[tiggerific]

Hi again,

Not sure if you needed the results from Option #4 but here they are (2 of them):

============

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

=========================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

=========================


And l2mfix option #1:

===========================


L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
"{5CA3D70E-1895-11CF-8E15-001234567890}"="DriveLetterAccess"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B7056B8E-4F99-44f8-8CBD-282390FE5428}"="VirtualCloneDrive"
"{B8323370-FF27-11D2-97B6-204C4F4F5020}"="SmartFTP Shell Extension DLL"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{1CE2AA40-1317-11D3-9922-00104B0AD431}"="CA_AntiVirus"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{92085AD4-F48A-450D-BD93-B28CC7DF67CE}"="eBay Toolbar"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
cdm.dll Thu 26 May 2005 4:16:24 A.... 75,544 73.77 K
gwfspi~1.dll Tue 12 Jul 2005 18:04:22 A.... 23,304 22.76 K
hhsetup.dll Fri 27 May 2005 11:59:52 A.... 38,912 38.00 K
icm32.dll Wed 29 Jun 2005 11:54:58 A.... 237,056 231.50 K
itircl.dll Fri 27 May 2005 11:59:52 A.... 143,872 140.50 K
itss.dll Fri 27 May 2005 11:59:52 A.... 128,000 125.00 K
iuengine.dll Thu 26 May 2005 4:16:24 A.... 198,424 193.77 K
legitc~1.dll Tue 12 Jul 2005 18:04:22 A.... 520,456 508.26 K
mscms.dll Wed 29 Jun 2005 11:54:58 A.... 68,608 67.00 K
msi.dll Wed 4 May 2005 14:45:32 A.... 2,890,240 2.75 M
msihnd.dll Wed 4 May 2005 14:45:36 A.... 271,360 265.00 K
msimsg.dll Wed 4 May 2005 14:45:36 A.... 884,736 864.00 K
msisip.dll Wed 4 May 2005 14:45:36 A.... 15,360 15.00 K
msjctsj.dll Tue 7 Jun 2005 0:43:50 A.... 2 0.00 K
mucltui.dll Thu 26 May 2005 4:16:24 A.... 127,208 124.23 K
muweb.dll Thu 26 May 2005 4:19:32 A.... 178,408 174.23 K
wuapi.dll Thu 26 May 2005 4:16:30 A.... 465,176 454.27 K
wuaueng.dll Thu 26 May 2005 4:16:30 A.... 1,343,768 1.28 M
wuaueng1.dll Thu 26 May 2005 4:16:30 A.... 194,328 189.77 K
wucltui.dll Thu 26 May 2005 4:16:30 A.... 127,256 124.27 K
wups.dll Thu 26 May 2005 4:16:30 A.... 41,240 40.27 K
wups2.dll Thu 26 May 2005 4:16:30 A.... 18,200 17.77 K
wuweb.dll Thu 26 May 2005 4:16:30 A.... 173,536 169.47 K
xpsp3res.dll Tue 17 May 2005 10:26:30 A.... 17,920 17.50 K

24 items found: 24 files, 0 directories.
Total of file sizes: 8,182,914 bytes 7.80 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is C067-A0EF

Directory of C:\WINDOWS\System32

30/07/2005 12:45 PM <DIR> DLLCACHE
07/02/2004 02:13 PM <DIR> Microsoft
0 File(s) 0 bytes
2 Dir(s) 15,294,181,376 bytes free


============================


And the HJT log:


Logfile of HijackThis v1.99.1
Scan saved at 10:17:21 AM, on 2/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
E:\EASYPH~1\Apache\apache.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\EASYPH~1\MySql\bin\mysqld.exe
E:\EASYPH~1\Apache\apache.exe
C:\WINDOWS\System32\svchost.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
E:\Zend\STUDIO~1\php\php4.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe
C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Dell AIO Printer A940\dlbabmon.exe
E:\EasyPHP1-7\easyphp.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\System32\lexpps.exe
C:\Program Files\DS Clock\dsclock.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\WINDOWS\webshots.scr
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Trillian2\trillian.exe
C:\Program Files\Crazy Browser\Crazy Browser.exe
C:\Documents and Settings\Robyn\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IeCaptureBho Object - {7c1ce531-09e9-4fc5-9803-1c2956615786} - C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll
O3 - Toolbar: Zend Studio - {95188727-288F-4581-A48D-EAB3BD027314} - E:\Zend\bin\ZendIEToolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A940] "C:\Program Files\Dell AIO Printer A940\dlbabmgr.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [EasyPHP] "E:\EasyPHP1-7\easyphp.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKCU\..\Run: [DS Clock] "C:\Program Files\DS Clock\dsclock.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: BlueSoleil.lnk = ?
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian2\trillian.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googl...en/preview.html
O8 - Extra context menu item: Zend Studio - Debug current page - res://E:\Zend\bin\ZendIEToolbar.dll/DebugCurrent.html
O8 - Extra context menu item: Zend Studio - Debug next page - res://E:\Zend\bin\ZendIEToolbar.dll/DebugNext.html
O9 - Extra button: Aceclub.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\AceClub Casino\bin\IEExtension_AC.dll
O9 - Extra 'Tools' menuitem: Aceclub.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\AceClub Casino\bin\IEExtension_AC.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: PlanetLuck.com - {6F477182-DE4F-4326-ACE3-3110A676771B} - C:\Program Files\Planetluck Casino\bin\IEExtension_PL.dll
O9 - Extra 'Tools' menuitem: PlanetLuck.com - {6F477182-DE4F-4326-ACE3-3110A676771B} - C:\Program Files\Planetluck Casino\bin\IEExtension_PL.dll
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell...iler/SysPro.CAB
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots....SDownloader.ocx
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1122606155655
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O23 - Service: Apache - Unknown owner - E:\EASYPH~1\Apache\apache.exe" --ntservice (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: CWShredder Service - InterMute, Inc. - C:\Documents and Settings\Robyn\My Documents\REPAIR\Downloads\CWShredder.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySql - Unknown owner - E:\EASYPH~1\MySql\bin\mysqld.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe


===========================

Incidentally, I haven't had any popup problems, but I did a selective Panda scan last night which still found about 6 L2M infected files in "My Documents". I haven't attempted a clean or anything just yet because I'll wait for any further instructions from you, and would be doing a complete scan again anyway.


So, it's definitely looking a lot better wouldn't you say?

Robyn.

[Advertisements]

Hi Robyn, run the Panda scan again and let it do the cleaning (if it can). Then restart post the log for Panda here.

Did you install the below in RED? If not, uninstall them via the Add/Remove panel and fix the below in HijackThis:

O9 - Extra button: Aceclub.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\AceClub Casino\bin\IEExtension_AC.dll
O9 - Extra 'Tools' menuitem: Aceclub.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\AceClub Casino\bin\IEExtension_AC.dll
O9 - Extra button: PlanetLuck.com - {6F477182-DE4F-4326-ACE3-3110A676771B} - C:\Program Files\Planetluck Casino\bin\IEExtension_PL.dll
O9 - Extra 'Tools' menuitem: PlanetLuck.com - {6F477182-DE4F-4326-ACE3-3110A676771B} - C:\Program Files\Planetluck Casino\bin\IEExtension_PL.dll

[greyknight17]

Hi Robyn, run the Panda scan again and let it do the cleaning (if it can). Then restart post the log for Panda here.

Did you install the below in RED? If not, uninstall them via the Add/Remove panel and fix the below in HijackThis:

O9 - Extra button: Aceclub.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\AceClub Casino\bin\IEExtension_AC.dll
O9 - Extra 'Tools' menuitem: Aceclub.com - {2B6AA6C9-1646-46e7-8D23-D54274F2F2F2} - C:\Program Files\AceClub Casino\bin\IEExtension_AC.dll
O9 - Extra button: PlanetLuck.com - {6F477182-DE4F-4326-ACE3-3110A676771B} - C:\Program Files\Planetluck Casino\bin\IEExtension_PL.dll
O9 - Extra 'Tools' menuitem: PlanetLuck.com - {6F477182-DE4F-4326-ACE3-3110A676771B} - C:\Program Files\Planetluck Casino\bin\IEExtension_PL.dll

[tiggerific]

Hi again,

The ones you listed in red, I did install them and they've been there for years without a problem, so I'm not worried about those.

As soon as I get the PC having a rest (hehe, when I do) I'll run the Panda complete scan and get the log for you.

Cheers!

[tiggerific]

Ok, here goes....


Incident Status Location

Adware:adware/toolbarsimbar No disinfected HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\extensions\CmdMapping\{a26abcf0-1c8f-46e7-a67c-0489dc21b9cc}
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Robyn\My Documents\REPAIR\l2mfix\backup.zip[dbwave.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Robyn\My Documents\REPAIR\l2mfix\backup.zip[LT32.DLL]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Robyn\My Documents\REPAIR\l2mfix\backup.zip[mc4sdmod.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Robyn\My Documents\REPAIR\l2mfix\backup.zip[mndart.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Robyn\My Documents\REPAIR\l2mfix\backup.zip[wmauserv.dll]
Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Robyn\My Documents\REPAIR\l2mfix\backup.zip[guard.tmp]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-36a64538-619051fb.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-36a64538-619051fb.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-36a64538-619051fb.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-36a64538-619051fb.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\loaderadv761.jar-3fc1f793-623b9bf1.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\loaderadv761.jar-3fc1f793-623b9bf1.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\loaderadv761.jar-3fc1f793-623b9bf1.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\RECYCLER\S-1-5-21-1235437211-1622821726-518192276-1006\Dc9\Java\Deployment\cache\javapi\v1.0\jar\loaderadv761.jar-3fc1f793-623b9bf1.zip[Parser.class]
Virus:W32/Netsky.P.worm Disinfected Personal Folders\Deleted Items\Postcard\postcard_payments.zip[document.txt .exe]
Virus:W32/Netsky.P.worm Disinfected Personal Folders\Deleted Items\Stolen document\about_you.zip[data.rtf .scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\hello\auction.zip[auction.com]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: unknown\myaunt.zip[myaunt.rtf.exe]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\??\hello\document.zip[document.htm .exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\did you see her already?\swimmingpool_old_photos.zip[swimmingpool_old_photos.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: does it?\news.zip[news.rtf.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\here is the $%%454$\transfer.zip[transfer.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: does it?\trash_jokes.zip[trash_jokes.htm.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\believe me\swimmingpool_location.zip[swimmingpool_location.htm.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\re:\dinner.zip[dinner.com]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\report\letter.zip[letter.txt.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: excuse me\update.zip[update.txt.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\notification\old_photos.zip[old_photos.doc.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\important\party.zip[party.htm.exe]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Hi\my_details_sales.zip[details.txt .pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\let it!\wife.zip[wife.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\is that your car?\release.zip[release.com]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Submit a Virus Sample\signature.zip[data.rtf .scr]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Question\doc01.zip[document.txt .exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: does it?\privacy.zip[privacy.doc.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\private?\material.zip[material.doc.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\lets talk about it!\visa.zip[visa.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\take it\unfolds.zip[unfolds.txt.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\see this!\nothing_disco.zip[nothing_disco.doc.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\last chance!\material_trash.zip[material_trash.txt.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\here, the introduction\information.zip[information.htm.scr]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Status\data.zip[data.rtf .scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\last chance!\trash_story.zip[trash_story.doc.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\you have tried to steal!\final_posting.zip[final_posting.rtf.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\that's a funny text.\stuff.zip[stuff.txt.com]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\you?\your_stuff.zip[your_stuff.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\is that possible?\moonlight.zip[moonlight.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\last chance!\disco.zip[disco.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\hey\webcam.zip[webcam.doc.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\denied!\disco_information.zip[disco_information.htm.com]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: important\transfer.zip[transfer.htm.com]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\fake?\letter.zip[letter.rtf.com]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: hi\your_stuff_bill.zip[your_stuff_bill.txt.scr]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\good morning\document.zip[document.rtf.pif]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\do0i4grjj40j09gjijgpd\id09509.zip[details.txt .pif]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: here\information.zip[document.txt .exe]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Old photos\old_photos_payments.zip[details.txt .pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: hi\auction_number_phone.zip[auction_number_phone.pif]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\important data\data.zip[document.txt .exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\what do you think about it?\trash.zip[trash.scr]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Does it matter?\d4334938.zip[document.txt .exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\pwd?\class_photos.zip[class_photos.doc.scr]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: approved\word document.zip[details.txt .pif]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\Mail Delivery System\doc.zip[doc.txt .pif]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\hi\data.zip[data.pif]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\jolfthkgtweyuvyk\message.zip[message.cmd]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\test.zip[test.bat]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\Test\doc.zip[doc.doc .scr]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Administrator\details_sales.zip[document.txt .exe]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\test\test.zip[test.scr]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\Mail Delivery System\message.zip[message.pif]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Re: patched\file_payments.zip[document.txt .exe]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\MAIL DELIVERY SYSTEM\nqecn.zip[nqecn.scr]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\readme.zip[readme.pif]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\Mail Transaction Failed\readme.zip[readme.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: information\important.zip[important.com]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Secure SMTP Message\data.zip[document.txt .exe]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\Status\document.zip[document.pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: important\misc.zip[misc.com]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\hi\readme.zip[readme.htm .exe]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\Hello\doc.zip[doc.exe]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\I'm back!\aboutyou.zip[aboutyou.scr]
Virus:W32/Netsky.P.worm Disinfected Archive Folders\Deleted Items\Re: Your document\corrected.zip[document.txt .exe]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\test\body.zip[body.htm .scr]
Virus:W32/Lovgate.AC.worm Disinfected Archive Folders\Deleted Items\hello\body.zip[body.htm .pif]
Virus:W32/Netsky.C.worm Disinfected Archive Folders\Deleted Items\Re: excuse me\tear.zip[tear.doc.pif]
Virus:W32/Sober.M.worm Disinfected Archive Folders\Deleted Items\Mail_delivery_failed\header_text.zip[doc_data-text.txt .pif]
Virus:W32/Bagle.pwdzip Disinfected Archive Folders\Deleted Items\E-mail account security warning.\Attach.zip
Virus:W32/Sober.M.worm Disinfected Archive Folders\Deleted Items\You visit illegal websites\indictment_cit2128.zip[doc_data-text.txt .pif]
Virus:W32/Sober.M.worm Disinfected Archive Folders\Deleted Items\You visit illegal websites\text-indictment_cit4541.zip[doc_data-text.txt .pif]
Virus:W32/Sober.M.worm Disinfected Archive Folders\Deleted Items\You visit illegal websites\indictment_cit7726.zip[doc_data-text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [mail9736.zip][message_text.txt .pif]
Virus:Trj/Citifraud.A Disinfected Local Folders\Deleted Items\0fficiaI Information To CIient Of Citizens Bank[~000001.txt]
Virus:Exploit/Codebase.M No disinfected [NEW e-gold Account User Agreement.chm][menu0000.htm]
Virus:W32/Bizex.F.worm No disinfected [NEW e-gold Account User Agreement.chm][open.exe]
Virus:W32/Netsky.P.worm Disinfected [~000000.txt][application.doc .pif]
Virus:W32/Netsky.P.worm Disinfected [~000000.txt][id43342.exe]
Virus:W32/Sober.I.worm Disinfected [optusnet.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [oh_nono_9217.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [mail.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [thats_hard_4727.xls.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [auto__mail.bigpond5416.zip][message_text.txt .pif]
Virus:W32/Bizex.F.worm No disinfected [egoldgamescript.zip][help.chm][open.exe]
Virus:W32/Sober.I.worm Disinfected [net-tech.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [auto__mail.hotmail_6762.TXT.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [re_mail.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [webfront_1401.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [clipsal7979.DOC.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [landmark.TXT.zip][message_text.txt .pif]
Virus:W32/Sober.I.worm Disinfected [auto__mail.yahoo.EML.zip][message_text.txt .pif]
Virus:W32/Netsky.P.worm Disinfected [all_in_all_tiggerific.zip][document.txt .exe]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Re: Encrypted Mail[details.scr]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.P.worm Disinfected [document_with_notice.zip][details.txt .pif]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.D.worm Disinfected Local Folders\Deleted Items\Re: Re: Document[your_document.pif]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Re: Protected Mail Delivery[msg.doc .pif]
Virus:W32/Netsky.P.worm Disinfected [product_tiggerific.zip][details.txt .pif]
Virus:Trj/Citifraud.A Disinfected Local Folders\Deleted Items\IMPORTANT INFORMATION FROM SunTrust Bank BILLING DEPARTMENT[~000001.txt]
Virus:W32/Netsky.Z.worm Disinfected [Important.zip][Important.txt .exe]
Virus:Trj/Citifraud.A Disinfected Local Folders\Deleted Items\Important Bank Mail [Sat, 09 Oct 2004 17:04:23 -0500][~000001.txt]
Virus:Trj/Citifraud.A Disinfected Local Folders\Deleted Items\Smith Barney customer notice: data confirmation [Fri, 15 Oct 2004 05:58:18 +0600][~000001.txt]
Virus:W32/Netsky.P.worm Disinfected [details_tiggerific.zip][details.txt .pif]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Re: Mail Server[readme.txt.scr]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.D.worm Disinfected Local Folders\Deleted Items\Re: Re: Re: Your document[document_4351.pif]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.P.worm Disinfected [text_tiggerific.zip][data.rtf .scr]
Virus:W32/Netsky.D.worm Disinfected Local Folders\Deleted Items\Re: Details[my_details.pif]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.P.worm Disinfected [message.zip][document.txt .exe]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.P.worm Disinfected [sample01.zip][data.rtf .scr]
Virus:W32/Netsky.P.worm Disinfected [message_tiggerific.zip][details.txt .pif]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Re: here[excel document.txt.exe]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.P.worm Disinfected [pwd02.zip][details.txt .pif]
Virus:Exploit/iFrame Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[~000003.@x@]
Virus:W32/Netsky.P.worm Disinfected Local Folders\Deleted Items\Mail Delivery (failure [email protected])[message.scr]
Virus:W32/Netsky.Z.worm Disinfected [Part-2.zip][Part-2.txt .exe]


It's pretty big.. but I can account for most of them. Obviously I haven't emptied my Recycle bin since I deleted some viruses (done now). I also didn't realise that I still had Deleted Items from my Outlook archived (deleted now).

The majority of other ones are actually from my old Outlook (which I forgot about).

Of course, there's the ones that the l2m fix has backed up - which as far as I can see leaves only one that I don't know how to get rid of - the first one..

Adware:adware/toolbarsimbar

Unless of course you can see anything else really nasty in there that I might have missed.

Cheers and thanks.

Robyn.

[greyknight17]

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. While in the Registry Editor, navigate to:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\extensions\CmdMapping\ and delete {a26abcf0-1c8f-46e7-a67c-0489dc21b9cc}

If any of the above registry keys are giving you problems deleting, right click on them and click on Permissions. Then click on the Advanced button. Make sure the first box (Inherit from parent...) is checked. Click OK and OK. Then try deleting the entry again. Once you're done, close the Registry Editor.

Delete this file:

C:\Documents and Settings\Robyn\My Documents\REPAIR\l2mfix\backup.zip

Your log should be clean now

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.

[tiggerific]

Okie dokie,

Done all that and did another full Panda scan (they just updated their online scan yesterday to the new "ActiveScan" which picks up hacks, dialers, etc.).

Anyway, the only thing in the logs that I don't know how to deal with (or whether to leave them alone) are these two:

Hacktool:HackTool/NetCat.A No disinfected C:\WINDOWS\nc.exe
Hacktool:Hacktool/Processor No disinfected C:\WINDOWS\SYSTEM32\Process.exe

If you could just let me know if I need to do anything about them, then I'll agree with you and say my logs are clean

Cheers!

[greyknight17]

Upload this file (C:\WINDOWS\SYSTEM32\Process.exe) to http://virusscan.jotti.org and report back what it found. Go back to the system32 folder and click on that Process.exe file. Is it 52kb in size? Right click and go to properties. When was it created?

Delete that nc.exe file.

Any other problems now?

[tiggerific]

Hi again,

Long delay between getting things tidied up. Had a bit of a "setback" when my teenager did some game surfing

Anyways, here's the results from the PROCESS.EXE scan:

File: Process.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) (Note: only non-destructive malware has been found. Considering the non-destructive nature of samples like these - although they can be a pain -, results will not be stored in the database.)
MD5 7397f6ee4a9601a123b645c0cd428017
Packers detected: -

AntiVir Found SPR/Processor.20
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found not a virus Tool.Prockill
F-Prot Antivirus Found nothing
Fortinet Found W32/Startpage.DU-dr
Kaspersky Anti-Virus Found not-a-virus:RiskTool.Win32.Processor.20
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

Yes, it is 52Kb in size and has a creation date of 2nd August 05 (doesn't sound good), but it has a modified date of 13th Jan 05.

The version info is Copyright 2003 [email protected]

Should I just delete this? or do I need to do something else with it?

Everything else is looking [bleep] good

[greyknight17]

No, don't delete it. That sounds about right - the version info that is

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.