Hi Cretemonster,
I ran l2mfix second.bat. I didn't realize my computer rebooted. Anyway here are the l2mfix log and HijackThis log. Thanks.
Setting Directory
C:\Documents and Settings\Owner\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 540 'explorer.exe'
Killing PID 540 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 1584 'rundll32.exe'
Scanning First Pass. Please Wait!
Setting Directory
C:\Documents and Settings\Owner\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 2432 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 2544 'rundll32.exe'
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Backing Up: C:\WINNT\system32\kidfc.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\kidfc.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\kydukx.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\kydukx.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\rWsauto.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\rWsauto.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\vnar332.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\vnar332.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\WZDMLOG.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\WZDMLOG.dll
1 file(s) copied.
deleting: C:\WINNT\system32\kidfc.dll
Successfully Deleted: C:\WINNT\system32\kidfc.dll
deleting: C:\WINNT\system32\kidfc.dll
Successfully Deleted: C:\WINNT\system32\kidfc.dll
deleting: C:\WINNT\system32\kydukx.dll
Successfully Deleted: C:\WINNT\system32\kydukx.dll
deleting: C:\WINNT\system32\kydukx.dll
Successfully Deleted: C:\WINNT\system32\kydukx.dll
deleting: C:\WINNT\system32\rWsauto.dll
Successfully Deleted: C:\WINNT\system32\rWsauto.dll
deleting: C:\WINNT\system32\rWsauto.dll
Successfully Deleted: C:\WINNT\system32\rWsauto.dll
deleting: C:\WINNT\system32\vnar332.dll
Successfully Deleted: C:\WINNT\system32\vnar332.dll
deleting: C:\WINNT\system32\vnar332.dll
Successfully Deleted: C:\WINNT\system32\vnar332.dll
deleting: C:\WINNT\system32\WZDMLOG.dll
Successfully Deleted: C:\WINNT\system32\WZDMLOG.dll
deleting: C:\WINNT\system32\WZDMLOG.dll
Successfully Deleted: C:\WINNT\system32\WZDMLOG.dll
Zipping up files for submission:
adding: kidfc.dll (184 bytes security) (deflated 48%)
adding: kydukx.dll (184 bytes security) (deflated 48%)
adding: rWsauto.dll (184 bytes security) (deflated 48%)
adding: vnar332.dll (184 bytes security) (deflated 48%)
adding: WZDMLOG.dll (184 bytes security) (deflated 48%)
adding: clear.reg (184 bytes security) (deflated 22%)
adding: 1st report.txt (184 bytes security) (deflated 65%)
adding: direct.txt (184 bytes security) (stored 0%)
adding: lo2.txt (184 bytes security) (deflated 83%)
adding: readme.txt (184 bytes security) (deflated 51%)
adding: test.txt (184 bytes security) (deflated 81%)
adding: test2.txt (184 bytes security) (stored 0%)
adding: test3.txt (184 bytes security) (stored 0%)
adding: test5.txt (184 bytes security) (stored 0%)
adding: xfind.txt (184 bytes security) (deflated 78%)
adding: backregs/0B9E6FCA-A408-4E7C-92F9-8E45F45BAA9B.reg (184 bytes security) (deflated 70%)
adding: backregs/54E79E18-1C56-4009-A2F8-A47E56580C3F.reg (184 bytes security) (deflated 70%)
adding: backregs/6D8E50A4-D6F3-45F3-BE36-1D77C25E05C2.reg (184 bytes security) (deflated 70%)
adding: backregs/9C32E396-4135-4CD5-9CB6-FD5370DB0C62.reg (184 bytes security) (deflated 71%)
adding: backregs/C7FA6C7A-2671-4DD5-A0FD-A423DBB14BB4.reg (184 bytes security) (deflated 70%)
adding: backregs/shell.reg (184 bytes security) (deflated 74%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!
Warning (option /rga:(ci)) - There is no ACE to remove!
