[DocDoom5]

I like many others I see here am plagued by Winfixer and I suspect a few others. I have randum reboots at times, especially when trying to run spyware removal programs such as spybot, spysweeper, ect. Here is my logs. I may not have done everything in the right order, the highjack this log was the last thing done after all the cleaning. As soon as this was done, I opened a Browser...and Up pops Winfixer...Please help remove this nuisence.


Logfile of HijackThis v1.99.1
Scan saved at 11:22:39 AM, on 8/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Utopia\Angel\Angel.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\securitysuite.exe
C:\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\mxc42.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 11:16:12 AM, 8/8/2005
+ Report-Checksum: E3E67DA4

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{8085E374-ACBB-42F9-873F-49EC7E244F97} -> Spyware.Hijacker.Generic : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{A903BF95-883E-4E70-AEC8-6C27CDC0A6B2} -> Spyware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-329068152-1993962763-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0019C3E2-DD48-4A6D-ABCD-8D32436323D9} -> Spyware.BookedSpace : Cleaned with backup
HKU\S-1-5-21-329068152-1993962763-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{339BB23F-A864-48C0-A59F-29EA915965EC} -> Spyware.HuntBar : Cleaned with backup
HKU\S-1-5-21-329068152-1993962763-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{79849612-A98F-45B8-95E9-4D13C7B6B35C} -> Spyware.Crazywinnings : Cleaned with backup
HKU\S-1-5-21-329068152-1993962763-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8952A998-1E7E-4716-B23D-3DBE03910972} -> Spyware.HuntBar : Cleaned with backup
[528] C:\WINDOWS\system32\mxc42.dll -> Spyware.Look2Me : Error during cleaning
[1364] C:\WINDOWS\system32\wspdxm.dll -> Spyware.Look2Me : Error during cleaning
[1980] C:\WINDOWS\system32\wspdxm.dll -> Spyware.Look2Me : Error during cleaning
:mozilla.13:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sgpbizgt.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.14:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sgpbizgt.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sgpbizgt.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sgpbizgt.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sgpbizgt.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\sgpbizgt.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.15:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.16:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.68:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.69:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.70:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.72:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.101:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.102:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Cindie\Application Data\Mozilla\Firefox\Profiles\hd42wu8e.default\cookies.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.6:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.7:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.8:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.9:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.10:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.11:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.13:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.38:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.41:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.49:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.50:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.51:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.52:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.53:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.54:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.55:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.56:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.61:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.62:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.63:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.64:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.65:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.67:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.79:C:\Documents and Settings\Cody\Application Data\Mozilla\Firefox\Profiles\xuiyd48k.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adbrite : Cleaned with backup
:mozilla.21:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.22:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.23:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.24:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
:mozilla.25:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.26:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.27:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.28:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
:mozilla.44:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.91:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.98:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.99:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.100:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.106:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
:mozilla.107:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
:mozilla.108:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
:mozilla.144:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.145:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.146:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.147:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.148:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.149:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.150:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.151:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.152:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.153:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.154:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.155:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.156:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.157:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.158:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.159:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.160:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.161:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.162:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.163:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.164:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.165:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.166:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.169:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.170:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.171:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.172:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.173:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.174:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.175:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.176:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.177:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.178:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.194:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.195:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.196:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.197:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.203:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.206:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
:mozilla.217:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.218:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.281:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.282:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.283:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
:mozilla.284:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Targetnet : Cleaned with backup
:mozilla.291:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.292:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.293:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
:mozilla.310:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.311:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.312:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.313:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.314:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.315:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.320:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.321:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.322:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Bfast : Cleaned with backup
:mozilla.332:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.333:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.349:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.350:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.374:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.382:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Revenue : Cleaned with backup
:mozilla.398:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.399:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Linksynergy : Cleaned with backup
:mozilla.414:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.441:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Bluestreak : Cleaned with backup
:mozilla.457:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
:mozilla.471:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.X10 : Cleaned with backup
:mozilla.472:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.X10 : Cleaned with backup
:mozilla.473:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.X10 : Cleaned with backup
:mozilla.474:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.X10 : Cleaned with backup
:mozilla.573:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.612:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Specificclick : Cleaned with backup
:mozilla.617:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Internetfuel : Cleaned with backup
:mozilla.618:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Internetfuel : Cleaned with backup
:mozilla.619:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Internetfuel : Cleaned with backup
:mozilla.620:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Internetfuel : Cleaned with backup
:mozilla.621:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Internetfuel : Cleaned with backup
:mozilla.642:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.699:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.700:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Commission-junction : Cleaned with backup
:mozilla.756:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Hypertracker : Cleaned with backup
:mozilla.809:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Liveperson : Cleaned with backup
:mozilla.821:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
:mozilla.822:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
:mozilla.823:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
:mozilla.824:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
:mozilla.825:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
:mozilla.826:C:\Documents and Settings\Ken\Application Data\Mozilla\Firefox\Profiles\bibzwole.default\cookies-1.txt -> Spyware.Cookie.Casinotropez : Cleaned with backup
C:\Documents and Settings\Ken\My Documents\Saved data MY[bleep]\Downloads5\[CRACK] Heroes of Might and Magic 4 no cd.exe -> Trojan.Makecall.a : Cleaned with backup
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\4L6381UB\!update-2234[1].0000 -> TrojanDownloader.PurityScan.y : Cleaned with backup
C:\Program Files\Juno\bin\getjuno.exe -> Heuristic.Win32.Dialer : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\773E3E10-C4AA-4975-BC4B-D33FCD\6253A2C3-DF60-44B5-AB9C-A34AF8 -> Spyware.Delfin : Cleaned with backup
C:\WINDOWS\cfgmgr52\EECH1.bsx -> Spyware.BookedSpace : Cleaned with backup
C:\WINDOWS\cfgmgr52\SPZ3.bsx -> Spyware.BookedSpace : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\activex.exe -> Dialer.Generic : Cleaned with backup
C:\WINDOWS\icont.exe -> Spyware.AdURL : Cleaned with backup
C:\WINDOWS\ru.exe -> Spyware.PurityScan : Cleaned with backup
C:\WINDOWS\system\UpdInst.exe -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\aci2cqag.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\adifil32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ahicap32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\almfd.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\aothz.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\aricap.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ATHPRXY1.exe -> Spyware.UrlSpy : Cleaned with backup
C:\WINDOWS\system32\attodisc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\avmeter1.exe -> Spyware.UrlSpy : Cleaned with backup
C:\WINDOWS\system32\axcups.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\bjtsprx2.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\botsprx3.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cbfgnt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cctdll.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cctdll96.exe -> Spyware.UrlSpy : Cleaned with backup
C:\WINDOWS\system32\cempstui.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cfpbk32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\CJDBControlRoxio.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cknnwsp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ckusapi.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\clfgnt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cmfview.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\coedui.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\crnsole.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\csmaddin.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cvvfat.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cxutil.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\cZmocx.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\deconfig.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dedskmgr.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dfcdll.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dfdlgs.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dfghelp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dGdim.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\disenh.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dJdpmesh.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dlvacm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\doband.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dotmsft.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dqghelp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\drdlgs.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dRdrm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dvound.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dxactfrm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dxnetlib.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dYd8.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dymsadsn.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dynlobby.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\dyvenum.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ebs.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ebts.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\EfnClass.Dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\EinClass.Dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\eocapi.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ewentcls.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\fesrch.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\FT20ENU.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\FU20ENU.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ggtuname.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\gxkcsp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\icetppui.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\idssuba.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ifmp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ipaksie.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\itaapi.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ivitpki.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kadbene.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kaddv.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kadycc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kcdtuq.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kedkor.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\keiice.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\khdhe.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kldgae.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kldmlt47.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kmdur.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\koiice.dll -> TrojanSpy.Briss.n : Cleaned with backup
C:\WINDOWS\system32\ksdbene.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ksdlv.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ktdne.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kvdtuf.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\kxdfr.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\laras10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lawrp10n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lbcalsec.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lbmsp10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lcXbm12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\LFWND10N.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lhpsd10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\libar12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ljdlg12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\Ljpct12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lkas2kpm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lmas2kpm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\LNPNM12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\loCUT12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\loeps10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lotif10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lpdlg10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lplmb10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lqdlg12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\LQSCR12n.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lrpsd10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lscmgr10.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\LSEEI.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ltrt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lvisi12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lvras10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lwiff12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lwmac12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lxpcd12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lxtif10N.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lYprxy.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\lyrhelp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mbdrv.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mbimg32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mcdtctm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mcoa.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mcvidc32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mdratelc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mdwsock.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mfexch40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mfimg32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mfvcrt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mfvidc32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mgexcl40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mggsvc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mgrd2x40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mhc42.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mhise.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mihtmled.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\miidle.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mils31.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mjdxmlc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\Mjstdfmt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mkisip.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mlpbde40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mlvidc32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mmapsspc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mmastmib.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mmgsvc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mml_hp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mmtext40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mmvidc32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mnjter40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mNpistub.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mooert2.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\moutil.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\movidctl.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mpw3prt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mqexch40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mr3216.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mrrecr40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mrwebdvd.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mrxmlr.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mshcp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mtdtctm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mthtmler.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mucertui.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mudxmlc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\muidntld.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mUpistub.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mvwebdvd.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mwjtes40.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\mxls31.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\myimsg.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\myrddm.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\nb4_disp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\nbmsapi.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ndprint.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\nGrrhook.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\nlprint.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\nqtplwiz.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\nvlanui2.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ohesvr.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\oie2disp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\oje2disp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ojeaccrc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\olbc16gt.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\opeacc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\orpdx32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\oueacc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\oupdx32.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\pHp.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\PhpOops2.dll_tobedeleted -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\PKBDLG.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\pkrfproc.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\pkrfts.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\plftp32c.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ppdgen.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\psotowiz.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\psspl.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS\system32\ptdgen.dll -> Spyware.Look2Me : Cleaned with backup
C:\WINDOWS

[Advertisements]

Welcome to GTG.

