[redghia]

On reboot i got several (10+) of theese error messages




Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 356 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 376 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\aqycfilt.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\aurace.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\azaslg3716.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cwedui.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\enl0l13m1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fp0m03d1e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fp4o03h3e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\gpjql3151.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr2u05f9e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr6o05j3e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ib50_32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ir4ul5h91.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jxdw400.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\k4nole531h.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\k808lidu1808.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kirnel32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ktlql7351.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\LHPNM12n.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\Lrdxf12n.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ltl0273mg.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lv4409hqe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lv4u09h9e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\m6lslg3716.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mrcndmgr.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mv0sl9d71.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\n2n6lc5s1f.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\o6840glqe6qe0.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rDsmxs.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rvhx32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\UbinstGMT.dll
1 file(s) copied.
deleting: C:\WINDOWS\system32\aqycfilt.dll
Successfully Deleted: C:\WINDOWS\system32\aqycfilt.dll
deleting: C:\WINDOWS\system32\aurace.dll
Successfully Deleted: C:\WINDOWS\system32\aurace.dll
deleting: C:\WINDOWS\system32\azaslg3716.dll
Successfully Deleted: C:\WINDOWS\system32\azaslg3716.dll
deleting: C:\WINDOWS\system32\cwedui.dll
Successfully Deleted: C:\WINDOWS\system32\cwedui.dll
deleting: C:\WINDOWS\system32\enl0l13m1.dll
Successfully Deleted: C:\WINDOWS\system32\enl0l13m1.dll
deleting: C:\WINDOWS\system32\fp0m03d1e.dll
Successfully Deleted: C:\WINDOWS\system32\fp0m03d1e.dll
deleting: C:\WINDOWS\system32\fp4o03h3e.dll
Successfully Deleted: C:\WINDOWS\system32\fp4o03h3e.dll
deleting: C:\WINDOWS\system32\gpjql3151.dll
Successfully Deleted: C:\WINDOWS\system32\gpjql3151.dll
deleting: C:\WINDOWS\system32\hr2u05f9e.dll
Successfully Deleted: C:\WINDOWS\system32\hr2u05f9e.dll
deleting: C:\WINDOWS\system32\hr6o05j3e.dll
Successfully Deleted: C:\WINDOWS\system32\hr6o05j3e.dll
deleting: C:\WINDOWS\system32\ib50_32.dll
Successfully Deleted: C:\WINDOWS\system32\ib50_32.dll
deleting: C:\WINDOWS\system32\ir4ul5h91.dll
Successfully Deleted: C:\WINDOWS\system32\ir4ul5h91.dll
deleting: C:\WINDOWS\system32\jxdw400.dll
Successfully Deleted: C:\WINDOWS\system32\jxdw400.dll
deleting: C:\WINDOWS\system32\k4nole531h.dll
Successfully Deleted: C:\WINDOWS\system32\k4nole531h.dll
deleting: C:\WINDOWS\system32\k808lidu1808.dll
Successfully Deleted: C:\WINDOWS\system32\k808lidu1808.dll
deleting: C:\WINDOWS\system32\kirnel32.dll
Successfully Deleted: C:\WINDOWS\system32\kirnel32.dll
deleting: C:\WINDOWS\system32\ktlql7351.dll
Successfully Deleted: C:\WINDOWS\system32\ktlql7351.dll
deleting: C:\WINDOWS\system32\LHPNM12n.dll
Successfully Deleted: C:\WINDOWS\system32\LHPNM12n.dll
deleting: C:\WINDOWS\system32\Lrdxf12n.dll
Successfully Deleted: C:\WINDOWS\system32\Lrdxf12n.dll
deleting: C:\WINDOWS\system32\ltl0273mg.dll
Successfully Deleted: C:\WINDOWS\system32\ltl0273mg.dll
deleting: C:\WINDOWS\system32\lv4409hqe.dll
Successfully Deleted: C:\WINDOWS\system32\lv4409hqe.dll
deleting: C:\WINDOWS\system32\lv4u09h9e.dll
Successfully Deleted: C:\WINDOWS\system32\lv4u09h9e.dll
deleting: C:\WINDOWS\system32\m6lslg3716.dll
Successfully Deleted: C:\WINDOWS\system32\m6lslg3716.dll
deleting: C:\WINDOWS\system32\mrcndmgr.dll
Successfully Deleted: C:\WINDOWS\system32\mrcndmgr.dll
deleting: C:\WINDOWS\system32\mv0sl9d71.dll
Successfully Deleted: C:\WINDOWS\system32\mv0sl9d71.dll
deleting: C:\WINDOWS\system32\n2n6lc5s1f.dll
Successfully Deleted: C:\WINDOWS\system32\n2n6lc5s1f.dll
deleting: C:\WINDOWS\system32\o6840glqe6qe0.dll
Successfully Deleted: C:\WINDOWS\system32\o6840glqe6qe0.dll
deleting: C:\WINDOWS\system32\rDsmxs.dll
Successfully Deleted: C:\WINDOWS\system32\rDsmxs.dll
deleting: C:\WINDOWS\system32\rvhx32.dll
Successfully Deleted: C:\WINDOWS\system32\rvhx32.dll
deleting: C:\WINDOWS\system32\UbinstGMT.dll
Successfully Deleted: C:\WINDOWS\system32\UbinstGMT.dll