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
Restoring Windows Update Certificates.:
deleting local copy: kidfc.dll
deleting local copy: kidfc.dll
deleting local copy: kydukx.dll
deleting local copy: kydukx.dll
deleting local copy: rWsauto.dll
deleting local copy: rWsauto.dll
deleting local copy: vnar332.dll
deleting local copy: vnar332.dll
deleting local copy: WZDMLOG.dll
deleting local copy: WZDMLOG.dll
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\vnar332.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
The following are the files found:
****************************************************************************
C:\WINNT\system32\kidfc.dll
C:\WINNT\system32\kidfc.dll
C:\WINNT\system32\kydukx.dll
C:\WINNT\system32\kydukx.dll
C:\WINNT\system32\rWsauto.dll
C:\WINNT\system32\rWsauto.dll
C:\WINNT\system32\vnar332.dll
C:\WINNT\system32\vnar332.dll
C:\WINNT\system32\WZDMLOG.dll
C:\WINNT\system32\WZDMLOG.dll
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{9C32E396-4135-4CD5-9CB6-FD5370DB0C62}"=-
[-HKEY_CLASSES_ROOT\CLSID\{9C32E396-4135-4CD5-9CB6-FD5370DB0C62}]
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Setting Directory
C:\Documents and Settings\Owner\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 540 'explorer.exe'
Killing PID 540 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 1584 'rundll32.exe'
Scanning First Pass. Please Wait!
Setting Directory
C:\Documents and Settings\Owner\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 2432 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 2544 'rundll32.exe'
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Backing Up: C:\WINNT\system32\kidfc.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\kidfc.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\kydukx.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\kydukx.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\rWsauto.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\rWsauto.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\vnar332.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\vnar332.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\WZDMLOG.dll
1 file(s) copied.
Backing Up: C:\WINNT\system32\WZDMLOG.dll
1 file(s) copied.
deleting: C:\WINNT\system32\kidfc.dll
Successfully Deleted: C:\WINNT\system32\kidfc.dll
deleting: C:\WINNT\system32\kidfc.dll
Successfully Deleted: C:\WINNT\system32\kidfc.dll
deleting: C:\WINNT\system32\kydukx.dll
Successfully Deleted: C:\WINNT\system32\kydukx.dll
deleting: C:\WINNT\system32\kydukx.dll
Successfully Deleted: C:\WINNT\system32\kydukx.dll
deleting: C:\WINNT\system32\rWsauto.dll
Successfully Deleted: C:\WINNT\system32\rWsauto.dll
deleting: C:\WINNT\system32\rWsauto.dll
Successfully Deleted: C:\WINNT\system32\rWsauto.dll
deleting: C:\WINNT\system32\vnar332.dll
Successfully Deleted: C:\WINNT\system32\vnar332.dll
deleting: C:\WINNT\system32\vnar332.dll
Successfully Deleted: C:\WINNT\system32\vnar332.dll
deleting: C:\WINNT\system32\WZDMLOG.dll
Successfully Deleted: C:\WINNT\system32\WZDMLOG.dll
deleting: C:\WINNT\system32\WZDMLOG.dll
Successfully Deleted: C:\WINNT\system32\WZDMLOG.dll
Zipping up files for submission:
adding: kidfc.dll (184 bytes security) (deflated 48%)
adding: kydukx.dll (184 bytes security) (deflated 48%)
adding: rWsauto.dll (184 bytes security) (deflated 48%)
adding: vnar332.dll (184 bytes security) (deflated 48%)
adding: WZDMLOG.dll (184 bytes security) (deflated 48%)
adding: clear.reg (184 bytes security) (deflated 22%)
adding: 1st report.txt (184 bytes security) (deflated 65%)
adding: direct.txt (184 bytes security) (stored 0%)
adding: lo2.txt (184 bytes security) (deflated 83%)
adding: readme.txt (184 bytes security) (deflated 51%)
adding: test.txt (184 bytes security) (deflated 81%)
adding: test2.txt (184 bytes security) (stored 0%)
adding: test3.txt (184 bytes security) (stored 0%)
adding: test5.txt (184 bytes security) (stored 0%)
adding: xfind.txt (184 bytes security) (deflated 78%)
adding: backregs/0B9E6FCA-A408-4E7C-92F9-8E45F45BAA9B.reg (184 bytes security) (deflated 70%)
adding: backregs/54E79E18-1C56-4009-A2F8-A47E56580C3F.reg (184 bytes security) (deflated 70%)
adding: backregs/6D8E50A4-D6F3-45F3-BE36-1D77C25E05C2.reg (184 bytes security) (deflated 70%)
adding: backregs/9C32E396-4135-4CD5-9CB6-FD5370DB0C62.reg (184 bytes security) (deflated 71%)
adding: backregs/C7FA6C7A-2671-4DD5-A0FD-A423DBB14BB4.reg (184 bytes security) (deflated 70%)
adding: backregs/shell.reg (184 bytes security) (deflated 74%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!
Warning (option /rga:(ci)) - There is no ACE to remove!
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
Restoring Windows Update Certificates.:
deleting local copy: kidfc.dll
deleting local copy: kidfc.dll
deleting local copy: kydukx.dll
deleting local copy: kydukx.dll
deleting local copy: rWsauto.dll
deleting local copy: rWsauto.dll
deleting local copy: vnar332.dll
deleting local copy: vnar332.dll
deleting local copy: WZDMLOG.dll
deleting local copy: WZDMLOG.dll
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\vnar332.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
The following are the files found:
****************************************************************************
C:\WINNT\system32\kidfc.dll
C:\WINNT\system32\kidfc.dll
C:\WINNT\system32\kydukx.dll
C:\WINNT\system32\kydukx.dll
C:\WINNT\system32\rWsauto.dll
C:\WINNT\system32\rWsauto.dll
C:\WINNT\system32\vnar332.dll
C:\WINNT\system32\vnar332.dll
C:\WINNT\system32\WZDMLOG.dll
C:\WINNT\system32\WZDMLOG.dll
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{9C32E396-4135-4CD5-9CB6-FD5370DB0C62}"=-
[-HKEY_CLASSES_ROOT\CLSID\{9C32E396-4135-4CD5-9CB6-FD5370DB0C62}]
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
HijackThis log after l2mfix,
Logfile of HijackThis v1.99.1
Scan saved at 12:49:03 PM, on 8/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\NMSSvc.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\system32\SK9910DM.EXE
C:\WINNT\GWMDMMSG.exe
C:\WINNT\system32\igfxtray.exe
C:\WINNT\system32\hkcmd.exe
C:\WINNT\system32\nkuyqt.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\XQV\aurareco.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\dinst.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\WINNT\system32\ctfmon.exe
C:\Documents and Settings\Owner\My Documents\Download software\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.gateway.netR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {71D31E32-A7A3-8770-8669-AB1855ACC499} - C:\WINNT\system32\qbameb.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: AIM Helper - {D70E6A20-7060-4829-B3D7-B6624A1DE7C6} - C:\Program Files\AIM Toolbar\aimhelper.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [Keyboard Preload Check] C:\OEMDRVRS\KEYB\Preload.exe /DEVID: /CLASS:Keyboard /RunValue:"Keyboard Preload Check"
O4 - HKLM\..\Run: [GWMDMpi] C:\WINNT\GWMDMpi.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Dinst] C:\WINNT\dinst.exe
O4 - HKLM\..\Run: [ppnbhs] C:\WINNT\system32\nkuyqt.exe r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -
http://housecall60.t...all/xscan60.cabO16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) -
http://www.clubbox.c.../NowStarter.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....k/?linkid=39204O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) -
http://www.icannnews.../ST/ActiveX.ocxO16 - DPF: {48ED5A74-A5A6-4EDE-AAC5-42D697FC3F19} (cyberX Control) -
http://www.cyberoro....nload/cyber.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai...all/xscan53.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoft...free/asinst.cabO20 - Winlogon Notify: ShellScrap - C:\WINNT\system32\vnar332.dll (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINNT\svcproc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Sign In
Create Account