Before you do anything else, please create a folder for HijackThis and put it in a permanent folder (like C:\HJT) instead of the Temp folder. This is required because HijackThis will create backups and we don't want them to be deleted.

Download L2MFix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so!

Make sure you post the above log in the forum before proceeding any further. Once you did that, no need to wait for my reply, just go straight to the below steps and post those logs as well.

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing Enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2MFix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new HijackThis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[greyknight17]

Welcome to GTG.

Before you do anything else, please create a folder for HijackThis and put it in a permanent folder (like C:\HJT) instead of the Temp folder. This is required because HijackThis will create backups and we don't want them to be deleted.

Download L2MFix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so!

Make sure you post the above log in the forum before proceeding any further. Once you did that, no need to wait for my reply, just go straight to the below steps and post those logs as well.

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing Enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2MFix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new HijackThis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[DocDoom5]

Also forgot this Log...


L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnceEx]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mxc42.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{9C71B6DC-3142-7E89-4942-19B9685A561A}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{73B24247-042E-4EF5-ADC2-42F62E6FD654}"="ICQ Lite Shell Extension"
"{F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35}"=""
"{0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F}"=""
"{FE40A4D3-165B-4560-A989-C5A0CA285542}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35}\InprocServer32]
@="C:\\WINDOWS\\system32\\xulprov.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F}\InprocServer32]
@="C:\\WINDOWS\\system32\\wk2_32.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
aci2cqag.dll Sat Jul 16 2005 2:05:28p ..S.R 417,792 408.00 K
adifil32.dll Sat Jul 16 2005 12:59:18a ..S.R 417,792 408.00 K
ahicap32.dll Sun Jul 17 2005 3:28:26p ..S.R 417,792 408.00 K
almfd.dll Sat Jul 16 2005 12:59:22a ..S.R 417,792 408.00 K
aothz.dll Fri Jul 15 2005 11:53:22p ..S.R 417,792 408.00 K
aricap.dll Sun Jul 17 2005 3:28:30p ..S.R 417,792 408.00 K
attodisc.dll Fri Jul 15 2005 11:53:18p ..S.R 417,792 408.00 K
axcups.dll Sat Jul 16 2005 2:05:20p ..S.R 417,792 408.00 K
bjtsprx2.dll Sun Jul 17 2005 10:23:32a ..S.R 417,792 408.00 K
botsprx3.dll Sun Jul 17 2005 10:23:26a ..S.R 417,792 408.00 K
cbfgnt.dll Mon Jul 18 2005 10:56:32p ..S.R 417,792 408.00 K
cctdll.dll Sat Jul 16 2005 9:21:32p ..S.R 417,792 408.00 K
cdm.dll Thu May 26 2005 4:16:24a A.... 75,544 73.77 K
cempstui.dll Wed Jul 20 2005 5:34:44a ..S.R 417,792 408.00 K
cfpbk32.dll Mon Jul 18 2005 7:28:30a ..S.R 417,792 408.00 K
cjdbco~1.dll Wed Jul 20 2005 10:59:00p ..S.R 417,792 408.00 K
cknnwsp.dll Sun Jul 17 2005 7:17:28p ..S.R 417,792 408.00 K
ckusapi.dll Mon Jul 18 2005 6:03:30a ..S.R 417,792 408.00 K
clfgnt.dll Thu Jul 21 2005 10:06:50p ..S.R 417,792 408.00 K
cmfview.dll Sat Jul 16 2005 5:44:18a ..S.R 417,792 408.00 K
coedui.dll Wed Jul 20 2005 12:54:42p ..S.R 417,792 408.00 K
crnsole.dll Thu Jul 21 2005 10:07:12p ..S.R 417,792 408.00 K
csmaddin.dll Mon Jul 18 2005 6:03:34a ..S.R 417,792 408.00 K
cvvfat.dll Sat Jul 16 2005 9:21:22p ..S.R 417,792 408.00 K
cxutil.dll Wed Jul 20 2005 5:34:40a ..S.R 417,792 408.00 K
czmocx.dll Wed Jul 20 2005 10:58:56p ..S.R 417,792 408.00 K
deconfig.dll Wed Jul 20 2005 7:02:48p ..S.R 417,792 408.00 K
dedskmgr.dll Mon Jul 18 2005 7:28:34a ..S.R 417,792 408.00 K
dfcdll.dll Tue Jul 19 2005 4:19:38a ..S.R 417,792 408.00 K
dfdlgs.dll Fri Jul 15 2005 12:22:42a ..S.R 417,792 408.00 K
dfghelp.dll Wed Jul 20 2005 1:36:38a ..S.R 417,792 408.00 K
dgdim.dll Thu Jul 14 2005 1:27:36p ..S.R 417,792 408.00 K
disenh.dll Tue Jul 19 2005 8:59:56a ..S.R 417,792 408.00 K
djdpmesh.dll Tue Jul 19 2005 2:10:36p ..S.R 417,792 408.00 K
dlvacm.dll Tue Jul 19 2005 8:59:44a ..S.R 417,792 408.00 K
doband.dll Wed Jul 20 2005 7:02:52p ..S.R 417,792 408.00 K
dotmsft.dll Tue Jul 19 2005 12:21:32a ..S.R 417,792 408.00 K
dqghelp.dll Thu Jul 14 2005 1:27:42p ..S.R 417,792 408.00 K
drdlgs.dll Fri Jul 15 2005 1:48:40a ..S.R 417,792 408.00 K
drdrm.dll Tue Jul 19 2005 2:10:40p ..S.R 417,792 408.00 K
dvound.dll Sun Jul 17 2005 8:26:36p ..S.R 417,792 408.00 K
dxactfrm.dll Fri Jul 15 2005 12:22:38a ..S.R 417,792 408.00 K
dxnetlib.dll Wed Jul 20 2005 1:36:44a ..S.R 417,792 408.00 K
dyd8.dll Wed Jul 20 2005 12:54:46p ..S.R 417,792 408.00 K
dymsadsn.dll Sun Jul 17 2005 7:17:40p ..S.R 417,792 408.00 K
dynlobby.dll Tue Jul 19 2005 4:19:34a ..S.R 417,792 408.00 K
dyvenum.dll Fri Jul 15 2005 1:48:44a ..S.R 417,792 408.00 K
ebs.dll Fri Jul 15 2005 12:01:04p ..S.R 417,792 408.00 K
ebts.dll Sun Jun 26 2005 8:29:00p ..... 417,792 408.00 K
efnclass.dll Mon Jul 18 2005 8:30:32a ..S.R 417,792 408.00 K
einclass.dll Tue Jul 19 2005 12:21:38a ..S.R 417,792 408.00 K
eocapi.dll Thu Jul 21 2005 6:14:36p ..S.R 417,792 408.00 K
ewentcls.dll Thu Jul 21 2005 6:14:40p ..S.R 417,792 408.00 K
fesrch.dll Sat Jul 16 2005 5:44:22a ..S.R 417,792 408.00 K
ft20enu.dll Fri Jul 15 2005 12:01:14p ..S.R 417,792 408.00 K
fu20enu.dll Mon Jul 18 2005 8:30:44a ..S.R 417,792 408.00 K
gccoll~1.dll Tue Jul 12 2005 3:35:14p A.... 126,680 123.71 K
gcunco~1.dll Tue Jul 12 2005 3:35:10p A.... 95,448 93.21 K
ggtuname.dll Sat Jul 16 2005 5:50:22p ..S.R 417,792 408.00 K
gxkcsp.dll Sun Jul 17 2005 8:26:58p ..S.R 417,792 408.00 K
hashlib.dll Tue Jul 12 2005 3:35:14p A.... 117,976 115.21 K
hhsetup.dll Thu May 26 2005 10:04:28p A.... 41,472 40.50 K
