Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Having problems with WinFixer....my log attached. [CLOSED]


  • This topic is locked This topic is locked

#1
pghjezebel

pghjezebel

    New Member

  • Member
  • Pip
  • 7 posts
I keep getting popups for WinFixer, can someone take a look at my log file and help out??

Logfile of HijackThis v1.99.1
Scan saved at 1:28:12 PM, on 8/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\WinVNC.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Sync2It\Sync2It.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\mamasood\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Guardian Protection Services
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=gpsx-proxy;http=10.2.14.120:5555
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
;<local>
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Applications\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKCU\..\Run: [AIM] C:\Web\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [RssReader] C:\Program Files\RssReader\RssReader.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Startup: Sync2It.lnk = C:\Program Files\Sync2It\Sync2It.exe
O4 - Global Startup: Microsoft AntiSpyware.lnk = C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: WebTrends SmartView - {62D067DB-F0D6-4130-8D1A-BD990AC95CD7} - C:\Program Files\WebTrends On Demand SmartView\WTsvuOD.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Web\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0075546E-5D3D-11D2-A3E5-0060971304D8} (WTX_Installer Class) - http://www.webtrends...t/wtx_setup.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113400889484
O16 - DPF: {72C9EA8F-8965-40C2-ABAD-D460A5815F86} (hostCntrlIE Class) - https://vhost.oddcas...ostClientIE.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://sv.webtrends....dows-i586-p.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\ennml1511.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Virtual Network Computing (WinVNC) - Unknown owner - C:\Program Files\RealVNC\WinVNC.EXE" -service (file missing)


THANKS!!!

Edited by pghjezebel, 08 August 2005 - 11:36 AM.

  • 0

Advertisements


#2
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Welcome to GTG.

You didn't post the whole log. Where is the header information? We need that part.
  • 0

#3
pghjezebel

pghjezebel

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Sorry about that...I included it. Thanks.


Welcome to GTG.

You didn't post the whole log.  Where is the header information?  We need that part.

View Post


  • 0

#4
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Download L2MFix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts. Then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing Enter. This will scan your computer and it may appear nothing is happening. After a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 or any other files in the l2mfix folder until you are asked to do so!

Make sure you post the above log in the forum first before proceeding any further. After you posted that log, no need to wait for my reply. Immediately do the below and post those two logs as well:

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing Enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2MFix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new HijackThis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
  • 0

#5
pghjezebel

pghjezebel

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Control Panel]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\ennml1511.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{002B22FE-1CCE-9698-0F1C-054121D44C5B}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{6C961258-21EA-11D4-BD20-0050DA2ECD05}"="Gauss Repository"
"{CF56B9D2-0C3B-4F0A-8E26-4FD9199A5E39}"="MagNSContextMenu Class"
"{5CA3D70E-1895-11CF-8E15-001234567890}"="DriveLetterAccess"
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extension"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{0AC6C6C5-F7A8-11D2-BEF4-00C04F990001}"="Macromedia FTP & RDS"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="Web Folders"
"{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}"=""
"{1F465EA7-1861-453A-A6FA-7AC2C5B70653}"=""
"{8110DD47-807B-45D6-B588-3332BAA9BCD9}"=""
"{AB9B42A0-716A-4690-9997-AE0D972565AB}"=""
"{DEBDC93E-E0E9-4837-A510-8C2705AD7C68}"=""
"{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}"=""
"{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}"=""
"{7813B9D3-E446-484A-8F18-2E334209D45D}"=""
"{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}"=""
"{54105154-2BD1-4833-BA10-2CDCD59E2FFB}"=""
"{2F25CF20-C569-11D1-B94C-00608CB45480}"="TextPad"
"{709C6E11-538F-4759-86AC-6ACB302AA0DE}"="Desktop Manager"
@=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}\InprocServer32]
@="C:\\WINDOWS\\system32\\kxdmon.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}\InprocServer32]
@="C:\\WINDOWS\\system32\\ammxprox.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}\InprocServer32]
@="C:\\WINDOWS\\system32\\fcpsapi2.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}\InprocServer32]
@="C:\\WINDOWS\\system32\\mvl_hp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}\InprocServer32]
@="C:\\WINDOWS\\system32\\uqrcoina.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}\InprocServer32]
@="C:\\WINDOWS\\system32\\mwvcr71.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}\InprocServer32]
@="C:\\WINDOWS\\system32\\nowrsja.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
aewav.dll Sun Jun 19 2005 7:09:32p ..S.R 234,784 229.28 K
awmlib.dll Sun Jun 19 2005 7:09:28p ..S.R 234,784 229.28 K
cdm.dll Thu May 26 2005 4:16:24a A.... 75,544 73.77 K
chprops.dll Mon Jun 20 2005 4:19:12p ..S.R 233,690 228.21 K
cnl3d32.dll Tue Jun 21 2005 6:18:20p ..S.R 234,784 229.28 K
ctbcatq.dll Thu May 12 2005 6:55:26a ..S.R 234,272 228.78 K
cuodm.dll Thu May 12 2005 6:55:22a ..S.R 234,272 228.78 K
dfdim700.dll Tue Jun 21 2005 6:18:14p ..S.R 234,784 229.28 K
dpstyle.dll Tue May 10 2005 9:14:46p ..S.R 234,272 228.78 K
dxsrslvr.dll Tue May 10 2005 9:14:50p ..S.R 234,272 228.78 K
fcpsapi2.dll Mon Aug 8 2005 11:26:38a ..... 234,325 228.83 K
fwsrch.dll Thu May 12 2005 3:55:20a ..S.R 234,272 228.78 K
gwaraspi.dll Thu May 12 2005 3:55:24a ..S.R 234,272 228.78 K
hashlib.dll Tue Jul 12 2005 3:35:14p A.... 117,976 115.21 K
hhsetup.dll Thu May 26 2005 10:04:28p A.... 41,472 40.50 K
icm32.dll Tue Jun 28 2005 9:46:00p A.... 254,976 249.00 K
itircl.dll Thu May 26 2005 10:04:28p A.... 155,136 151.50 K
itss.dll Thu May 26 2005 10:04:28p A.... 137,216 134.00 K
iuengine.dll Thu May 26 2005 4:16:24a A.... 198,424 193.77 K
lmcwmi.dll Sat Jun 18 2005 6:22:26p ..S.R 234,784 229.28 K
lwfil60n.dll Sat Jun 18 2005 6:22:32p ..S.R 234,784 229.28 K
maxoci.dll Wed Jun 22 2005 2:13:16a ..S.R 234,784 229.28 K
mermsg.dll Sun Jun 19 2005 5:39:28a ..S.R 234,784 229.28 K
mjvideo.dll Fri Jun 17 2005 11:00:28p ..S.R 234,784 229.28 K
morle32.dll Wed May 11 2005 9:55:20p ..S.R 234,272 228.78 K
mortdep.dll Sun Jun 19 2005 5:39:32a ..S.R 234,784 229.28 K
mrxml2.dll Fri Jun 17 2005 11:00:32p ..S.R 234,784 229.28 K
mscms.dll Tue Jun 28 2005 9:46:00p A.... 74,240 72.50 K
msxlegih.dll Wed Jun 22 2005 2:13:20a ..S.R 234,784 229.28 K
mwstkprp.dll Wed May 11 2005 9:55:24p ..S.R 234,272 228.78 K
mydscli.dll Sun Jun 19 2005 5:56:28p ..S.R 234,784 229.28 K
mygentr.dll Sun Jun 19 2005 5:56:32p ..S.R 234,784 229.28 K
pwdrv.dll Thu Jun 23 2005 4:21:54p ..S.R 235,328 229.81 K
pwnppagn.dll Wed May 11 2005 1:55:20p ..S.R 235,069 229.56 K
qkvd.dll Tue Jul 26 2005 8:39:08a ..S.R 234,895 229.39 K
ropi.dll Thu May 12 2005 7:55:26a ..S.R 234,272 228.78 K
rtcss.dll Tue Jul 26 2005 8:39:40a ..S.R 233,248 227.78 K
setuid.dll Mon May 16 2005 4:09:04p A.... 64,512 63.00 K
sjcoinst.dll Thu May 12 2005 2:55:24a ..S.R 234,272 228.78 K
sjnike.dll Thu May 12 2005 2:55:20a ..S.R 234,272 228.78 K
smdpapi.dll Mon Jun 20 2005 7:55:34a ..S.R 234,784 229.28 K
stprv.dll Wed Jun 22 2005 8:50:18a ..S.R 234,784 229.28 K
tkpisrv.dll Tue Jun 21 2005 9:16:14a ..S.R 234,784 229.28 K
tupmib.dll Tue Jun 21 2005 9:16:20a ..S.R 234,784 229.28 K
wuapi.dll Thu May 26 2005 4:16:30a A.... 465,176 454.27 K
wuaueng.dll Thu May 26 2005 4:16:30a A.... 1,343,768 1.28 M
wuaueng1.dll Thu May 26 2005 4:16:30a A.... 194,328 189.77 K
wucltui.dll Thu May 26 2005 4:16:30a A.... 127,256 124.27 K
wups.dll Thu May 26 2005 4:16:30a A.... 41,240 40.27 K
wups2.dll Thu May 26 2005 4:16:30a A.... 18,200 17.77 K
wuweb.dll Thu May 26 2005 4:16:30a A.... 173,536 169.47 K
xnsp3res.dll Mon Jul 11 2005 10:54:12p ..S.R 234,784 229.28 K
xpsp3res.dll Mon May 16 2005 8:25:36p ..... 15,360 15.00 K