Zipping up files for submission:
adding: aqycfilt.dll (188 bytes security) (deflated 4%)
adding: aurace.dll (188 bytes security) (deflated 5%)
adding: azaslg3716.dll (188 bytes security) (deflated 4%)
adding: BANTAM.DLL (188 bytes security) (deflated 60%)
adding: BLW32.DLL (188 bytes security) (deflated 50%)
adding: cwedui.dll (188 bytes security) (deflated 4%)
adding: enl0l13m1.dll (188 bytes security) (deflated 4%)
adding: fp0m03d1e.dll (188 bytes security) (deflated 4%)
adding: fp4o03h3e.dll (188 bytes security) (deflated 5%)
adding: gdiplus.dll (148 bytes security) (deflated 43%)
adding: gpjql3151.dll (188 bytes security) (deflated 5%)
adding: hr2u05f9e.dll (188 bytes security) (deflated 4%)
adding: hr6o05j3e.dll (188 bytes security) (deflated 4%)
adding: ib50_32.dll (188 bytes security) (deflated 4%)
adding: IDAPI32.DLL (188 bytes security) (deflated 56%)
adding: IDASCI32.DLL (188 bytes security) (deflated 48%)
adding: IDBAT32.DLL (188 bytes security) (deflated 51%)
adding: IDDA3532.DLL (188 bytes security) (deflated 60%)
adding: IDDAO32.DLL (188 bytes security) (deflated 60%)
adding: IDDBAS32.DLL (188 bytes security) (deflated 50%)
adding: IDDR32.DLL (188 bytes security) (deflated 56%)
adding: IDODBC32.DLL (188 bytes security) (deflated 57%)
adding: IDPDX32.DLL (188 bytes security) (deflated 47%)
adding: IDPROV32.DLL (188 bytes security) (deflated 48%)
adding: IDQBE32.DLL (188 bytes security) (deflated 49%)
adding: IDR20009.DLL (188 bytes security) (deflated 69%)
adding: IDSQL32.DLL (188 bytes security) (deflated 54%)
adding: ir4ul5h91.dll (188 bytes security) (deflated 5%)
adding: jxdw400.dll (188 bytes security) (deflated 4%)
adding: k4nole531h.dll (188 bytes security) (deflated 4%)
adding: k808lidu1808.dll (188 bytes security) (deflated 5%)
adding: kirnel32.dll (188 bytes security) (deflated 4%)
adding: ktlql7351.dll (188 bytes security) (deflated 5%)
adding: LHPNM12n.dll (188 bytes security) (deflated 4%)
adding: Lrdxf12n.dll (188 bytes security) (deflated 4%)
adding: ltl0273mg.dll (188 bytes security) (deflated 4%)
adding: lv4409hqe.dll (188 bytes security) (deflated 5%)
adding: lv4u09h9e.dll (188 bytes security) (deflated 5%)
adding: m6lslg3716.dll (188 bytes security) (deflated 4%)
adding: mrcndmgr.dll (188 bytes security) (deflated 4%)
adding: mv0sl9d71.dll (188 bytes security) (deflated 5%)
adding: n2n6lc5s1f.dll (188 bytes security) (deflated 5%)
adding: o6840glqe6qe0.dll (188 bytes security) (deflated 4%)
adding: PlayerHost.dll (188 bytes security) (deflated 71%)
adding: rDsmxs.dll (188 bytes security) (deflated 4%)
adding: rvhx32.dll (188 bytes security) (deflated 5%)
adding: SQLDB232.DLL (188 bytes security) (deflated 56%)
adding: SQLINF32.DLL (188 bytes security) (deflated 54%)
adding: SQLINT32.DLL (188 bytes security) (deflated 54%)
adding: SQLMSS32.DLL (188 bytes security) (deflated 56%)
adding: SQLORA32.DLL (188 bytes security) (deflated 56%)
adding: SQLORA8.DLL (188 bytes security) (deflated 56%)
adding: SQLSSC32.DLL (188 bytes security) (deflated 56%)
adding: SQLSYB32.DLL (188 bytes security) (deflated 56%)
adding: UbinstGMT.dll (188 bytes security) (deflated 5%)
adding: clear.reg (188 bytes security) (deflated 71%)
adding: DIAG.INI (188 bytes security) (deflated 56%)
adding: AILog.txt (188 bytes security) (stored 0%)
adding: bios.txt (188 bytes security) (deflated 38%)
adding: DIAG.TXT (188 bytes security) (deflated 65%)
adding: DIAGENG.TXT (188 bytes security) (deflated 66%)
adding: HINWEIS.TXT (188 bytes security) (deflated 38%)
adding: HISTENG.TXT (188 bytes security) (deflated 60%)
adding: HISTORY.TXT (188 bytes security) (deflated 60%)
adding: lo2.txt (188 bytes security) (deflated 86%)
adding: REGENG.TXT (188 bytes security) (deflated 59%)
adding: REGISTER.TXT (188 bytes security) (deflated 58%)
adding: test.txt (188 bytes security) (deflated 80%)
adding: test2.txt (188 bytes security) (deflated 50%)
adding: test3.txt (188 bytes security) (deflated 50%)
adding: test5.txt (188 bytes security) (deflated 50%)
adding: xfind.txt (188 bytes security) (deflated 74%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:

deleting local copy: aqycfilt.dll
deleting local copy: aurace.dll
deleting local copy: azaslg3716.dll
deleting local copy: cwedui.dll
deleting local copy: enl0l13m1.dll
deleting local copy: fp0m03d1e.dll
deleting local copy: fp4o03h3e.dll
deleting local copy: gpjql3151.dll
deleting local copy: hr2u05f9e.dll
deleting local copy: hr6o05j3e.dll
deleting local copy: ib50_32.dll
deleting local copy: ir4ul5h91.dll
deleting local copy: jxdw400.dll
deleting local copy: k4nole531h.dll
deleting local copy: k808lidu1808.dll
deleting local copy: kirnel32.dll
deleting local copy: ktlql7351.dll
deleting local copy: LHPNM12n.dll
deleting local copy: Lrdxf12n.dll
deleting local copy: ltl0273mg.dll
deleting local copy: lv4409hqe.dll
deleting local copy: lv4u09h9e.dll
deleting local copy: m6lslg3716.dll
deleting local copy: mrcndmgr.dll
deleting local copy: mv0sl9d71.dll
deleting local copy: n2n6lc5s1f.dll
deleting local copy: o6840glqe6qe0.dll
deleting local copy: rDsmxs.dll
deleting local copy: rvhx32.dll
deleting local copy: UbinstGMT.dll

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\default]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mfrle32.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MS-DOS Emulation]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\guard.tmp"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\aqycfilt.dll
C:\WINDOWS\system32\aurace.dll
C:\WINDOWS\system32\azaslg3716.dll
C:\WINDOWS\system32\cwedui.dll
C:\WINDOWS\system32\enl0l13m1.dll
C:\WINDOWS\system32\fp0m03d1e.dll
C:\WINDOWS\system32\fp4o03h3e.dll
C:\WINDOWS\system32\gpjql3151.dll
C:\WINDOWS\system32\hr2u05f9e.dll
C:\WINDOWS\system32\hr6o05j3e.dll
C:\WINDOWS\system32\ib50_32.dll
C:\WINDOWS\system32\ir4ul5h91.dll
C:\WINDOWS\system32\jxdw400.dll
C:\WINDOWS\system32\k4nole531h.dll
C:\WINDOWS\system32\k808lidu1808.dll
C:\WINDOWS\system32\kirnel32.dll
C:\WINDOWS\system32\ktlql7351.dll
C:\WINDOWS\system32\LHPNM12n.dll
C:\WINDOWS\system32\Lrdxf12n.dll
C:\WINDOWS\system32\ltl0273mg.dll
C:\WINDOWS\system32\lv4409hqe.dll
C:\WINDOWS\system32\lv4u09h9e.dll
C:\WINDOWS\system32\m6lslg3716.dll
C:\WINDOWS\system32\mrcndmgr.dll
C:\WINDOWS\system32\mv0sl9d71.dll
C:\WINDOWS\system32\n2n6lc5s1f.dll
C:\WINDOWS\system32\o6840glqe6qe0.dll
C:\WINDOWS\system32\rDsmxs.dll
C:\WINDOWS\system32\rvhx32.dll
C:\WINDOWS\system32\UbinstGMT.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{08625A55-6B3A-4109-88D8-56E8E333BB5E}"=-
"{E1322F09-02B6-4E72-B5CC-6B795E758A7B}"=-
"{FFF53BEF-BDA8-4AE2-8132-1ED35E97AD8C}"=-
"{52873B9C-4FB9-4D86-9A8F-80B81F2BB70D}"=-
"{5C9B06B7-04C7-4023-A090-A8008C37FABF}"=-
"{DAF11285-46F9-45A4-8383-F7A1EBE87E8F}"=-
"{A0BBE383-78E3-4C73-8128-1180B21D6A01}"=-
"{4683E64C-B125-495F-86F4-BFB5247CEDB8}"=-
"{E2CFB238-033C-429C-AEA0-4BFA6AF41BC9}"=-
"{EAA67C8D-5396-4ED9-9070-F1E9C30EB045}"=-
"{338A5538-4F3F-4DFE-8A14-E18D6E2EE8F1}"=-
"{5F98A4B6-CD25-42E8-81F2-2D6F392D1A84}"=-
"{ECDB9291-581E-441F-BBFB-A5DD3E73A550}"=-
"{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}"=-
"{F7F4E57E-2EBA-4123-903B-F1B85C40F791}"=-
"{E47953F8-125D-44A3-B6AF-B9C476F91E80}"=-
"{CD8D6C15-0BB8-4BDD-BA31-D79166660EEE}"=-
"{D3E9B3D1-22C7-4218-BA26-C0870B87441E}"=-
"{C25B7CF2-04EB-4FEF-BDD1-E937FC107EA2}"=-
"{8DF69A41-8595-4603-9687-17878366E970}"=-
"{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}"=-
"{90297BEE-CA79-485B-A504-50437C73BC1C}"=-
"{AADB38B6-0FCF-4658-B241-0768463432A2}"=-
"{CE85D680-9227-4EC0-9011-CF8F65BF9C69}"=-
"{40A0BE73-1DA1-47A9-964D-69207A2B5055}"=-
"{FAB9D278-019D-4BD0-AB48-B5DA18735547}"=-
"{2FF0E91F-F374-4285-8950-192EDE10110F}"=-
"{EEA42CC7-3814-4724-B055-1FD9177C68E5}"=-
"{031E5D37-227D-49F3-9FE0-20891140911F}"=-
"{22A4C29F-5E0D-472B-9A39-E558935E4219}"=-
"{77664C73-DC80-4D79-8150-062055E5FC8E}"=-
"{4CB8FBB3-1B8B-4532-BCBE-978745D1C8AD}"=-
"{5F0EF905-E697-4C41-8A46-2F52DE1707C3}"=-
[-HKEY_CLASSES_ROOT\CLSID\{08625A55-6B3A-4109-88D8-56E8E333BB5E}]
[-HKEY_CLASSES_ROOT\CLSID\{E1322F09-02B6-4E72-B5CC-6B795E758A7B}]
[-HKEY_CLASSES_ROOT\CLSID\{FFF53BEF-BDA8-4AE2-8132-1ED35E97AD8C}]
[-HKEY_CLASSES_ROOT\CLSID\{52873B9C-4FB9-4D86-9A8F-80B81F2BB70D}]
[-HKEY_CLASSES_ROOT\CLSID\{5C9B06B7-04C7-4023-A090-A8008C37FABF}]
[-HKEY_CLASSES_ROOT\CLSID\{DAF11285-46F9-45A4-8383-F7A1EBE87E8F}]
[-HKEY_CLASSES_ROOT\CLSID\{A0BBE383-78E3-4C73-8128-1180B21D6A01}]
[-HKEY_CLASSES_ROOT\CLSID\{4683E64C-B125-495F-86F4-BFB5247CEDB8}]
[-HKEY_CLASSES_ROOT\CLSID\{E2CFB238-033C-429C-AEA0-4BFA6AF41BC9}]
[-HKEY_CLASSES_ROOT\CLSID\{EAA67C8D-5396-4ED9-9070-F1E9C30EB045}]
[-HKEY_CLASSES_ROOT\CLSID\{338A5538-4F3F-4DFE-8A14-E18D6E2EE8F1}]
[-HKEY_CLASSES_ROOT\CLSID\{5F98A4B6-CD25-42E8-81F2-2D6F392D1A84}]
[-HKEY_CLASSES_ROOT\CLSID\{ECDB9291-581E-441F-BBFB-A5DD3E73A550}]
[-HKEY_CLASSES_ROOT\CLSID\{21AD238D-0317-458F-ACCF-E5BF0FCF06AA}]
[-HKEY_CLASSES_ROOT\CLSID\{F7F4E57E-2EBA-4123-903B-F1B85C40F791}]
[-HKEY_CLASSES_ROOT\CLSID\{E47953F8-125D-44A3-B6AF-B9C476F91E80}]
[-HKEY_CLASSES_ROOT\CLSID\{CD8D6C15-0BB8-4BDD-BA31-D79166660EEE}]
[-HKEY_CLASSES_ROOT\CLSID\{D3E9B3D1-22C7-4218-BA26-C0870B87441E}]
[-HKEY_CLASSES_ROOT\CLSID\{C25B7CF2-04EB-4FEF-BDD1-E937FC107EA2}]
[-HKEY_CLASSES_ROOT\CLSID\{8DF69A41-8595-4603-9687-17878366E970}]
[-HKEY_CLASSES_ROOT\CLSID\{CDE3BEA4-8C45-4124-8E99-347CEFD0059A}]
[-HKEY_CLASSES_ROOT\CLSID\{90297BEE-CA79-485B-A504-50437C73BC1C}]
[-HKEY_CLASSES_ROOT\CLSID\{AADB38B6-0FCF-4658-B241-0768463432A2}]
[-HKEY_CLASSES_ROOT\CLSID\{CE85D680-9227-4EC0-9011-CF8F65BF9C69}]
[-HKEY_CLASSES_ROOT\CLSID\{40A0BE73-1DA1-47A9-964D-69207A2B5055}]
[-HKEY_CLASSES_ROOT\CLSID\{FAB9D278-019D-4BD0-AB48-B5DA18735547}]
[-HKEY_CLASSES_ROOT\CLSID\{2FF0E91F-F374-4285-8950-192EDE10110F}]
[-HKEY_CLASSES_ROOT\CLSID\{EEA42CC7-3814-4724-B055-1FD9177C68E5}]
[-HKEY_CLASSES_ROOT\CLSID\{031E5D37-227D-49F3-9FE0-20891140911F}]
[-HKEY_CLASSES_ROOT\CLSID\{22A4C29F-5E0D-472B-9A39-E558935E4219}]
[-HKEY_CLASSES_ROOT\CLSID\{77664C73-DC80-4D79-8150-062055E5FC8E}]
[-HKEY_CLASSES_ROOT\CLSID\{4CB8FBB3-1B8B-4532-BCBE-978745D1C8AD}]
[-HKEY_CLASSES_ROOT\CLSID\{5F0EF905-E697-4C41-8A46-2F52DE1707C3}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************


Edited by redghia, 07 November 2005 - 02:26 AM.

[Advertisements]

Ok, now we will go for manual deletion, please post a new l2mfix Option1 log and a new HijackThis log.

Don't reboot until you receive new instructions.

[Armodeluxe]

Ok, now we will go for manual deletion, please post a new l2mfix Option1 log and a new HijackThis log.

Don't reboot until you receive new instructions.

[redghia]

System seems to be a little cleaner - I still have the cram toolbar installer


Logfile of HijackThis v1.99.1
Scan saved at 7:19:50 PM, on 8/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\PROGRA~1\TWEAKM~1\TMTray.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\Documents and Settings\Ashley\My Documents\Programs\Spyware Programs\HijackThis.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TSC.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\pcclient.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [TweakMASTER] "C:\PROGRA~1\TWEAKM~1\TMTray.exe"
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MSN Messenger.lnk = C:\Program Files\MSN Messenger\msnmsgr.exe
O4 - Startup: SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13....es/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.co...clean_micro.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124188782390
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zon...ot.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O18 - Protocol: bw+0 - {BBD517CC-DE59-4465-A135-694E1859EF1D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: default - C:\WINDOWS\system32\mfrle32.dll (file missing)
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\guard.tmp (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

[redghia]

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\default]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mfrle32.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MS-DOS Emulation]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\guard.tmp"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{ED65AC21-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device"
"{ED65AC22-B24F-11d3-BA80-00C0CA16AA37}"="Siemens Device ContextMenuHandler"
"{ED65AC23-B24F-11d3-BA80-00C0CA16AA37}"="Siemens SX1 PropertySheetHandler"
"{48F45200-91E6-11CE-8A4F-0080C81A28D4}"="TMD Shell Extension"
"{771A9DA0-731A-11CE-993C-00AA004ADB6C}"="VBPropSheet"
"{D9872D13-7651-4471-9EEE-F0A00218BEBB}"="Multiscan"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension"
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
atl71.dll Mon 10 Oct 2005 2:46:00 A.... 89,088 87.00 K
browseui.dll Sat 3 Sep 2005 10:22:04 A.... 1,019,904 996.00 K
cdfview.dll Sat 3 Sep 2005 10:22:04 A.... 151,040 147.50 K
cdosys.dll Sat 10 Sep 2005 12:23:42 A.... 2,067,968 1.97 M
danim.dll Sat 3 Sep 2005 10:22:04 A.... 1,053,696 1.00 M
dxtrans.dll Sat 3 Sep 2005 10:22:04 A.... 205,312 200.50 K
extmgr.dll Sat 3 Sep 2005 10:22:04 ..... 55,808 54.50 K
iepeers.dll Sat 3 Sep 2005 10:22:04 A.... 251,392 245.50 K
inseng.dll Sat 3 Sep 2005 10:22:04 A.... 96,256 94.00 K
islzma.dll Fri 21 Oct 2005 15:50:14 A.... 102,912 100.50 K
kemutb.dll Mon 10 Oct 2005 2:46:00 A.... 143,360 140.00 K
kemutil.dll Mon 10 Oct 2005 2:46:00 A.... 94,208 92.00 K
kemwnd.dll Mon 10 Oct 2005 2:46:00 A.... 86,016 84.00 K
kemxml.dll Mon 10 Oct 2005 2:46:00 A.... 65,536 64.00 K
linkinfo.dll Thu 1 Sep 2005 12:11:54 A.... 19,968 19.50 K
mbsreg~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,112 25.50 K
mbsuse~1.dll Fri 9 Sep 2005 8:23:10 A.... 26,624 26.00 K
mbswin~1.dll Fri 9 Sep 2005 8:23:10 A.... 51,200 50.00 K
mfc71.dll Mon 10 Oct 2005 2:46:00 A.... 1,060,864 1.01 M
mfc71u.dll Mon 10 Oct 2005 2:46:00 A.... 1,047,552 1023.00 K
mshtml.dll Tue 4 Oct 2005 18:26:00 A.... 3,015,168 2.88 M
mshtmled.dll Sat 3 Sep 2005 10:22:06 A.... 448,512 438.00 K
msrating.dll Sat 3 Sep 2005 10:22:06 A.... 146,432 143.00 K
mstime.dll Sat 3 Sep 2005 10:22:06 A.... 530,432 518.00 K
msvcp71.dll Mon 10 Oct 2005 2:46:00 A.... 499,712 488.00 K
msvcr71.dll Mon 10 Oct 2005 2:46:00 A.... 348,160 340.00 K
netman.dll Tue 23 Aug 2005 4:59:46 A.... 197,632 193.00 K
pngfilt.dll Sat 3 Sep 2005 10:22:06 A.... 39,424 38.50 K
quartz.dll Tue 30 Aug 2005 14:43:42 A.... 1,287,680 1.23 M
rbap350.dll Fri 9 Sep 2005 8:23:10 A.... 60,416 59.00 K
rbrege~1.dll Fri 9 Sep 2005 8:23:10 A.... 73,216 71.50 K
rbsele~1.dll Fri 9 Sep 2005 8:23:10 A.... 27,648 27.00 K
rbspri~1.dll Fri 9 Sep 2005 8:23:10 A.... 56,832 55.50 K
shdocvw.dll Sat 3 Sep 2005 10:22:06 A.... 1,483,776 1.41 M
shell32.dll Fri 23 Sep 2005 13:35:30 A.... 8,450,560 8.06 M
shlwapi.dll Sat 3 Sep 2005 10:22:06 A.... 473,600 462.50 K
sirenacm.dll Thu 13 Oct 2005 10:41:06 A.... 118,784 116.00 K
umpnpmgr.dll Tue 23 Aug 2005 14:05:42 A.... 123,392 120.50 K
unicows.dll Mon 10 Oct 2005 2:46:00 A.... 258,352 252.30 K
urlmon.dll Sat 3 Sep 2005 10:22:06 A.... 608,768 594.50 K
wininet.dll Sat 3 Sep 2005 10:22:06 A.... 658,432 643.00 K
winsrv.dll Thu 1 Sep 2005 12:11:54 A.... 291,840 285.00 K
wrlogo~1.dll Mon 24 Oct 2005 12:19:50 A.... 492,544 481.00 K
wrlzma.dll Mon 24 Oct 2005 12:19:46 A.... 17,920 17.50 K

44 items found: 44 files, 0 directories.
Total of file sizes: 27,424,048 bytes 26.15 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
atmtdd~1.tmp Sun 23 Oct 2005 18:15:08 A.... 0 0.00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 0 bytes 0.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 741B-A95D

Directory of C:\WINDOWS\System32

05/11/2005 07:48 PM <DIR> dllcache
03/11/2005 09:50 PM 3,766 KGyGaAvL.sys
03/11/2005 08:53 PM 56 EC756A2DDD.sys
29/12/2004 09:50 PM <DIR> Microsoft
2 File(s) 3,822 bytes
2 Dir(s) 48,871,387,136 bytes free

[Armodeluxe]

All the files are gone, good news..

Run l2mfix.bat and press 4 to restore the registry permissions..then press E to exit..

Open HijackThis and click Scan. Put a check next to these:

O20 - Winlogon Notify: default - C:\WINDOWS\system32\mfrle32.dll (file missing)
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\guard.tmp (file missing)

Close all other windows except HijackThis and click Fix Checked. If you receive messages from Microsoft Antispyware, Spysweeper and Winpatrol, allow the changes.

First, download and install CleanUp! but do not run it yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.

Please update Ewido

• Launch ewido, there should be a big E icon on your desktop, double-click it.
• On the left hand side of the main screen click update
• Click on Start
• The update will start and a progress bar will show the updates being installed
• After the updates are installed, exit Ewido

Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.

Once in Safe Mode:

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files
• Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.

If Cleanup! asks if you want to reboot, click NO

Open Ewido

• Click on scanner
• Click Complete System Scan
• Let the program scan the machine

While the scan is in progress you will be prompted to clean the first infected file it finds. Choose "remove", then put a check next to "Perform action on all infections" in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop
• Exit Ewido

Reboot back to normal mode. Let's run also an online scan.

Go here to make an online scan:

http://www.pandasoft.../activescan.htm

- Once you are on the Panda site click the Scan your PC button
- A new window will open...click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
- When download is complete, click on Local Disks to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Then please post a new HijackThis log along with the logs from Ewido and Panda.

[redghia]

I see that the forum was down, Anything more i have to do as i still havent restarted the comp like u said

[redghia]

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 7:27:50 PM, 10/11/2005
+ Report-Checksum: E6B90DA

+ Scan result:

C:\backup.zip/aqycfilt.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/aurace.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/azaslg3716.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/cwedui.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/enl0l13m1.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/fp0m03d1e.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/fp4o03h3e.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/gpjql3151.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/hr2u05f9e.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/hr6o05j3e.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/ib50_32.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/ir4ul5h91.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/jxdw400.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/k4nole531h.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/k808lidu1808.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/kirnel32.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/ktlql7351.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/LHPNM12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/Lrdxf12n.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/ltl0273mg.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/lv4409hqe.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/lv4u09h9e.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/m6lslg3716.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/mrcndmgr.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/mv0sl9d71.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/n2n6lc5s1f.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/o6840glqe6qe0.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/rDsmxs.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/rvhx32.dll -> Spyware.Look2Me : Cleaned with backup
C:\backup.zip/UbinstGMT.dll -> Spyware.Look2Me : Cleaned with backup


::Report End

[redghia]

Incident Status Location

Adware:Adware/IST.ISTBar No disinfected C:\Documents and Settings\Ashley\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-5aa0b436-4eb37f41.zip[InstallerApplet.class]
Virus:W32/Sober.I.worm Renamed C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\[email protected][homer.zm9][message_text.txt .pif]
Virus:W32/Netsky.B.worm Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\[email protected][doc.zip][doc.scr]
Virus:W32/Sober.G.worm Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[yourmail.doc.zip][p-zipped_file_data .pif]
Virus:W32/Sober.G.worm Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[check_this_3712.word.zip][p-zipped_file_data .pif]
Virus:W32/Sober.G.worm Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[EM.dhs_1311.com]
Virus:W32/Sober.I.worm Renamed C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[auto__mail.anz.zm9][message_text.txt .pif]
Virus:W32/Sober.I.worm Renamed C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[yahoo_6043.zl6]
Virus:W32/Sober.I.worm Renamed C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[hotmail_7354.zl6]
Virus:W32/Sober.I.worm Renamed C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[care2.DOC.zl6]
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[~0002173.~]
Virus:W32/Klez.I Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[the.pif]
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[~0002192.~]
Virus:W32/Klez.I Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[Nqwb.scr]
Virus:W32/Klez.I Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[It.exe]
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[~0002220.~]
Virus:W32/Klez.I Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[Done..bat]
Virus:W32/Lentin.E Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[goldfish.jpg
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[~0002289.~]
Virus:W32/Lentin.E Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[goldfish.htm.pif]
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[~0002481.~]
Virus:W32/Bugbear Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[conflict.doc.exe]
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[~0002547.~]
Virus:W32/Bugbear Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[mdac_typ.exe.exe]
Virus:Exploit/iFrame Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[~0002786.~]
Virus:W32/Bugbear.B.Dam Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Inbox[FACSIMILE TRANSMISSION.doc.pif]
Virus:Trj/Downloader.EC Disinfected C:\Documents and Settings\Ashley\Application Data\Thunderbird\Profiles\vebd976f.default\Mail\Local Folders\Sent[Office XP Universal Activator v1.0.zip][start.exe]
Virus:W32/Sober.I.worm Renamed Archive Folders\[email protected]\Your Password <KEY:2409>\homer.zm9[message_text.txt .pif]
Virus:W32/Netsky.B.worm Disinfected Archive Folders\[email protected]\unknown\doc.zip[doc.scr]
Virus:W32/Lentin.E Disinfected Personal Folders\Inbox\Fw: goldfish\goldfish.jpg
Virus:W32/Sober.G.worm Disinfected Personal Folders\Inbox\Sorry, that's your mail\yourmail.doc.zip[p-zipped_file_data .pif]
Virus:W32/Sober.G.worm Disinfected Personal Folders\Inbox\Warning!\check_this_3712.word.zip[p-zipped_file_data .pif]
Virus:W32/Sober.G.worm Disinfected Personal Folders\Inbox\Mail delivery failed (Nr.:4307)\EM.dhs_1311.com
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\mail delivery system <SMTP:6881>\auto__mail.anz.zm9[message_text.txt .pif]
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\FwD: Confirmation <KEY:7963>\yahoo_6043.zl6
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\Mail Error <Esmtp:9706>\hotmail_7354.zl6
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\FwD: Registration confirmation\care2.DOC.zl6
Virus:W32/Lentin.E Disinfected Personal Folders\Inbox\Fw: goldfish\goldfish.jpg
Virus:W32/Sober.G.worm Disinfected Personal Folders\Inbox\Sorry, that's your mail\yourmail.doc.zip[p-zipped_file_data .pif]
Virus:W32/Sober.G.worm Disinfected Personal Folders\Inbox\Warning!\check_this_3712.word.zip[p-zipped_file_data .pif]
Virus:W32/Sober.G.worm Disinfected Personal Folders\Inbox\Mail delivery failed (Nr.:4307)\EM.dhs_1311.com
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\mail delivery system <SMTP:6881>\auto__mail.anz.zm9[message_text.txt .pif]
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\FwD: Confirmation <KEY:7963>\yahoo_6043.zl6
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\Mail Error <Esmtp:9706>\hotmail_7354.zl6
Virus:W32/Sober.I.worm Renamed Personal Folders\Inbox\FwD: Registration confirmation\care2.DOC.zl6
Virus:Trj/Downloader.EC Disinfected Personal Folders\Sent Items\Emailing: Office XP Universal Activator v1.0\Office XP Universal Activator v1.0.zip[start.exe]
Virus:W32/Sober.I.worm Renamed C:\Documents and Settings\Evan\Application Data\Thunderbird\Profiles\2eiw8lew.default\Mail\Local Folders\[email protected][homer.zm9][message_text.txt .pif]
Virus:W32/Sober.I.worm Renamed Personal Folders\[email protected]\Your Password <KEY:2409>\homer.zm9[message_text.txt .pif]
Adware:adware/cashsaver No disinfected C:\WINDOWS\system32\CSUninstall.exe
Adware:adware/ncase No disinfected C:\WINDOWS\system32\saie_gdf.dat

[Armodeluxe]

You forgot to post a new HijackThis log..

Reconfigure Windows XP to show hidden files:
Click Start. Open My Computer.
Select the Tools menu and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

Please delete these two files:

C:\WINDOWS\system32\CSUninstall.exe
C:\WINDOWS\system32\saie_gdf.dat

Then empty the contents of this folder: (everything in it)

C:\Documents and Settings\Ashley\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar

When done, please put the file view settings back to original..

Then please post a new HijackThis log.

[redghia]

Sorry about the hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 6:22:49 PM, on 11/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\PROGRA~1\TWEAKM~1\TMTray.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Documents and Settings\Ashley\My Documents\Programs\Spyware Programs\HijackThis.exe

O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [TweakMASTER] "C:\PROGRA~1\TWEAKM~1\TMTray.exe"
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MSN Messenger.lnk = C:\Program Files\MSN Messenger\msnmsgr.exe
O4 - Startup: SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Add to &LinkFox - res://C:\PROGRA~1\TWEAKM~1\TweakBHO.dll/IESCRIPT
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI699F~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by13fd.bay13....es/MsnPUpld.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.co...clean_micro.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1124188782390
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zon...ot.cab31267.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O18 - Protocol: bw+0 - {BBD517CC-DE59-4465-A135-694E1859EF1D} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

[Armodeluxe]

Everything looks good.

Now let's reset your restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Please take the following into consideration to maintain a clean computer.

Visit Windows Update regularly to get the latest security updates.You can also enable automatic updates.Your antivirus software and antispyware programs should also be updated regularly. Make a habit of running scans on a timely basis. Be careful about what you download, scan every file before clicking on it.

Additional programs to consider:

Spywareblaster Prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.Blocks spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.Restricts the actions of potentially unwanted sites in Internet Explorer.
Spywareguard An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware!
IE/Spyad
Adds a list of malicious sites to your Restricted Sites Zone.
Firefox An alternate browser safer than IE

A good article to read:
So how did I get infected in the first place?

Regards,

Armodeluxe

[redghia]

Thanks for all your help, I was using firefox in the firsplace when i got the infection

[Armodeluxe]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.