icetppui.dll Sat Jul 16 2005 7:57:26p ..S.R 417,792 408.00 K
icm32.dll Tue Jun 28 2005 9:46:00p A.... 254,976 249.00 K
idssuba.dll Thu Jul 21 2005 2:19:08p ..S.R 417,792 408.00 K
ifmp.dll Sun Jul 17 2005 11:49:26a ..S.R 417,792 408.00 K
ipaksie.dll Sun Jul 17 2005 11:49:30a ..S.R 417,792 408.00 K
itaapi.dll Sat Jul 16 2005 5:50:34p ..S.R 417,792 408.00 K
itircl.dll Thu May 26 2005 10:04:28p A.... 155,136 151.50 K
itss.dll Thu May 26 2005 10:04:28p A.... 137,216 134.00 K
iuengine.dll Thu May 26 2005 4:16:24a A.... 198,424 193.77 K
ivitpki.dll Sat Jul 16 2005 7:57:22p ..S.R 417,792 408.00 K
kadbene.dll Wed Jul 20 2005 4:25:44a ..S.R 417,792 408.00 K
kaddv.dll Sat Jul 16 2005 10:30:22p ..S.R 417,792 408.00 K
kadycc.dll Sat Jul 16 2005 8:40:20a ..S.R 417,792 408.00 K
kcdtuq.dll Mon Jul 18 2005 1:20:32p ..S.R 417,792 408.00 K
kedkor.dll Sat Jul 16 2005 10:06:26a ..S.R 417,792 408.00 K
keiice.dll Mon Jul 18 2005 10:48:30a ..S.R 417,792 408.00 K
khdhe.dll Sat Jul 16 2005 10:06:18a ..S.R 417,792 408.00 K
kldgae.dll Mon Jul 18 2005 10:56:38p ..S.R 417,792 408.00 K
kldmlt47.dll Tue Jul 19 2005 2:54:34a ..S.R 417,792 408.00 K
kmdur.dll Mon Jul 18 2005 1:20:36p ..S.R 417,792 408.00 K
ksdbene.dll Wed Jul 20 2005 4:25:40a ..S.R 417,792 408.00 K
ksdlv.dll Tue Jul 19 2005 9:54:50p ..S.R 417,792 408.00 K
ktdne.dll Tue Jul 19 2005 2:54:38a ..S.R 417,792 408.00 K
kvdtuf.dll Tue Jul 19 2005 9:55:00p ..S.R 417,792 408.00 K
kxdfr.dll Sat Jul 16 2005 10:30:30p ..S.R 417,792 408.00 K
laras10n.dll Sun Jul 17 2005 7:48:30a ..S.R 417,792 408.00 K
lawrp10n.dll Wed Jul 20 2005 11:52:42a ..S.R 417,792 408.00 K
lbcalsec.dll Wed Jul 20 2005 5:59:52p ..S.R 417,792 408.00 K
lbmsp10n.dll Sun Jul 17 2005 2:15:26p ..S.R 417,792 408.00 K
lcxbm12n.dll Wed Jul 20 2005 4:33:48p ..S.R 417,792 408.00 K
lfwnd10n.dll Wed Jul 20 2005 3:20:44p ..S.R 417,792 408.00 K
lhpsd10n.dll Thu Jul 21 2005 12:23:48a ..S.R 417,792 408.00 K
libar12n.dll Thu Jul 21 2005 1:24:54a ..S.R 417,792 408.00 K
ljdlg12n.dll Sun Jul 17 2005 5:08:36a ..S.R 417,792 408.00 K
ljpct12n.dll Sun Jul 17 2005 2:15:30p ..S.R 417,792 408.00 K
lkas2kpm.dll Wed Jul 20 2005 11:52:46a ..S.R 417,792 408.00 K
lmas2kpm.dll Sun Jul 17 2005 5:08:46a ..S.R 417,792 408.00 K
lnpnm12n.dll Tue Jul 19 2005 4:36:36p ..S.R 417,792 408.00 K
locut12n.dll Fri Jul 15 2005 8:17:16p ..S.R 417,792 408.00 K
loeps10n.dll Fri Jul 15 2005 8:17:20p ..S.R 417,792 408.00 K
lotif10n.dll Sat Jul 16 2005 3:20:24a ..S.R 417,792 408.00 K
lpdlg10n.dll Tue Jul 19 2005 11:41:40a ..S.R 417,792 408.00 K
lplmb10n.dll Tue Jul 19 2005 7:50:34a ..S.R 417,792 408.00 K
lqdlg12n.dll Tue Jul 19 2005 11:41:36a ..S.R 417,792 408.00 K
lqscr12n.dll Sun Jul 17 2005 7:48:24a ..S.R 417,792 408.00 K
lrpsd10n.dll Thu Jul 21 2005 12:23:54a ..S.R 417,792 408.00 K
lscmgr10.dll Wed Jul 20 2005 4:33:42p ..S.R 417,792 408.00 K
lseei.dll Sat Jul 16 2005 8:40:28a ..S.R 417,792 408.00 K
ltrt.dll Wed Jul 20 2005 5:59:48p ..S.R 417,792 408.00 K
lvisi12n.dll Sat Jul 16 2005 11:56:34p ..S.R 417,792 408.00 K
lvras10n.dll Sat Jul 16 2005 3:20:28a ..S.R 417,792 408.00 K
lwiff12n.dll Wed Jul 20 2005 12:10:38a ..S.R 417,792 408.00 K
lwmac12n.dll Wed Jul 20 2005 12:10:42a ..S.R 417,792 408.00 K
lxpcd12n.dll Tue Jul 19 2005 7:50:38a ..S.R 417,792 408.00 K
lxtif10n.dll Tue Jul 19 2005 4:36:40p ..S.R 417,792 408.00 K
lyprxy.dll Mon Jul 18 2005 10:48:36a ..S.R 417,792 408.00 K
lyrhelp.dll Thu Jul 21 2005 1:24:50a ..S.R 417,792 408.00 K
mbdrv.dll Tue Jul 19 2005 12:46:36p ..S.R 417,792 408.00 K
mbimg32.dll Sun Jul 17 2005 4:56:30p ..S.R 417,792 408.00 K
mcdtctm.dll Tue Jul 19 2005 7:09:46p ..S.R 417,792 408.00 K
mcoa.dll Wed Jul 20 2005 8:31:52p ..S.R 417,792 408.00 K
mcvidc32.dll Sat Jul 16 2005 11:56:54p ..S.R 417,792 408.00 K
mdratelc.dll Tue Jul 19 2005 6:05:36p ..S.R 417,792 408.00 K
mdwsock.dll Mon Jul 18 2005 3:54:36p ..S.R 417,792 408.00 K
mfexch40.dll Fri Jul 15 2005 10:51:16p ..S.R 417,792 408.00 K
mfimg32.dll Wed Jul 20 2005 9:36:48p ..S.R 417,792 408.00 K
mfvcrt.dll Thu Jul 14 2005 2:49:42p ..S.R 417,792 408.00 K
mfvidc32.dll Thu Jul 14 2005 2:49:38p ..S.R 417,792 408.00 K
mgexcl40.dll Sat Jul 16 2005 2:15:18a ..S.R 417,792 408.00 K
mggsvc.dll Sat Jul 16 2005 2:15:22a ..S.R 417,792 408.00 K
mgrd2x40.dll Sun Jul 17 2005 1:12:32a ..S.R 417,792 408.00 K
mhc42.dll Fri Jul 15 2005 2:43:24p ..S.R 417,792 408.00 K
mhise.dll Tue Jul 19 2005 1:45:34a ..S.R 417,792 408.00 K
mihtmled.dll Fri Jul 22 2005 1:56:38a ..S.R 417,792 408.00 K
miidle.dll Mon Jun 20 2005 3:34:48a ..S.R 417,792 408.00 K
mils31.dll Fri Jul 15 2005 5:31:20p ..S.R 417,792 408.00 K
mjdxmlc.dll Wed Jul 20 2005 6:59:40a ..S.R 417,792 408.00 K
mjstdfmt.dll Mon Jul 18 2005 4:56:32p ..S.R 417,792 408.00 K
mkisip.dll Fri Jul 15 2005 10:51:24p ..S.R 417,792 408.00 K
mlpbde40.dll Tue Jul 19 2005 6:05:40p ..S.R 417,792 408.00 K
mlvidc32.dll Mon Jul 18 2005 11:56:34a ..S.R 417,792 408.00 K
mmapsspc.dll Thu Jul 21 2005 4:04:50a ..... 417,792 408.00 K
mmastmib.dll Mon Jul 18 2005 11:56:30a ..S.R 417,792 408.00 K
mmgsvc.dll Sat Jul 16 2005 12:55:20p ..S.R 417,792 408.00 K
mml_hp.dll Fri Jul 15 2005 2:43:30p ..S.R 417,792 408.00 K
mmtext40.dll Sat Jul 16 2005 4:42:20p ..S.R 417,792 408.00 K
mmvidc32.dll Sun Jul 17 2005 1:14:32p ..S.R 417,792 408.00 K
mnjter40.dll Sun Jun 26 2005 8:31:34p ..S.R 417,792 408.00 K
mnpistub.dll Wed Jul 20 2005 9:36:52p ..S.R 417,792 408.00 K
mooert2.dll Sun Jul 17 2005 1:12:24a ..S.R 417,792 408.00 K
moutil.dll Tue Jul 19 2005 1:45:38a ..S.R 417,792 408.00 K
movidctl.dll Sat Jul 16 2005 4:42:30p ..S.R 417,792 408.00 K
mpw3prt.dll Fri Jul 15 2005 10:36:06a ..S.R 417,792 408.00 K
mqexch40.dll Fri Jul 22 2005 1:56:42a ..S.R 417,792 408.00 K
mr3216.dll Sun Jul 17 2005 9:52:34p ..S.R 417,792 408.00 K
mrrecr40.dll Mon Jul 18 2005 4:56:36p ..S.R 417,792 408.00 K
mrwebdvd.dll Wed Jul 20 2005 6:59:44a ..S.R 417,792 408.00 K
mrxmlr.dll Fri Jul 15 2005 10:36:14a ..S.R 417,792 408.00 K
mscms.dll Tue Jun 28 2005 9:46:00p A.... 74,240 72.50 K
mshcp.dll Sun Jul 17 2005 1:14:26p ..S.R 417,792 408.00 K
mtdtctm.dll Fri Jul 15 2005 9:26:16p ..S.R 417,792 408.00 K
mthtmler.dll Sun Jul 17 2005 4:56:26p ..S.R 417,792 408.00 K
mucertui.dll Wed Jul 20 2005 8:31:48p ..S.R 417,792 408.00 K
mudxmlc.dll Sat Jul 16 2005 6:52:22p ..S.R 417,792 408.00 K
muidntld.dll Sat Jul 16 2005 12:55:24p ..S.R 417,792 408.00 K
mupistub.dll Wed Jul 20 2005 3:20:56p ..S.R 417,792 408.00 K
mvwebdvd.dll Mon Jul 18 2005 3:54:32p ..S.R 417,792 408.00 K
mwjtes40.dll Sat Jul 16 2005 6:52:32p ..S.R 417,792 408.00 K
mxc42.dll Fri Jul 22 2005 11:42:22a ..S.R 417,792 408.00 K
mxls31.dll Sun Jul 17 2005 9:52:28p ..S.R 417,792 408.00 K
myimsg.dll Fri Jul 15 2005 5:31:16p ..S.R 417,792 408.00 K
myrddm.dll Tue Jul 19 2005 12:46:42p ..S.R 417,792 408.00 K
nb4_disp.dll Fri Jul 15 2005 3:13:44a ..S.R 417,792 408.00 K
nbmsapi.dll Fri Jul 15 2005 3:13:38a ..S.R 417,792 408.00 K
ndprint.dll Wed Jul 20 2005 10:27:54a ..S.R 417,792 408.00 K
ngrrhook.dll Mon Jul 18 2005 2:29:30p ..S.R 417,792 408.00 K
nlprint.dll Wed Jul 20 2005 10:27:48a ..S.R 417,792 408.00 K
nqtplwiz.dll Mon Jul 18 2005 2:29:36p ..S.R 417,792 408.00 K
nvlanui2.dll Tue Jul 19 2005 7:10:06p ..S.R 417,792 408.00 K
ohesvr.dll Sat Jul 16 2005 7:14:18a ..S.R 417,792 408.00 K
oie2disp.dll Mon Jul 18 2005 6:11:32p ..S.R 417,792 408.00 K
oje2disp.dll Mon Jul 18 2005 4:37:34a ..S.R 417,792 408.00 K
ojeaccrc.dll Tue Jul 19 2005 11:01:48p ..S.R 417,792 408.00 K
olbc16gt.dll Thu Jul 21 2005 11:28:38p ..S.R 417,792 408.00 K
opeacc.dll Mon Jul 18 2005 6:11:36p ..S.R 417,792 408.00 K
orpdx32.dll Mon Jul 18 2005 4:37:28a ..S.R 417,792 408.00 K
oueacc.dll Fri Jul 15 2005 9:24:26a ..S.R 417,792 408.00 K
oupdx32.dll Tue Jul 19 2005 11:01:40p ..S.R 417,792 408.00 K
php.dll Sat Jul 16 2005 7:14:22a ..S.R 417,792 408.00 K
phpoop~1.dll Wed Jul 20 2005 2:09:48p ..S.R 417,792 408.00 K
pkbdlg.dll Mon Jul 18 2005 9:30:32p ..S.R 417,792 408.00 K
pkrfproc.dll Mon Jul 18 2005 12:41:28a ..S.R 417,792 408.00 K
pkrfts.dll Thu Jul 21 2005 4:45:36p ..S.R 417,792 408.00 K
plftp32c.dll Tue Jul 19 2005 5:21:34a ..S.R 417,792 408.00 K
pncrt.dll Fri May 20 2005 10:07:46p A.... 278,528 272.00 K
pndx5016.dll Fri May 20 2005 10:07:48p A.... 6,656 6.50 K
pndx5032.dll Fri May 20 2005 10:07:48p A.... 5,632 5.50 K
ppdgen.dll Wed Jul 20 2005 2:09:42p ..S.R 417,792 408.00 K
psotowiz.dll Thu Jul 21 2005 4:45:40p ..S.R 417,792 408.00 K
psspl.dll Mon Jul 18 2005 12:41:32a ..S.R 417,792 408.00 K
ptdgen.dll Thu Jul 21 2005 11:28:46p ..S.R 417,792 408.00 K
qddwipes.dll Tue Jul 19 2005 5:21:38a ..S.R 417,792 408.00 K
qrsf.dll Fri Jul 22 2005 3:22:38a ..... 417,792 408.00 K
qssf.dll Mon Jul 18 2005 9:30:36p ..S.R 417,792 408.00 K
ragsvc.dll Fri Jul 22 2005 12:43:36a ..S.R 417,792 408.00 K
rkched32.dll Fri Jul 22 2005 12:43:42a ..S.R 417,792 408.00 K
rknd.dll Fri Jul 15 2005 9:25:02a ..S.R 417,792 408.00 K
rmoc3260.dll Fri May 20 2005 10:08:02p A.... 176,167 172.04 K
ror20.dll Mon Jul 11 2005 11:32:02a ..S.R 417,792 408.00 K
rrnd.dll Wed Jul 20 2005 9:15:52a ..S.R 417,792 408.00 K
rvvpmsg.dll Mon Jul 11 2005 11:32:10a ..S.R 417,792 408.00 K
rzsdlg.dll Wed Jul 20 2005 9:15:44a ..S.R 417,792 408.00 K
sblwid.dll Fri Jul 15 2005 1:25:22p ..S.R 417,792 408.00 K
sbmpsnap.dll Sat Jul 16 2005 3:22:32p ..S.R 417,792 408.00 K
sharddlg.dll Sat Jul 9 2005 10:52:46a ..S.R 417,792 408.00 K
sjoolss.dll Fri Jul 15 2005 1:25:28p ..S.R 417,792 408.00 K
skfrdm.dll Mon Jul 18 2005 7:14:36p ..S.R 417,792 408.00 K
sncsccp.dll Tue Jul 19 2005 3:19:36p ..S.R 417,792 408.00 K
spreamci.dll Tue Jul 19 2005 10:25:42a ..S.R 417,792 408.00 K
ssgnb.dll Mon Jul 18 2005 7:14:32p ..S.R 417,792 408.00 K
sss.dll Wed Jul 20 2005 3:01:38a ..S.R 417,792 408.00 K
suoolss.dll Sat Jul 16 2005 3:22:28p ..S.R 417,792 408.00 K
svell.dll Tue Jul 19 2005 3:19:40p ..S.R 417,792 408.00 K
svlsrv32.dll Tue Jul 19 2005 10:25:36a ..S.R 417,792 408.00 K
tkpmon.dll Wed Jul 20 2005 3:01:44a ..S.R 417,792 408.00 K
tld32.dll Mon Jul 18 2005 1:51:28a ..S.R 417,792 408.00 K
tlpi3.dll Fri Jul 15 2005 9:26:26p ..S.R 417,792 408.00 K
ttext.dll Mon Jul 18 2005 1:51:32a ..S.R 417,792 408.00 K
ubandlg.dll Thu Jul 14 2005 11:13:42p ..S.R 417,792 408.00 K
udrsdpia.dll Fri Jul 15 2005 8:12:14a ..S.R 417,792 408.00 K
ulrv80a.dll Mon Jul 18 2005 8:21:40p ..S.R 417,792 408.00 K
unrsdpia.dll Fri Jul 15 2005 4:13:16p ..S.R 417,792 408.00 K
uonp.dll Fri Jul 15 2005 8:12:02a ..S.R 417,792 408.00 K
utiime.dll Thu Jul 14 2005 11:13:38p ..S.R 417,792 408.00 K
uxandlg.dll Fri Jul 15 2005 4:13:22p ..S.R 417,792 408.00 K
vdsapi.dll Sun Jul 17 2005 6:07:34p ..S.R 417,792 408.00 K
vlsapi.dll Sun Jul 17 2005 6:07:28p ..S.R 417,792 408.00 K
voipxspx.dll Tue Jul 19 2005 8:31:58p ..S.R 417,792 408.00 K
vtscript.dll Mon Jul 18 2005 8:21:44p ..S.R 417,792 408.00 K
waasf.dll Tue Jul 19 2005 8:32:18p ..S.R 417,792 408.00 K
wciscmgr.dll Thu Jul 21 2005 7:18:40p ..S.R 417,792 408.00 K
wdiprop.dll Thu Jul 21 2005 7:18:36p ..S.R 417,792 408.00 K
wgascr.dll Sun Jun 26 2005 9:09:10p ..... 417,792 408.00 K
wk2_32.dll Mon Aug 8 2005 9:16:18a ..S.R 417,792 408.00 K
wlbhits.dll Mon Jul 18 2005 3:08:28a ..S.R 417,792 408.00 K
wlntrust.dll Thu Jul 14 2005 4:13:36p ..S.R 417,792 408.00 K
ws2time.dll Mon Jul 18 2005 3:08:32a ..S.R 417,792 408.00 K
wtfeman.dll Thu Jul 14 2005 4:13:40p ..S.R 417,792 408.00 K
wuapi.dll Thu May 26 2005 4:16:30a A.... 465,176 454.27 K
wuaueng.dll Thu May 26 2005 4:16:30a A.... 1,343,768 1.28 M
wuaueng1.dll Thu May 26 2005 4:16:30a A.... 194,328 189.77 K
wucltui.dll Thu May 26 2005 4:16:30a A.... 127,256 124.27 K
wups.dll Thu May 26 2005 4:16:30a A.... 41,240 40.27 K
wups2.dll Thu May 26 2005 4:16:30a A.... 18,200 17.77 K
wuweb.dll Thu May 26 2005 4:16:30a A.... 173,536 169.47 K
wydmlog.dll Sun Jul 17 2005 2:40:24a ..S.R 417,792 408.00 K
xgctsrv.dll Tue Jul 19 2005 6:26:38a ..S.R 417,792 408.00 K
xhlprov.dll Tue Jul 19 2005 6:26:34a ..S.R 417,792 408.00 K
xpsp3res.dll Mon May 16 2005 8:25:36p ..... 15,360 15.00 K
xqsp3res.dll Sun Jul 17 2005 2:40:28a ..S.R 417,792 408.00 K
xulprov.dll Sun Jun 26 2005 8:34:34p ..S.R 417,792 408.00 K

263 items found: 263 files (237 H/S), 0 directories.
Total of file sizes: 104,810,831 bytes 99.95 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Wed Jun 22 2005 11:16:46p ..S.R 417,792 408.00 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 417,792 bytes 408.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is B87D-D1F1

Directory of C:\WINDOWS\System32

08/08/2005 09:16 AM 417,792 wk2_32.dll
08/06/2005 03:31 PM <DIR> dllcache
07/22/2005 11:42 AM 417,792 mxc42.dll
07/22/2005 01:56 AM 417,792 mqexch40.dll
07/22/2005 01:56 AM 417,792 mihtmled.dll
07/22/2005 12:43 AM 417,792 rkched32.dll
07/22/2005 12:43 AM 417,792 ragsvc.dll
07/21/2005 11:28 PM 417,792 ptdgen.dll
07/21/2005 11:28 PM 417,792 olbc16gt.dll
07/21/2005 10:07 PM 417,792 crnsole.dll
07/21/2005 10:06 PM 417,792 clfgnt.dll
07/21/2005 07:18 PM 417,792 wciscmgr.dll
07/21/2005 07:18 PM 417,792 wdiprop.dll
07/21/2005 06:14 PM 417,792 ewentcls.dll
07/21/2005 06:14 PM 417,792 eocapi.dll
07/21/2005 04:45 PM 417,792 psotowiz.dll
07/21/2005 04:45 PM 417,792 pkrfts.dll
07/21/2005 02:19 PM 417,792 idssuba.dll
07/21/2005 10:00 AM 401,408 r?gsvr32.exe
07/21/2005 09:55 AM 401,408 ??ool32.exe
07/21/2005 01:24 AM 417,792 libar12n.dll
07/21/2005 01:24 AM 417,792 lyrhelp.dll
07/21/2005 12:23 AM 417,792 lrpsd10N.dll
07/21/2005 12:23 AM 417,792 lhpsd10N.dll
07/20/2005 10:58 PM 417,792 CJDBControlRoxio.dll
07/20/2005 10:58 PM 417,792 cZmocx.dll
07/20/2005 09:36 PM 417,792 mNpistub.dll
07/20/2005 09:36 PM 417,792 mfimg32.dll
07/20/2005 08:31 PM 417,792 mcoa.dll
07/20/2005 08:31 PM 417,792 mucertui.dll
07/20/2005 07:02 PM 417,792 doband.dll
07/20/2005 07:02 PM 417,792 deconfig.dll
07/20/2005 05:59 PM 417,792 lbcalsec.dll
07/20/2005 05:59 PM 417,792 ltrt.dll
07/20/2005 04:33 PM 417,792 lcXbm12n.dll
07/20/2005 04:33 PM 417,792 lscmgr10.dll
07/20/2005 03:20 PM 417,792 mUpistub.dll
07/20/2005 03:20 PM 417,792 LFWND10N.DLL
07/20/2005 02:09 PM 417,792 PhpOops2.dll_tobedeleted
07/20/2005 02:09 PM 417,792 ppdgen.dll
07/20/2005 12:54 PM 417,792 dYd8.dll
07/20/2005 12:54 PM 417,792 coedui.dll
07/20/2005 11:52 AM 417,792 lkas2kpm.dll
07/20/2005 11:52 AM 417,792 lawrp10n.dll
07/20/2005 10:27 AM 417,792 ndprint.dll
07/20/2005 10:27 AM 417,792 nlprint.dll
07/20/2005 09:15 AM 417,792 rrnd.dll
07/20/2005 09:15 AM 417,792 rZsdlg.dll
07/20/2005 06:59 AM 417,792 mrwebdvd.dll
07/20/2005 06:59 AM 417,792 mjdxmlc.dll
07/20/2005 05:34 AM 417,792 cempstui.dll
07/20/2005 05:34 AM 417,792 cxutil.dll
07/20/2005 04:25 AM 417,792 kadbene.dll
07/20/2005 04:25 AM 417,792 ksdbene.dll
07/20/2005 03:01 AM 417,792 tkpmon.dll
07/20/2005 03:01 AM 417,792 sss.dll
07/20/2005 01:36 AM 417,792 dxnetlib.dll
07/20/2005 01:36 AM 417,792 dfghelp.dll
07/20/2005 12:10 AM 417,792 lwmac12n.dll
07/20/2005 12:10 AM 417,792 lwiff12n.dll
07/19/2005 11:01 PM 417,792 ojeaccrc.dll
07/19/2005 11:01 PM 417,792 oupdx32.dll
07/19/2005 09:54 PM 417,792 kvdtuf.dll
07/19/2005 09:54 PM 417,792 ksdlv.dll
07/19/2005 08:32 PM 417,792 waasf.dll
07/19/2005 08:31 PM 417,792 voipxspx.dll
07/19/2005 07:10 PM 417,792 nvlanui2.dll
07/19/2005 07:09 PM 417,792 mcdtctm.dll
07/19/2005 06:05 PM 417,792 mlpbde40.dll
07/19/2005 06:05 PM 417,792 mdratelc.dll
07/19/2005 04:36 PM 417,792 lxtif10N.dll
07/19/2005 04:36 PM 417,792 LNPNM12n.dll
07/19/2005 03:19 PM 417,792 svell.dll
07/19/2005 03:19 PM 417,792 sncsccp.dll
07/19/2005 02:10 PM 417,792 dRdrm.dll
07/19/2005 02:10 PM 417,792 dJdpmesh.dll
07/19/2005 12:46 PM 417,792 myrddm.dll
07/19/2005 12:46 PM 417,792 mbdrv.dll
07/19/2005 11:41 AM 417,792 lpdlg10N.dll
07/19/2005 11:41 AM 417,792 lqdlg12n.dll
07/19/2005 10:25 AM 417,792 spreamci.dll
07/19/2005 10:25 AM 417,792 svlsrv32.dll
07/19/2005 08:59 AM 417,792 disenh.dll
07/19/2005 08:59 AM 417,792 dlvacm.dll
07/19/2005 07:50 AM 417,792 lxpcd12n.dll
07/19/2005 07:50 AM 417,792 lplmb10N.dll
07/19/2005 06:26 AM 417,792 xGctsrv.dll
07/19/2005 06:26 AM 417,792 xhlprov.dll
07/19/2005 05:21 AM 417,792 qddwipes.dll
07/19/2005 05:21 AM 417,792 plftp32c.dll
07/19/2005 04:19 AM 417,792 dfcdll.dll
07/19/2005 04:19 AM 417,792 dynlobby.dll
07/19/2005 02:54 AM 417,792 ktdne.dll
07/19/2005 02:54 AM 417,792 kldmlt47.dll
07/19/2005 01:45 AM 417,792 moutil.dll
07/19/2005 01:45 AM 417,792 mhise.dll
07/19/2005 12:21 AM 417,792 EinClass.Dll
07/19/2005 12:21 AM 417,792 dotmsft.dll
07/18/2005 10:56 PM 417,792 kldgae.dll
07/18/2005 10:56 PM 417,792 cbfgnt.dll
07/18/2005 09:30 PM 417,792 qSsf.dll
07/18/2005 09:30 PM 417,792 PKBDLG.DLL
07/18/2005 08:21 PM 417,792 vtscript.dll
07/18/2005 08:21 PM 417,792 ulrv80a.dll
07/18/2005 07:14 PM 417,792 sKfrdm.dll
07/18/2005 07:14 PM 417,792 sSgnb.dll
07/18/2005 06:11 PM 417,792 opeacc.dll
07/18/2005 06:11 PM 417,792 oie2disp.dll
07/18/2005 04:56 PM 417,792 mrrecr40.dll
07/18/2005 04:56 PM 417,792 Mjstdfmt.dll
07/18/2005 03:54 PM 417,792 mdwsock.dll
07/18/2005 03:54 PM 417,792 mvwebdvd.dll
07/18/2005 02:29 PM 417,792 nqtplwiz.dll
07/18/2005 02:29 PM 417,792 nGrrhook.dll
07/18/2005 01:20 PM 417,792 kmdur.dll
07/18/2005 01:20 PM 417,792 kcdtuq.dll
07/18/2005 11:56 AM 417,792 mlvidc32.dll
07/18/2005 11:56 AM 417,792 mmastmib.dll
07/18/2005 10:48 AM 417,792 lYprxy.dll
07/18/2005 10:48 AM 417,792 keiice.dll
07/18/2005 08:30 AM 417,792 FU20ENU.DLL
07/18/2005 08:30 AM 417,792 EfnClass.Dll
07/18/2005 07:28 AM 417,792 dedskmgr.dll
07/18/2005 07:28 AM 417,792 cfpbk32.dll
07/18/2005 06:03 AM 417,792 csmaddin.dll
07/18/2005 06:03 AM 417,792 ckusapi.dll
07/18/2005 04:37 AM 417,792 oje2disp.dll
07/18/2005 04:37 AM 417,792 orpdx32.dll
07/18/2005 03:08 AM 417,792 wS2time.dll
07/18/2005 03:08 AM 417,792 wlbhits.dll
07/18/2005 01:51 AM 417,792 ttext.dll
07/18/2005 01:51 AM 417,792 tld32.dll
07/18/2005 12:41 AM 417,792 psspl.dll
07/18/2005 12:41 AM 417,792 pkrfproc.dll
07/17/2005 09:52 PM 417,792 mr3216.dll
07/17/2005 09:52 PM 417,792 mxls31.dll
07/17/2005 08:26 PM 417,792 gxkcsp.dll
07/17/2005 08:26 PM 417,792 dvound.dll
07/17/2005 07:17 PM 417,792 dymsadsn.dll
07/17/2005 07:17 PM 417,792 cknnwsp.dll
07/17/2005 06:07 PM 417,792 vdsapi.dll
07/17/2005 06:07 PM 417,792 vlsapi.dll
07/17/2005 04:56 PM 417,792 mbimg32.dll
07/17/2005 04:56 PM 417,792 mthtmler.dll
07/17/2005 03:28 PM 417,792 aricap.dll
07/17/2005 03:28 PM 417,792 ahicap32.dll
07/17/2005 02:15 PM 417,792 Ljpct12n.dll
07/17/2005 02:15 PM 417,792 lbmsp10N.dll
07/17/2005 01:14 PM 417,792 mmvidc32.dll
07/17/2005 01:14 PM 417,792 mshcp.dll
07/17/2005 11:49 AM 417,792 ipaksie.dll
07/17/2005 11:49 AM 417,792 ifmp.dll
07/17/2005 10:23 AM 417,792 bjtsprx2.dll
07/17/2005 10:23 AM 417,792 botsprx3.dll
07/17/2005 07:48 AM 417,792 laras10N.dll
07/17/2005 07:48 AM 417,792 LQSCR12n.DLL
07/17/2005 05:08 AM 417,792 lmas2kpm.dll
07/17/2005 05:08 AM 417,792 ljdlg12n.dll
07/17/2005 02:40 AM 417,792 xqsp3res.dll
07/17/2005 02:40 AM 417,792 wydmlog.dll
07/17/2005 01:12 AM 417,792 mgrd2x40.dll
07/17/2005 01:12 AM 417,792 mooert2.dll
07/16/2005 11:56 PM 417,792 mcvidc32.dll
07/16/2005 11:56 PM 417,792 lvisi12n.dll
07/16/2005 10:30 PM 417,792 kxdfr.dll
07/16/2005 10:30 PM 417,792 kaddv.dll
07/16/2005 09:21 PM 417,792 cctdll.dll
07/16/2005 09:21 PM 417,792 cvvfat.dll
07/16/2005 07:57 PM 417,792 icetppui.dll
07/16/2005 07:57 PM 417,792 ivitpki.dll
07/16/2005 06:52 PM 417,792 mwjtes40.dll
07/16/2005 06:52 PM 417,792 mudxmlc.dll
07/16/2005 05:50 PM 417,792 itaapi.dll
07/16/2005 05:50 PM 417,792 ggtuname.dll
07/16/2005 04:42 PM 417,792 movidctl.dll
07/16/2005 04:42 PM 417,792 mmtext40.dll
07/16/2005 03:22 PM 417,792 sbmpsnap.dll
07/16/2005 03:22 PM 417,792 suoolss.dll
07/16/2005 02:05 PM 417,792 aci2cqag.dll
07/16/2005 02:05 PM 417,792 axcups.dll
07/16/2005 12:55 PM 417,792 muidntld.dll
07/16/2005 12:55 PM 417,792 mmgsvc.dll
07/16/2005 10:06 AM 417,792 kedkor.dll
07/16/2005 10:06 AM 417,792 khdhe.dll
07/16/2005 08:40 AM 417,792 LSEEI.DLL
07/16/2005 08:40 AM 417,792 kadycc.dll
07/16/2005 07:14 AM 417,792 pHp.dll
07/16/2005 07:14 AM 417,792 ohesvr.dll
07/16/2005 05:44 AM 417,792 fesrch.dll
07/16/2005 05:44 AM 417,792 cmfview.dll
07/16/2005 03:20 AM 417,792 lvras10N.dll
07/16/2005 03:20 AM 417,792 lotif10N.dll
07/16/2005 02:15 AM 417,792 mggsvc.dll
07/16/2005 02:15 AM 417,792 mgexcl40.dll
07/16/2005 12:59 AM 417,792 almfd.dll
07/16/2005 12:59 AM 417,792 adifil32.dll
07/15/2005 11:53 PM 417,792 aothz.dll
07/15/2005 11:53 PM 417,792 attodisc.dll
07/15/2005 10:51 PM 417,792 mkisip.dll
07/15/2005 10:51 PM 417,792 mfexch40.dll
07/15/2005 09:26 PM 417,792 tLpi3.dll
07/15/2005 09:26 PM 417,792 mtdtctm.dll
07/15/2005 08:17 PM 417,792 loeps10N.dll
07/15/2005 08:17 PM 417,792 loCUT12n.dll
07/15/2005 05:31 PM 417,792 mils31.dll
07/15/2005 05:31 PM 417,792 myimsg.dll
07/15/2005 04:13 PM 417,792 uxandlg.dll
07/15/2005 04:13 PM 417,792 unrsdpia.dll
07/15/2005 02:43 PM 417,792 mml_hp.dll
07/15/2005 02:43 PM 417,792 mhc42.dll
07/15/2005 01:25 PM 417,792 sjoolss.dll
07/15/2005 01:25 PM 417,792 sblwid.dll
07/15/2005 12:01 PM 417,792 FT20ENU.DLL
07/15/2005 12:01 PM 417,792 ebs.dll
07/15/2005 10:36 AM 417,792 mrxmlr.dll
07/15/2005 10:36 AM 417,792 mpw3prt.dll
07/15/2005 09:25 AM 417,792 rknd.dll
07/15/2005 09:24 AM 417,792 oueacc.dll
07/15/2005 08:12 AM 417,792 udrsdpia.dll
07/15/2005 08:12 AM 417,792 uonp.dll
07/15/2005 03:13 AM 417,792 nb4_disp.dll
07/15/2005 03:13 AM 417,792 nbmsapi.dll
07/15/2005 01:48 AM 417,792 dyvenum.dll
07/15/2005 01:48 AM 417,792 drdlgs.dll
07/15/2005 12:22 AM 417,792 dfdlgs.dll
07/15/2005 12:22 AM 417,792 dxactfrm.dll
07/14/2005 11:13 PM 417,792 ubandlg.dll
07/14/2005 11:13 PM 417,792 utiime.dll
07/14/2005 04:13 PM 417,792 wtfeman.dll
07/14/2005 04:13 PM 417,792 wlntrust.dll
07/14/2005 02:49 PM 417,792 mfvcrt.dll
07/14/2005 02:49 PM 417,792 mfvidc32.dll
07/14/2005 01:27 PM 417,792 dqghelp.dll
07/14/2005 01:27 PM 417,792 dGdim.dll
07/11/2005 11:32 AM 417,792 rvvpmsg.dll
07/11/2005 11:32 AM 417,792 ror20.dll
07/09/2005 10:52 AM 417,792 sharddlg.dll
06/26/2005 08:34 PM 417,792 xulprov.dll
06/26/2005 08:31 PM 417,792 mnjter40.dll
06/22/2005 11:16 PM 417,792 guard.tmp
06/20/2005 03:34 AM 417,792 miidle.dll
05/04/2005 05:18 PM <DIR> Microsoft
240 File(s) 100,237,312 bytes
2 Dir(s) 842,461,184 bytes free

[greyknight17]

Not sure if you are still running L2MFix or not, but I'm waiting for the option #2 log now

Also, don't forget to post the HijackThis log when you are ready. I will take a look at all these logs.

[DocDoom5]

L2Mfix 1.03a

Running From:
C:\Stuff\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Stuff\l2mfix
System Rebooted!

Running From:
C:\Stuff\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1528 'explorer.exe'
Killing PID 1528 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1608 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\lgfil12n.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lgfil12n.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mxc42.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mxc42.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\njwmsdrm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\njwmsdrm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\lgfil12n.DLL
Successfully Deleted: C:\WINDOWS\system32\lgfil12n.DLL
deleting: C:\WINDOWS\system32\lgfil12n.DLL
Successfully Deleted: C:\WINDOWS\system32\lgfil12n.DLL
deleting: C:\WINDOWS\system32\mxc42.dll
Successfully Deleted: C:\WINDOWS\system32\mxc42.dll
deleting: C:\WINDOWS\system32\mxc42.dll
Successfully Deleted: C:\WINDOWS\system32\mxc42.dll
deleting: C:\WINDOWS\system32\njwmsdrm.dll
Successfully Deleted: C:\WINDOWS\system32\njwmsdrm.dll
deleting: C:\WINDOWS\system32\njwmsdrm.dll
Successfully Deleted: C:\WINDOWS\system32\njwmsdrm.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp


Zipping up files for submission:
adding: lgfil12n.DLL (188 bytes security) (deflated 48%)
adding: mxc42.dll (188 bytes security) (deflated 48%)
adding: njwmsdrm.dll (188 bytes security) (deflated 48%)
adding: guard.tmp (188 bytes security) (deflated 48%)
adding: clear.reg (188 bytes security) (deflated 46%)
adding: echo.reg (188 bytes security) (deflated 6%)
adding: direct.txt (188 bytes security) (stored 0%)
adding: lo2.txt (188 bytes security) (deflated 80%)
adding: readme.txt (188 bytes security) (deflated 49%)
adding: report.txt (188 bytes security) (deflated 65%)
adding: test.txt (188 bytes security) (deflated 77%)
adding: test2.txt (188 bytes security) (deflated 27%)
adding: test3.txt (188 bytes security) (deflated 27%)
adding: test5.txt (188 bytes security) (deflated 27%)
adding: xfind.txt (188 bytes security) (deflated 73%)
adding: backregs/0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F.reg (188 bytes security) (deflated 70%)
adding: backregs/F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35.reg (188 bytes security) (deflated 70%)
adding: backregs/shell.reg (188 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: lgfil12n.DLL
deleting local copy: lgfil12n.DLL
deleting local copy: mxc42.dll
deleting local copy: mxc42.dll
deleting local copy: njwmsdrm.dll
deleting local copy: njwmsdrm.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\lgfil12n.DLL
C:\WINDOWS\system32\lgfil12n.DLL
C:\WINDOWS\system32\mxc42.dll
C:\WINDOWS\system32\mxc42.dll
C:\WINDOWS\system32\njwmsdrm.dll
C:\WINDOWS\system32\njwmsdrm.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35}"=-
"{0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F}"=-
"{FE40A4D3-165B-4560-A989-C5A0CA285542}"=-
[-HKEY_CLASSES_ROOT\CLSID\{F2D9484E-96AF-4A33-B32A-7F9ED1CA9A35}]
[-HKEY_CLASSES_ROOT\CLSID\{0D6FEA6B-D67A-4E24-A1D0-4535101EFA4F}]
[-HKEY_CLASSES_ROOT\CLSID\{FE40A4D3-165B-4560-A989-C5A0CA285542}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************


Also here is the new HJT log.

Logfile of HijackThis v1.99.1
Scan saved at 12:05:19 PM, on 8/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Utopia\Angel\Angel.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Utopia Angel] "C:\Utopia\Angel\Angel.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

[greyknight17]

Arrggg, it didn't remove the others

Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Copy the below files (just use your mouse and highlight - then right click Copy) and go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say no:

c:\windows\system32\dllcache\aci2cqag.dll
c:\windows\system32\dllcache\adifil32.dll
c:\windows\system32\dllcache\ahicap32.dll
c:\windows\system32\dllcache\almfd.dll
c:\windows\system32\dllcache\aothz.dll
c:\windows\system32\dllcache\aricap.dll
c:\windows\system32\dllcache\attodisc.dll
c:\windows\system32\dllcache\axcups.dll
c:\windows\system32\dllcache\bjtsprx2.dll
c:\windows\system32\dllcache\botsprx3.dll
c:\windows\system32\dllcache\cbfgnt.dll
c:\windows\system32\dllcache\cctdll.dll
c:\windows\system32\dllcache\cempstui.dll
c:\windows\system32\dllcache\cfpbk32.dll
c:\windows\system32\dllcache\CJDBControlRoxio.dll
c:\windows\system32\dllcache\cknnwsp.dll
c:\windows\system32\dllcache\ckusapi.dll
c:\windows\system32\dllcache\clfgnt.dll
c:\windows\system32\dllcache\cmfview.dll
c:\windows\system32\dllcache\coedui.dll
c:\windows\system32\dllcache\crnsole.dll
c:\windows\system32\dllcache\csmaddin.dll
c:\windows\system32\dllcache\cvvfat.dll
c:\windows\system32\dllcache\cxutil.dll
c:\windows\system32\dllcache\cZmocx.dll
c:\windows\system32\dllcache\deconfig.dll
c:\windows\system32\dllcache\dedskmgr.dll
c:\windows\system32\dllcache\dfcdll.dll
c:\windows\system32\dllcache\dfdlgs.dll
c:\windows\system32\dllcache\dfghelp.dll
c:\windows\system32\dllcache\dGdim.dll
c:\windows\system32\dllcache\disenh.dll
c:\windows\system32\dllcache\dJdpmesh.dll
c:\windows\system32\dllcache\dllcache
c:\windows\system32\dllcache\dlvacm.dll
c:\windows\system32\dllcache\doband.dll
c:\windows\system32\dllcache\dotmsft.dll
c:\windows\system32\dllcache\dqghelp.dll
c:\windows\system32\dllcache\drdlgs.dll
c:\windows\system32\dllcache\dRdrm.dll
c:\windows\system32\dllcache\dvound.dll
c:\windows\system32\dllcache\dxactfrm.dll
c:\windows\system32\dllcache\dxnetlib.dll
c:\windows\system32\dllcache\dYd8.dll
c:\windows\system32\dllcache\dymsadsn.dll
c:\windows\system32\dllcache\dynlobby.dll
c:\windows\system32\dllcache\dyvenum.dll
c:\windows\system32\dllcache\ebs.dll
c:\windows\system32\dllcache\EfnClass.Dll
c:\windows\system32\dllcache\EinClass.Dll
c:\windows\system32\dllcache\eocapi.dll
c:\windows\system32\dllcache\ewentcls.dll
c:\windows\system32\dllcache\fesrch.dll
c:\windows\system32\dllcache\FT20ENU.DLL
c:\windows\system32\dllcache\FU20ENU.DLL
c:\windows\system32\dllcache\ggtuname.dll
c:\windows\system32\dllcache\guard.tmp
c:\windows\system32\dllcache\gxkcsp.dll
c:\windows\system32\dllcache\icetppui.dll
c:\windows\system32\dllcache\idssuba.dll
c:\windows\system32\dllcache\ifmp.dll
c:\windows\system32\dllcache\ipaksie.dll
c:\windows\system32\dllcache\itaapi.dll
c:\windows\system32\dllcache\ivitpki.dll
c:\windows\system32\dllcache\kadbene.dll
c:\windows\system32\dllcache\kaddv.dll
c:\windows\system32\dllcache\kadycc.dll
c:\windows\system32\dllcache\kcdtuq.dll
c:\windows\system32\dllcache\kedkor.dll
c:\windows\system32\dllcache\keiice.dll
c:\windows\system32\dllcache\khdhe.dll
c:\windows\system32\dllcache\kldgae.dll
c:\windows\system32\dllcache\kldmlt47.dll
c:\windows\system32\dllcache\kmdur.dll
c:\windows\system32\dllcache\ksdbene.dll
c:\windows\system32\dllcache\ksdlv.dll
c:\windows\system32\dllcache\ktdne.dll
c:\windows\system32\dllcache\kvdtuf.dll
c:\windows\system32\dllcache\kxdfr.dll
c:\windows\system32\dllcache\laras10N.dll
c:\windows\system32\dllcache\lawrp10n.dll
c:\windows\system32\dllcache\lbcalsec.dll
c:\windows\system32\dllcache\lbmsp10N.dll
c:\windows\system32\dllcache\lcXbm12n.dll
c:\windows\system32\dllcache\LFWND10N.DLL
c:\windows\system32\dllcache\lhpsd10N.dll
c:\windows\system32\dllcache\libar12n.dll
c:\windows\system32\dllcache\ljdlg12n.dll
c:\windows\system32\dllcache\Ljpct12n.dll
c:\windows\system32\dllcache\lkas2kpm.dll
c:\windows\system32\dllcache\lmas2kpm.dll
c:\windows\system32\dllcache\LNPNM12n.dll
c:\windows\system32\dllcache\loCUT12n.dll
c:\windows\system32\dllcache\loeps10N.dll
c:\windows\system32\dllcache\lotif10N.dll
c:\windows\system32\dllcache\lpdlg10N.dll
c:\windows\system32\dllcache\lplmb10N.dll
c:\windows\system32\dllcache\lqdlg12n.dll
c:\windows\system32\dllcache\LQSCR12n.DLL
c:\windows\system32\dllcache\lrpsd10N.dll
c:\windows\system32\dllcache\lscmgr10.dll
c:\windows\system32\dllcache\LSEEI.DLL
c:\windows\system32\dllcache\ltrt.dll
c:\windows\system32\dllcache\lvisi12n.dll
c:\windows\system32\dllcache\lvras10N.dll
c:\windows\system32\dllcache\lwiff12n.dll
c:\windows\system32\dllcache\lwmac12n.dll
c:\windows\system32\dllcache\lxpcd12n.dll
c:\windows\system32\dllcache\lxtif10N.dll
c:\windows\system32\dllcache\lYprxy.dll
c:\windows\system32\dllcache\lyrhelp.dll
c:\windows\system32\dllcache\mbdrv.dll
c:\windows\system32\dllcache\mbimg32.dll
c:\windows\system32\dllcache\mcdtctm.dll
c:\windows\system32\dllcache\mcoa.dll
c:\windows\system32\dllcache\mcvidc32.dll
c:\windows\system32\dllcache\mdratelc.dll
c:\windows\system32\dllcache\mdwsock.dll
c:\windows\system32\dllcache\mfexch40.dll
c:\windows\system32\dllcache\mfimg32.dll
c:\windows\system32\dllcache\mfvcrt.dll
c:\windows\system32\dllcache\mfvidc32.dll
c:\windows\system32\dllcache\mgexcl40.dll
c:\windows\system32\dllcache\mggsvc.dll
c:\windows\system32\dllcache\mgrd2x40.dll
c:\windows\system32\dllcache\mhc42.dll
c:\windows\system32\dllcache\mhise.dll
c:\windows\system32\dllcache\mihtmled.dll
c:\windows\system32\dllcache\miidle.dll
c:\windows\system32\dllcache\mils31.dll
c:\windows\system32\dllcache\mjdxmlc.dll
c:\windows\system32\dllcache\Mjstdfmt.dll
c:\windows\system32\dllcache\mkisip.dll
c:\windows\system32\dllcache\mlpbde40.dll
c:\windows\system32\dllcache\mlvidc32.dll
c:\windows\system32\dllcache\mmastmib.dll
c:\windows\system32\dllcache\mmgsvc.dll
c:\windows\system32\dllcache\mml_hp.dll
c:\windows\system32\dllcache\mmtext40.dll
c:\windows\system32\dllcache\mmvidc32.dll
c:\windows\system32\dllcache\mnjter40.dll
c:\windows\system32\dllcache\mNpistub.dll
c:\windows\system32\dllcache\mooert2.dll
c:\windows\system32\dllcache\moutil.dll
c:\windows\system32\dllcache\movidctl.dll
c:\windows\system32\dllcache\mpw3prt.dll
c:\windows\system32\dllcache\mqexch40.dll
c:\windows\system32\dllcache\mr3216.dll
c:\windows\system32\dllcache\mrrecr40.dll
c:\windows\system32\dllcache\mrwebdvd.dll
c:\windows\system32\dllcache\mrxmlr.dll
c:\windows\system32\dllcache\mshcp.dll
c:\windows\system32\dllcache\mtdtctm.dll
c:\windows\system32\dllcache\mthtmler.dll
c:\windows\system32\dllcache\mucertui.dll
c:\windows\system32\dllcache\mudxmlc.dll
c:\windows\system32\dllcache\muidntld.dll
c:\windows\system32\dllcache\mUpistub.dll
c:\windows\system32\dllcache\mvwebdvd.dll
c:\windows\system32\dllcache\mwjtes40.dll
c:\windows\system32\dllcache\mxc42.dll
c:\windows\system32\dllcache\mxls31.dll
c:\windows\system32\dllcache\myimsg.dll
c:\windows\system32\dllcache\myrddm.dll
c:\windows\system32\dllcache\nb4_disp.dll
c:\windows\system32\dllcache\nbmsapi.dll
c:\windows\system32\dllcache\ndprint.dll
c:\windows\system32\dllcache\nGrrhook.dll
c:\windows\system32\dllcache\nlprint.dll
c:\windows\system32\dllcache\nqtplwiz.dll
c:\windows\system32\dllcache\nvlanui2.dll
c:\windows\system32\dllcache\ohesvr.dll
c:\windows\system32\dllcache\oie2disp.dll
c:\windows\system32\dllcache\oje2disp.dll
c:\windows\system32\dllcache\ojeaccrc.dll
c:\windows\system32\dllcache\olbc16gt.dll
c:\windows\system32\dllcache\opeacc.dll
c:\windows\system32\dllcache\orpdx32.dll
c:\windows\system32\dllcache\oueacc.dll
c:\windows\system32\dllcache\oupdx32.dll
c:\windows\system32\dllcache\pHp.dll
c:\windows\system32\dllcache\PhpOops2.dll_tobedeleted
c:\windows\system32\dllcache\PKBDLG.DLL
c:\windows\system32\dllcache\pkrfproc.dll
c:\windows\system32\dllcache\pkrfts.dll
c:\windows\system32\dllcache\plftp32c.dll
c:\windows\system32\dllcache\ppdgen.dll
c:\windows\system32\dllcache\psotowiz.dll
c:\windows\system32\dllcache\psspl.dll
c:\windows\system32\dllcache\ptdgen.dll
c:\windows\system32\dllcache\qddwipes.dll
c:\windows\system32\dllcache\qSsf.dll
c:\windows\system32\dllcache\ragsvc.dll
c:\windows\system32\dllcache\rkched32.dll
c:\windows\system32\dllcache\rknd.dll
c:\windows\system32\dllcache\ror20.dll
c:\windows\system32\dllcache\rrnd.dll
c:\windows\system32\dllcache\rvvpmsg.dll
c:\windows\system32\dllcache\rZsdlg.dll
c:\windows\system32\dllcache\sblwid.dll
c:\windows\system32\dllcache\sbmpsnap.dll
c:\windows\system32\dllcache\sharddlg.dll
c:\windows\system32\dllcache\sjoolss.dll
c:\windows\system32\dllcache\sKfrdm.dll
c:\windows\system32\dllcache\sncsccp.dll
c:\windows\system32\dllcache\spreamci.dll
c:\windows\system32\dllcache\sSgnb.dll
c:\windows\system32\dllcache\sss.dll
c:\windows\system32\dllcache\suoolss.dll
c:\windows\system32\dllcache\svell.dll
c:\windows\system32\dllcache\svlsrv32.dll
c:\windows\system32\dllcache\tkpmon.dll
c:\windows\system32\dllcache\tld32.dll
c:\windows\system32\dllcache\tLpi3.dll
c:\windows\system32\dllcache\ttext.dll
c:\windows\system32\dllcache\ubandlg.dll
c:\windows\system32\dllcache\udrsdpia.dll
c:\windows\system32\dllcache\ulrv80a.dll
c:\windows\system32\dllcache\unrsdpia.dll
c:\windows\system32\dllcache\uonp.dll
c:\windows\system32\dllcache\utiime.dll
c:\windows\system32\dllcache\uxandlg.dll
c:\windows\system32\dllcache\vdsapi.dll
c:\windows\system32\dllcache\vlsapi.dll
c:\windows\system32\dllcache\voipxspx.dll
c:\windows\system32\dllcache\vtscript.dll
c:\windows\system32\dllcache\waasf.dll
c:\windows\system32\dllcache\wciscmgr.dll
c:\windows\system32\dllcache\wdiprop.dll
c:\windows\system32\dllcache\wlbhits.dll
c:\windows\system32\dllcache\wlntrust.dll
c:\windows\system32\dllcache\wS2time.dll
c:\windows\system32\dllcache\wtfeman.dll
c:\windows\system32\dllcache\wydmlog.dll
c:\windows\system32\dllcache\xGctsrv.dll
c:\windows\system32\dllcache\xhlprov.dll
c:\windows\system32\dllcache\xqsp3res.dll
c:\windows\system32\dllcache\xulprov.dll
c:\windows\system32\wk2_32.dll

For these two, I want you to upload them to http://virusscan.jotti.org and report back what it found.

c:\windows\system32\??ool32.exe
c:\windows\system32\r?gsvr32.exe

Restart and run L2MFix - use option #1 and post that log here along with a new HijackThis log.

[DocDoom5]

Killbox is not allowing me to Paste from the Clipboard. It gives me a file error, and states that "You have not specified any file to delete. You must specify a file path in the yellow box." It will allow me to paste 1 path at a time, but not the whole list. What do you want me to do now?


Also for the Two paths at the bottom you wanted me to post to Jotti, this was the reply from Jotti for both paths...

"The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file"

Edited by DocDoom5, 13 August 2005 - 02:06 AM.

[greyknight17]

OK, I made a mistake on this one the other day. I actually just realized that after doing some other users log and tried to find my reply to your topic....gave up

I edited my reply now for KillBox. See those files in RED? Select those lines in red and copy it. Now try pasting from clipboard in killbox.

[DocDoom5]

Still will not allow me to paste the clipboard into the line to use. It keeps giving me the same answer. I can do single lines, but not all of them at once.

[greyknight17]

OK, I guess you may do them one line at a time then. Or if you wish, boot into Safe Mode and delete those files manually without KillBox if it's easier for you.

[greyknight17]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.