53 items found: 53 files (35 H/S), 0 directories.
Total of file sizes: 11,942,803 bytes 11.39 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Mon Aug 8 2005 11:27:38a ..S.R 234,325 228.83 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 234,325 bytes 228.83 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 1CA2-5962

Directory of C:\WINDOWS\System32

08/08/2005 11:27 AM 234,325 guard.tmp
08/08/2005 10:32 AM 234,325 h22o0cf3ef2.dll
08/08/2005 10:16 AM 234,325 ennml1511.dll
08/05/2005 11:47 AM 234,325 o0480ahued480.dll
08/04/2005 03:13 PM 233,248 g2jolc131f.dll
07/26/2005 05:51 PM <DIR> dllcache
07/26/2005 08:40 AM 0 lvl2093oe.dll
07/26/2005 08:39 AM 233,248 rtcss.dll
07/26/2005 08:39 AM 234,895 qkvd.dll
07/14/2005 11:29 AM 234,784 hrjo0513e.dll
07/14/2005 11:23 AM 234,895 j86mlij118o.dll
07/11/2005 10:54 PM 234,784 xnsp3res.dll
07/11/2005 08:25 AM 236,530 jtro0793e.dll
07/05/2005 11:44 AM 234,895 en42l1ho1.dll
06/29/2005 08:50 AM 235,019 jt4s07h7e.dll
06/27/2005 09:10 AM 235,469 ktrml7911.dll
06/23/2005 04:21 PM 235,328 pwdrv.dll
06/23/2005 04:21 PM 236,278 q0nu0a59ed.dll
06/22/2005 10:45 AM 234,784 n6r2lg9o16.dll
06/22/2005 09:05 AM 235,328 l44q0eh5eh4.dll
06/22/2005 08:50 AM 234,784 stprv.dll
06/22/2005 02:13 AM 234,784 msxlegih.dll
06/22/2005 02:13 AM 234,784 maxoci.dll
06/21/2005 06:18 PM 234,784 cnl3d32.dll
06/21/2005 06:18 PM 234,784 dFdim700.dll
06/21/2005 09:16 AM 234,784 tupmib.dll
06/21/2005 09:16 AM 234,784 tKpisrv.dll
06/20/2005 04:19 PM 233,690 chprops.dll
06/20/2005 04:17 PM 234,784 mv6ol9j31.dll
06/20/2005 07:55 AM 234,784 smdpapi.dll
06/19/2005 07:09 PM 234,784 aewav.dll
06/19/2005 07:09 PM 234,784 awmlib.dll
06/19/2005 05:56 PM 234,784 mygentr.dll
06/19/2005 05:56 PM 234,784 mydscli.dll
06/19/2005 05:39 AM 234,784 mortdep.dll
06/19/2005 05:39 AM 234,784 mermsg.dll
06/18/2005 06:22 PM 234,784 LWFIL60N.DLL
06/18/2005 06:22 PM 234,784 lmcwmi.dll
06/17/2005 11:00 PM 234,784 mrxml2.dll
06/17/2005 11:00 PM 234,784 mjvideo.dll
06/17/2005 08:31 AM 233,690 azau0g39e6.dll
06/14/2005 09:59 AM 233,690 dn0q01d5e.dll
06/10/2005 08:44 AM 233,690 k2260cfsef260.dll
06/06/2005 10:07 AM 233,690 mv6ul9j91.dll
05/20/2005 04:57 PM 233,690 ir44l5hq1.dll
05/20/2005 04:28 PM 233,651 j80s0id7e80.dll
05/12/2005 02:06 PM 236,075 lvr8099ue.dll
05/12/2005 07:55 AM 234,272 rOpi.dll
05/12/2005 06:55 AM 234,272 ctbcatq.dll
05/12/2005 06:55 AM 234,272 cuodm.dll
05/12/2005 03:55 AM 234,272 GWARAspi.dll
05/12/2005 03:55 AM 234,272 fwsrch.dll
05/12/2005 02:55 AM 234,272 sjcoinst.dll
05/12/2005 02:55 AM 234,272 sjnike.dll
05/11/2005 09:55 PM 234,272 mwstkprp.dll
05/11/2005 09:55 PM 234,272 morle32.dll
05/11/2005 01:55 PM 235,069 pwnppagn.dll
05/11/2005 01:55 PM 233,020 q2rqlc951f.dll
05/10/2005 09:14 PM 234,272 dxsrslvr.dll
05/10/2005 09:14 PM 234,272 dpstyle.dll
05/10/2005 09:15 AM 235,069 o6lu0g39e6.dll
05/10/2005 09:12 AM 234,236 hrjm0511e.dll
05/06/2005 02:14 PM 235,069 fpns0357e.dll
05/06/2005 02:12 PM 235,069 ammxprox.dll
05/06/2005 02:03 PM 234,236 nowrsja.dll
05/06/2005 01:55 PM 234,633 mwvcr71.dll
05/06/2005 01:51 PM 234,236 uqrcoina.dll
05/06/2005 01:48 PM 233,248 mvl_hp.dll
05/02/2005 12:14 PM 233,248 kxdmon.dll
04/13/2005 08:28 AM <DIR> Microsoft
04/05/2001 01:43 PM 94,208 msstkprp.dll
69 File(s) 15,807,880 bytes
2 Dir(s) 26,428,747,776 bytes free
  • 0

