[breejen]

help
I heard you guys were great with removing malware. I need your help. I have tried near all to remove this annoying winfixer popup and nothing has worked.
Here is my hijack this logfile
Please help
Breejen

Logfile of HijackThis v1.99.1
Scan saved at 6:43:34 PM, on 08/13/05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\command.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\etb\pokapoka63.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe
C:\Program Files\SpamBayes\bin\sb_tray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\DOCUME~1\JOHANN~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [pdfFactory Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BI1HelperStartUp] C:\PROGRA~1\BEACHI~1\BI1HEL~1.EXE /partner BI1
O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\sspggd.exe reg_run
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [iasnhl] C:\WINDOWS\system32\iasnhl.exe
O4 - HKCU\..\Run: [KB4pROinX] umpnt97.exe
O4 - HKCU\..\Run: [Aida] C:\Program Files\rdso\eetu.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpamBayes Tray Icon.lnk = C:\Program Files\SpamBayes\bin\sb_tray.exe
O4 - Global Startup: D-link AirPlus G DWL-G120 Wireless USB.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsear...earch.html?p=ZU
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O16 - DPF: JT's Blocks - http://download.game...ts/y/blt1_x.cab
O16 - DPF: Toki Toki Boom - http://download.game...nts/y/vto_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Backgammon - http://download.game...nts/y/at1_x.cab
O16 - DPF: Yahoo! Bingo - http://download.game...nts/y/xt0_x.cab
O16 - DPF: Yahoo! Bridge - http://download.game...nts/y/bt1_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct4_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: Yahoo! Gin - http://download.game...nts/y/nt1_x.cab
O16 - DPF: Yahoo! Go Fish - http://download.game...nts/y/zt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.game...nts/y/ht1_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! MahJong - http://download.game...nts/y/ot0_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst4_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt3_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: Yahoo! Reversi - http://download.game...nts/y/rt0_x.cab
O16 - DPF: Yahoo! Sheepshead - http://download.game...nts/y/dt0_x.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {18C3FD15-74F6-4280-9C98-3590C966B7B8} (SkillGam Control) - http://www.worldwinn...am/skillgam.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {41D1977F-4161-4720-800F-EA4903983A38} (Jigsaw Genius Control) - http://www.worldwinn...gsaw/jigsaw.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinn...ck/bjattack.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://www.worldwinn...x/blockwerx.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep....00719/sb02a.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinn...ll/freecell.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1123370263354
O16 - DPF: {6F6DBC29-7A0C-4AC0-A42D-10EC70678526} (Word Cubes Control) - http://www.worldwinn...be/wordcube.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinn...v44/sol/sol.cab
O16 - DPF: {9D8D7672-93FF-417E-9024-C16AD141C50C} (Haunted Control) - http://www.worldwinn...ted/haunted.cab
O16 - DPF: {9EAC0186-5F5A-4362-B120-15C312CE012D} - http://www.awmdabest...cabl/273/tb.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinn...apit/swapit.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinn...man/hangman.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} (Tile City Control) - http://www.worldwinn...ty/tilecity.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinn...paint/paint.cab
O16 - DPF: {CA356D79-679B-4B4C-8E49-5AF97014F4C1} - http://files-pl.star...tarware_323.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.g...zylomloader.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.game...outLauncher.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = L7746.wfix.com
O17 - HKLM\Software\..\Telephony: DomainName = L7746.wfix.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6170FA43-37E8-480B-89CC-60526FF476E0}: Domain = L7746.wfix.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB9F4403-37CD-4872-8E5F-E19B722822F1}: Domain = L7746.wfx.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4AAD1CB-F6DD-4F8C-BE54-F8BD78B236B0}: Domain = L7746.wfix.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = L7746.wfix.com
O20 - Winlogon Notify: IntlRun - C:\WINDOWS\system32\cnosys.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Advertisements]

Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

[tampabelle]

Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

[breejen]

I did as you asked and here is the log

L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\IntlRun]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\cnosys.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{E987E005-2042-A1AE-3EC5-406BD81611C4}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{04D641C3-1463-4CB3-97E8-E6F65F363D80}"=""
"{EE6F34A3-3A43-4450-9C28-DE60EA61D200}"=""
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{BFD654BF-6A95-4291-AA9B-78890F322875}"=""
"{3E78580A-28B3-4DAA-90A0-6819D85C8018}"=""
"{2C521CB7-8812-4F78-88BF-10D099AC623D}"=""
"{EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B}"=""
"{5E86ED05-AB5C-4C5E-AC2A-669FC604F104}"=""
"{443D437D-3A7A-48C6-8A7D-C89E861B1F3B}"=""
"{25BF3C20-6A00-4B31-A53C-A978F35FAF66}"=""
"{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"="TrojanHunter Menu Shell Extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{2C521CB7-8812-4F78-88BF-10D099AC623D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2C521CB7-8812-4F78-88BF-10D099AC623D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2C521CB7-8812-4F78-88BF-10D099AC623D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{2C521CB7-8812-4F78-88BF-10D099AC623D}\InprocServer32]
@="C:\\WINDOWS\\system32\\NKTAPI.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B}\InprocServer32]
@="C:\\WINDOWS\\system32\\stsvc.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5E86ED05-AB5C-4C5E-AC2A-669FC604F104}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5E86ED05-AB5C-4C5E-AC2A-669FC604F104}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5E86ED05-AB5C-4C5E-AC2A-669FC604F104}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5E86ED05-AB5C-4C5E-AC2A-669FC604F104}\InprocServer32]
@="C:\\WINDOWS\\system32\\dmmclien.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{443D437D-3A7A-48C6-8A7D-C89E861B1F3B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{443D437D-3A7A-48C6-8A7D-C89E861B1F3B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{443D437D-3A7A-48C6-8A7D-C89E861B1F3B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{443D437D-3A7A-48C6-8A7D-C89E861B1F3B}\InprocServer32]
@="C:\\WINDOWS\\system32\\sxlunirl.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{25BF3C20-6A00-4B31-A53C-A978F35FAF66}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{25BF3C20-6A00-4B31-A53C-A978F35FAF66}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{25BF3C20-6A00-4B31-A53C-A978F35FAF66}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{25BF3C20-6A00-4B31-A53C-A978F35FAF66}\InprocServer32]
@="C:\\WINDOWS\\system32\\dcprov.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
abdiodev.dll Thu Jul 21 2005 9:15:16p ..S.R 417,792 408.00 K
atmtd.dll Sat Aug 6 2005 2:06:04a A.... 687,592 671.48 K
cdm.dll Thu May 26 2005 4:16:24a A.... 75,544 73.77 K
cnosys.dll Fri Jul 22 2005 7:59:38a ..S.R 417,792 408.00 K
cqusapi.dll Mon Aug 1 2005 6:26:06a ..S.R 417,792 408.00 K
cradmin.dll Thu Jul 21 2005 10:36:32p ..S.R 417,792 408.00 K
datadx.dll Fri Aug 12 2005 5:43:06p A.... 30,208 29.50 K
dcprov.dll Sat Aug 13 2005 5:42:18p ..S.R 417,792 408.00 K
dgghelp.dll Sat Jul 30 2005 11:54:08p ..S.R 417,792 408.00 K
diound3d.dll Thu Jul 21 2005 7:57:22p ..S.R 417,792 408.00 K
dkmsrpcn.dll Thu Jul 21 2005 10:37:04p ..S.R 417,792 408.00 K
doound.dll Thu Jul 21 2005 7:57:16p ..S.R 417,792 408.00 K
eaann.dll Sat Aug 13 2005 5:43:04p A.... 10,240 10.00 K
fgsdrv.dll Thu Jul 21 2005 10:07:22p ..S.R 417,792 408.00 K
fssjjdf.dll Sat Aug 13 2005 5:43:02p A.... 46,080 45.00 K
gccoll~1.dll Tue Jul 12 2005 3:35:14p A.... 126,680 123.71 K
gcunco~1.dll Tue Jul 12 2005 3:35:10p A.... 95,448 93.21 K
hashlib.dll Tue Jul 12 2005 3:35:14p A.... 117,976 115.21 K
hhsetup.dll Thu May 26 2005 10:04:28p A.... 41,472 40.50 K
icm32.dll Tue Jun 28 2005 9:46:00p A.... 254,976 249.00 K
iskww.dll Wed Aug 3 2005 5:40:44a A.... 0 0.00 K
itircl.dll Thu May 26 2005 10:04:28p A.... 155,136 151.50 K
itss.dll Thu May 26 2005 10:04:28p A.... 137,216 134.00 K
iuengine.dll Thu May 26 2005 4:16:24a A.... 198,424 193.77 K
kerberos.dll Wed Jun 15 2005 1:49:30p A.... 295,936 289.00 K
kfdit.dll Fri Jul 22 2005 3:28:16a ..S.R 417,792 408.00 K
kldno.dll Tue Aug 2 2005 7:51:10p ..S.R 417,792 408.00 K
kmdjpn.dll Fri Jul 22 2005 3:28:20a ..S.R 417,792 408.00 K
kpdgae.dll Sat Jul 30 2005 11:56:06p ..S.R 417,792 408.00 K
kpdinbe1.dll Sat Jul 30 2005 11:56:04p ..S.R 417,792 408.00 K
ktddiv2.dll Thu Jul 21 2005 9:15:20p ..S.R 417,792 408.00 K
legitc~1.dll Wed Aug 3 2005 10:33:42a A.... 520,456 508.26 K
loxp2p32.dll Fri Jul 22 2005 4:37:24a ..S.R 417,792 408.00 K
luxp2p32.dll Fri Jul 22 2005 4:37:18a ..S.R 417,792 408.00 K
mbratelc.dll Fri Jul 22 2005 2:21:16a ..S.R 417,792 408.00 K
mscms.dll Tue Jun 28 2005 9:46:00p A.... 74,240 72.50 K
mucltui.dll Thu May 26 2005 4:16:24a A.... 127,208 124.23 K
muweb.dll Thu May 26 2005 4:19:32a A.... 178,408 174.23 K
mwstdfmt.dll Fri Jul 22 2005 2:21:22a ..S.R 417,792 408.00 K
nikppcy.dll Wed Aug 3 2005 5:40:44a A.... 34,816 34.00 K
oqbcjt32.dll Thu Jul 21 2005 6:30:14p ..S.R 417,792 408.00 K
oumkk.dll Wed Jul 6 2005 3:04:16p A.... 0 0.00 K
rvcrt4.dll Fri Jul 22 2005 6:03:22a ..S.R 417,792 408.00 K
stsvc.dll Fri Aug 12 2005 7:29:08p ..S.R 417,792 408.00 K
sxlunirl.dll Tue Aug 2 2005 7:54:20p ..S.R 417,792 408.00 K
tapisrv.dll Fri Jul 8 2005 12:27:56p A.... 249,344 243.50 K
umpnpmgr.dll Wed Jun 29 2005 10:02:40p A.... 118,272 115.50 K
vfp6r.dll Tue Jun 14 2005 4:37:02p A.... 3,372,816 3.21 M
vfp6renu.dll Tue Jun 14 2005 4:37:02p A.... 876,032 855.50 K
waidx.dll Thu Jul 21 2005 5:00:16p ..S.R 417,792 408.00 K
wihatm.dll Sat Jul 30 2005 11:46:12p ..S.R 417,792 408.00 K
wlploc.dll Fri Jul 22 2005 1:15:30a ..S.R 417,792 408.00 K
wuapi.dll Thu May 26 2005 4:16:30a A.... 465,176 454.27 K
wuaueng.dll Thu May 26 2005 4:16:30a A.... 1,343,768 1.28 M
wuaueng1.dll Thu May 26 2005 4:16:30a A.... 194,328 189.77 K
wucltui.dll Thu May 26 2005 4:16:30a A.... 127,256 124.27 K
wups.dll Thu May 26 2005 4:16:30a A.... 41,240 40.27 K
wups2.dll Thu May 26 2005 4:16:30a A.... 18,200 17.77 K
wuweb.dll Thu May 26 2005 4:16:30a A.... 173,536 169.47 K
wvnsta.dll Thu Jul 21 2005 5:00:22p ..S.R 417,792 408.00 K
wwdap32.dll Fri Jul 22 2005 1:15:18a ..S.R 417,792 408.00 K
xpsp3res.dll Mon May 16 2005 8:26:30p A.... 17,920 17.50 K

62 items found: 62 files (29 H/S), 0 directories.
Total of file sizes: 22,321,912 bytes 21.29 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Tue Aug 2 2005 11:19:26a ..S.R 417,792 408.00 K

1 item found: 1 file (1 H/S), 0 directories.
Total of file sizes: 417,792 bytes 408.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is DCEF-98D1

Directory of C:\WINDOWS\System32

08/13/05 05:42 PM 417,792 dcprov.dll
08/12/05 07:29 PM 417,792 stsvc.dll
08/02/05 07:54 PM 417,792 sxlunirl.dll
08/02/05 07:51 PM 417,792 KLDNO.DLL
08/02/05 11:19 AM 417,792 guard.tmp
08/01/05 06:26 AM 417,792 cqusapi.dll
07/30/05 11:56 PM 417,792 KPDGAE.DLL
07/30/05 11:56 PM 417,792 kpdinbe1.dll
07/30/05 11:54 PM 417,792 dgghelp.dll
07/30/05 11:46 PM 417,792 WIHATM.DLL
07/22/05 07:59 AM 417,792 cnosys.dll
07/22/05 06:03 AM 417,792 rvcrt4.dll
07/22/05 04:37 AM 417,792 LOXP2P32.DLL
07/22/05 04:37 AM 417,792 LUXP2P32.DLL
07/22/05 03:28 AM 417,792 kmdjpn.dll
07/22/05 03:28 AM 417,792 KFDIT.DLL
07/22/05 02:21 AM 417,792 MWSTDFMT.DLL
07/22/05 02:21 AM 417,792 MBRATELC.DLL
07/22/05 01:15 AM 417,792 wlploc.dll
07/22/05 01:15 AM 417,792 wwdap32.dll
07/21/05 10:37 PM 417,792 dkmsrpcn.dll
07/21/05 10:36 PM 417,792 CRADMIN.DLL
07/21/05 10:07 PM 417,792 fgsdrv.dll
07/21/05 09:15 PM 417,792 ktddiv2.dll
07/21/05 09:15 PM 417,792 Abdiodev.dll
07/21/05 07:57 PM 417,792 diound3d.dll
07/21/05 07:57 PM 417,792 doound.dll
07/21/05 06:30 PM 417,792 oqbcjt32.dll
07/21/05 05:00 PM 417,792 wvnsta.dll
07/21/05 05:00 PM 417,792 waidx.dll
02/25/05 08:50 PM 512 AlwJR.j5r
02/25/05 09:18 AM 846 Wdj7.a6p
02/24/05 09:18 AM 846 SzfpW5mn.cvb
02/23/05 09:18 AM 846 Buw0i.65q
02/22/05 09:18 AM 846 ErdHI.9qw
02/21/05 09:18 AM 846 GnsDk.b90
02/20/05 09:17 AM 512 Yijq5g.n91
02/19/05 09:16 AM 846 Fya24W.7u0
02/18/05 09:15 AM 512 TafqX5mo.dvb
02/17/05 09:15 AM 846 Eruz6x9.v5w
02/16/05 09:14 AM 846 Zqyg9f5.4nv
02/15/05 03:06 PM 512 Wfe4Nv.5sv
02/15/05 09:14 AM 846 Fmr0i.a99
02/14/05 09:13 AM 846 OmjcA03.a23
02/13/05 09:12 AM 846 Wdit.06p
02/12/05 09:11 AM 846 Oval63H.j9q
02/10/05 09:11 AM 846 Zgm8.dv7
02/08/05 09:10 AM 846 KrwH5f.d27
02/07/05 09:10 AM 846 Yfk8.bt6
02/06/05 09:10 AM 846 UbgrYPnp.ewd
02/04/05 09:10 AM 846 WcisZRpq.fye
02/03/05 09:09 AM 846 FmsCj.b90
02/02/05 09:09 AM 846 UbgrYQnp.exd
02/01/05 09:09 AM 846 JqvGne.017
01/31/05 09:08 AM 846 Zgl8.du7
01/30/05 09:08 AM 846 QzygH.ph4
01/28/05 09:08 AM 846 Oval73H.j9r
01/27/05 09:08 AM 846 GnsDk.c90
01/26/05 09:07 AM 846 KrwH5f.117
01/20/05 02:46 PM 846 TafqW5mn.cvb
01/14/05 02:43 PM 846 Anh4V.7ub
01/13/05 02:43 PM 846 UbgrXPno.dwc
01/12/05 02:43 PM 846 Rydo84k.lat
01/10/05 02:43 PM 846 Elq0i.z99
12/31/04 09:32 AM 512 Jofs6.edy
12/22/04 12:46 PM 512 Dkp0h.y89
12/07/04 10:20 AM 512 MtyJ62F.h8o
12/02/04 10:20 AM 512 HotElc.006
11/30/04 10:19 AM 512 Yfl8.cu6
11/01/04 04:03 AM 512 LsxI52.eg8
10/31/04 12:02 PM 512 YdvHgTTO.8r9
10/28/04 11:01 AM 512 Flr0i.a99
10/26/04 08:52 AM 512 Cvx137.6ry
10/25/04 08:52 AM 512 KrwH5g.d27
10/18/04 08:02 AM 512 Cvx1j.76r
10/13/04 10:47 PM 512 Ahm9.ev7
06/28/02 12:58 AM <DIR> Microsoft
76 File(s) 12,567,332 bytes
1 Dir(s) 19,382,550,528 bytes free

[tampabelle]

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log, and we'll clean up what's left.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[breejen]

here's the log
Thanks for all your help by the way
I really appreciate it

L2Mfix 1.03a

Running From:
C:\DOCUME~1\JOHANN~1\Desktop\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Full access DELL\Scott Pinsker
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Full access DELL\Scott Pinsker
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Johanna Pinsker\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Johanna Pinsker\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 200 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1544 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\Abdiodev.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\Abdiodev.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cnosys.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cnosys.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cqusapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cqusapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\CRADMIN.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\CRADMIN.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dcprov.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dcprov.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dgghelp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dgghelp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\diound3d.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\diound3d.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dkmsrpcn.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dkmsrpcn.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\doound.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\doound.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fgsdrv.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fgsdrv.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KFDIT.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KFDIT.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KKDIT142.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KKDIT142.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KLDNO.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KLDNO.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kmdjpn.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kmdjpn.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KPDGAE.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\KPDGAE.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kpdinbe1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kpdinbe1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ktddiv2.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ktddiv2.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\LOXP2P32.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\LOXP2P32.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\LUXP2P32.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\LUXP2P32.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MBRATELC.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MBRATELC.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MWSTDFMT.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MWSTDFMT.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\oqbcjt32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\oqbcjt32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rvcrt4.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rvcrt4.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\stsvc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\stsvc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sxlunirl.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sxlunirl.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\waidx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\waidx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\WIHATM.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\WIHATM.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wlploc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wlploc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wvnsta.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wvnsta.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wwdap32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wwdap32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\Abdiodev.dll
Successfully Deleted: C:\WINDOWS\system32\Abdiodev.dll
deleting: C:\WINDOWS\system32\Abdiodev.dll
Successfully Deleted: C:\WINDOWS\system32\Abdiodev.dll
deleting: C:\WINDOWS\system32\cnosys.dll
Successfully Deleted: C:\WINDOWS\system32\cnosys.dll
deleting: C:\WINDOWS\system32\cnosys.dll
Successfully Deleted: C:\WINDOWS\system32\cnosys.dll
deleting: C:\WINDOWS\system32\cqusapi.dll
Successfully Deleted: C:\WINDOWS\system32\cqusapi.dll
deleting: C:\WINDOWS\system32\cqusapi.dll
Successfully Deleted: C:\WINDOWS\system32\cqusapi.dll
deleting: C:\WINDOWS\system32\CRADMIN.DLL
Successfully Deleted: C:\WINDOWS\system32\CRADMIN.DLL
deleting: C:\WINDOWS\system32\CRADMIN.DLL
Successfully Deleted: C:\WINDOWS\system32\CRADMIN.DLL
deleting: C:\WINDOWS\system32\dcprov.dll
Successfully Deleted: C:\WINDOWS\system32\dcprov.dll
deleting: C:\WINDOWS\system32\dcprov.dll
Successfully Deleted: C:\WINDOWS\system32\dcprov.dll
deleting: C:\WINDOWS\system32\dgghelp.dll
Successfully Deleted: C:\WINDOWS\system32\dgghelp.dll
deleting: C:\WINDOWS\system32\dgghelp.dll
Successfully Deleted: C:\WINDOWS\system32\dgghelp.dll
deleting: C:\WINDOWS\system32\diound3d.dll
Successfully Deleted: C:\WINDOWS\system32\diound3d.dll
deleting: C:\WINDOWS\system32\diound3d.dll
Successfully Deleted: C:\WINDOWS\system32\diound3d.dll
deleting: C:\WINDOWS\system32\dkmsrpcn.dll
Successfully Deleted: C:\WINDOWS\system32\dkmsrpcn.dll
deleting: C:\WINDOWS\system32\dkmsrpcn.dll
Successfully Deleted: C:\WINDOWS\system32\dkmsrpcn.dll
deleting: C:\WINDOWS\system32\doound.dll
Successfully Deleted: C:\WINDOWS\system32\doound.dll
deleting: C:\WINDOWS\system32\doound.dll
Successfully Deleted: C:\WINDOWS\system32\doound.dll
deleting: C:\WINDOWS\system32\fgsdrv.dll
Successfully Deleted: C:\WINDOWS\system32\fgsdrv.dll
deleting: C:\WINDOWS\system32\fgsdrv.dll
Successfully Deleted: C:\WINDOWS\system32\fgsdrv.dll
deleting: C:\WINDOWS\system32\KFDIT.DLL
Successfully Deleted: C:\WINDOWS\system32\KFDIT.DLL
deleting: C:\WINDOWS\system32\KFDIT.DLL
Successfully Deleted: C:\WINDOWS\system32\KFDIT.DLL
deleting: C:\WINDOWS\system32\KKDIT142.DLL
Successfully Deleted: C:\WINDOWS\system32\KKDIT142.DLL
deleting: C:\WINDOWS\system32\KKDIT142.DLL
Successfully Deleted: C:\WINDOWS\system32\KKDIT142.DLL
deleting: C:\WINDOWS\system32\KLDNO.DLL
Successfully Deleted: C:\WINDOWS\system32\KLDNO.DLL
deleting: C:\WINDOWS\system32\KLDNO.DLL
Successfully Deleted: C:\WINDOWS\system32\KLDNO.DLL
deleting: C:\WINDOWS\system32\kmdjpn.dll
Successfully Deleted: C:\WINDOWS\system32\kmdjpn.dll
deleting: C:\WINDOWS\system32\kmdjpn.dll
Successfully Deleted: C:\WINDOWS\system32\kmdjpn.dll
deleting: C:\WINDOWS\system32\KPDGAE.DLL
Successfully Deleted: C:\WINDOWS\system32\KPDGAE.DLL
deleting: C:\WINDOWS\system32\KPDGAE.DLL
Successfully Deleted: C:\WINDOWS\system32\KPDGAE.DLL
deleting: C:\WINDOWS\system32\kpdinbe1.dll
Successfully Deleted: C:\WINDOWS\system32\kpdinbe1.dll
deleting: C:\WINDOWS\system32\kpdinbe1.dll
Successfully Deleted: C:\WINDOWS\system32\kpdinbe1.dll
deleting: C:\WINDOWS\system32\ktddiv2.dll
Successfully Deleted: C:\WINDOWS\system32\ktddiv2.dll
deleting: C:\WINDOWS\system32\ktddiv2.dll
Successfully Deleted: C:\WINDOWS\system32\ktddiv2.dll
deleting: C:\WINDOWS\system32\LOXP2P32.DLL
Successfully Deleted: C:\WINDOWS\system32\LOXP2P32.DLL
deleting: C:\WINDOWS\system32\LOXP2P32.DLL
Successfully Deleted: C:\WINDOWS\system32\LOXP2P32.DLL
deleting: C:\WINDOWS\system32\LUXP2P32.DLL
Successfully Deleted: C:\WINDOWS\system32\LUXP2P32.DLL
deleting: C:\WINDOWS\system32\LUXP2P32.DLL
Successfully Deleted: C:\WINDOWS\system32\LUXP2P32.DLL
deleting: C:\WINDOWS\system32\MBRATELC.DLL
Successfully Deleted: C:\WINDOWS\system32\MBRATELC.DLL
deleting: C:\WINDOWS\system32\MBRATELC.DLL
Successfully Deleted: C:\WINDOWS\system32\MBRATELC.DLL
deleting: C:\WINDOWS\system32\MWSTDFMT.DLL
Successfully Deleted: C:\WINDOWS\system32\MWSTDFMT.DLL
deleting: C:\WINDOWS\system32\MWSTDFMT.DLL
Successfully Deleted: C:\WINDOWS\system32\MWSTDFMT.DLL
deleting: C:\WINDOWS\system32\oqbcjt32.dll
Successfully Deleted: C:\WINDOWS\system32\oqbcjt32.dll
deleting: C:\WINDOWS\system32\oqbcjt32.dll
Successfully Deleted: C:\WINDOWS\system32\oqbcjt32.dll
deleting: C:\WINDOWS\system32\rvcrt4.dll
Successfully Deleted: C:\WINDOWS\system32\rvcrt4.dll
deleting: C:\WINDOWS\system32\rvcrt4.dll
Successfully Deleted: C:\WINDOWS\system32\rvcrt4.dll
deleting: C:\WINDOWS\system32\stsvc.dll
Successfully Deleted: C:\WINDOWS\system32\stsvc.dll
deleting: C:\WINDOWS\system32\stsvc.dll
Successfully Deleted: C:\WINDOWS\system32\stsvc.dll
deleting: C:\WINDOWS\system32\sxlunirl.dll
Successfully Deleted: C:\WINDOWS\system32\sxlunirl.dll
deleting: C:\WINDOWS\system32\sxlunirl.dll
Successfully Deleted: C:\WINDOWS\system32\sxlunirl.dll
deleting: C:\WINDOWS\system32\waidx.dll
Successfully Deleted: C:\WINDOWS\system32\waidx.dll
deleting: C:\WINDOWS\system32\waidx.dll
Successfully Deleted: C:\WINDOWS\system32\waidx.dll
deleting: C:\WINDOWS\system32\WIHATM.DLL
Successfully Deleted: C:\WINDOWS\system32\WIHATM.DLL
deleting: C:\WINDOWS\system32\WIHATM.DLL
Successfully Deleted: C:\WINDOWS\system32\WIHATM.DLL
deleting: C:\WINDOWS\system32\wlploc.dll
Successfully Deleted: C:\WINDOWS\system32\wlploc.dll
deleting: C:\WINDOWS\system32\wlploc.dll
Successfully Deleted: C:\WINDOWS\system32\wlploc.dll
deleting: C:\WINDOWS\system32\wvnsta.dll
Successfully Deleted: C:\WINDOWS\system32\wvnsta.dll
deleting: C:\WINDOWS\system32\wvnsta.dll
Successfully Deleted: C:\WINDOWS\system32\wvnsta.dll
deleting: C:\WINDOWS\system32\wwdap32.dll
Successfully Deleted: C:\WINDOWS\system32\wwdap32.dll
deleting: C:\WINDOWS\system32\wwdap32.dll
Successfully Deleted: C:\WINDOWS\system32\wwdap32.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Desktop.ini sucessfully removed


Zipping up files for submission:
adding: Abdiodev.dll (164 bytes security) (deflated 48%)
adding: cnosys.dll (164 bytes security) (deflated 48%)
adding: cqusapi.dll (164 bytes security) (deflated 48%)
adding: CRADMIN.DLL (164 bytes security) (deflated 48%)
adding: dcprov.dll (164 bytes security) (deflated 48%)
adding: dgghelp.dll (164 bytes security) (deflated 48%)
adding: diound3d.dll (164 bytes security) (deflated 48%)
adding: dkmsrpcn.dll (164 bytes security) (deflated 48%)
adding: doound.dll (164 bytes security) (deflated 48%)
adding: fgsdrv.dll (164 bytes security) (deflated 48%)
adding: KFDIT.DLL (164 bytes security) (deflated 48%)
adding: KKDIT142.DLL (164 bytes security) (deflated 48%)
adding: KLDNO.DLL (164 bytes security) (deflated 48%)
adding: kmdjpn.dll (164 bytes security) (deflated 48%)
adding: KPDGAE.DLL (164 bytes security) (deflated 48%)
adding: kpdinbe1.dll (164 bytes security) (deflated 48%)
adding: ktddiv2.dll (164 bytes security) (deflated 48%)
adding: LOXP2P32.DLL (164 bytes security) (deflated 48%)
adding: LUXP2P32.DLL (164 bytes security) (deflated 48%)
adding: MBRATELC.DLL (164 bytes security) (deflated 48%)
adding: MWSTDFMT.DLL (164 bytes security) (deflated 48%)
adding: oqbcjt32.dll (164 bytes security) (deflated 48%)
adding: rvcrt4.dll (164 bytes security) (deflated 48%)
adding: stsvc.dll (164 bytes security) (deflated 48%)
adding: sxlunirl.dll (164 bytes security) (deflated 48%)
adding: waidx.dll (164 bytes security) (deflated 48%)
adding: WIHATM.DLL (164 bytes security) (deflated 48%)
adding: wlploc.dll (164 bytes security) (deflated 48%)
adding: wvnsta.dll (164 bytes security) (deflated 48%)
adding: wwdap32.dll (164 bytes security) (deflated 48%)
adding: guard.tmp (164 bytes security) (deflated 48%)
adding: clear.reg (164 bytes security) (deflated 63%)
adding: echo.reg (164 bytes security) (deflated 10%)
adding: DESKTOP.INI (164 bytes security) (stored 0%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 89%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 73%)
adding: test.txt (164 bytes security) (deflated 90%)
adding: test2.txt (164 bytes security) (deflated 44%)
adding: test3.txt (164 bytes security) (deflated 44%)
adding: test5.txt (164 bytes security) (deflated 44%)
adding: xfind.txt (164 bytes security) (deflated 87%)
adding: backregs/25BF3C20-6A00-4B31-A53C-A978F35FAF66.reg (164 bytes security) (deflated 70%)
adding: backregs/2C521CB7-8812-4F78-88BF-10D099AC623D.reg (164 bytes security) (deflated 70%)
adding: backregs/443D437D-3A7A-48C6-8A7D-C89E861B1F3B.reg (164 bytes security) (deflated 70%)
adding: backregs/5E86ED05-AB5C-4C5E-AC2A-669FC604F104.reg (164 bytes security) (deflated 70%)
adding: backregs/EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 65%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Full access DELL\Scott Pinsker
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: Abdiodev.dll
deleting local copy: Abdiodev.dll
deleting local copy: cnosys.dll
deleting local copy: cnosys.dll
deleting local copy: cqusapi.dll
deleting local copy: cqusapi.dll
deleting local copy: CRADMIN.DLL
deleting local copy: CRADMIN.DLL
deleting local copy: dcprov.dll
deleting local copy: dcprov.dll
deleting local copy: dgghelp.dll
deleting local copy: dgghelp.dll
deleting local copy: diound3d.dll
deleting local copy: diound3d.dll
deleting local copy: dkmsrpcn.dll
deleting local copy: dkmsrpcn.dll
deleting local copy: doound.dll
deleting local copy: doound.dll
deleting local copy: fgsdrv.dll
deleting local copy: fgsdrv.dll
deleting local copy: KFDIT.DLL
deleting local copy: KFDIT.DLL
deleting local copy: KKDIT142.DLL
deleting local copy: KKDIT142.DLL
deleting local copy: KLDNO.DLL
deleting local copy: KLDNO.DLL
deleting local copy: kmdjpn.dll
deleting local copy: kmdjpn.dll
deleting local copy: KPDGAE.DLL
deleting local copy: KPDGAE.DLL
deleting local copy: kpdinbe1.dll
deleting local copy: kpdinbe1.dll
deleting local copy: ktddiv2.dll
deleting local copy: ktddiv2.dll
deleting local copy: LOXP2P32.DLL
deleting local copy: LOXP2P32.DLL
deleting local copy: LUXP2P32.DLL
deleting local copy: LUXP2P32.DLL
deleting local copy: MBRATELC.DLL
deleting local copy: MBRATELC.DLL
deleting local copy: MWSTDFMT.DLL
deleting local copy: MWSTDFMT.DLL
deleting local copy: oqbcjt32.dll
deleting local copy: oqbcjt32.dll
deleting local copy: rvcrt4.dll
deleting local copy: rvcrt4.dll
deleting local copy: stsvc.dll
deleting local copy: stsvc.dll
deleting local copy: sxlunirl.dll
deleting local copy: sxlunirl.dll
deleting local copy: waidx.dll
deleting local copy: waidx.dll
deleting local copy: WIHATM.DLL
deleting local copy: WIHATM.DLL
deleting local copy: wlploc.dll
deleting local copy: wlploc.dll
deleting local copy: wvnsta.dll
deleting local copy: wvnsta.dll
deleting local copy: wwdap32.dll
deleting local copy: wwdap32.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\Abdiodev.dll
C:\WINDOWS\system32\Abdiodev.dll
C:\WINDOWS\system32\cnosys.dll
C:\WINDOWS\system32\cnosys.dll
C:\WINDOWS\system32\cqusapi.dll
C:\WINDOWS\system32\cqusapi.dll
C:\WINDOWS\system32\CRADMIN.DLL
C:\WINDOWS\system32\CRADMIN.DLL
C:\WINDOWS\system32\dcprov.dll
C:\WINDOWS\system32\dcprov.dll
C:\WINDOWS\system32\dgghelp.dll
C:\WINDOWS\system32\dgghelp.dll
C:\WINDOWS\system32\diound3d.dll
C:\WINDOWS\system32\diound3d.dll
C:\WINDOWS\system32\dkmsrpcn.dll
C:\WINDOWS\system32\dkmsrpcn.dll
C:\WINDOWS\system32\doound.dll
C:\WINDOWS\system32\doound.dll
C:\WINDOWS\system32\fgsdrv.dll
C:\WINDOWS\system32\fgsdrv.dll
C:\WINDOWS\system32\KFDIT.DLL
C:\WINDOWS\system32\KFDIT.DLL
C:\WINDOWS\system32\KKDIT142.DLL
C:\WINDOWS\system32\KKDIT142.DLL
C:\WINDOWS\system32\KLDNO.DLL
C:\WINDOWS\system32\KLDNO.DLL
C:\WINDOWS\system32\kmdjpn.dll
C:\WINDOWS\system32\kmdjpn.dll
C:\WINDOWS\system32\KPDGAE.DLL
C:\WINDOWS\system32\KPDGAE.DLL
C:\WINDOWS\system32\kpdinbe1.dll
C:\WINDOWS\system32\kpdinbe1.dll
C:\WINDOWS\system32\ktddiv2.dll
C:\WINDOWS\system32\ktddiv2.dll
C:\WINDOWS\system32\LOXP2P32.DLL
C:\WINDOWS\system32\LOXP2P32.DLL
C:\WINDOWS\system32\LUXP2P32.DLL
C:\WINDOWS\system32\LUXP2P32.DLL
C:\WINDOWS\system32\MBRATELC.DLL
C:\WINDOWS\system32\MBRATELC.DLL
C:\WINDOWS\system32\MWSTDFMT.DLL
C:\WINDOWS\system32\MWSTDFMT.DLL
C:\WINDOWS\system32\oqbcjt32.dll
C:\WINDOWS\system32\oqbcjt32.dll
C:\WINDOWS\system32\rvcrt4.dll
C:\WINDOWS\system32\rvcrt4.dll
C:\WINDOWS\system32\stsvc.dll
C:\WINDOWS\system32\stsvc.dll
C:\WINDOWS\system32\sxlunirl.dll
C:\WINDOWS\system32\sxlunirl.dll
C:\WINDOWS\system32\waidx.dll
C:\WINDOWS\system32\waidx.dll
C:\WINDOWS\system32\WIHATM.DLL
C:\WINDOWS\system32\WIHATM.DLL
C:\WINDOWS\system32\wlploc.dll
C:\WINDOWS\system32\wlploc.dll
C:\WINDOWS\system32\wvnsta.dll
C:\WINDOWS\system32\wvnsta.dll
C:\WINDOWS\system32\wwdap32.dll
C:\WINDOWS\system32\wwdap32.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{04D641C3-1463-4CB3-97E8-E6F65F363D80}"=-
"{EE6F34A3-3A43-4450-9C28-DE60EA61D200}"=-
"{BFD654BF-6A95-4291-AA9B-78890F322875}"=-
"{3E78580A-28B3-4DAA-90A0-6819D85C8018}"=-
"{2C521CB7-8812-4F78-88BF-10D099AC623D}"=-
"{EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B}"=-
"{5E86ED05-AB5C-4C5E-AC2A-669FC604F104}"=-
"{443D437D-3A7A-48C6-8A7D-C89E861B1F3B}"=-
"{25BF3C20-6A00-4B31-A53C-A978F35FAF66}"=-
[-HKEY_CLASSES_ROOT\CLSID\{04D641C3-1463-4CB3-97E8-E6F65F363D80}]
[-HKEY_CLASSES_ROOT\CLSID\{EE6F34A3-3A43-4450-9C28-DE60EA61D200}]
[-HKEY_CLASSES_ROOT\CLSID\{BFD654BF-6A95-4291-AA9B-78890F322875}]
[-HKEY_CLASSES_ROOT\CLSID\{3E78580A-28B3-4DAA-90A0-6819D85C8018}]
[-HKEY_CLASSES_ROOT\CLSID\{2C521CB7-8812-4F78-88BF-10D099AC623D}]
[-HKEY_CLASSES_ROOT\CLSID\{EC1ACFB8-1807-4EDF-ADCA-F199B7719D5B}]
[-HKEY_CLASSES_ROOT\CLSID\{5E86ED05-AB5C-4C5E-AC2A-669FC604F104}]
[-HKEY_CLASSES_ROOT\CLSID\{443D437D-3A7A-48C6-8A7D-C89E861B1F3B}]
[-HKEY_CLASSES_ROOT\CLSID\{25BF3C20-6A00-4B31-A53C-A978F35FAF66}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
****************************************************************************


[tampabelle]

Hi,

Can you post a fresh HJT log please ???

[breejen]

here it is

Logfile of HijackThis v1.99.1
Scan saved at 11:55:49 PM, on 08/13/05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\command.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\TrojanHunter 4.2\THGuard.exe
C:\WINDOWS\etb\pokapoka63.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\DOCUME~1\JOHANN~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [pdfFactory Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BI1HelperStartUp] C:\PROGRA~1\BEACHI~1\BI1HEL~1.EXE /partner BI1
O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\sspggd.exe reg_run
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [iasnhl] C:\WINDOWS\system32\iasnhl.exe
O4 - HKCU\..\Run: [KB4pROinX] umpnt97.exe
O4 - HKCU\..\Run: [Aida] C:\Program Files\rdso\eetu.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpamBayes Tray Icon.lnk = C:\Program Files\SpamBayes\bin\sb_tray.exe
O4 - Global Startup: D-link AirPlus G DWL-G120 Wireless USB.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsear...earch.html?p=ZU
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O16 - DPF: JT's Blocks - http://download.game...ts/y/blt1_x.cab
O16 - DPF: Toki Toki Boom - http://download.game...nts/y/vto_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Backgammon - http://download.game...nts/y/at1_x.cab
O16 - DPF: Yahoo! Bingo - http://download.game...nts/y/xt0_x.cab
O16 - DPF: Yahoo! Bridge - http://download.game...nts/y/bt1_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct4_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: Yahoo! Gin - http://download.game...nts/y/nt1_x.cab
O16 - DPF: Yahoo! Go Fish - http://download.game...nts/y/zt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.game...nts/y/ht1_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! MahJong - http://download.game...nts/y/ot0_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst4_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt3_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: Yahoo! Reversi - http://download.game...nts/y/rt0_x.cab
O16 - DPF: Yahoo! Sheepshead - http://download.game...nts/y/dt0_x.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {18C3FD15-74F6-4280-9C98-3590C966B7B8} (SkillGam Control) - http://www.worldwinn...am/skillgam.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {41D1977F-4161-4720-800F-EA4903983A38} (Jigsaw Genius Control) - http://www.worldwinn...gsaw/jigsaw.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinn...ck/bjattack.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://www.worldwinn...x/blockwerx.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep....00719/sb02a.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinn...ll/freecell.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1123370263354
O16 - DPF: {6F6DBC29-7A0C-4AC0-A42D-10EC70678526} (Word Cubes Control) - http://www.worldwinn...be/wordcube.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinn...v44/sol/sol.cab
O16 - DPF: {9D8D7672-93FF-417E-9024-C16AD141C50C} (Haunted Control) - http://www.worldwinn...ted/haunted.cab
O16 - DPF: {9EAC0186-5F5A-4362-B120-15C312CE012D} - http://www.awmdabest...cabl/273/tb.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinn...apit/swapit.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinn...man/hangman.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} (Tile City Control) - http://www.worldwinn...ty/tilecity.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinn...paint/paint.cab
O16 - DPF: {CA356D79-679B-4B4C-8E49-5AF97014F4C1} - http://files-pl.star...tarware_323.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.g...zylomloader.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.game...outLauncher.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = L7746.wfix.com
O17 - HKLM\Software\..\Telephony: DomainName = L7746.wfix.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6170FA43-37E8-480B-89CC-60526FF476E0}: Domain = L7746.wfix.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB9F4403-37CD-4872-8E5F-E19B722822F1}: Domain = L7746.wfx.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4AAD1CB-F6DD-4F8C-BE54-F8BD78B236B0}: Domain = L7746.wfix.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = L7746.wfix.com
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[tampabelle]

Please print out these instructions or copy them into a text file on your Desktop for easy access.

During the fix, u will be asked to fix some entries, delete some files or uninstall some programs. If in case, you do not see those entries / files / programs, please make a note of it. Continue with the fix and in your next post please inform me of all deviations from the fix prescribed.

1. Download Programs

Please download these programs and save them in a new folder on your desktop -

CleanUp
Ewido Security Suite

Install Ewido, and update the definitions to the newest files. Do NOT run a scan yet.

CWShredder

Update CWShredder

* Open CWShredder and click I AGREE
* Click Check For Update
* Close CWShredder


2. Remove Infections

Click on Start ---> Run. Type Services.msc and hit enter. Locate the item - Command Service . Right click on it and then click on properties. In the Startup Type choose the option Disable. Close the window.

Restart the PC in Safe Mode (repeatedly tap the F8 key when the PC is starting up).

Run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.

Run CleanUp and delete all temp files including temporary internet files

Run Ewido full scan. Let it fix any items it finds.

3. Run Hijack This

Run Hijack This and click on scan. The following items need to be fixed -

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O4 - HKCU\..\Run: [iasnhl] C:\WINDOWS\system32\iasnhl.exe
O4 - HKCU\..\Run: [KB4pROinX] umpnt97.exe
O4 - HKCU\..\Run: [Aida] C:\Program Files\rdso\eetu.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Search - http://bar.mywebsear...earch.html?p=ZU
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\System32\shdocvw.dll
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep....00719/sb02a.cab
O16 - DPF: {9EAC0186-5F5A-4362-B120-15C312CE012D} - http://www.awmdabest...cabl/273/tb.cab

Close all windows other than Hijack This. Check the boxes next to above items and click on Fix checked.

4. Delete Rogue files

Open Windows Explorer (right click on Start and then click on explore). Locate and delete the following folders and files -

Folders
C:\Program Files\rdso
C:\WINDOWS\etb


Files
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\system32\iasnhl.exe
C:\WINDOWS\command.exe

umpnt97.exe

(Search for this file using the Windows Search function)


Clear out the files in the Prefetch folder. Go to start> run> type into the box Prefetch. It will open the folder Prefetch. Delete all the files in that folder. Dont delete the folder, only the files in it !!!!!!!!

Run Hijack This again. Click on config ---> Misc Tools ---> Delete an NT Service. Type in cmdService and hit enter.

Reboot the PC in Normal Mode.


Run Hijack This and post a fresh HJT log along with Ewido scan report.

[breejen]

hi
I tried to download CWShredder but I keep on getting a "CWShredder has encountered a problem and needs to close. We are sorry for the inconvenience." message. I don't know why I"m getting this message therefore could you recommend another way to get this program or another similar program I could use
Thanks

[tampabelle]

Leave the part about CWShredder. Do the rest of the fix and post back the logs

[breejen]

When I run the services.msc it displays "MMC requires explorere 5.5 or greater to be installed." I have IE 6.0 but it's XPSP-sp2. I have a bunch of my program that won't work because it doesn't recognize this version as being higher than IE 6.0. Is there something I can do to remedy this situation?
Thanks

[tampabelle]

Hi,

You may have problems at different stages. Please continue with the fix to the extent possible and then post back the deviations. We can then tackle all the issues at one time. Usually all these issues have one single solution.

[breejen]

Here's the log

Logfile of HijackThis v1.99.1
Scan saved at 3:44:38 PM, on 08/14/05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\aolserv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\command.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\imapi.exe
C:\DOCUME~1\JOHANN~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\D-link AirPlus G DWL-G120 Wireless USB\120UTIL.exe
C:\Program Files\SpamBayes\bin\sb_tray.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [pdfFactory Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [BI1HelperStartUp] C:\PROGRA~1\BEACHI~1\BI1HEL~1.EXE /partner BI1
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\sspggd.exe reg_run
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpamBayes Tray Icon.lnk = C:\Program Files\SpamBayes\bin\sb_tray.exe
O4 - Global Startup: D-link AirPlus G DWL-G120 Wireless USB.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O16 - DPF: JT's Blocks - http://download.game...ts/y/blt1_x.cab
O16 - DPF: Toki Toki Boom - http://download.game...nts/y/vto_x.cab
O16 - DPF: Tornado 21 - http://download.game...s/y/t21t0_x.cab
O16 - DPF: Video Poker - http://download.game...ts/y/vpt0_x.cab
O16 - DPF: Yahoo! Backgammon - http://download.game...nts/y/at1_x.cab
O16 - DPF: Yahoo! Bingo - http://download.game...nts/y/xt0_x.cab
O16 - DPF: Yahoo! Bridge - http://download.game...nts/y/bt1_x.cab
O16 - DPF: Yahoo! Dice - http://download.game...ts/y/dct4_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: Yahoo! Gin - http://download.game...nts/y/nt1_x.cab
O16 - DPF: Yahoo! Go Fish - http://download.game...nts/y/zt3_x.cab
O16 - DPF: Yahoo! Hearts - http://download.game...nts/y/ht1_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.s...og/y/ks12_x.cab
O16 - DPF: Yahoo! MahJong - http://download.game...nts/y/ot0_x.cab
O16 - DPF: Yahoo! MahJong Solitaire - http://download.game...s/y/mjst4_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt3_x.cab
O16 - DPF: Yahoo! Pyramids - http://download.game...ts/y/pyt1_x.cab
O16 - DPF: Yahoo! Reversi - http://download.game...nts/y/rt0_x.cab
O16 - DPF: Yahoo! Sheepshead - http://download.game...nts/y/dt0_x.cab
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {18C3FD15-74F6-4280-9C98-3590C966B7B8} (SkillGam Control) - http://www.worldwinn...am/skillgam.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {41D1977F-4161-4720-800F-EA4903983A38} (Jigsaw Genius Control) - http://www.worldwinn...gsaw/jigsaw.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay10...es/MsnPUpld.cab
O16 - DPF: {58FC4C77-71C2-4972-A8CD-78691AD85158} (BJA Control) - http://www.worldwinn...ck/bjattack.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://www.worldwinn...x/blockwerx.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinn...ll/freecell.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1123370263354
O16 - DPF: {6F6DBC29-7A0C-4AC0-A42D-10EC70678526} (Word Cubes Control) - http://www.worldwinn...be/wordcube.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinn...v44/sol/sol.cab
O16 - DPF: {9D8D7672-93FF-417E-9024-C16AD141C50C} (Haunted Control) - http://www.worldwinn...ted/haunted.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinn...apit/swapit.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinn...man/hangman.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {BA94245D-2AA0-4953-9D9F-B0EE4CC02C43} (Tile City Control) - http://www.worldwinn...ty/tilecity.cab
O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} (Paint Control) - http://www.worldwinn...paint/paint.cab
O16 - DPF: {CA356D79-679B-4B4C-8E49-5AF97014F4C1} - http://files-pl.star...tarware_323.cab
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.g...zylomloader.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.game...outLauncher.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = L7746.wfix.com
O17 - HKLM\Software\..\Telephony: DomainName = L7746.wfix.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6170FA43-37E8-480B-89CC-60526FF476E0}: Domain = L7746.wfix.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB9F4403-37CD-4872-8E5F-E19B722822F1}: Domain = L7746.wfx.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4AAD1CB-F6DD-4F8C-BE54-F8BD78B236B0}: Domain = L7746.wfix.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = L7746.wfix.com
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

And here's the latest scan from ewido (2nd scan after performing all the other steps you recommended)

--------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 4:44:41 PM, 08/14/05
+ Report-Checksum: BAB7858A

+ Scan result:

C:\Program Files\Microsoft AntiSpyware\Quarantine\EF6B2739-8CB4-4AD4-9463-792D07\CD205FF9-E97C-4A44-BF5C-3D081E -> Spyware.Look2Me : Error during cleaning
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271799.exe -> Adware.Gator : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271800.exe -> Adware.Gator : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271801.dll -> Spyware.WebSearch : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271802.exe -> Adware.BetterInternet : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271803.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271804.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271805.exe -> TrojanDropper.Agent.qz : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271806.dll -> Spyware.EliteBar : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271807.exe -> Spyware.PurityScan : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271808.exe -> Spyware.AdSrve : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271809.exe -> Spyware.AdSrve : Cleaned with backup
C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1365\A0271810.exe -> TrojanSpy.VB.eh : Cleaned with backup


::Report End

[tampabelle]

• Download WinPFind
  • Right Click the Zip Folder and Select "Extract All"
  • Extract it somewhere you will remember like the Desktop
  • Dont do anything with it yet!
• Download Track qoo
  • Save it somewhere you will remember like the Desktop

Reboot into Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Doubleclick WinPFind.exe

• Click "Start Scan"
• It will scan the entire System, so please be patient!
• Once the Scan is Complete
• Go to the WinPFind folder
• Locate WinPFind.txt
• Place those results in the next post!

Reboot back to Normal Mode!

Double Click on "Track qoo.vbs"

Note - If you Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless!

Wait a few seconds and a notepad page will pop up, Copy & Paste those results and place them in the next post along with the results of WinPFind!

[breejen]

here is the winpfind log

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version:

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...
UPX! 01/09/05 12:38:14 PM 4128 C:\8355.exe
PEC2 07/16/05 11:03:30 AM 2547712 C:\crash.txt

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
UPX! 08/02/05 5:46:56 PM 187904 C:\WINDOWS\asappsrv.dll
UPX! 08/02/05 5:58:40 PM 293888 C:\WINDOWS\command.exe
aspack 02/03/03 3:09:00 AM 505360 C:\WINDOWS\eFaxview.exe
abetterinternet.com 08/03/05 5:40:44 AM 10865 C:\WINDOWS\mznoo.dll
web-nex 08/03/05 5:40:44 AM 10865 C:\WINDOWS\mznoo.dll
ad-w-a-r-e.com 08/03/05 5:40:44 AM 10865 C:\WINDOWS\mznoo.dll

Checking %System% folder...
69.59.186.63 08/12/05 5:43:06 PM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
209.66.67.134 08/12/05 5:43:06 PM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.97 08/12/05 5:43:06 PM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
66.63.167.77 08/12/05 5:43:06 PM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
web-nex 08/12/05 5:43:06 PM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
winsync 08/12/05 5:43:06 PM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
rec2_run 08/12/05 5:43:06 PM 30208 C:\WINDOWS\SYSTEM32\datadx.dll
PEC2 08/18/01 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\DFRG.MSC
69.59.186.63 08/14/05 3:43:58 PM 10240 C:\WINDOWS\SYSTEM32\eaann.dll
209.66.67.134 08/14/05 3:43:58 PM 10240 C:\WINDOWS\SYSTEM32\eaann.dll
web-nex 08/14/05 3:43:58 PM 10240 C:\WINDOWS\SYSTEM32\eaann.dll
winsync 08/14/05 3:43:58 PM 10240 C:\WINDOWS\SYSTEM32\eaann.dll
69.59.186.63 08/14/05 3:43:56 PM 46080 C:\WINDOWS\SYSTEM32\fssjjdf.dll
209.66.67.134 08/14/05 3:43:56 PM 46080 C:\WINDOWS\SYSTEM32\fssjjdf.dll
web-nex 08/14/05 3:43:56 PM 46080 C:\WINDOWS\SYSTEM32\fssjjdf.dll
winsync 08/14/05 3:43:56 PM 46080 C:\WINDOWS\SYSTEM32\fssjjdf.dll
aspack 02/03/03 3:09:00 AM 881152 C:\WINDOWS\SYSTEM32\jsdvwsdk.dll
PTech 08/03/05 10:33:42 AM 520456 C:\WINDOWS\SYSTEM32\LegitCheckControl.DLL
PECompact2 08/04/05 10:01:54 AM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 08/04/05 10:01:54 AM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe
UPX! 07/26/05 8:10:54 PM 66048 C:\WINDOWS\SYSTEM32\netcal.exe
KavSvc 08/03/05 5:40:44 AM 34816 C:\WINDOWS\SYSTEM32\nikppcy.dll
69.59.186.63 08/03/05 5:40:44 AM 34816 C:\WINDOWS\SYSTEM32\nikppcy.dll
209.66.67.134 08/03/05 5:40:44 AM 34816 C:\WINDOWS\SYSTEM32\nikppcy.dll
testpopup 08/03/05 5:40:44 AM 34816 C:\WINDOWS\SYSTEM32\nikppcy.dll
web-nex 08/03/05 5:40:44 AM 34816 C:\WINDOWS\SYSTEM32\nikppcy.dll
yourkey 08/03/05 5:40:44 AM 34816 C:\WINDOWS\SYSTEM32\nikppcy.dll
aspack 08/04/04 12:56:38 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 08/04/04 12:56:46 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
winsync 08/18/01 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\WBDBASE.DEU

Checking %System%\Drivers folder and sub-folders...
PTech 08/03/04 10:41:38 PM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\ETC\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
S 08/14/05 5:43:10 PM 2048 C:\WINDOWS\BOOTSTAT.DAT
H 08/06/05 12:51:54 PM 54156 C:\WINDOWS\QTFont.qfn
H 06/25/05 4:03:32 PM 0 C:\WINDOWS\INF\oem41.inf
H 08/07/05 6:50:34 AM 0 C:\WINDOWS\INF\oem42.inf
S 07/08/05 4:23:18 PM 12143 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB893756.cat
S 06/30/05 9:06:34 AM 11437 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896423.cat
S 06/30/05 1:42:18 PM 11084 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899587.cat
S 06/30/05 2:21:10 PM 11084 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899588.cat
S 06/30/05 8:46:18 AM 11084 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899591.cat
S 06/23/05 6:54:18 PM 10849 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB900930.cat
S 06/28/05 10:12:56 PM 11845 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB901214.cat
S 07/02/05 4:18:16 AM 9445 C:\WINDOWS\SYSTEM32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB903235.cat
H 08/14/05 5:42:58 PM 8192 C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
H 08/14/05 5:43:42 PM 1024 C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
H 08/14/05 5:43:14 PM 16384 C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
H 08/14/05 5:44:16 PM 77824 C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
H 08/14/05 5:43:22 PM 1236992 C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
H 08/13/05 10:29:30 PM 1024 C:\WINDOWS\SYSTEM32\CONFIG\USERDIFF.LOG
H 08/10/05 7:19:18 PM 1024 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\NTUSER.DAT.LOG
S 06/21/05 1:30:24 PM 558 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\E6024EAC88E6B6165D49FE3C95ADD735
S 06/21/05 1:30:24 PM 144 C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\E6024EAC88E6B6165D49FE3C95ADD735
SH 08/14/05 3:43:18 PM 388 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\dc8b0a94-94f4-47d8-b422-6ee0cef36a01
SH 08/14/05 3:43:18 PM 24 C:\WINDOWS\SYSTEM32\Microsoft\Protect\S-1-5-18\User\Preferred
H 07/16/05 10:25:26 AM 40613 C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\lxbbma.GID
SH 08/04/05 8:23:58 PM 210 C:\WINDOWS\Tasks\RUTASK.job
H 08/14/05 5:42:12 PM 6 C:\WINDOWS\Tasks\SA.DAT
SH 07/09/05 5:00:26 AM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\1C4WSKBE\desktop.ini
SH 06/20/05 2:06:44 PM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\6A16FH2Q\desktop.ini
SH 07/09/05 5:00:54 AM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\CQN7HYM0\desktop.ini
SH 07/14/05 10:46:34 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\desktop.ini
SH 07/17/05 5:28:06 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\0RLV2ERX\desktop.ini
SH 07/25/05 12:39:26 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\5OH6YOQB\desktop.ini
SH 07/25/05 8:43:48 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\804PKZAD\desktop.ini
SH 07/14/05 10:46:34 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\85AB89AF\desktop.ini
SH 07/17/05 5:28:06 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\8DY7W5YN\desktop.ini
SH 07/25/05 8:43:48 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\C5YRK5MV\desktop.ini
SH 07/14/05 10:46:34 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\CHEFKHMJ\desktop.ini
SH 07/25/05 12:39:26 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\IJM3Q2ZL\desktop.ini
SH 07/25/05 8:43:48 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\KDM3WTE7\desktop.ini
SH 07/17/05 5:28:06 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\LZZZ9L4E\desktop.ini
SH 07/17/05 5:28:06 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\M95MF2D0\desktop.ini
SH 07/25/05 12:39:26 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\MQ46FLMU\desktop.ini
SH 07/15/05 3:09:52 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\O5GZWF4V\desktop.ini
SH 07/14/05 10:46:34 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\OLQROPQV\desktop.ini
SH 07/25/05 12:39:26 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\PIQD254I\desktop.ini
SH 07/15/05 3:09:52 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\QXXMBAX4\desktop.ini
SH 07/25/05 8:43:48 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\SL638XUV\desktop.ini
SH 07/14/05 10:46:34 AM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\W1234567\desktop.ini
SH 07/15/05 3:09:52 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\X7JBDXOE\desktop.ini
SH 07/15/05 3:09:52 PM 67 C:\WINDOWS\Temporary Internet Files\Content.IE5\Z2GNNXKD\desktop.ini

Checking for CPL files...
Microsoft Corporation 08/04/04 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Creative Technology Ltd. 03/19/98 2:00:00 AM 18432 C:\WINDOWS\SYSTEM32\Audiohq.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
08/12/05 5:43:06 PM 31232 C:\WINDOWS\SYSTEM32\conres.cpl
Creative Technology Ltd. 08/24/00 2:56:00 AM 228352 C:\WINDOWS\SYSTEM32\CTDetect.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Sun Microsystems, Inc. 06/03/05 3:52:54 AM 49265 C:\WINDOWS\SYSTEM32\jpicpl32.cpl
Microsoft Corporation 08/18/01 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\MAIN.CPL
Microsoft Corporation 08/04/04 12:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 08/18/01 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\NCPA.CPL
Microsoft Corporation 08/04/04 12:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 08/26/96 2:12:00 AM 341504 C:\WINDOWS\SYSTEM32\QTW32.CPL
Apple Computer, Inc. 01/06/04 4:02:36 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 08/18/01 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\TELEPHON.CPL
Microsoft Corporation 08/04/04 12:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 08/04/04 12:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 05/26/05 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 05/26/05 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\DLLCACHE\wuaucpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
02/25/05 7:06:56 PM 609 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\D-link AirPlus G DWL-G120 Wireless USB.lnk
02/09/04 9:22:38 AM 1730 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
08/14/05 3:43:54 PM 92160 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\riak.exe

Checking files in %ALLUSERSPROFILE%\Application Data folder...
07/08/02 6:32:58 PM 13 C:\Documents and Settings\All Users\Application Data\DirectCDUserNameE.txt

Checking files in %USERPROFILE%\Startup folder...
08/11/05 6:14:06 PM 700 C:\Documents and Settings\Johanna Pinsker\Start Menu\Programs\Startup\SpamBayes Tray Icon.lnk

Checking files in %USERPROFILE%\Application Data folder...
11/09/04 5:13:40 PM 0 C:\Documents and Settings\Johanna Pinsker\Application Data\dm.ini
12/08/03 12:24:12 AM 78856 C:\Documents and Settings\Johanna Pinsker\Application Data\GDIPFONTCACHEV1.DAT
08/22/03 5:09:48 PM 2238 C:\Documents and Settings\Johanna Pinsker\Application Data\iconaugust.ico
08/19/03 1:13:04 AM 2102 C:\Documents and Settings\Johanna Pinsker\Application Data\LG_1010_closed_32x32.ico
02/24/05 4:25:14 PM 9373 C:\Documents and Settings\Johanna Pinsker\Application Data\Microsoft Excel.EML
07/10/03 1:40:30 PM 3774 C:\Documents and Settings\Johanna Pinsker\Application Data\WSM5Roses.ico

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\HotShellExt
{02040CD1-EF11-11D5-BC3F-0003473F5BF0} = C:\Program Files\Common Files\efax\hotshell.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mxynnksx
{17bf7545-dbf1-4b51-b58d-979bca74e464} = C:\WINDOWS\system32\eaann.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WS_FTP
{797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WS_FTP
{797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Program Files\ewido\security suite\context.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9} = C:\PROGRA~1\TROJAN~1.2\contmenu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Yahoo! Toolbar Helper =
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
= C:\PROGRA~1\SPYBOT~1\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9394EDE7-C8B5-483E-8773-474BF36AF6E4}
ST = C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
MSNToolBandBHO = C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDF3E430-B101-42AD-A544-FADC6B084872}
CNavExtBho Class = C:\Program Files\Norton AntiVirus\NavShExt.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{83B28A74-640D-48F4-9F51-E80EED7CC7E0}
=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
Real.com = C:\WINDOWS\System32\Shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping
MenuText = :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}
ButtonText = Research :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
ButtonText = Real.com :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E023F504-0C5A-4750-A1E7-A9046DEA8A21}
ButtonText = MoneySide :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96}
ButtonText = Yahoo! Messenger : C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{9404901D-06DA-4B23-A0EE-3EA4F64EC9B3}
MoneySide = C:\Program Files\Microsoft Money\System\mnyviewer.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Favorites Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
History Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer Band = %SystemRoot%\System32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{EF99BD32-C1FB-11D2-892F-0090271D4F88} = Yahoo! Toolbar :
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
UpdReg C:\WINDOWS\Updreg.exe
AHQInit C:\Program Files\Creative\SBLive\Program\AHQInit.exe
AdaptecDirectCD "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
Dell|Alert C:\Program Files\Dell\Support\Alert\bin\DAMon.exe
BJCFD C:\Program Files\BroadJump\Client Foundation\CFD.exe
DIGStream C:\Program Files\DIGStream\digstream.exe
LexStart
Lexmark X74-X75 "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
pdfFactory Dispatcher v2 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime
AOLDialer C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
AOL Spyware Protection "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
NAV Agent C:\PROGRA~1\NORTON~1\navapw32.exe
Symantec NetDriver Monitor C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
MMTray C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
BI1HelperStartUp C:\PROGRA~1\BEACHI~1\BI1HEL~1.EXE /partner BI1
SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
THGuard "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
winsync C:\WINDOWS\system32\sspggd.exe reg_run

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
msnmsgr "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
Microsoft Works Update Detection C:\Program Files\Microsoft Works\WkDetect.exe
ctfmon.exe C:\WINDOWS\system32\ctfmon.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1
undockwithoutlogon 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer


HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
odensc C:\WINDOWS\system32\odensc.exe
iasnhl C:\WINDOWS\system32\iasnhl.exe


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll
CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll
UPnPMonitor {e57ce738-33e8-4c51-8354-bb4de9d215d1} = C:\WINDOWS\system32\upnpui.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
Shell = explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.3.0 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 08/14/05 5:53:52 PM


here is the prack qoo log

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="C:\\WINDOWS\\Updreg.exe"
"AHQInit"="C:\\Program Files\\Creative\\SBLive\\Program\\AHQInit.exe"
"AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\""
"Dell|Alert"="C:\\Program Files\\Dell\\Support\\Alert\\bin\\DAMon.exe"
"BJCFD"="C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe"
"DIGStream"="C:\\Program Files\\DIGStream\\digstream.exe"
"LexStart"=""
"Lexmark X74-X75"="\"C:\\Program Files\\Lexmark X74-X75\\lxbbbmgr.exe\""
"pdfFactory Dispatcher v2"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\fppdis2a.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"
"AOL Spyware Protection"="\"C:\\PROGRA~1\\COMMON~1\\AOL\\AOLSPY~1\\AOLSP Scheduler.exe\""
"NAV Agent"="C:\\PROGRA~1\\NORTON~1\\navapw32.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer"
"gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\""
"MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe"
"BI1HelperStartUp"="C:\\PROGRA~1\\BEACHI~1\\BI1HEL~1.EXE /partner BI1"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\jusched.exe"
"THGuard"="\"C:\\Program Files\\TrojanHunter 4.2\\THGuard.exe\""
"winsync"="C:\\WINDOWS\\system32\\sspggd.exe reg_run"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

-----------------
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers


Subkey --- ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}
C:\Program Files\ewido\security suite\context.dll

Subkey --- HotShellExt
{02040CD1-EF11-11D5-BC3F-0003473F5BF0}
C:\Program Files\Common Files\efax\hotshell.dll

Subkey --- mxynnksx
{17bf7545-dbf1-4b51-b58d-979bca74e464}
C:\WINDOWS\system32\eaann.dll

Subkey --- Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03}
C:\WINDOWS\System32\cscui.dll

Subkey --- Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936}
C:\WINDOWS\system32\SHELL32.dll

Subkey --- Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46}
C:\WINDOWS\system32\SHELL32.dll

Subkey --- Symantec.Norton.Antivirus.IEContextMenu
{5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2}
C:\Program Files\Norton AntiVirus\NavShExt.dll

Subkey --- TrojanHunter
{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}
C:\PROGRA~1\TROJAN~1.2\contmenu.dll

Subkey --- WS_FTP
{797F3885-5429-11D4-8823-0050DA59922B}
C:\Program Files\WS_FTP Pro\wsftpsi.dll

Subkey --- {a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin
C:\WINDOWS\system32\SHELL32.dll

=====================

HKEY_CLASSES_ROOT\Folder\shellex\ColumnHandlers


Subkey --- {0D2E74C4-3C34-11d2-A27E-00C04FC30871}
C:\WINDOWS\system32\SHELL32.dll

Subkey --- {24F14F01-7B1C-11d1-838f-0000F80461CF}
C:\WINDOWS\system32\SHELL32.dll

Subkey --- {24F14F02-7B1C-11d1-838f-0000F80461CF}
C:\WINDOWS\system32\SHELL32.dll

Subkey --- {66742402-F9B9-11D1-A202-0000F81FEDEE}
C:\WINDOWS\system32\SHELL32.dll

==============================
C:\Documents and Settings\All Users\Start Menu\Programs\Startup

D-link AirPlus G DWL-G120 Wireless USB.lnk
DESKTOP.INI
Microsoft Office.lnk
riak.exe
==============================
C:\Documents and Settings\Johanna Pinsker\Start Menu\Programs\Startup

D-link AirPlus G DWL-G120 Wireless USB.lnk
DESKTOP.INI
Microsoft Office.lnk
riak.exe
DESKTOP.INI
SpamBayes Tray Icon.lnk
==============================
C:\WINDOWS\SYSTEM32 cpl files


access.cpl Microsoft Corporation
appwiz.cpl Microsoft Corporation
Audiohq.cpl Creative Technology Ltd.
bthprops.cpl Microsoft Corporation
conres.cpl
CTDetect.cpl Creative Technology Ltd.
desk.cpl Microsoft Corporation
firewall.cpl Microsoft Corporation
hdwwiz.cpl Microsoft Corporation
inetcpl.cpl Microsoft Corporation
intl.cpl Microsoft Corporation
irprops.cpl Microsoft Corporation
joy.cpl Microsoft Corporation
jpicpl32.cpl Sun Microsystems, Inc.
MAIN.CPL Microsoft Corporation
mmsys.cpl Microsoft Corporation
NCPA.CPL Microsoft Corporation
netsetup.cpl Microsoft Corporation
nusrmgr.cpl Microsoft Corporation
odbccp32.cpl Microsoft Corporation
powercfg.cpl Microsoft Corporation
QTW32.CPL Apple Computer, Inc.
QuickTime.cpl Apple Computer, Inc.
sysdm.cpl Microsoft Corporation
TELEPHON.CPL Microsoft Corporation
timedate.cpl Microsoft Corporation
wscui.cpl Microsoft Corporation
wuaucpl.cpl Microsoft Corporation