[ghostyy]

Newest log(september 11)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [hBv2RWM5V] glmmrt.exe
O4 - HKCU\..\Run: [Software Less] C:\DOCUME~1\OWNER~1.YOU\APPLIC~1\DELETE~1\vc else.exe
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\Yahoo!\YPSR\ppclean.exe" "clean" "smartfinder" "2"
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Microsoft AntiSpyware helper (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121982530265
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macrom...abs/swflash.cab



Getting pop ups [bleep], Ran ad-adware and microsoft's all that good stuff, Nothings killing it, help please!!! :'( Im going nuts ><

Edited by ghostyy, 11 September 2005 - 10:31 AM.

[Advertisements]

Hello

Sorry for the delayed response, it has been very busy lately.

If you still require help please post a new Hijack log in this
thread and I will help you. If your problem has been fixed please
respond and let us know.

Thanks

[loophole]

Hello

Sorry for the delayed response, it has been very busy lately.

If you still require help please post a new Hijack log in this
thread and I will help you. If your problem has been fixed please
respond and let us know.

Thanks

[ghostyy]

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Winamp\winampa.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\rundll32.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [hBv2RWM5V] glmmrt.exe
O4 - HKCU\..\Run: [Software Less] C:\DOCUME~1\OWNER~1.YOU\APPLIC~1\DELETE~1\vc else.exe
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\Yahoo!\YPSR\ppclean.exe" "clean" "smartfinder" "2"
O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O9 - Extra button: Microsoft AntiSpyware helper (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macr...director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121982530265
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macrom...abs/swflash.cab

[loophole]

Can you please post a new Hijack log including the header at the top

Thanks

[ghostyy]

Logfile of HijackThis v1.99.1
Scan saved at 11:49:37 PM, on 9/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Winamp\winampa.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\rundll32.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Local Settings\Temporary Internet Files\Content.IE5\OXM74PQZ\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\Yahoo!\YPSR\ppclean.exe" "clean" "smartfinder" "2"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [hBv2RWM5V] glmmrt.exe
O4 - HKCU\..\Run: [Software Less] C:\DOCUME~1\OWNER~1.YOU\APPLIC~1\DELETE~1\vc else.exe
O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Microsoft AntiSpyware helper - {B8AD7EB4-1CB1-41C6-947D-64E7A320506E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {B8AD7EB4-1CB1-41C6-947D-64E7A320506E} - (no file) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121982530265
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) -

Sorry about that

[loophole]

Hello and welcome to Geeks to Go

I see you have been infected by malware. Lets get you fixed up.
Please follow the directions as closely as you can . Lets begin

Please download FileFind from Atribune.
Unzip the file and save it to your desktop.

To run FileFind, please do the following:

• Click on FileFind.exe
• In the box labeled "Enter the directory to search"
  • Enter Drive eg.. C:\
• In the box labeled "Enter the file to search"
  • Enter the file glmmrt.exe to search for the file(s)
• Now click on the "Find" button
• Once the utility has found the files click on "Export"
• This will save a text file to your C:\ drive as "Export.txt"
• Double click on Export.txt, copy and paste this information in your next post

[ghostyy]

No files found

[loophole]

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O4 - HKCU\..\Run: [hBv2RWM5V] glmmrt.exe
O9 - Extra button: Microsoft AntiSpyware helper - {B8AD7EB4-1CB1-41C6-947D-64E7A320506E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {B8AD7EB4-1CB1-41C6-947D-64E7A320506E} - (no file) (HKCU)

Now close all windows other than HiJackThis, then click Fix Checked

Please run this online virus scan:
Panda Active Scan You need to use Internet Explorer for this scan.

• Once you get to the Panda site, scroll down a bit and click on Scan your PC
• A new window will appear; click on Check Now!
• A new window will appear; fill in the boxes (Country, State, email addy)
• Click on Scan Now! >
  If you have never used ActiveScan before, you will be prompted to install an ActiveX control (asinst.cab) : click on Install. Panda will install the component, and then install the latest signature files.
• From "Select a device to scan...", choose "My Computer"
• Allow the scan to run. It'll take a while.
• When complete, click on "See Report", and then on "Save report"; save it to a convenient location.
• I will need you to post that report in your next reply; simply open the text file, then copy/paste the content here. Also post a new Hijack log

Thanks

[ghostyy]

Incident Status Location

Adware:Adware/Lop No disinfected c:\docume~1\owner~1.you\locals~1\temp\johoqkth.exe
Adware:adware/superspider No disinfected C:\PROGRAM FILES\q330994.exe
Adware:adware/transponder No disinfected C:\WINDOWS\SYSTEM32\c17b6s.dll
Spyware:spyware/whazit No disinfected C:\WINDOWS\SYSTEM32\fiz1
Adware:adware/powersearch No disinfected C:\WINDOWS\SYSTEM32\stlb2.xml
Adware:adware/keenvalue No disinfected C:\WINDOWS\BROWSERXTRAS\PN\remove.exe
Adware:adware/cws.searchmeup No disinfected C:\new.exe
Adware:adware/bookedspace No disinfected C:\WINDOWS\cfgmgr52.ini
Spyware:spyware/virtumonde No disinfected C:\WINDOWS\dpusys.ini
Adware:adware/adurl No disinfected C:\WINDOWS\icont.exe
Adware:adware/msxmidi No disinfected C:\WINDOWS\msxmidi.exe
Dialer:dialer.xd No disinfected C:\WINDOWS\switchagreement.txt
Spyware:spyware/wareout No disinfected C:\WINDOWS\tmp.hta
Adware:adware/ncase No disinfected C:\WINDOWS\SYSTEM32\FLEOK
Adware:adware/sidesearch No disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Lycos
Spyware:spyware/cydoor No disinfected C:\WINDOWS\cdmxtras
Adware:adware/sqwire No disinfected Windows Registry
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\audio browse math save\Htm Multi.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\DELETE HOLE SUPPORT\vc else.exe
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\Dummy.class-41eed9ac-49707715.class
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\VerifierBug.class-5d2e5082-356add75.class
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\1Click DVD Copy 4.2.1.5.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\ABBA - Gold.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Access Database Design Programming. 3rd.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Atomix Virtual DJ 3.1.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Avant Browser 10.1.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Ballance 1.13.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\BurnerSoft Smart DVDCD Burner 3.0.33.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Cisco Routers for The Desperate - No Sta.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\ColorShade 2.5.1.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\DVD Cloner II 2.50.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\EasyBoot UltraISO 7.6.2.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Franz Ferdinand - Franz Ferdinand.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\GameJack Version 5.0.3.6.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Good Keywords 2.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\High Impact Email Pro 3.2.212.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Internet TV 4.5.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\K-Lite Codec Pack 2.53.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\LanBuster 1.02.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Logos and Ringtones for Nokia.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\MAD TV - Jim Carrey Funny Videos.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\MB Ruler 3.0.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\POP3 Cleaner 2.1.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Power Retouche.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Raxco PerfectDisk 7.0.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Robots (2005).zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\SkinStudio 4.6.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Super Utilities 5.3.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Titan FTP 4.02.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Total Game Control 3.3.3.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Ulead GIF Animator 5.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Ultimate Forum Pack 1.2.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\VA - Angels 2 Chill Trance Essentials 2C.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Windows XP Pro 64-bit.zip[Setup.exe]
Virus:W32/Alcan.A.worm Disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Complete\Wintensity Screen Dimmer 101.zip[Setup.exe]
Adware:Adware/Lop No disinfected C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Local Settings\Temp\johoqkth.exe
Virus:W32/ImpLinker.A Disinfected C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
Adware:Adware/AdDestroyer No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\288BB76E-4A26-4AC7-B975-BF59AE\37A661D0-92E0-45F7-AEC3-BB8221
Adware:Adware/AdDestroyer No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\288BB76E-4A26-4AC7-B975-BF59AE\7CFEFC29-FB1E-4EA1-90AE-14BE93
Adware:Adware/AdDestroyer No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\288BB76E-4A26-4AC7-B975-BF59AE\805821A3-8C7E-4B2B-9D9E-AA7F73
Adware:Adware/Apropos No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\39C64E84-3CEA-4668-B1E9-ACC09A\95A8FF9C-F1E0-43D2-94CD-C20933
Adware:Adware/Apropos No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\39C64E84-3CEA-4668-B1E9-ACC09A\DC2C6020-92C0-4832-9008-94D20A
Adware:Adware/BookedSpace No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\485CD8D2-41FD-43B7-A8D1-F14C26\7BCC7754-EB19-48D5-95E9-90982C
Adware:Adware/Apropos No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\50488455-9572-483B-855D-9C1031\D0C74033-7959-420A-BD10-F73F9A
Adware:Adware/FavoriteMan No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\5148FD8D-BA38-4FE6-B90B-EDE266\3B98CD7A-7898-4D2C-9082-C7EC81
Adware:Adware/nCase No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\58E209B1-4099-4797-991C-8F6BA6\9056AE81-D80C-437E-BBC9-4BB9CF
Adware:Adware/nCase No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\58E209B1-4099-4797-991C-8F6BA6\F5EC0B43-2907-4233-B6E0-E4AFF2
Spyware:Spyware/New.net No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\610D6532-FFF8-4D5D-A907-841842\590F4A5B-81DB-4F81-BD0A-E85FA5
Spyware:Spyware/New.net No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\610D6532-FFF8-4D5D-A907-841842\E1A304B4-599D-4D90-93E6-4479C6
Adware:Adware/Apropos No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\6C810E19-6F7F-4034-A1E8-5A69FA\C9C22D05-F95E-4A09-B59C-4BFD10
Virus:Trj/Clicker.DJ Disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\7B1AFF16-503B-4F79-8294-D691C8\4D20D061-B0D3-4A28-A8CA-4F8E5E
Adware:Adware/BrowserAid No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\84B0442A-F164-4982-9BA9-55161F\76DDD21A-4BFC-445F-AF16-1E5C3F
Adware:Adware/WUpd No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\8A4B3E01-B0E8-4E11-82AF-B1A26C\B8CFB9EA-0485-4414-AD61-272D3C
Adware:Adware/BookedSpace No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\8EDC5235-39F1-4B90-956C-E91CE9\84E28968-36F6-4FDD-8A79-E6C86B
Adware:Adware/BookedSpace No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\A389BB86-9043-44A7-919A-A181E2\2E801A2F-6FDE-47B1-8E1E-CE10D0
Adware:Adware/Lop No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\A4222B5E-9952-4D80-BFCA-31DA9A\74050ECE-ADAF-474C-B73E-BB1A99
Virus:Trj/Clicker.DJ Disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\A8DA1FFE-F232-4700-ACCC-B1B803\77A19B7E-89A8-4586-A560-0602FB
Adware:Adware/Apropos No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B2287E28-4D4A-47A8-AF09-8CBD5D\7C2E4F96-A47A-49AD-B020-AC29C8
Adware:Adware/Apropos No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B2287E28-4D4A-47A8-AF09-8CBD5D\AA376A2A-18B2-44C0-B15D-D72CDD
Adware:Adware/E2Give No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\B621EAFD-8EDC-4E02-90C8-93BBE7\D877E233-E566-4A50-9921-12F0A1
Adware:Adware/nCase No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\C0A1E0BA-A813-49E4-A208-8BA6F3\30B308D0-CF19-4AD8-9932-17CFBA
Adware:Adware/DelFinMedia No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\CAA42593-1EA0-439C-AB26-A267BA\A67E1257-587E-4100-A55A-CB039A
Virus:Trj/Clicker.DJ Disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\E0242A35-4192-4D1A-A409-63BCA5\0262303D-260B-4B7F-B294-43C30E
Adware:Adware/Lop No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\F9335C9E-CB7A-48C5-A3BE-03C3E1\6C36A465-E653-41CA-8116-8B6659
Virus:W32/Alcan.A.worm Disinfected C:\Program Files\winupdates\a.zip[Setup.exe]
Adware:Adware/DelFinMedia No disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\20050722182118.zip[RemoveDisplayUtility.exe]
Adware:Adware/Apropos No disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq2D.tmp
Adware:Adware/IEDriver No disinfected C:\Program Files\Yahoo!\YPSR\Quarantine\ppq3C.tmp
Spyware:Spyware/BetterInet No disinfected C:\RECYCLER\S-1-5-21-1857549811-1087583210-3220342197-1003\Dc32\Quarantine\20041112233327578.zip[data1.dat]
Adware:Adware/Apropos No disinfected C:\RECYCLER\S-1-5-21-1857549811-1087583210-3220342197-1003\Dc32\Quarantine\ppq1427.tmp
Adware:Adware/Apropos No disinfected C:\RECYCLER\S-1-5-21-1857549811-1087583210-3220342197-1003\Dc32\Quarantine\ppq1428.tmp
Adware:Adware/P2PNetworking No disinfected C:\RECYCLER\S-1-5-21-1857549811-1087583210-3220342197-1003\Dc32\Quarantine\ppq144C.tmp
Adware:Adware/Apropos No disinfected C:\RECYCLER\S-1-5-21-1857549811-1087583210-3220342197-1003\Dc32\Quarantine\ppq1453.tmp
Spyware:Spyware/BetterInet No disinfected C:\RECYCLER\S-1-5-21-1857549811-1087583210-3220342197-1003\Dc34\button.inf
Adware:Adware/Startpage.RF No disinfected C:\RECYCLER\S-1-5-21-1857549811-1087583210-3220342197-1003\Dc34\search.inf
Adware:Adware/ISearch No disinfected C:\WINDOWS\HLInstaller6b.exe
Spyware:Spyware/Melkosoft No disinfected C:\WINDOWS\lexa.exe
Possible Virus. No disinfected C:\WINDOWS\msupdsrv.exe
Dialer:Dialer.Gen No disinfected C:\WINDOWS\switchagreement.txt
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\abi3d1ag.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\agtodisc.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\awlui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ayptif.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\bdhci.dll
Adware:Adware/KeenValue No disinfected C:\WINDOWS\system32\c17b6s.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cnmpstui.dll
Adware:Adware/Midaddle No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\8NT.dll
Adware:Adware/Midaddle No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\addit.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\alchem.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\alchem.ini
Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\auf0.exe
Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\auf1.exe
Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\auf2.exe
Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\AutoUpdate0\setup.inf
Adware:Adware/StatBlaster No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\BSy.exe
Adware:Adware/Midaddle No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\S.exe
Adware:Adware/Gator No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\Temporary Internet Files\Content.IE5\9M9AXMG6\hdplugin_1015_bundle43v2d12[1].cab[HDPlugin1015.dll]
Adware:Adware/Twain-Tech No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\THI31A7.tmp\twaintec.inf
Adware:Adware/eZula No disinfected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\TopTextiLookup.htm
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\csmmdlg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cvwmdm.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cWrds.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cxlbact.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dbdiagn.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dbspex.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dndmoprp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dtwsockx.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dv7vb.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\dzocx.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\fecfg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\hkvcp70.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iusetup.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iwetcomm.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kddru.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lb32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lhckout.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lpcalspl.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\lrbmp11n.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mcdtclog.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mcftedit.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mfrui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mjieftp.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mNg_hook.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\MOIMRT.DLL
Spyware:Spyware/Inetdo No disinfected C:\WINDOWS\system32\ms0b920b.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\msrmsg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mtrui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mx43dmod.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\myrddm.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\myrui.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ncevtmsg.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nrobjapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nrwrsde.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nsobjapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ntshell.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\numarta.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\oce2.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ogfox32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\onfox32.dll
Adware:Adware/SearchExe No disinfected C:\WINDOWS\system32\oohm.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\otbc32gt.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\pjrpnsp.dll
Virus:W32/ImpLinker.A Disinfected C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\nview.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rEsapi32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rppwsx.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\RYBios32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sdmapi.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\snextspk.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\swrrun.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\sxman32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wnsapi32.dll
Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wossvc.dll
Adware:Adware/PurityScan No disinfected C:\WINDOWS\system32\??curity\javaw.exe
Virus:JS/Psyme.AG Disinfected C:\WINDOWS\tmp.hta

[ghostyy]

Logfile of HijackThis v1.99.1
Scan saved at 10:06:54 PM, on 9/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\OWNER~1.YOU\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\Yahoo!\YPSR\ppclean.exe" "clean" "smartfinder" "2"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Software Less] C:\DOCUME~1\OWNER~1.YOU\APPLIC~1\DELETE~1\vc else.exe
O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121982530265
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe

[loophole]

Is that all Now I can see the problem. Lets start cleaning

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

[ghostyy]

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OPXPGina]
"STARTUP"="OPWlxStartup"
"RECONNECT"="OPWlxReconnect"
"UNLOCK"="OPWlxUnlock"
"ASYNCHRONOUS"=dword:00000000
"DLLNAME"="C:\\Program Files\\Softex\\OmniPass\\opxpgina.dll"
"STOPSCREENSAVER"="OPWlxStopScreenSaver"
"STARTSCREENSAVER"="OPWlxStartScreenSaver"
"LOCK"="OPWlxLock"
"LOGOFF"="OPWlxLogoff"
"SHUTDOWN"="OPWlxShutdown"
"STARTSHELL"="OPWlxStartShell"
"IMPERSONATE"=dword:00000000
"LOGON"="OPWlxLogon"
"DISCONNECT"="OPWlxDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{648070CF-739D-FCE6-82F4-B32FDE07AC2B}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}"="Share-to-Web Upload Folder"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{7F67036B-66F1-411A-AD85-759FB9C5B0DB}"="SampleView"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{CCFE56EE-C7DE-44EE-A160-4553A5A912C9}"="OmniPass Shell Extension"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
abi3d1ag.dll Fri Jul 22 2005 5:32:28p ..S.R 417,792 408.00 K
agtodisc.dll Fri Jul 22 2005 5:32:34p ..S.R 417,792 408.00 K
awlui.dll Mon Jul 11 2005 9:57:34a ..S.R 417,792 408.00 K
ayptif.dll Fri Jul 22 2005 12:28:56p ..S.R 417,792 408.00 K
bdhci.dll Fri Jul 22 2005 7:09:50a ..S.R 417,792 408.00 K
browseui.dll Sat Jul 2 2005 8:11:28p A.... 1,019,904 996.00 K
cdfview.dll Sat Jul 2 2005 8:11:28p A.... 151,040 147.50 K
cmdlin~1.dll Thu Sep 1 2005 7:34:10p A.... 43,520 42.50 K
cnmpstui.dll Fri Jul 22 2005 10:20:22p ..S.R 417,792 408.00 K
csmmdlg.dll Thu Jul 21 2005 9:01:48p ..S.R 417,792 408.00 K
cvwmdm.dll Fri Jul 22 2005 10:20:12p ..S.R 417,792 408.00 K
cwrds.dll Thu Jul 21 2005 9:01:26p ..S.R 417,792 408.00 K
cxlbact.dll Fri Jul 22 2005 7:10:08a ..S.R 417,792 408.00 K
dbdiagn.dll Thu Jul 21 2005 7:45:30p ..S.R 417,792 408.00 K
dbspex.dll Mon Jul 11 2005 11:01:24a ..S.R 417,792 408.00 K
dndmoprp.dll Thu Jul 21 2005 10:25:12p ..S.R 417,792 408.00 K
dtwsockx.dll Thu Jul 21 2005 10:25:06p ..S.R 417,792 408.00 K
dv7vb.dll Thu Jul 21 2005 2:25:52p ..S.R 417,792 408.00 K
dzocx.dll Thu Jul 21 2005 2:25:32p ..S.R 417,792 408.00 K
fecfg.dll Mon Jul 11 2005 11:01:56a ..S.R 417,792 408.00 K
gccoll~1.dll Tue Jul 12 2005 3:35:14p A.... 126,680 123.71 K
gcunco~1.dll Tue Jul 12 2005 3:35:10p A.... 95,448 93.21 K
hashlib.dll Tue Jul 12 2005 3:35:14p A.... 117,976 115.21 K
hkvcp70.dll Thu Jul 21 2005 7:46:00p ..S.R 417,792 408.00 K
icm32.dll Tue Jun 28 2005 7:46:00p A.... 254,976 249.00 K
iepeers.dll Sat Jul 2 2005 8:11:28p A.... 251,392 245.50 K
inseng.dll Sat Jul 2 2005 8:11:28p A.... 96,256 94.00 K
iusetup.dll Fri Jul 22 2005 8:21:44a ..S.R 417,792 408.00 K
iwetcomm.dll Fri Jul 22 2005 8:21:58a ..S.R 417,792 408.00 K
kddru.dll Thu Jul 21 2005 6:16:20p ..S.R 417,792 408.00 K
lb32.dll Fri Jul 22 2005 11:02:58a ..S.R 417,792 408.00 K
lhckout.dll Thu Jul 21 2005 6:16:46p ..S.R 417,792 408.00 K
lpcalspl.dll Fri Jul 22 2005 11:02:46a ..S.R 417,792 408.00 K
lrbmp11n.dll Fri Jul 22 2005 9:02:22p ..S.R 417,792 408.00 K
mcdtclog.dll Fri Jul 22 2005 4:26:00a ..S.R 417,792 408.00 K
mcftedit.dll Fri Jul 22 2005 5:48:02a ..S.R 417,792 408.00 K
mfrui.dll Thu Jul 21 2005 5:00:28p ..S.R 417,792 408.00 K
mjieftp.dll Thu Jul 21 2005 3:37:22p ..S.R 417,792 408.00 K
mng_hook.dll Fri Jul 22 2005 9:02:38p ..S.R 417,792 408.00 K
moimrt.dll Thu Jul 21 2005 3:37:16p ..S.R 417,792 408.00 K
mscms.dll Tue Jun 28 2005 7:46:00p A.... 74,240 72.50 K
mshtml.dll Tue Jul 19 2005 8:00:30p A.... 3,014,144 2.87 M
mshtmled.dll Sat Jul 2 2005 8:11:30p A.... 448,512 438.00 K
msrating.dll Sat Jul 2 2005 8:11:30p A.... 146,432 143.00 K
msrmsg.dll Fri Jul 22 2005 6:39:14p ..S.R 417,792 408.00 K
mtrui.dll Fri Jul 22 2005 6:39:08p ..S.R 417,792 408.00 K
mx43dmod.dll Thu Jul 21 2005 5:00:20p ..S.R 417,792 408.00 K
myrddm.dll Fri Jul 22 2005 5:47:50a ..S.R 417,792 408.00 K
myrui.dll Fri Jul 22 2005 4:25:50a ..S.R 417,792 408.00 K
nc5594~1.dll Wed Aug 31 2005 11:08:02a A.... 142,480 139.14 K
ncevtmsg.dll Fri Jul 22 2005 7:45:10p ..S.R 417,792 408.00 K
nrobjapi.dll Fri Jul 22 2005 2:10:16a ..S.R 417,792 408.00 K
nrwrsde.dll Fri Jul 22 2005 3:24:52a ..S.R 417,792 408.00 K
nsobjapi.dll Fri Jul 22 2005 2:10:04a ..S.R 417,792 408.00 K
ntshell.dll Fri Jul 22 2005 3:25:00a ..S.R 417,792 408.00 K
numarta.dll Fri Jul 22 2005 7:45:14p ..S.R 417,792 408.00 K
oce2.dll Fri Jul 22 2005 2:42:28p ..S.R 417,792 408.00 K
ogfox32.dll Fri Jul 22 2005 2:42:34p ..S.R 417,792 408.00 K
onfox32.dll Fri Jul 22 2005 1:01:04a ..S.R 417,792 408.00 K
otbc32gt.dll Fri Jul 22 2005 1:00:58a ..S.R 417,792 408.00 K
pjrpnsp.dll Fri Jul 22 2005 9:46:58a ..S.R 417,792 408.00 K
pngfilt.dll Sat Jul 2 2005 8:11:30p A.... 39,424 38.50 K
resapi32.dll Fri Jul 22 2005 1:29:28p ..S.R 417,792 408.00 K
rppwsx.dll Fri Jul 22 2005 9:47:20a ..S.R 417,792 408.00 K
rybios32.dll Fri Jul 22 2005 1:29:38p ..S.R 417,792 408.00 K
sdmapi.dll Thu Jul 21 2005 11:47:08p ..S.R 417,792 408.00 K
shdocvw.dll Sat Jul 2 2005 8:11:30p A.... 1,483,776 1.41 M
shlwapi.dll Sat Jul 2 2005 8:11:30p A.... 473,600 462.50 K
sintf16.dll Fri Aug 26 2005 11:39:08p A.... 12,067 11.78 K
sintf32.dll Fri Aug 26 2005 11:39:08p A.... 17,212 16.81 K
sintfnt.dll Fri Aug 26 2005 11:39:08p A.... 21,840 21.33 K
snextspk.dll Fri Jul 22 2005 4:09:58p ..S.R 417,792 408.00 K
sporder.dll Sat Sep 10 2005 12:02:32p A.... 8,464 8.27 K
swrrun.dll Fri Jul 22 2005 4:09:36p ..S.R 417,792 408.00 K
sxman32.dll Thu Jul 21 2005 11:47:14p ..S.R 417,792 408.00 K
tapisrv.dll Fri Jul 8 2005 10:27:56a A.... 249,344 243.50 K
umpnpmgr.dll Wed Jun 29 2005 8:02:40p A.... 118,272 115.50 K
urlmon.dll Sat Jul 2 2005 8:11:30p ..... 607,744 593.50 K
wininet.dll Sat Jul 2 2005 8:11:30p ..... 658,432 643.00 K
wnsapi32.dll Mon Jul 11 2005 9:57:20a ..S.R 417,792 408.00 K
wossvc.dll Fri Jul 22 2005 12:28:38p ..S.R 417,792 408.00 K

81 items found: 81 files (56 H/S), 0 directories.
Total of file sizes: 33,069,527 bytes 31.54 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C is HP_PAVILION
Volume Serial Number is 9C65-1D63

Directory of C:\WINDOWS\System32

09/18/2005 09:37 AM <DIR> ..
09/18/2005 09:37 AM <DIR> .
08/23/2005 02:41 AM <DIR> dllcache
07/22/2005 10:20 PM 417,792 cnmpstui.dll
07/22/2005 10:20 PM 417,792 cvwmdm.dll
07/22/2005 09:02 PM 417,792 mNg_hook.dll
07/22/2005 09:02 PM 417,792 lrbmp11n.dll
07/22/2005 07:45 PM 417,792 numarta.dll
07/22/2005 07:45 PM 417,792 ncevtmsg.dll
07/22/2005 06:39 PM 417,792 msrmsg.dll
07/22/2005 06:39 PM 417,792 mtrui.dll
07/22/2005 05:32 PM 417,792 agtodisc.dll
07/22/2005 05:32 PM 417,792 abi3d1ag.dll
07/22/2005 04:09 PM 417,792 snextspk.dll
07/22/2005 04:09 PM 417,792 swrrun.dll
07/22/2005 02:42 PM 417,792 ogfox32.dll
07/22/2005 02:42 PM 417,792 oce2.dll
07/22/2005 01:29 PM 417,792 RYBios32.dll
07/22/2005 01:29 PM 417,792 rEsapi32.dll
07/22/2005 12:28 PM 417,792 ayptif.dll
07/22/2005 12:28 PM 417,792 wossvc.dll
07/22/2005 11:02 AM 417,792 lb32.dll
07/22/2005 11:02 AM 417,792 lpcalspl.dll
07/22/2005 09:47 AM 417,792 rppwsx.dll
07/22/2005 09:46 AM 417,792 pjrpnsp.dll
07/22/2005 08:21 AM 417,792 iwetcomm.dll
07/22/2005 08:21 AM 417,792 iusetup.dll
07/22/2005 07:10 AM 417,792 cxlbact.dll
07/22/2005 07:09 AM 417,792 bdhci.dll
07/22/2005 05:48 AM 417,792 mcftedit.dll
07/22/2005 05:47 AM 417,792 myrddm.dll
07/22/2005 04:25 AM 417,792 mcdtclog.dll
07/22/2005 04:25 AM 417,792 myrui.dll
07/22/2005 03:24 AM 417,792 ntshell.dll
07/22/2005 03:24 AM 417,792 nrwrsde.dll
07/22/2005 02:10 AM 417,792 nrobjapi.dll
07/22/2005 02:10 AM 417,792 nsobjapi.dll
07/22/2005 01:01 AM 417,792 onfox32.dll
07/22/2005 01:00 AM 417,792 otbc32gt.dll
07/21/2005 11:47 PM 417,792 sxman32.dll
07/21/2005 11:47 PM 417,792 sdmapi.dll
07/21/2005 10:25 PM 417,792 dndmoprp.dll
07/21/2005 10:25 PM 417,792 dtwsockx.dll
07/21/2005 09:01 PM 417,792 csmmdlg.dll
07/21/2005 09:01 PM 417,792 cWrds.dll
07/21/2005 07:45 PM 417,792 hkvcp70.dll
07/21/2005 07:45 PM 417,792 dbdiagn.dll
07/21/2005 06:16 PM 417,792 lhckout.dll
07/21/2005 06:16 PM 417,792 kddru.dll
07/21/2005 05:00 PM 417,792 mfrui.dll
07/21/2005 05:00 PM 417,792 mx43dmod.dll
07/21/2005 03:37 PM 417,792 mjieftp.dll
07/21/2005 03:37 PM 417,792 MOIMRT.DLL
07/21/2005 02:25 PM 417,792 dv7vb.dll
07/21/2005 02:25 PM 417,792 dzocx.dll
07/11/2005 11:01 AM 417,792 fecfg.dll
07/11/2005 11:01 AM 417,792 dbspex.dll
07/11/2005 09:57 AM 417,792 awlui.dll
07/11/2005 09:57 AM 417,792 wnsapi32.dll
03/12/2005 04:20 PM 848 KGyGaAvL.sys
12/02/2004 02:23 AM 0 d2kpax.exe
12/02/2004 02:23 AM 0 d2kpax.dll
12/02/2004 02:23 AM 0 msxslab.dll
12/02/2004 02:23 AM 0 jac.dll
10/19/2004 03:57 PM 56 85750EC037.sys
10/07/2004 06:19 PM 512 CnhvL4.s12
04/09/2003 11:51 PM <DIR> Microsoft
63 File(s) 23,397,768 bytes
4 Dir(s) 92,287,041,536 bytes free

[loophole]

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix.

[ghostyy]

Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 248 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 608 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\abi3d1ag.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\abi3d1ag.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\agtodisc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\agtodisc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\awlui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\awlui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ayptif.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ayptif.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\bdhci.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\bdhci.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cnmpstui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cnmpstui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\csmmdlg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\csmmdlg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cvwmdm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cvwmdm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cWrds.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cWrds.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cxlbact.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cxlbact.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dbdiagn.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dbdiagn.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dbspex.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dbspex.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dndmoprp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dndmoprp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dtwsockx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dtwsockx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dv7vb.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dv7vb.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dzocx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dzocx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fecfg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fecfg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hkvcp70.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hkvcp70.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\iusetup.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\iusetup.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\iwetcomm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\iwetcomm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kddru.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kddru.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lb32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lb32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lhckout.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lhckout.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lpcalspl.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lpcalspl.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lrbmp11n.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lrbmp11n.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mcdtclog.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mcdtclog.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mcftedit.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mcftedit.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mfrui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mfrui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mjieftp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mjieftp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mNg_hook.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mNg_hook.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MOIMRT.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MOIMRT.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\msrmsg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\msrmsg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mtrui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mtrui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mx43dmod.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mx43dmod.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\myrddm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\myrddm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\myrui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\myrui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ncevtmsg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ncevtmsg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nrobjapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nrobjapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nrwrsde.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nrwrsde.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nsobjapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\nsobjapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ntshell.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ntshell.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\numarta.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\numarta.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\oce2.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\oce2.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ogfox32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ogfox32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\onfox32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\onfox32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\otbc32gt.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\otbc32gt.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\pjrpnsp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\pjrpnsp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rEsapi32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rEsapi32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rppwsx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rppwsx.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\RYBios32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\RYBios32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sdmapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sdmapi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\snextspk.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\snextspk.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\swrrun.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\swrrun.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sxman32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\sxman32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wnsapi32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wnsapi32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wossvc.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wossvc.dll
1 file(s) copied.
deleting: C:\WINDOWS\system32\abi3d1ag.dll
Successfully Deleted: C:\WINDOWS\system32\abi3d1ag.dll
deleting: C:\WINDOWS\system32\abi3d1ag.dll
Successfully Deleted: C:\WINDOWS\system32\abi3d1ag.dll
deleting: C:\WINDOWS\system32\agtodisc.dll
Successfully Deleted: C:\WINDOWS\system32\agtodisc.dll
deleting: C:\WINDOWS\system32\agtodisc.dll
Successfully Deleted: C:\WINDOWS\system32\agtodisc.dll
deleting: C:\WINDOWS\system32\awlui.dll
Successfully Deleted: C:\WINDOWS\system32\awlui.dll
deleting: C:\WINDOWS\system32\awlui.dll
Successfully Deleted: C:\WINDOWS\system32\awlui.dll
deleting: C:\WINDOWS\system32\ayptif.dll
Successfully Deleted: C:\WINDOWS\system32\ayptif.dll
deleting: C:\WINDOWS\system32\ayptif.dll
Successfully Deleted: C:\WINDOWS\system32\ayptif.dll
deleting: C:\WINDOWS\system32\bdhci.dll
Successfully Deleted: C:\WINDOWS\system32\bdhci.dll
deleting: C:\WINDOWS\system32\bdhci.dll
Successfully Deleted: C:\WINDOWS\system32\bdhci.dll
deleting: C:\WINDOWS\system32\cnmpstui.dll
Successfully Deleted: C:\WINDOWS\system32\cnmpstui.dll
deleting: C:\WINDOWS\system32\cnmpstui.dll
Successfully Deleted: C:\WINDOWS\system32\cnmpstui.dll
deleting: C:\WINDOWS\system32\csmmdlg.dll
Successfully Deleted: C:\WINDOWS\system32\csmmdlg.dll
deleting: C:\WINDOWS\system32\csmmdlg.dll
Successfully Deleted: C:\WINDOWS\system32\csmmdlg.dll
deleting: C:\WINDOWS\system32\cvwmdm.dll
Successfully Deleted: C:\WINDOWS\system32\cvwmdm.dll
deleting: C:\WINDOWS\system32\cvwmdm.dll
Successfully Deleted: C:\WINDOWS\system32\cvwmdm.dll
deleting: C:\WINDOWS\system32\cWrds.dll
Successfully Deleted: C:\WINDOWS\system32\cWrds.dll
deleting: C:\WINDOWS\system32\cWrds.dll
Successfully Deleted: C:\WINDOWS\system32\cWrds.dll
deleting: C:\WINDOWS\system32\cxlbact.dll
Successfully Deleted: C:\WINDOWS\system32\cxlbact.dll
deleting: C:\WINDOWS\system32\cxlbact.dll
Successfully Deleted: C:\WINDOWS\system32\cxlbact.dll
deleting: C:\WINDOWS\system32\dbdiagn.dll
Successfully Deleted: C:\WINDOWS\system32\dbdiagn.dll
deleting: C:\WINDOWS\system32\dbdiagn.dll
Successfully Deleted: C:\WINDOWS\system32\dbdiagn.dll
deleting: C:\WINDOWS\system32\dbspex.dll
Successfully Deleted: C:\WINDOWS\system32\dbspex.dll
deleting: C:\WINDOWS\system32\dbspex.dll
Successfully Deleted: C:\WINDOWS\system32\dbspex.dll
deleting: C:\WINDOWS\system32\dndmoprp.dll
Successfully Deleted: C:\WINDOWS\system32\dndmoprp.dll
deleting: C:\WINDOWS\system32\dndmoprp.dll
Successfully Deleted: C:\WINDOWS\system32\dndmoprp.dll
deleting: C:\WINDOWS\system32\dtwsockx.dll
Successfully Deleted: C:\WINDOWS\system32\dtwsockx.dll
deleting: C:\WINDOWS\system32\dtwsockx.dll
Successfully Deleted: C:\WINDOWS\system32\dtwsockx.dll
deleting: C:\WINDOWS\system32\dv7vb.dll
Successfully Deleted: C:\WINDOWS\system32\dv7vb.dll
deleting: C:\WINDOWS\system32\dv7vb.dll
Successfully Deleted: C:\WINDOWS\system32\dv7vb.dll
deleting: C:\WINDOWS\system32\dzocx.dll
Successfully Deleted: C:\WINDOWS\system32\dzocx.dll
deleting: C:\WINDOWS\system32\dzocx.dll
Successfully Deleted: C:\WINDOWS\system32\dzocx.dll
deleting: C:\WINDOWS\system32\fecfg.dll
Successfully Deleted: C:\WINDOWS\system32\fecfg.dll
deleting: C:\WINDOWS\system32\fecfg.dll
Successfully Deleted: C:\WINDOWS\system32\fecfg.dll
deleting: C:\WINDOWS\system32\hkvcp70.dll
Successfully Deleted: C:\WINDOWS\system32\hkvcp70.dll
deleting: C:\WINDOWS\system32\hkvcp70.dll
Successfully Deleted: C:\WINDOWS\system32\hkvcp70.dll
deleting: C:\WINDOWS\system32\iusetup.dll
Successfully Deleted: C:\WINDOWS\system32\iusetup.dll
deleting: C:\WINDOWS\system32\iusetup.dll
Successfully Deleted: C:\WINDOWS\system32\iusetup.dll
deleting: C:\WINDOWS\system32\iwetcomm.dll
Successfully Deleted: C:\WINDOWS\system32\iwetcomm.dll
deleting: C:\WINDOWS\system32\iwetcomm.dll
Successfully Deleted: C:\WINDOWS\system32\iwetcomm.dll
deleting: C:\WINDOWS\system32\kddru.dll
Successfully Deleted: C:\WINDOWS\system32\kddru.dll
deleting: C:\WINDOWS\system32\kddru.dll
Successfully Deleted: C:\WINDOWS\system32\kddru.dll
deleting: C:\WINDOWS\system32\lb32.dll
Successfully Deleted: C:\WINDOWS\system32\lb32.dll
deleting: C:\WINDOWS\system32\lb32.dll
Successfully Deleted: C:\WINDOWS\system32\lb32.dll
deleting: C:\WINDOWS\system32\lhckout.dll
Successfully Deleted: C:\WINDOWS\system32\lhckout.dll
deleting: C:\WINDOWS\system32\lhckout.dll
Successfully Deleted: C:\WINDOWS\system32\lhckout.dll
deleting: C:\WINDOWS\system32\lpcalspl.dll
Successfully Deleted: C:\WINDOWS\system32\lpcalspl.dll
deleting: C:\WINDOWS\system32\lpcalspl.dll
Successfully Deleted: C:\WINDOWS\system32\lpcalspl.dll
deleting: C:\WINDOWS\system32\lrbmp11n.dll
Successfully Deleted: C:\WINDOWS\system32\lrbmp11n.dll
deleting: C:\WINDOWS\system32\lrbmp11n.dll
Successfully Deleted: C:\WINDOWS\system32\lrbmp11n.dll
deleting: C:\WINDOWS\system32\mcdtclog.dll
Successfully Deleted: C:\WINDOWS\system32\mcdtclog.dll
deleting: C:\WINDOWS\system32\mcdtclog.dll
Successfully Deleted: C:\WINDOWS\system32\mcdtclog.dll
deleting: C:\WINDOWS\system32\mcftedit.dll
Successfully Deleted: C:\WINDOWS\system32\mcftedit.dll
deleting: C:\WINDOWS\system32\mcftedit.dll
Successfully Deleted: C:\WINDOWS\system32\mcftedit.dll
deleting: C:\WINDOWS\system32\mfrui.dll
Successfully Deleted: C:\WINDOWS\system32\mfrui.dll
deleting: C:\WINDOWS\system32\mfrui.dll
Successfully Deleted: C:\WINDOWS\system32\mfrui.dll
deleting: C:\WINDOWS\system32\mjieftp.dll
Successfully Deleted: C:\WINDOWS\system32\mjieftp.dll
deleting: C:\WINDOWS\system32\mjieftp.dll
Successfully Deleted: C:\WINDOWS\system32\mjieftp.dll
deleting: C:\WINDOWS\system32\mNg_hook.dll
Successfully Deleted: C:\WINDOWS\system32\mNg_hook.dll
deleting: C:\WINDOWS\system32\mNg_hook.dll
Successfully Deleted: C:\WINDOWS\system32\mNg_hook.dll
deleting: C:\WINDOWS\system32\MOIMRT.DLL
Successfully Deleted: C:\WINDOWS\system32\MOIMRT.DLL
deleting: C:\WINDOWS\system32\MOIMRT.DLL
Successfully Deleted: C:\WINDOWS\system32\MOIMRT.DLL
deleting: C:\WINDOWS\system32\msrmsg.dll
Successfully Deleted: C:\WINDOWS\system32\msrmsg.dll
deleting: C:\WINDOWS\system32\msrmsg.dll
Successfully Deleted: C:\WINDOWS\system32\msrmsg.dll
deleting: C:\WINDOWS\system32\mtrui.dll
Successfully Deleted: C:\WINDOWS\system32\mtrui.dll
deleting: C:\WINDOWS\system32\mtrui.dll
Successfully Deleted: C:\WINDOWS\system32\mtrui.dll
deleting: C:\WINDOWS\system32\mx43dmod.dll
Successfully Deleted: C:\WINDOWS\system32\mx43dmod.dll
deleting: C:\WINDOWS\system32\mx43dmod.dll
Successfully Deleted: C:\WINDOWS\system32\mx43dmod.dll
deleting: C:\WINDOWS\system32\myrddm.dll
Successfully Deleted: C:\WINDOWS\system32\myrddm.dll
deleting: C:\WINDOWS\system32\myrddm.dll
Successfully Deleted: C:\WINDOWS\system32\myrddm.dll
deleting: C:\WINDOWS\system32\myrui.dll
Successfully Deleted: C:\WINDOWS\system32\myrui.dll
deleting: C:\WINDOWS\system32\myrui.dll
Successfully Deleted: C:\WINDOWS\system32\myrui.dll
deleting: C:\WINDOWS\system32\ncevtmsg.dll
Successfully Deleted: C:\WINDOWS\system32\ncevtmsg.dll
deleting: C:\WINDOWS\system32\ncevtmsg.dll
Successfully Deleted: C:\WINDOWS\system32\ncevtmsg.dll
deleting: C:\WINDOWS\system32\nrobjapi.dll
Successfully Deleted: C:\WINDOWS\system32\nrobjapi.dll
deleting: C:\WINDOWS\system32\nrobjapi.dll
Successfully Deleted: C:\WINDOWS\system32\nrobjapi.dll
deleting: C:\WINDOWS\system32\nrwrsde.dll
Successfully Deleted: C:\WINDOWS\system32\nrwrsde.dll
deleting: C:\WINDOWS\system32\nrwrsde.dll
Successfully Deleted: C:\WINDOWS\system32\nrwrsde.dll
deleting: C:\WINDOWS\system32\nsobjapi.dll
Successfully Deleted: C:\WINDOWS\system32\nsobjapi.dll
deleting: C:\WINDOWS\system32\nsobjapi.dll
Successfully Deleted: C:\WINDOWS\system32\nsobjapi.dll
deleting: C:\WINDOWS\system32\ntshell.dll
Successfully Deleted: C:\WINDOWS\system32\ntshell.dll
deleting: C:\WINDOWS\system32\ntshell.dll
Successfully Deleted: C:\WINDOWS\system32\ntshell.dll
deleting: C:\WINDOWS\system32\numarta.dll
Successfully Deleted: C:\WINDOWS\system32\numarta.dll
deleting: C:\WINDOWS\system32\numarta.dll
Successfully Deleted: C:\WINDOWS\system32\numarta.dll
deleting: C:\WINDOWS\system32\oce2.dll
Successfully Deleted: C:\WINDOWS\system32\oce2.dll
deleting: C:\WINDOWS\system32\oce2.dll
Successfully Deleted: C:\WINDOWS\system32\oce2.dll
deleting: C:\WINDOWS\system32\ogfox32.dll
Successfully Deleted: C:\WINDOWS\system32\ogfox32.dll
deleting: C:\WINDOWS\system32\ogfox32.dll
Successfully Deleted: C:\WINDOWS\system32\ogfox32.dll
deleting: C:\WINDOWS\system32\onfox32.dll
Successfully Deleted: C:\WINDOWS\system32\onfox32.dll
deleting: C:\WINDOWS\system32\onfox32.dll
Successfully Deleted: C:\WINDOWS\system32\onfox32.dll
deleting: C:\WINDOWS\system32\otbc32gt.dll
Successfully Deleted: C:\WINDOWS\system32\otbc32gt.dll
deleting: C:\WINDOWS\system32\otbc32gt.dll
Successfully Deleted: C:\WINDOWS\system32\otbc32gt.dll
deleting: C:\WINDOWS\system32\pjrpnsp.dll
Successfully Deleted: C:\WINDOWS\system32\pjrpnsp.dll
deleting: C:\WINDOWS\system32\pjrpnsp.dll
Successfully Deleted: C:\WINDOWS\system32\pjrpnsp.dll
deleting: C:\WINDOWS\system32\rEsapi32.dll
Successfully Deleted: C:\WINDOWS\system32\rEsapi32.dll
deleting: C:\WINDOWS\system32\rEsapi32.dll
Successfully Deleted: C:\WINDOWS\system32\rEsapi32.dll
deleting: C:\WINDOWS\system32\rppwsx.dll
Successfully Deleted: C:\WINDOWS\system32\rppwsx.dll
deleting: C:\WINDOWS\system32\rppwsx.dll
Successfully Deleted: C:\WINDOWS\system32\rppwsx.dll
deleting: C:\WINDOWS\system32\RYBios32.dll
Successfully Deleted: C:\WINDOWS\system32\RYBios32.dll
deleting: C:\WINDOWS\system32\RYBios32.dll
Successfully Deleted: C:\WINDOWS\system32\RYBios32.dll
deleting: C:\WINDOWS\system32\sdmapi.dll
Successfully Deleted: C:\WINDOWS\system32\sdmapi.dll
deleting: C:\WINDOWS\system32\sdmapi.dll
Successfully Deleted: C:\WINDOWS\system32\sdmapi.dll
deleting: C:\WINDOWS\system32\snextspk.dll
Successfully Deleted: C:\WINDOWS\system32\snextspk.dll
deleting: C:\WINDOWS\system32\snextspk.dll
Successfully Deleted: C:\WINDOWS\system32\snextspk.dll
deleting: C:\WINDOWS\system32\swrrun.dll
Successfully Deleted: C:\WINDOWS\system32\swrrun.dll
deleting: C:\WINDOWS\system32\swrrun.dll
Successfully Deleted: C:\WINDOWS\system32\swrrun.dll
deleting: C:\WINDOWS\system32\sxman32.dll
Successfully Deleted: C:\WINDOWS\system32\sxman32.dll
deleting: C:\WINDOWS\system32\sxman32.dll
Successfully Deleted: C:\WINDOWS\system32\sxman32.dll
deleting: C:\WINDOWS\system32\wnsapi32.dll
Successfully Deleted: C:\WINDOWS\system32\wnsapi32.dll
deleting: C:\WINDOWS\system32\wnsapi32.dll
Successfully Deleted: C:\WINDOWS\system32\wnsapi32.dll
deleting: C:\WINDOWS\system32\wossvc.dll
Successfully Deleted: C:\WINDOWS\system32\wossvc.dll
deleting: C:\WINDOWS\system32\wossvc.dll
Successfully Deleted: C:\WINDOWS\system32\wossvc.dll


Zipping up files for submission:
adding: abi3d1ag.dll (208 bytes security) (deflated 48%)
adding: agtodisc.dll (208 bytes security) (deflated 48%)
adding: awlui.dll (208 bytes security) (deflated 48%)
adding: ayptif.dll (208 bytes security) (deflated 48%)
adding: bdhci.dll (208 bytes security) (deflated 48%)
adding: cnmpstui.dll (208 bytes security) (deflated 48%)
adding: csmmdlg.dll (208 bytes security) (deflated 48%)
adding: cvwmdm.dll (208 bytes security) (deflated 48%)
adding: cWrds.dll (208 bytes security) (deflated 48%)
adding: cxlbact.dll (208 bytes security) (deflated 48%)
adding: dbdiagn.dll (208 bytes security) (deflated 48%)
adding: dbspex.dll (208 bytes security) (deflated 48%)
adding: dndmoprp.dll (208 bytes security) (deflated 48%)
adding: dtwsockx.dll (208 bytes security) (deflated 48%)
adding: dv7vb.dll (208 bytes security) (deflated 48%)
adding: dzocx.dll (208 bytes security) (deflated 48%)
adding: fecfg.dll (208 bytes security) (deflated 48%)
adding: hkvcp70.dll (208 bytes security) (deflated 48%)
adding: iusetup.dll (208 bytes security) (deflated 48%)
adding: iwetcomm.dll (208 bytes security) (deflated 48%)
adding: kddru.dll (208 bytes security) (deflated 48%)
adding: lb32.dll (208 bytes security) (deflated 48%)
adding: lhckout.dll (208 bytes security) (deflated 48%)
adding: lpcalspl.dll (208 bytes security) (deflated 48%)
adding: lrbmp11n.dll (208 bytes security) (deflated 48%)
adding: mcdtclog.dll (208 bytes security) (deflated 48%)
adding: mcftedit.dll (208 bytes security) (deflated 48%)
adding: mfrui.dll (208 bytes security) (deflated 48%)
adding: mjieftp.dll (208 bytes security) (deflated 48%)
adding: mNg_hook.dll (208 bytes security) (deflated 48%)
adding: MOIMRT.DLL (208 bytes security) (deflated 48%)
adding: msrmsg.dll (208 bytes security) (deflated 48%)
adding: mtrui.dll (208 bytes security) (deflated 48%)
adding: mx43dmod.dll (208 bytes security) (deflated 48%)
adding: myrddm.dll (208 bytes security) (deflated 48%)
adding: myrui.dll (208 bytes security) (deflated 48%)
adding: ncevtmsg.dll (208 bytes security) (deflated 48%)
adding: nrobjapi.dll (208 bytes security) (deflated 48%)
adding: nrwrsde.dll (208 bytes security) (deflated 48%)
adding: nsobjapi.dll (208 bytes security) (deflated 48%)
adding: ntshell.dll (208 bytes security) (deflated 48%)
adding: numarta.dll (208 bytes security) (deflated 48%)
adding: oce2.dll (208 bytes security) (deflated 48%)
adding: ogfox32.dll (208 bytes security) (deflated 48%)
adding: onfox32.dll (208 bytes security) (deflated 48%)
adding: otbc32gt.dll (208 bytes security) (deflated 48%)
adding: pjrpnsp.dll (208 bytes security) (deflated 48%)
adding: rEsapi32.dll (208 bytes security) (deflated 48%)
adding: rppwsx.dll (208 bytes security) (deflated 48%)
adding: RYBios32.dll (208 bytes security) (deflated 48%)
adding: sdmapi.dll (208 bytes security) (deflated 48%)
adding: snextspk.dll (208 bytes security) (deflated 48%)
adding: swrrun.dll (208 bytes security) (deflated 48%)
adding: sxman32.dll (208 bytes security) (deflated 48%)
adding: wnsapi32.dll (208 bytes security) (deflated 48%)
adding: wossvc.dll (208 bytes security) (deflated 48%)
adding: clear.reg (208 bytes security) (deflated 2%)
adding: Export.txt (208 bytes security) (stored 0%)
adding: lo2.txt (208 bytes security) (deflated 93%)
adding: log.txt (208 bytes security) (deflated 89%)
adding: log_client.txt (208 bytes security) (deflated 30%)
adding: test.txt (208 bytes security) (deflated 91%)
adding: test2.txt (208 bytes security) (stored 0%)
adding: test3.txt (208 bytes security) (stored 0%)
adding: test5.txt (208 bytes security) (stored 0%)
adding: xfind.txt (208 bytes security) (deflated 89%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:

deleting local copy: abi3d1ag.dll
deleting local copy: abi3d1ag.dll
deleting local copy: agtodisc.dll
deleting local copy: agtodisc.dll
deleting local copy: awlui.dll
deleting local copy: awlui.dll
deleting local copy: ayptif.dll
deleting local copy: ayptif.dll
deleting local copy: bdhci.dll
deleting local copy: bdhci.dll
deleting local copy: cnmpstui.dll
deleting local copy: cnmpstui.dll
deleting local copy: csmmdlg.dll
deleting local copy: csmmdlg.dll
deleting local copy: cvwmdm.dll
deleting local copy: cvwmdm.dll
deleting local copy: cWrds.dll
deleting local copy: cWrds.dll
deleting local copy: cxlbact.dll
deleting local copy: cxlbact.dll
deleting local copy: dbdiagn.dll
deleting local copy: dbdiagn.dll
deleting local copy: dbspex.dll
deleting local copy: dbspex.dll
deleting local copy: dndmoprp.dll
deleting local copy: dndmoprp.dll
deleting local copy: dtwsockx.dll
deleting local copy: dtwsockx.dll
deleting local copy: dv7vb.dll
deleting local copy: dv7vb.dll
deleting local copy: dzocx.dll
deleting local copy: dzocx.dll
deleting local copy: fecfg.dll
deleting local copy: fecfg.dll
deleting local copy: hkvcp70.dll
deleting local copy: hkvcp70.dll
deleting local copy: iusetup.dll
deleting local copy: iusetup.dll
deleting local copy: iwetcomm.dll
deleting local copy: iwetcomm.dll
deleting local copy: kddru.dll
deleting local copy: kddru.dll
deleting local copy: lb32.dll
deleting local copy: lb32.dll
deleting local copy: lhckout.dll
deleting local copy: lhckout.dll
deleting local copy: lpcalspl.dll
deleting local copy: lpcalspl.dll
deleting local copy: lrbmp11n.dll
deleting local copy: lrbmp11n.dll
deleting local copy: mcdtclog.dll
deleting local copy: mcdtclog.dll
deleting local copy: mcftedit.dll
deleting local copy: mcftedit.dll
deleting local copy: mfrui.dll
deleting local copy: mfrui.dll
deleting local copy: mjieftp.dll
deleting local copy: mjieftp.dll
deleting local copy: mNg_hook.dll
deleting local copy: mNg_hook.dll
deleting local copy: MOIMRT.DLL
deleting local copy: MOIMRT.DLL
deleting local copy: msrmsg.dll
deleting local copy: msrmsg.dll
deleting local copy: mtrui.dll
deleting local copy: mtrui.dll
deleting local copy: mx43dmod.dll
deleting local copy: mx43dmod.dll
deleting local copy: myrddm.dll
deleting local copy: myrddm.dll
deleting local copy: myrui.dll
deleting local copy: myrui.dll
deleting local copy: ncevtmsg.dll
deleting local copy: ncevtmsg.dll
deleting local copy: nrobjapi.dll
deleting local copy: nrobjapi.dll
deleting local copy: nrwrsde.dll
deleting local copy: nrwrsde.dll
deleting local copy: nsobjapi.dll
deleting local copy: nsobjapi.dll
deleting local copy: ntshell.dll
deleting local copy: ntshell.dll
deleting local copy: numarta.dll
deleting local copy: numarta.dll
deleting local copy: oce2.dll
deleting local copy: oce2.dll
deleting local copy: ogfox32.dll
deleting local copy: ogfox32.dll
deleting local copy: onfox32.dll
deleting local copy: onfox32.dll
deleting local copy: otbc32gt.dll
deleting local copy: otbc32gt.dll
deleting local copy: pjrpnsp.dll
deleting local copy: pjrpnsp.dll
deleting local copy: rEsapi32.dll
deleting local copy: rEsapi32.dll
deleting local copy: rppwsx.dll
deleting local copy: rppwsx.dll
deleting local copy: RYBios32.dll
deleting local copy: RYBios32.dll
deleting local copy: sdmapi.dll
deleting local copy: sdmapi.dll
deleting local copy: snextspk.dll
deleting local copy: snextspk.dll
deleting local copy: swrrun.dll
deleting local copy: swrrun.dll
deleting local copy: sxman32.dll
deleting local copy: sxman32.dll
deleting local copy: wnsapi32.dll
deleting local copy: wnsapi32.dll
deleting local copy: wossvc.dll
deleting local copy: wossvc.dll