#6
pghjezebel

pghjezebel

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Okay, I ran m2mfix but after I rebooted, it never came back up again with a logfile. Here is my HT file though.....

Logfile of HijackThis v1.99.1
Scan saved at 2:25:28 PM, on 8/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\WinVNC.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\Web\AIM\aim.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Sync2It\Sync2It.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\mamasood\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Guardian Protection Services
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=gpsx-proxy;http=10.2.14.120:5555
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
;<local>
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Applications\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKCU\..\Run: [AIM] C:\Web\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [RssReader] C:\Program Files\RssReader\RssReader.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Startup: Sync2It.lnk = C:\Program Files\Sync2It\Sync2It.exe
O4 - Global Startup: Microsoft AntiSpyware.lnk = C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: WebTrends SmartView - {62D067DB-F0D6-4130-8D1A-BD990AC95CD7} - C:\Program Files\WebTrends On Demand SmartView\WTsvuOD.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Web\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0075546E-5D3D-11D2-A3E5-0060971304D8} (WTX_Installer Class) - http://www.webtrends...t/wtx_setup.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113400889484
O16 - DPF: {72C9EA8F-8965-40C2-ABAD-D460A5815F86} (hostCntrlIE Class) - https://vhost.oddcas...ostClientIE.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://sv.webtrends....dows-i586-p.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Virtual Network Computing (WinVNC) - Unknown owner - C:\Program Files\RealVNC\WinVNC.EXE" -service (file missing)


  • 0

#7
pghjezebel

pghjezebel

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Okay, I ran m2mfix but after I rebooted, it never came back up again with a logfile. Here is my HT file though.....

Logfile of HijackThis v1.99.1
Scan saved at 2:25:28 PM, on 8/8/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\WinVNC.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\DWRCST.exe
C:\Web\AIM\aim.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Sync2It\Sync2It.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\mamasood\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Guardian Protection Services
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=gpsx-proxy;http=10.2.14.120:5555
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
;<local>
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Applications\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKCU\..\Run: [AIM] C:\Web\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [RssReader] C:\Program Files\RssReader\RssReader.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Startup: Sync2It.lnk = C:\Program Files\Sync2It\Sync2It.exe
O4 - Global Startup: Microsoft AntiSpyware.lnk = C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: WebTrends SmartView - {62D067DB-F0D6-4130-8D1A-BD990AC95CD7} - C:\Program Files\WebTrends On Demand SmartView\WTsvuOD.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Web\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0075546E-5D3D-11D2-A3E5-0060971304D8} (WTX_Installer Class) - http://www.webtrends...t/wtx_setup.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1113400889484
O16 - DPF: {72C9EA8F-8965-40C2-ABAD-D460A5815F86} (hostCntrlIE Class) - https://vhost.oddcas...ostClientIE.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://sv.webtrends....dows-i586-p.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Virtual Network Computing (WinVNC) - Unknown owner - C:\Program Files\RealVNC\WinVNC.EXE" -service (file missing)


  • 0

#8
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Run L2MFix with option #1 again and post that log. I will take a look at it to see if option #2 did anything with it.

The HijackThis log looks clean so far. Just need to see that L2MFix option #1 log. It has a lot of bad files there the first time.
  • 0

#9
pghjezebel

pghjezebel

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{002B22FE-1CCE-9698-0F1C-054121D44C5B}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{6C961258-21EA-11D4-BD20-0050DA2ECD05}"="Gauss Repository"
"{CF56B9D2-0C3B-4F0A-8E26-4FD9199A5E39}"="MagNSContextMenu Class"
"{5CA3D70E-1895-11CF-8E15-001234567890}"="DriveLetterAccess"
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extension"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{0AC6C6C5-F7A8-11D2-BEF4-00C04F990001}"="Macromedia FTP & RDS"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{BDEADF00-C265-11d0-BCED-00A0C90AB50F}"="Web Folders"
"{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}"=""
"{1F465EA7-1861-453A-A6FA-7AC2C5B70653}"=""
"{8110DD47-807B-45D6-B588-3332BAA9BCD9}"=""
"{AB9B42A0-716A-4690-9997-AE0D972565AB}"=""
"{DEBDC93E-E0E9-4837-A510-8C2705AD7C68}"=""
"{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}"=""
"{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}"=""
"{7813B9D3-E446-484A-8F18-2E334209D45D}"=""
"{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}"=""
"{54105154-2BD1-4833-BA10-2CDCD59E2FFB}"=""
"{2F25CF20-C569-11D1-B94C-00608CB45480}"="TextPad"
"{709C6E11-538F-4759-86AC-6ACB302AA0DE}"="Desktop Manager"
@=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C75377C2-94DE-48B3-B77D-89A06DDEC1A8}\InprocServer32]
@="C:\\WINDOWS\\system32\\kxdmon.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1F465EA7-1861-453A-A6FA-7AC2C5B70653}\InprocServer32]
@="C:\\WINDOWS\\system32\\ammxprox.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{AB9B42A0-716A-4690-9997-AE0D972565AB}\InprocServer32]
@="C:\\WINDOWS\\system32\\fcpsapi2.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BB70357F-4E8D-4F3D-9CC7-4A007D5CDCB1}\InprocServer32]
@="C:\\WINDOWS\\system32\\mvl_hp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EECDDC6-8FAE-41A4-A6B5-1515E22E25A6}\InprocServer32]
@="C:\\WINDOWS\\system32\\uqrcoina.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5A84E4C6-61A3-4CB9-A456-5DD598B4BC03}\InprocServer32]
@="C:\\WINDOWS\\system32\\mwvcr71.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{54105154-2BD1-4833-BA10-2CDCD59E2FFB}\InprocServer32]
@="C:\\WINDOWS\\system32\\nowrsja.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
aewav.dll Sun Jun 19 2005 7:09:32p ..S.R 234,784 229.28 K
awmlib.dll Sun Jun 19 2005 7:09:28p ..S.R 234,784 229.28 K
cdm.dll Thu May 26 2005 4:16:24a A.... 75,544 73.77 K
chprops.dll Mon Jun 20 2005 4:19:12p ..S.R 233,690 228.21 K
cnl3d32.dll Tue Jun 21 2005 6:18:20p ..S.R 234,784 229.28 K
ctbcatq.dll Thu May 12 2005 6:55:26a ..S.R 234,272 228.78 K
cuodm.dll Thu May 12 2005 6:55:22a ..S.R 234,272 228.78 K
dfdim700.dll Tue Jun 21 2005 6:18:14p ..S.R 234,784 229.28 K
dpstyle.dll Tue May 10 2005 9:14:46p ..S.R 234,272 228.78 K
dxsrslvr.dll Tue May 10 2005 9:14:50p ..S.R 234,272 228.78 K
fwsrch.dll Thu May 12 2005 3:55:20a ..S.R 234,272 228.78 K
gwaraspi.dll Thu May 12 2005 3:55:24a ..S.R 234,272 228.78 K
hashlib.dll Tue Jul 12 2005 3:35:14p A.... 117,976 115.21 K
hhsetup.dll Thu May 26 2005 10:04:28p A.... 41,472 40.50 K
icm32.dll Tue Jun 28 2005 9:46:00p A.... 254,976 249.00 K
itircl.dll Thu May 26 2005 10:04:28p A.... 155,136 151.50 K
itss.dll Thu May 26 2005 10:04:28p A.... 137,216 134.00 K
iuengine.dll Thu May 26 2005 4:16:24a A.... 198,424 193.77 K
lmcwmi.dll Sat Jun 18 2005 6:22:26p ..S.R 234,784 229.28 K
lwfil60n.dll Sat Jun 18 2005 6:22:32p ..S.R 234,784 229.28 K
maxoci.dll Wed Jun 22 2005 2:13:16a ..S.R 234,784 229.28 K
mermsg.dll Sun Jun 19 2005 5:39:28a ..S.R 234,784 229.28 K
mjvideo.dll Fri Jun 17 2005 11:00:28p ..S.R 234,784 229.28 K
morle32.dll Wed May 11 2005 9:55:20p ..S.R 234,272 228.78 K
mortdep.dll Sun Jun 19 2005 5:39:32a ..S.R 234,784 229.28 K
mrxml2.dll Fri Jun 17 2005 11:00:32p ..S.R 234,784 229.28 K
mscms.dll Tue Jun 28 2005 9:46:00p A.... 74,240 72.50 K
msxlegih.dll Wed Jun 22 2005 2:13:20a ..S.R 234,784 229.28 K
mwstkprp.dll Wed May 11 2005 9:55:24p ..S.R 234,272 228.78 K
mydscli.dll Sun Jun 19 2005 5:56:28p ..S.R 234,784 229.28 K
mygentr.dll Sun Jun 19 2005 5:56:32p ..S.R 234,784 229.28 K
pwdrv.dll Thu Jun 23 2005 4:21:54p ..S.R 235,328 229.81 K
pwnppagn.dll Wed May 11 2005 1:55:20p ..S.R 235,069 229.56 K
qkvd.dll Tue Jul 26 2005 8:39:08a ..S.R 234,895 229.39 K
ropi.dll Thu May 12 2005 7:55:26a ..S.R 234,272 228.78 K
rtcss.dll Tue Jul 26 2005 8:39:40a ..S.R 233,248 227.78 K
setuid.dll Mon May 16 2005 4:09:04p A.... 64,512 63.00 K
sjcoinst.dll Thu May 12 2005 2:55:24a ..S.R 234,272 228.78 K
sjnike.dll Thu May 12 2005 2:55:20a ..S.R 234,272 228.78 K
smdpapi.dll Mon Jun 20 2005 7:55:34a ..S.R 234,784 229.28 K
stprv.dll Wed Jun 22 2005 8:50:18a ..S.R 234,784 229.28 K
tkpisrv.dll Tue Jun 21 2005 9:16:14a ..S.R 234,784 229.28 K
tupmib.dll Tue Jun 21 2005 9:16:20a ..S.R 234,784 229.28 K
wuapi.dll Thu May 26 2005 4:16:30a A.... 465,176 454.27 K
wuaueng.dll Thu May 26 2005 4:16:30a A.... 1,343,768 1.28 M
wuaueng1.dll Thu May 26 2005 4:16:30a A.... 194,328 189.77 K
wucltui.dll Thu May 26 2005 4:16:30a A.... 127,256 124.27 K
wups.dll Thu May 26 2005 4:16:30a A.... 41,240 40.27 K
wups2.dll Thu May 26 2005 4:16:30a A.... 18,200 17.77 K
wuweb.dll Thu May 26 2005 4:16:30a A.... 173,536 169.47 K
xnsp3res.dll Mon Jul 11 2005 10:54:12p ..S.R 234,784 229.28 K
xpsp3res.dll Mon May 16 2005 8:25:36p ..... 15,360 15.00 K

52 items found: 52 files (35 H/S), 0 directories.
Total of file sizes: 11,708,478 bytes 11.16 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Mon Aug 8 2005 11:27:38a ..S.R 234,325 228.83 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 234,325 bytes 228.83 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 1CA2-5962

Directory of C:\WINDOWS\System32

08/08/2005 11:27 AM 234,325 guard.tmp
08/08/2005 10:32 AM 234,325 h22o0cf3ef2.dll
08/05/2005 11:47 AM 234,325 o0480ahued480.dll
08/04/2005 03:13 PM 233,248 g2jolc131f.dll
07/26/2005 05:51 PM <DIR> dllcache
07/26/2005 08:40 AM 0 lvl2093oe.dll
07/26/2005 08:39 AM 233,248 rtcss.dll
07/26/2005 08:39 AM 234,895 qkvd.dll
07/14/2005 11:29 AM 234,784 hrjo0513e.dll
07/14/2005 11:23 AM 234,895 j86mlij118o.dll
07/11/2005 10:54 PM 234,784 xnsp3res.dll
07/11/2005 08:25 AM 236,530 jtro0793e.dll
07/05/2005 11:44 AM 234,895 en42l1ho1.dll
06/29/2005 08:50 AM 235,019 jt4s07h7e.dll
06/27/2005 09:10 AM 235,469 ktrml7911.dll
06/23/2005 04:21 PM 235,328 pwdrv.dll
06/23/2005 04:21 PM 236,278 q0nu0a59ed.dll
06/22/2005 10:45 AM 234,784 n6r2lg9o16.dll
06/22/2005 09:05 AM 235,328 l44q0eh5eh4.dll
06/22/2005 08:50 AM 234,784 stprv.dll
06/22/2005 02:13 AM 234,784 msxlegih.dll
06/22/2005 02:13 AM 234,784 maxoci.dll
06/21/2005 06:18 PM 234,784 cnl3d32.dll
06/21/2005 06:18 PM 234,784 dFdim700.dll
06/21/2005 09:16 AM 234,784 tupmib.dll
06/21/2005 09:16 AM 234,784 tKpisrv.dll
06/20/2005 04:19 PM 233,690 chprops.dll
06/20/2005 04:17 PM 234,784 mv6ol9j31.dll
06/20/2005 07:55 AM 234,784 smdpapi.dll
06/19/2005 07:09 PM 234,784 aewav.dll
06/19/2005 07:09 PM 234,784 awmlib.dll
06/19/2005 05:56 PM 234,784 mygentr.dll
06/19/2005 05:56 PM 234,784 mydscli.dll
06/19/2005 05:39 AM 234,784 mortdep.dll
06/19/2005 05:39 AM 234,784 mermsg.dll
06/18/2005 06:22 PM 234,784 LWFIL60N.DLL
06/18/2005 06:22 PM 234,784 lmcwmi.dll
06/17/2005 11:00 PM 234,784 mrxml2.dll
06/17/2005 11:00 PM 234,784 mjvideo.dll
06/17/2005 08:31 AM 233,690 azau0g39e6.dll
06/14/2005 09:59 AM 233,690 dn0q01d5e.dll
06/10/2005 08:44 AM 233,690 k2260cfsef260.dll
06/06/2005 10:07 AM 233,690 mv6ul9j91.dll
05/20/2005 04:57 PM 233,690 ir44l5hq1.dll
05/20/2005 04:28 PM 233,651 j80s0id7e80.dll
05/12/2005 02:06 PM 236,075 lvr8099ue.dll
05/12/2005 07:55 AM 234,272 rOpi.dll
05/12/2005 06:55 AM 234,272 ctbcatq.dll
05/12/2005 06:55 AM 234,272 cuodm.dll
05/12/2005 03:55 AM 234,272 GWARAspi.dll
05/12/2005 03:55 AM 234,272 fwsrch.dll
05/12/2005 02:55 AM 234,272 sjcoinst.dll
05/12/2005 02:55 AM 234,272 sjnike.dll
05/11/2005 09:55 PM 234,272 mwstkprp.dll
05/11/2005 09:55 PM 234,272 morle32.dll
05/11/2005 01:55 PM 235,069 pwnppagn.dll
05/11/2005 01:55 PM 233,020 q2rqlc951f.dll
05/10/2005 09:14 PM 234,272 dxsrslvr.dll
05/10/2005 09:14 PM 234,272 dpstyle.dll
05/10/2005 09:15 AM 235,069 o6lu0g39e6.dll
05/10/2005 09:12 AM 234,236 hrjm0511e.dll
05/06/2005 02:14 PM 235,069 fpns0357e.dll
05/06/2005 02:12 PM 235,069 ammxprox.dll
05/06/2005 02:03 PM 234,236 nowrsja.dll
05/06/2005 01:55 PM 234,633 mwvcr71.dll
05/06/2005 01:51 PM 234,236 uqrcoina.dll
05/06/2005 01:48 PM 233,248 mvl_hp.dll
05/02/2005 12:14 PM 233,248 kxdmon.dll
04/13/2005 08:28 AM <DIR> Microsoft
04/05/2001 01:43 PM 94,208 msstkprp.dll
68 File(s) 15,573,555 bytes
2 Dir(s) 26,420,080,640 bytes free


There you go....
It seems to have worked...the Winfix popups died and since reboot, ive only seen 1 other pop up....

Edited by pghjezebel, 08 August 2005 - 01:33 PM.

  • 0

#10
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
OK, it didn't look like L2MFix fixed anything. I want you to run L2MFix with option #2 again. See if it will restart and open up a Notepad file with the log for you.

If not, I want you to go into the l2mfix folder and double click on second.bat file. See if that will give you a log. Post that here.

I want you to do this afterwards:

Download KillBox http://www.greyknigh...spy/KillBox.exe. Run KillBox and check the box that says 'End Explorer Shell While Killing File'. Next click on 'Delete on Reboot'. Copy the below files (select/highlight them with your mouse and right click -> Copy) and go back to KillBox. Go to File->Paste from Clipboard and then hit the button with a red circle and white X. Confirm to delete and when asked if you want to reboot, say no:

c:\windows\system32\guard.tmp
c:\windows\system32\h22o0cf3ef2.dll
c:\windows\system32\o0480ahued480.dll
c:\windows\system32\g2jolc131f.dll
c:\windows\system32\dllcache\lvl2093oe.dll
c:\windows\system32\dllcache\rtcss.dll
c:\windows\system32\dllcache\qkvd.dll
c:\windows\system32\dllcache\hrjo0513e.dll
c:\windows\system32\dllcache\j86mlij118o.dll
c:\windows\system32\dllcache\xnsp3res.dll
c:\windows\system32\dllcache\jtro0793e.dll
c:\windows\system32\dllcache\en42l1ho1.dll
c:\windows\system32\dllcache\jt4s07h7e.dll
c:\windows\system32\dllcache\ktrml7911.dll
c:\windows\system32\dllcache\pwdrv.dll
c:\windows\system32\dllcache\q0nu0a59ed.dll
c:\windows\system32\dllcache\n6r2lg9o16.dll
c:\windows\system32\dllcache\l44q0eh5eh4.dll
c:\windows\system32\dllcache\stprv.dll
c:\windows\system32\dllcache\msxlegih.dll
c:\windows\system32\dllcache\maxoci.dll
c:\windows\system32\dllcache\cnl3d32.dll
c:\windows\system32\dllcache\dFdim700.dll
c:\windows\system32\dllcache\tupmib.dll
c:\windows\system32\dllcache\tKpisrv.dll
c:\windows\system32\dllcache\chprops.dll
c:\windows\system32\dllcache\mv6ol9j31.dll
c:\windows\system32\dllcache\smdpapi.dll
c:\windows\system32\dllcache\aewav.dll
c:\windows\system32\dllcache\awmlib.dll
c:\windows\system32\dllcache\mygentr.dll
c:\windows\system32\dllcache\mydscli.dll
c:\windows\system32\dllcache\mortdep.dll
c:\windows\system32\dllcache\mermsg.dll
c:\windows\system32\dllcache\LWFIL60N.DLL
c:\windows\system32\dllcache\lmcwmi.dll
c:\windows\system32\dllcache\mrxml2.dll
c:\windows\system32\dllcache\mjvideo.dll
c:\windows\system32\dllcache\azau0g39e6.dll
c:\windows\system32\dllcache\dn0q01d5e.dll
c:\windows\system32\dllcache\k2260cfsef260.dll
c:\windows\system32\dllcache\mv6ul9j91.dll
c:\windows\system32\dllcache\ir44l5hq1.dll
c:\windows\system32\dllcache\j80s0id7e80.dll
c:\windows\system32\dllcache\lvr8099ue.dll
c:\windows\system32\dllcache\rOpi.dll
c:\windows\system32\dllcache\ctbcatq.dll
c:\windows\system32\dllcache\cuodm.dll
c:\windows\system32\dllcache\GWARAspi.dll
c:\windows\system32\dllcache\fwsrch.dll
c:\windows\system32\dllcache\sjcoinst.dll
c:\windows\system32\dllcache\sjnike.dll
c:\windows\system32\dllcache\mwstkprp.dll
c:\windows\system32\dllcache\morle32.dll
c:\windows\system32\dllcache\pwnppagn.dll
c:\windows\system32\dllcache\q2rqlc951f.dll
c:\windows\system32\dllcache\dxsrslvr.dll
c:\windows\system32\dllcache\dpstyle.dll
c:\windows\system32\dllcache\o6lu0g39e6.dll
c:\windows\system32\dllcache\hrjm0511e.dll
c:\windows\system32\dllcache\fpns0357e.dll
c:\windows\system32\dllcache\ammxprox.dll
c:\windows\system32\dllcache\nowrsja.dll
c:\windows\system32\dllcache\mwvcr71.dll
c:\windows\system32\dllcache\uqrcoina.dll
c:\windows\system32\dllcache\mvl_hp.dll
c:\windows\system32\dllcache\kxdmon.dll

  • 0

#11
pghjezebel

pghjezebel

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Neither one of the first options gave me a log file.
I also did the third step...so should I reboot now?
  • 0

#12
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Yes, restart now.

I want you to run L2MFix with option #1 again like you did the first time. Give me that log along with a new HijackThis log.
  • 0

#13
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP