDOWS\system32\nrlanui.dll
Successfully Deleted: C:\WINDOWS\system32\nrlanui.dll
deleting: C:\WINDOWS\system32\nrlanui.dll
Successfully Deleted: C:\WINDOWS\system32\nrlanui.dll
deleting: C:\WINDOWS\system32\rrched32.dll
Successfully Deleted: C:\WINDOWS\system32\rrched32.dll
deleting: C:\WINDOWS\system32\rrched32.dll
Successfully Deleted: C:\WINDOWS\system32\rrched32.dll
deleting: C:\WINDOWS\system32\sqlwapi.dll
Successfully Deleted: C:\WINDOWS\system32\sqlwapi.dll
deleting: C:\WINDOWS\system32\sqlwapi.dll
Successfully Deleted: C:\WINDOWS\system32\sqlwapi.dll
deleting: C:\WINDOWS\system32\szbiop.dll
Successfully Deleted: C:\WINDOWS\system32\szbiop.dll
deleting: C:\WINDOWS\system32\szbiop.dll
Successfully Deleted: C:\WINDOWS\system32\szbiop.dll
deleting: C:\WINDOWS\system32\tlolhelp.dll
Successfully Deleted: C:\WINDOWS\system32\tlolhelp.dll
deleting: C:\WINDOWS\system32\tlolhelp.dll
Successfully Deleted: C:\WINDOWS\system32\tlolhelp.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp


Zipping up files for submission:
adding: ayvpack.dll (164 bytes security) (deflated 48%)
adding: derawex.dll (164 bytes security) (deflated 48%)
adding: evpsrv.dll (164 bytes security) (deflated 48%)
adding: ihuv_32.dll (164 bytes security) (deflated 48%)
adding: mcpatcha.dll (164 bytes security) (deflated 48%)
adding: mfsign32.dll (164 bytes security) (deflated 48%)
adding: miihnd.dll (164 bytes security) (deflated 48%)
adding: mxxlegih.dll (164 bytes security) (deflated 48%)
adding: mzvbvm60.dll (164 bytes security) (deflated 48%)
adding: njdll.dll (164 bytes security) (deflated 48%)
adding: njlanman.dll (164 bytes security) (deflated 48%)
adding: nrlanui.dll (164 bytes security) (deflated 48%)
adding: rrched32.dll (164 bytes security) (deflated 48%)
adding: sqlwapi.dll (164 bytes security) (deflated 48%)
adding: szbiop.dll (164 bytes security) (deflated 48%)
adding: tlolhelp.dll (164 bytes security) (deflated 48%)
adding: guard.tmp (164 bytes security) (deflated 48%)
adding: clear.reg (164 bytes security) (deflated 46%)
adding: echo.reg (164 bytes security) (deflated 9%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 87%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 68%)
adding: test.txt (164 bytes security) (deflated 89%)
adding: test2.txt (164 bytes security) (deflated 27%)
adding: test3.txt (164 bytes security) (deflated 27%)
adding: test5.txt (164 bytes security) (deflated 27%)
adding: xfind.txt (164 bytes security) (deflated 85%)
adding: backregs/19608543-68D8-41BC-A5A3-01F09D7DB4C4.reg (164 bytes security) (deflated 70%)
adding: backregs/3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C.reg (164 bytes security) (deflated 70%)
adding: backregs/D75948F4-F073-4A0E-B2F7-844B9151E23D.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: ayvpack.dll
deleting local copy: ayvpack.dll
deleting local copy: derawex.dll
deleting local copy: derawex.dll
deleting local copy: evpsrv.dll
deleting local copy: evpsrv.dll
deleting local copy: ihuv_32.dll
deleting local copy: ihuv_32.dll
deleting local copy: mcpatcha.dll
deleting local copy: mcpatcha.dll
deleting local copy: mfsign32.dll
deleting local copy: mfsign32.dll
deleting local copy: miihnd.dll
deleting local copy: miihnd.dll
deleting local copy: mxxlegih.dll
deleting local copy: mxxlegih.dll
deleting local copy: mzvbvm60.dll
deleting local copy: mzvbvm60.dll
deleting local copy: njdll.dll
deleting local copy: njdll.dll
deleting local copy: njlanman.dll
deleting local copy: njlanman.dll
deleting local copy: nrlanui.dll
deleting local copy: nrlanui.dll
deleting local copy: rrched32.dll
deleting local copy: rrched32.dll
deleting local copy: sqlwapi.dll
deleting local copy: sqlwapi.dll
deleting local copy: szbiop.dll
deleting local copy: szbiop.dll
deleting local copy: tlolhelp.dll
deleting local copy: tlolhelp.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\System32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"
"StartShell"="NavStartShellEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\ayvpack.dll
C:\WINDOWS\system32\ayvpack.dll
C:\WINDOWS\system32\derawex.dll
C:\WINDOWS\system32\derawex.dll
C:\WINDOWS\system32\evpsrv.dll
C:\WINDOWS\system32\evpsrv.dll
C:\WINDOWS\system32\ihuv_32.dll
C:\WINDOWS\system32\ihuv_32.dll
C:\WINDOWS\system32\mcpatcha.dll
C:\WINDOWS\system32\mcpatcha.dll
C:\WINDOWS\system32\mfsign32.dll
C:\WINDOWS\system32\mfsign32.dll
C:\WINDOWS\system32\miihnd.dll
C:\WINDOWS\system32\miihnd.dll
C:\WINDOWS\system32\mxxlegih.dll
C:\WINDOWS\system32\mxxlegih.dll
C:\WINDOWS\system32\mzvbvm60.dll
C:\WINDOWS\system32\mzvbvm60.dll
C:\WINDOWS\system32\njdll.dll
C:\WINDOWS\system32\njdll.dll
C:\WINDOWS\system32\njlanman.dll
C:\WINDOWS\system32\njlanman.dll
C:\WINDOWS\system32\nrlanui.dll
C:\WINDOWS\system32\nrlanui.dll
C:\WINDOWS\system32\rrched32.dll
C:\WINDOWS\system32\rrched32.dll
C:\WINDOWS\system32\sqlwapi.dll
C:\WINDOWS\system32\sqlwapi.dll
C:\WINDOWS\system32\szbiop.dll
C:\WINDOWS\system32\szbiop.dll
C:\WINDOWS\system32\tlolhelp.dll
C:\WINDOWS\system32\tlolhelp.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C}"=-
"{D75948F4-F073-4A0E-B2F7-844B9151E23D}"=-
"{19608543-68D8-41BC-A5A3-01F09D7DB4C4}"=-
[-HKEY_CLASSES_ROOT\CLSID\{3D4EDCA2-2176-4A34-B51E-1E3B9ED12D1C}]
[-HKEY_CLASSES_ROOT\CLSID\{D75948F4-F073-4A0E-B2F7-844B9151E23D}]
[-HKEY_CLASSES_ROOT\CLSID\{19608543-68D8-41BC-A5A3-01F09D7DB4C4}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************




Updated Hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 9:26:24 PM, on 7/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\mceu.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Network ICE\BlackICE\blackice.exe
c:\program files\Network ICE\BlackICE\blackd.exe
C:\Program Files\VPNClient\cvpnd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Ernie\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\VPNClient\vpngui.exe
O4 - Global Startup: RealSecure Desktop Protector.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121865670546
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = bbh.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = bbh.com
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: BlackICE - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\blackd.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\VPNClient\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\RapApp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

[greyknight17]

It should be running much better now after that cleanup

OK, there's still something in there. let's use these two programs:

Right click on http://www.silentrun...ent Runners.vbs and choose Save As...Save it to your Desktop. Make sure you have disabled any programs that may block/disable scripts (ex: Ad-Watch, TeaTimer, Norton, etc.). Double click on 'Silent Runners' to run it. This will take a few minutes. It will create a file called 'Startup Programs' followed by your computer name and current date. Open up that file and post all the contents here in your next post.

Please empty any Quarantine folder in your antivirus program and purge all recovery items in the Spybot program (if you use it) before running this tool.

Download the Mwav virus checker at http://www.mwti.net/antivirus/mwav.asp (Use Link 3)

1. Save it to a folder.
2. Reboot into Safe Mode.
3. Double click the Mwav.exe file. This is a stand alone tool and NOT just a virus checker......so it won't install anything.
4. Select all local drives, scan all files, and press SCAN. When it is completed, anything found will be displayed in the lower pane.
5. In the Virus Log Information Pane......
Left click and highlight all the information in the Lower pane --- Use &CTRL C &on your keyboard to copy everything found in the lower pane and save it to a notepad file
*Note* If prompted that a virus was found and you need to purchase the product to remove the malware, just close out the prompt and let it continue scanning. We are not going to use this to remove anything...but to ID the bad files.

Once you copy that to a Notepad file...highlight the text and copy it here.

[thahamer]

"Silent Runners.vbs", revision 39, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AIM" = "C:\Program Files\AIM\aim.exe -cnetwait.odl" ["America Online, Inc."]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"vptray" = "C:\Program Files\NavNT\vptray.exe" ["Symantec Corporation"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"WinampAgent" = ""C:\Program Files\Winamp\Winampa.exe"" [null data]
"UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]
"VTTimer" = "VTTimer.exe" ["S3 Graphics, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Explode"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\UNBIND.DLL" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! NavLogon\DLLName = "C:\WINDOWS\System32\NavLogon.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Bliss.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "Ernie" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\Ernie\Start Menu\Programs\Startup
"Microsoft Find Fast" -> shortcut to: "C:\Program Files\Microsoft Office\Office\FINDFAST.EXE" [MS]
"Office Startup" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA.EXE -b" [MS]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Cisco Systems VPN Client" -> shortcut to: "C:\Program Files\VPNClient\vpngui.exe "-user_logon"" ["Cisco Systems, Inc."]
"RealSecure Desktop Protector" -> shortcut to: " -closed" [file not found]


Enabled Scheduled Tasks:
------------------------

"RUTASK" -> launches: "C:\WINDOWS\ru.exe" [null data]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\
"ButtonText" = "AIM"
"Exec" = "C:\Program Files\AIM\aim.exe" ["America Online, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

BlackICE, BlackICE, ""c:\program files\Network ICE\BlackICE\blackd.exe"" ["Internet Security Systems, Inc."]
Cisco Systems, Inc. VPN Service, CVPND, ""C:\Program Files\VPNClient\cvpnd.exe"" ["Cisco Systems, Inc."]
DefWatch, DefWatch, "C:\Program Files\NavNT\defwatch.exe" ["Symantec Corporation"]
Intel File Transfer, Intel File Transfer, "C:\WINDOWS\system32\cba\xfr.exe" ["Intel® Corporation"]
Intel PDS, Intel PDS, "C:\WINDOWS\system32\cba\pds.exe" ["Intel® Corporation"]
Norton AntiVirus Client, Norton AntiVirus Server, "C:\Program Files\NavNT\rtvscan.exe" ["Symantec Corporation"]
SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 41 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 17 seconds.
---------- (total run time: 90 seconds)




MWAV Checker



File C:\Documents and Settings\Ernie\Desktop\backups\backup-20050727-202154-427.dll tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "mxoaldr Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "MaxSpeed Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxsfs.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\logo.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\scribble.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\dot.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\mnature.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\hoverbot.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\will.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\powerpup.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\genius.act". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{000208FE-0000-0000-C000-000000000046}" refers to invalid object "xlrec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{000208FF-0000-0000-C000-000000000046}" refers to invalid object "xlrec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\MediaGatewayX.Installer" refers to invalid object "{15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
File C:\WINDOWS\3jjau.sys infected by "Trojan.Win32.Kolweb.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\iyyjdyxp.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\WINDOWS\ru.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\WINDOWS\system32\3jjau.sys infected by "Trojan.Win32.Kolweb.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\ati3duag.exe tagged as "not-a-virus:AdWare.UrlSpy.b". Action Taken: No Action Taken.
File C:\WINDOWS\system32\avwav802.exe tagged as "not-a-virus:AdWare.UrlSpy.b". Action Taken: No Action Taken.
File C:\WINDOWS\system32\camocx16.exe tagged as "not-a-virus:AdWare.UrlSpy.b". Action Taken: No Action Taken.
File C:\WINDOWS\system32\dlcl.edp infected by "Net-Worm.Win32.Randon.an" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\hosts infected by "Trojan.Win32.Qhost" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\mirindaspg.exe infected by "Trojan.Win32.Kolweb.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\palsp.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.591. No Action Taken.
File C:\WINDOWS\system32\SSK39.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\tw0ke36.exe infected by "Trojan.Win32.Kolweb.b" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\xmconfig.exe infected by "Trojan.Win32.Pakes" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\ysbinstall_1000489_3.exe infected by "Trojan-Downloader.Win32.IstBar.ja" Virus! Action Taken: No Action Taken.
File C:\WINDOWS\system32\zema infected by "Net-Worm.Win32.Randon" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\3jjau.sys infected by "Trojan.Win32.Kolweb.b" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\atiupdate.exe infected by "Trojan-Downloader.Win32.Delf.go" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\b.com infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\cfg106.tmpcfgmgr52\bbi2.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\nsh_104.exe tagged as "not-a-virus:AdWare.Downloadware". Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\res15A.tmp tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\KDAV09UF\look4[bleep][1].htm infected by "Trojan.JS.Seeker-based" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\Temp\wrapperouter.exe tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\O789ABUD\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\O789ABUD\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\O789ABUD\upd209[1].exe tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\QIAK3DW6\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\QIAK3DW6\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\QIAK3DW6\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\W49YY2FO\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\W49YY2FO\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\W49YY2FO\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\W49YY2FO\AppWrap[4].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\W49YY2FO\AppWrap[5].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\YQRA2UV5\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\YQRA2UV5\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\YQRA2UV5\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\DOCUME~1\Ernie\LOCALS~1\TEMPOR~1\Content.IE5\YQRA2UV5\AppWrap[4].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\01300000.VBN infected by "Exploit.HTML.Mht" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\04B80000.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06CC0000.VBN infected by "IM-Worm.Win32.Kelvir.dd" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\07A00000.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\07A40000.VBN infected by "IM-Worm.Win32.Kelvir.dd" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F9C0000.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F9C0001.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F9C0002.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F9C0003.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Desktop\backups\backup-20050727-202154-427.dll tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\gbnnn.exe infected by "Net-Worm.Win32.Randon" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\3jjau.sys infected by "Trojan.Win32.Kolweb.b" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\atiupdate.exe infected by "Trojan-Downloader.Win32.Delf.go" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\b.com infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\cfg106.tmpcfgmgr52\bbi2.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\nsh_104.exe tagged as "not-a-virus:AdWare.Downloadware". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\res15A.tmp tagged as "not-a-virus:AdWare.180Solutions.g". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\Temporary Internet Files\Content.IE5\KDAV09UF\look4[bleep][1].htm infected by "Trojan.JS.Seeker-based" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temp\wrapperouter.exe tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\O789ABUD\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\O789ABUD\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\O789ABUD\upd209[1].exe tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\QIAK3DW6\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\QIAK3DW6\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\QIAK3DW6\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\W49YY2FO\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\W49YY2FO\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\W49YY2FO\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\W49YY2FO\AppWrap[4].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\W49YY2FO\AppWrap[5].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\YQRA2UV5\AppWrap[1].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\YQRA2UV5\AppWrap[2].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\YQRA2UV5\AppWrap[3].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Local Settings\Temporary Internet Files\Content.IE5\YQRA2UV5\AppWrap[4].exe infected by "Trojan-Dropper.Win32.Agent.pb" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\ysbinstall_1000489_3.exe infected by "Trojan-Downloader.Win32.IstBar.ja" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2J6VKZG7\!update-2124[1].0000 tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\2J6VKZG7\!update-2134[1].0000 tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ATUJQFY5\!update-2104[1].0000 infected by "Trojan-Downloader.Win32.PurityScan.w" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\ATUJQFY5\!update-2164[1].0000 tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HXAWLJ26\!update-2114[1].0000 infected by "Trojan-Downloader.Win32.PurityScan.w" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HXAWLJ26\!update-2174[1].0000 tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe tagged as "not-a-virus:AdWare.DelphinMedia.Viewer.f". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\1272BEFA-5430-48FB-BB6C-E91811\A117F569-2F64-4E05-A487-3C992F infected by "Trojan-Downloader.Win32.Agent.qg" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\1FA57E60-1FD0-4D82-B10C-145424\B7BEA82D-F46F-4E42-97FE-38360D infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\46ADCFA5-379A-4C76-BA73-43EB26\9C306DA1-4AEF-45B8-9B01-1A1AEF tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\4B3E7711-30BB-44D2-9F8A-B08EFC\CA604F64-DF3B-4843-8FBD-52E590 tagged as "not-a-virus:AdWare.CashBack.d". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\4B3E7711-30BB-44D2-9F8A-B08EFC\D6C69C59-331F-4262-A73D-050C35 tagged as "not-a-virus:AdWare.BargainBuddy.y". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\613D01FF-AA9B-42AA-967C-40B442\640CD6D0-37B4-4B36-AA72-879F81 infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\663AF66C-3DCE-4C6E-8C37-723217\E2B79DF3-23C1-40BB-BE52-017AF9 infected by "Trojan-Clicker.Win32.Small.ez" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\8922A940-6EBA-4E79-99E8-35D60F\16745552-E537-4049-BF24-5AB27D infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\8F0E3C9A-C098-4A12-892F-2CA451\C083DBA6-4CA6-478A-AEEA-9EF4DC tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\B9FF6165-C896-482C-98A6-1D504B\AFBF522C-9AAE-4585-B546-08C4FA tagged as "not-a-virus:AdWare.SurfSide.l". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\C09CBCA8-965A-4E5B-94DA-D43F4C\F8A7C86C-1A5A-4535-83B2-7F3729 infected by "Trojan-Downloader.Win32.Braidupdate.d" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\C64624AA-D10B-4933-9F70-BDD73D\201A5E2D-342B-4C61-A73B-1DF653 infected by "Trojan-Clicker.Win32.Small.ez" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\CD95948A-6446-4D9E-B9F1-A84938\C411522A-1008-4AE1-B26D-80E754 tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\D7703F37-C56E-4ED7-B7ED-5BF0DD\065D705F-586C-410F-9E89-C08CC2 tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\D7703F37-C56E-4ED7-B7ED-5BF0DD\7CB11833-7D65-4EBB-92B3-213519 tagged as "not-a-virus:AdWare.VirtualBouncer". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\D7703F37-C56E-4ED7-B7ED-5BF0DD\94CB971D-6C7B-4085-90F8-15CD77 tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\D7703F37-C56E-4ED7-B7ED-5BF0DD\AA35BEEC-25A8-42FE-B225-8FD371 tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\DDCFA740-4D75-44FF-BB84-8DEDDE\F5C11003-CE00-47AC-8C3D-B5E6FC tagged as "not-a-virus:AdWare.WinAD.be". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\DF890CA2-719D-4863-93F1-CA7908\5CA50395-51A6-43B6-9433-F579AC infected by "Trojan-Clicker.Win32.Small.ez" Virus! Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\DFB58683-4589-4484-ABAA-694754\9F97021E-FB42-4186-856A-E25700 tagged as "not-a-virus:AdWare.Sahat.ad". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\E0A7A851-959A-47B1-8419-284597\FF290857-1A3D-4E7F-8913-B1CFFD tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\Program Files\Microsoft AntiSpyware\Quarantine\E7B31D4A-212E-4795-BB37-E41867\03C3B716-ECD4-4C55-8FF9-351142 tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-854245398-1004336348-839522115-1004\Dc1.exe tagged as "not-a-virus:AdWare.Apropos.o". Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-854245398-1004336348-839522115-1004\Dc2.exe infected by "Trojan-Downloader.Win32.Agent.ro" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-854245398-1004336348-839522115-1004\Dc6.dll infected by "Trojan-Clicker.Win32.Small.ez" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-854245398-1004336348-839522115-1004\Dc7.dll infected by "Trojan-Downloader.Win32.Braidupdate.d" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0002801.exe tagged as "not-a-virus:AdWare.BetterInternet.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0002814.exe tagged as "not-a-virus:AdWare.PurityScan.cn". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0002818.dll tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0002828.exe tagged as "not-a-virus:AdWare.BargainBuddy.y". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0003715.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0003716.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0003717.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0003721.dll tagged as "not-a-virus:AdWare.PurityScan.ak". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0003729.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0003751.exe tagged as "not-a-virus:AdWare.BetterInternet.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP10\A0003752.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP13\A0003865.exe tagged as "not-a-virus:AdWare.BetterInternet.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP17\A0003927.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP17\A0003988.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP17\A0003989.exe tagged as "not-a-virus:AdWare.BetterInternet.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP17\A0004002.exe infected by "Trojan-Downloader.Win32.Delf.go" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP17\A0004003.exe infected by "Trojan-Downloader.Win32.Intexp.c" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP17\A0004007.dll tagged as "not-a-virus:AdWare.BetterInternet.h". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP17\A0004010.exe tagged as "not-a-virus:AdWare.VirtualBouncer.c". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP18\A0004014.dll tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP18\A0004015.dll infected by "Trojan-Clicker.Win32.Small.ez" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP18\A0004019.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP18\A0004025.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP18\A0004026.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP18\A0004033.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP18\A0004069.exe tagged as "not-a-virus:AdWare.BetterInternet.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP34\A0004311.exe tagged as "not-a-virus:AdWare.BetterInternet.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004325.exe tagged as "not-a-virus:AdWare.Sahat.ai". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004327.exe tagged as "not-a-virus:AdWare.Sahat.ah". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004328.dll tagged as "not-a-virus:AdWare.Sahat.ad". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004368.exe infected by "Trojan-Dropper.Win32.Agent.hh" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004372.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004373.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004438.exe tagged as "not-a-virus:AdWare.BetterInternet.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004439.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004441.exe tagged as "not-a-virus:AdWare.BetterInternet.l". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004450.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004451.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004458.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004463.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004464.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP35\A0004466.exe infected by "Trojan-Downloader.Win32.PurityScan.w" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007834.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007837.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007855.exe infected by "Trojan-Dropper.Win32.Agent.hh" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007856.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007857.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007858.exe infected by "Trojan-Dropper.Win32.Agent.lu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007859.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007860.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007861.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007874.exe infected by "Trojan-Downloader.Win32.PurityScan.w" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007888.exe infected by "Net-Worm.Win32.Randon" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007893.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007895.exe infected by "Trojan-Dropper.Win32.Agent.hh" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007899.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007903.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP53\A0007907.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0007994.exe infected by "Trojan-Dropper.Win32.Small.qn" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008005.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008020.exe tagged as "not-a-virus:AdWare.VirtualBouncer.i". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008024.EXE tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008025.EXE tagged as "not-a-virus:AdWare.VirtualBouncer.j". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008028.EXE tagged as "not-a-virus:AdWare.VirtualBouncer". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008036.dll tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008040.exe tagged as "not-a-virus:AdWare.BargainBuddy.y". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008041.exe tagged as "not-a-virus:AdWare.CashBack.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008042.exe tagged as "not-a-virus:AdWare.CashBack.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008046.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008049.dll infected by "Trojan-Clicker.Win32.Small.ez" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008051.dll infected by "Trojan-Downloader.Win32.Braidupdate.d" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008065.exe tagged as "not-a-virus:AdWare.BargainBuddy.y". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008066.dll tagged as "not-a-virus:AdWare.SurfSide.l". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008067.dll tagged as "not-a-virus:AdWare.SurfSide.n". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008069.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008071.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008072.exe infected by "Trojan-Dropper.Win32.Agent.lu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008073.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008074.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008075.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008084.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008085.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008094.exe tagged as "not-a-virus:AdWare.BargainBuddy.y". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008103.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008104.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008105.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008106.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008107.exe infected by "Trojan.Win32.StartPage.nk" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008114.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008118.exe infected by "Trojan-Downloader.Win32.PurityScan.w" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008123.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008128.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008129.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008175.exe infected by "Trojan-Downloader.Win32.Agent.qg" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008179.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008184.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008185.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008200.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008205.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008206.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008212.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008217.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP54\A0008218.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP55\A0008225.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP55\A0008230.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP55\A0008231.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008306.exe tagged as "not-a-virus:AdWare.UrlSpy.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008307.exe tagged as "not-a-virus:AdWare.UrlSpy.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008314.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008316.exe tagged as "not-a-virus:AdWare.PurityScan.ci". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008317.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008322.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008327.exe infected by "Trojan-Downloader.Win32.PurityScan.w" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008328.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008334.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008340.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008351.exe tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008352.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008353.exe infected by "Trojan-Dropper.Win32.Agent.hl" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008354.exe infected by "Trojan-Dropper.Win32.Agent.lu" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008355.exe tagged as "not-a-virus:AdWare.BetterInternet". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008359.exe tagged as "not-a-virus:AdWare.PurityScan.w". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008362.exe infected by "Trojan-Downloader.Win32.PurityScan.w" Virus! Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008366.dll tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008375.exe tagged as "not-a-virus:AdWare.BargainBuddy.y". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008376.exe tagged as "not-a-virus:AdWare.CashBack.b". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008377.exe tagged as "not-a-virus:AdWare.CashBack.d". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008381.dll tagged as "not-a-virus:AdWare.SurfSide.l". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{451E388C-CAC2-47F0-BFE5-741E2C7478E8}\RP56\A0008382.dll tagged as "not-a-virus:AdWare.SurfSide.n". Action Taken: No Action Taken.
File C:\System Volume Information\_rest

[greyknight17]

OK, go into your Norton program and delete ALL the quarantined items. Do the same thing for Microsoft AntiSpyware.

Open Scheduled Tasks by clicking Start, All Programs, point to Accessories, point to System Tools, and then click Scheduled Tasks. Look for RUTASK and delete it.

Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Copy the below files and go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say no:

C:\Program Files\Common Files\Uninstall Information\RemoveDisplayUtility.exe
C:\Documents and Settings\Ernie\ysbinstall_1000489_3.exe
C:\WINDOWS\3jjau.sys
C:\WINDOWS\iyyjdyxp.exe
C:\WINDOWS\ru.exe
C:\WINDOWS\system32\3jjau.sys
C:\WINDOWS\system32\ati3duag.exe
C:\WINDOWS\system32\avwav802.exe
C:\WINDOWS\system32\camocx16.exe
C:\WINDOWS\system32\dlcl.edp
C:\WINDOWS\system32\hosts
C:\WINDOWS\system32\mirindaspg.exe
C:\WINDOWS\system32\palsp.exe
C:\WINDOWS\system32\SSK39.exe
C:\WINDOWS\system32\tw0ke36.exe
C:\WINDOWS\system32\xmconfig.exe
C:\WINDOWS\system32\ysbinstall_1000489_3.exe
C:\WINDOWS\ru.exe
C:\WINDOWS\system32\mceu.exe

Delete this if found -> C:\WINDOWS\system32\zema

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. OK, before we go on, I want you to take note of this first. This program will wipe out all files in your Temporary folders, any file extensions that have a tilde (~) in it, .bak files, .chk files, .tmp files and index.dat files. Most of you should be ok with this, but there may be some who need these files. If you are one of them, do not follow this step. Post back a reply telling us about this. So if that's ok, then download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Run CleanUp! and click on CleanUp! button. Once it's done, you may click the Close button. When asked if you want to logoff, choose No.

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer and uncheck the same box to enable System Restore.

Restart and post new logs for Silents Runners, mwav and HijackThis.

[thahamer]

"Silent Runners.vbs", revision 39, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"AIM" = "C:\Program Files\AIM\aim.exe -cnetwait.odl" ["America Online, Inc."]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"vptray" = "C:\Program Files\NavNT\vptray.exe" ["Symantec Corporation"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"WinampAgent" = ""C:\Program Files\Winamp\Winampa.exe"" [null data]
"UserFaultCheck" = "C:\WINDOWS\system32\dumprep 0 -u" [MS]
"VTTimer" = "VTTimer.exe" ["S3 Graphics, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Display Panning CPL Extension"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}" = "LDVP Shell Extensions"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}" = "iTunes"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\iTunes\iTunesMiniPlayer.dll" ["Apple Computer, Inc."]
"{BB7DF450-F119-11CD-8465-00AA00425D90}" = "Microsoft Access Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\soa800.dll" [MS]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Explode"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office\UNBIND.DLL" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{9EF34FF2-3396-4527-9D27-04C8C1C67806}" = "Microsoft AntiSpyware Service Hook"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft AntiSpyware\shellextension.dll" [MS]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! NavLogon\DLLName = "C:\WINDOWS\System32\NavLogon.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
LDVPMenu\(Default) = "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll" ["Symantec Corporation"]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Bliss.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "Ernie" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\Ernie\Start Menu\Programs\Startup
"Office Startup" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA.EXE -b" [MS]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Cisco Systems VPN Client" -> shortcut to: "C:\Program Files\VPNClient\vpngui.exe "-user_logon"" ["Cisco Systems, Inc."]
"RealSecure Desktop Protector" -> shortcut to: " -closed" [file not found]


Enabled Scheduled Tasks:
------------------------

"RUTASK" -> launches: "C:\WINDOWS\ru.exe" [file not found]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{AC9E2541-2814-11D5-BC6D-00B0D0A1DE45}\
"ButtonText" = "AIM"
"Exec" = "C:\Program Files\AIM\aim.exe" ["America Online, Inc."]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

BlackICE, BlackICE, ""c:\program files\Network ICE\BlackICE\blackd.exe"" ["Internet Security Systems, Inc."]
Cisco Systems, Inc. VPN Service, CVPND, ""C:\Program Files\VPNClient\cvpnd.exe"" ["Cisco Systems, Inc."]
DefWatch, DefWatch, "C:\Program Files\NavNT\defwatch.exe" ["Symantec Corporation"]
Intel File Transfer, Intel File Transfer, "C:\WINDOWS\system32\cba\xfr.exe" ["Intel® Corporation"]
Intel PDS, Intel PDS, "C:\WINDOWS\system32\cba\pds.exe" ["Intel® Corporation"]
Norton AntiVirus Client, Norton AntiVirus Server, "C:\Program Files\NavNT\rtvscan.exe" ["Symantec Corporation"]
SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 35 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 11 seconds.
---------- (total run time: 69 seconds)



MWAV Log:

File C:\Documents and Settings\Ernie\Desktop\backups\backup-20050727-202154-427.dll tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "mxoaldr Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "MaxSpeed Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\pxsfs.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\logo.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\scribble.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\dot.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\mnature.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\hoverbot.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\will.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\powerpup.act". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "D:\Office\Actors\genius.act". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{000208FE-0000-0000-C000-000000000046}" refers to invalid object "xlrec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{000208FF-0000-0000-C000-000000000046}" refers to invalid object "xlrec.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{83D4679F-B6D7-11D2-BF36-00C04FB90A03}" refers to invalid object "C:\PROGRA~1\MESSEN~1\rtcimsp.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken.
Entry "HKCR\CLSID\{99180163-DA16-101A-935C-444553540000}" refers to invalid object "recncl.dll". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Alg.AlgSetup.1" refers to invalid object "{27D0BCCC-344D-4287-AF37-0C72C161C14C}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\RTCCore.RTCClient.1" refers to invalid object "{7a42ea29-a2b7-40c4-b091-f6f024aa89be}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F9C0000.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0F9C0002.VBN infected by "Rootkit.Win32.Agent.l" Virus! Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Desktop\backups\backup-20050727-202154-427.dll tagged as "not-a-virus:AdWare.BookedSpace.e". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\Desktop\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Look2Me.ag". Action Taken: No Action Taken.
File C:\Documents and Settings\Ernie\gbnnn.exe infected by "Net-Worm.Win32.Randon" Virus! Action Taken: No Action Taken.
File C:\RECYCLER\S-1-5-21-854245398-1004336348-839522115-1004\Dc51\8C406132-C1B1-492A-8940-2879D5 tagged as "not-a-virus:AdWare.DelphinMediaViewer.f". Action Taken: No Action Taken.




Logfile of HijackThis v1.99.1
Scan saved at 10:40:00 AM, on 7/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\Winampa.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Network ICE\BlackICE\blackice.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
c:\program files\Network ICE\BlackICE\blackd.exe
C:\Program Files\VPNClient\cvpnd.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Ernie\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\VPNClient\vpngui.exe
O4 - Global Startup: RealSecure Desktop Protector.lnk = ?
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121865670546
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = bbh.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = bbh.com
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: BlackICE - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\blackd.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\VPNClient\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - c:\program files\Network ICE\BlackICE\RapApp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

[greyknight17]

Delete these if found:

C:\Documents and Settings\Ernie\Desktop\backups\backup-20050727-202154-427.dll
C:\Documents and Settings\Ernie\Desktop\l2mfix\backup.zip
C:\Documents and Settings\Ernie\gbnnn.exe
C:\Documents and Settings\Ernie\Desktop\backups\backup-20050727-202154-427.dll
C:\Documents and Settings\Ernie\Desktop\l2mfix\backup.zip
C:\WINDOWS\ru.exe

*Download RegSeeker http://www.hoverdesk.net/freeware.htm and install it.
*Click on 'Clean The Registry' in the left panel.
*Check all boxes (make sure the backup box in the lower left corner is selected!).
*After it runs, click 'Select All' on the bottom. Then right-click on any selected item in the window and select 'Delete Selected Items'.
*Click 'Quit RegSeeker'.

Now, open any of your installed programs, and make sure that everything opens ok. If so, reboot, then go back and run RegSeeker again. Do the same thing again if anything is found. You may have to run RegSeeker 5 - 6 times, but you want it showing none to very few items.

*Make sure to reboot between each use of the program.

Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

@echo off
if exist c:\tasks.txt del c:\tasks.txt
jt /se >>c:\tasks.txt

Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it and go to your c: drive to get me the tasks.txt file. Post that here. You may delete the file afterwards.

[greyknight17]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.