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\OPXPGina]
"STARTUP"="OPWlxStartup"
"RECONNECT"="OPWlxReconnect"
"UNLOCK"="OPWlxUnlock"
"ASYNCHRONOUS"=dword:00000000
"DLLNAME"="C:\\Program Files\\Softex\\OmniPass\\opxpgina.dll"
"STOPSCREENSAVER"="OPWlxStopScreenSaver"
"STARTSCREENSAVER"="OPWlxStartScreenSaver"
"LOCK"="OPWlxLock"
"LOGOFF"="OPWlxLogoff"
"SHUTDOWN"="OPWlxShutdown"
"STARTSHELL"="OPWlxStartShell"
"IMPERSONATE"=dword:00000000
"LOGON"="OPWlxLogon"
"DISCONNECT"="OPWlxDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\abi3d1ag.dll
C:\WINDOWS\system32\abi3d1ag.dll
C:\WINDOWS\system32\agtodisc.dll
C:\WINDOWS\system32\agtodisc.dll
C:\WINDOWS\system32\awlui.dll
C:\WINDOWS\system32\awlui.dll
C:\WINDOWS\system32\ayptif.dll
C:\WINDOWS\system32\ayptif.dll
C:\WINDOWS\system32\bdhci.dll
C:\WINDOWS\system32\bdhci.dll
C:\WINDOWS\system32\cnmpstui.dll
C:\WINDOWS\system32\cnmpstui.dll
C:\WINDOWS\system32\csmmdlg.dll
C:\WINDOWS\system32\csmmdlg.dll
C:\WINDOWS\system32\cvwmdm.dll
C:\WINDOWS\system32\cvwmdm.dll
C:\WINDOWS\system32\cWrds.dll
C:\WINDOWS\system32\cWrds.dll
C:\WINDOWS\system32\cxlbact.dll
C:\WINDOWS\system32\cxlbact.dll
C:\WINDOWS\system32\dbdiagn.dll
C:\WINDOWS\system32\dbdiagn.dll
C:\WINDOWS\system32\dbspex.dll
C:\WINDOWS\system32\dbspex.dll
C:\WINDOWS\system32\dndmoprp.dll
C:\WINDOWS\system32\dndmoprp.dll
C:\WINDOWS\system32\dtwsockx.dll
C:\WINDOWS\system32\dtwsockx.dll
C:\WINDOWS\system32\dv7vb.dll
C:\WINDOWS\system32\dv7vb.dll
C:\WINDOWS\system32\dzocx.dll
C:\WINDOWS\system32\dzocx.dll
C:\WINDOWS\system32\fecfg.dll
C:\WINDOWS\system32\fecfg.dll
C:\WINDOWS\system32\hkvcp70.dll
C:\WINDOWS\system32\hkvcp70.dll
C:\WINDOWS\system32\iusetup.dll
C:\WINDOWS\system32\iusetup.dll
C:\WINDOWS\system32\iwetcomm.dll
C:\WINDOWS\system32\iwetcomm.dll
C:\WINDOWS\system32\kddru.dll
C:\WINDOWS\system32\kddru.dll
C:\WINDOWS\system32\lb32.dll
C:\WINDOWS\system32\lb32.dll
C:\WINDOWS\system32\lhckout.dll
C:\WINDOWS\system32\lhckout.dll
C:\WINDOWS\system32\lpcalspl.dll
C:\WINDOWS\system32\lpcalspl.dll
C:\WINDOWS\system32\lrbmp11n.dll
C:\WINDOWS\system32\lrbmp11n.dll
C:\WINDOWS\system32\mcdtclog.dll
C:\WINDOWS\system32\mcdtclog.dll
C:\WINDOWS\system32\mcftedit.dll
C:\WINDOWS\system32\mcftedit.dll
C:\WINDOWS\system32\mfrui.dll
C:\WINDOWS\system32\mfrui.dll
C:\WINDOWS\system32\mjieftp.dll
C:\WINDOWS\system32\mjieftp.dll
C:\WINDOWS\system32\mNg_hook.dll
C:\WINDOWS\system32\mNg_hook.dll
C:\WINDOWS\system32\MOIMRT.DLL
C:\WINDOWS\system32\MOIMRT.DLL
C:\WINDOWS\system32\msrmsg.dll
C:\WINDOWS\system32\msrmsg.dll
C:\WINDOWS\system32\mtrui.dll
C:\WINDOWS\system32\mtrui.dll
C:\WINDOWS\system32\mx43dmod.dll
C:\WINDOWS\system32\mx43dmod.dll
C:\WINDOWS\system32\myrddm.dll
C:\WINDOWS\system32\myrddm.dll
C:\WINDOWS\system32\myrui.dll
C:\WINDOWS\system32\myrui.dll
C:\WINDOWS\system32\ncevtmsg.dll
C:\WINDOWS\system32\ncevtmsg.dll
C:\WINDOWS\system32\nrobjapi.dll
C:\WINDOWS\system32\nrobjapi.dll
C:\WINDOWS\system32\nrwrsde.dll
C:\WINDOWS\system32\nrwrsde.dll
C:\WINDOWS\system32\nsobjapi.dll
C:\WINDOWS\system32\nsobjapi.dll
C:\WINDOWS\system32\ntshell.dll
C:\WINDOWS\system32\ntshell.dll
C:\WINDOWS\system32\numarta.dll
C:\WINDOWS\system32\numarta.dll
C:\WINDOWS\system32\oce2.dll
C:\WINDOWS\system32\oce2.dll
C:\WINDOWS\system32\ogfox32.dll
C:\WINDOWS\system32\ogfox32.dll
C:\WINDOWS\system32\onfox32.dll
C:\WINDOWS\system32\onfox32.dll
C:\WINDOWS\system32\otbc32gt.dll
C:\WINDOWS\system32\otbc32gt.dll
C:\WINDOWS\system32\pjrpnsp.dll
C:\WINDOWS\system32\pjrpnsp.dll
C:\WINDOWS\system32\rEsapi32.dll
C:\WINDOWS\system32\rEsapi32.dll
C:\WINDOWS\system32\rppwsx.dll
C:\WINDOWS\system32\rppwsx.dll
C:\WINDOWS\system32\RYBios32.dll
C:\WINDOWS\system32\RYBios32.dll
C:\WINDOWS\system32\sdmapi.dll
C:\WINDOWS\system32\sdmapi.dll
C:\WINDOWS\system32\snextspk.dll
C:\WINDOWS\system32\snextspk.dll
C:\WINDOWS\system32\swrrun.dll
C:\WINDOWS\system32\swrrun.dll
C:\WINDOWS\system32\sxman32.dll
C:\WINDOWS\system32\sxman32.dll
C:\WINDOWS\system32\wnsapi32.dll
C:\WINDOWS\system32\wnsapi32.dll
C:\WINDOWS\system32\wossvc.dll
C:\WINDOWS\system32\wossvc.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************

[ghostyy]

Logfile of HijackThis v1.99.1
Scan saved at 11:35:01 PM, on 9/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Desktop\HijackThis.exe
C:\Documents and Settings\Owner.YOUR-O0KWKW9JWC\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_6_0_0.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\RunOnce: [Pest Cleaning] "C:\Program Files\Yahoo!\YPSR\ppclean.exe" "clean" "smartfinder" "2"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [Software Less] C:\DOCUME~1\OWNER~1.YOU\APPLIC~1\DELETE~1\vc else.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games....GamesPlugin.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by18fd.bay18....es/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1121982530265
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe