[Alain Grondin]

Hi, I unable to remove guard.tmp, could you help me ?

See the log of Ewido and Hijackthis
---------------------------------------------------------
ewido security suite - Rapport de scan
---------------------------------------------------------

+ Créé le: 16:44:47, 2005-10-31
+ Somme de contrôle: AD57AC6F

+ Résultats du scan:

[1580] C:\WINDOWS\system32\guard.tmp -> Spyware.Look2Me : Erreur durant le nettoyage
[1676] C:\WINDOWS\system32\guard.tmp -> Spyware.Look2Me : Erreur durant le nettoyage
C:\WINDOWS\system32\GIODMFR.Dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\WINDOWS\system32\PGDLIB32.DLL -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\WINDOWS\system32\qjartz.dll -> Spyware.Look2Me : Nettoyer et sauvegarder


::Fin du rapport


Logfile of HijackThis v1.99.1
Scan saved at 17:12:50, on 2005-10-31
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\System32\TpScrLk.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoft....com/activescan (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Mise à jour de logiciels ThinkPad - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\enr6l19s1.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe


Thank you for your help

[Advertisements]

Hi Alain and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log. I see by the programs that you have run that you are operating in the French language. I prefer that these help sessions be conducted in English so that they may possibly benefit other users but please feel free, if unsure of anything or if you don't know how to explain something in English, to pose your question in French as I have a working knowledge of the language. I am not that familiar with the technical jargon in French but do well in general conversation.

A.
Download a trial version of SpySweeper

• Install the application
• Update its definitions
• Run the program
• Let it remove everything it wants
• Finally, when it has finished its work, REBOOT your system.

B. Please provide a fresh HijackThis log for review as well as any log that you get from using Spy Sweeper,



Au plaisir,

Trevuren

[Trevuren]

Hi Alain and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log. I see by the programs that you have run that you are operating in the French language. I prefer that these help sessions be conducted in English so that they may possibly benefit other users but please feel free, if unsure of anything or if you don't know how to explain something in English, to pose your question in French as I have a working knowledge of the language. I am not that familiar with the technical jargon in French but do well in general conversation.

A.
Download a trial version of SpySweeper

• Install the application
• Update its definitions
• Run the program
• Let it remove everything it wants
• Finally, when it has finished its work, REBOOT your system.

B. Please provide a fresh HijackThis log for review as well as any log that you get from using Spy Sweeper,



Au plaisir,

Trevuren

[Alain Grondin]

Trevuren, thank you very much for your help. I downloaded SpySweeper, install and run it. Seee the new logs.

SpySweeper log

20:23: | Start of Session, 1 novembre, 2005 |
20:23: Spy Sweeper started
20:23: Sweep initiated using definitions version 564
20:23: Starting Memory Sweep
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:24: Found Adware: icannnews
20:24: Detected running threat: C:\WINDOWS\system32\n6l8lg3u16.dll (ID = 83)
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:25: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:25: Memory Sweep Complete, Elapsed Time: 00:01:47
20:25: Starting Registry Sweep
20:25: Found Adware: azsearch toolbar
20:25: HKCR\azentretien.loader\ (5 subtraces) (ID = 103886)
20:25: HKCR\clsid\{0d2def3a-f4f1-42ec-ac4f-132e7ba6e292}\ (9 subtraces) (ID = 103887)
20:25: HKLM\software\azentretienco\ (3 subtraces) (ID = 103905)
20:25: HKLM\software\classes\azentretien.loader.1\ (3 subtraces) (ID = 103909)
20:25: HKLM\software\classes\azentretien.loader\ (5 subtraces) (ID = 103910)
20:25: HKLM\software\classes\clsid\{0d2def3a-f4f1-42ec-ac4f-132e7ba6e292}\ (9 subtraces) (ID = 103911)
20:25: Registry Sweep Complete, Elapsed Time:00:00:07
20:25: Starting Cookie Sweep
20:25: Cookie Sweep Complete, Elapsed Time: 00:00:00
20:25: Starting File Sweep
20:25: Found Adware: effective-i toolbar
20:25: c:\program files\thesearchaccelerator (ID = -2147481059)
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:26: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:27: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:27: azesearch.bmp (ID = 50322)
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:28: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:29: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:31: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:32: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.ad-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:33: The Spy Communication shield has blocked access to: www.a-d-w-a-r-e.com
20:39: azesearch.inf (ID = 50329)
20:39: File Sweep Complete, Elapsed Time: 00:13:25
20:39: Full Sweep has completed. Elapsed time 00:15:22
20:39: Traces Found: 44
20:46: Removal process initiated
20:46: Quarantining All Traces: azsearch toolbar
20:46: Quarantining All Traces: effective-i toolbar
20:46: Quarantining All Traces: icannnews
20:46: icannnews is in use. It will be removed on reboot.
20:46: C:\WINDOWS\system32\n6l8lg3u16.dll is in use. It will be removed on reboot.
20:46: Preparing to restart your computer. Please wait...
20:46: Removal process completed. Elapsed time 00:00:34
20:49: Hosts file is too large.
20:50: | End of Session, 1 novembre, 2005 |


Logfile of HijackThis v1.99.1
Scan saved at 20:53:32, on 2005-11-01
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\TpScrLk.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\System32\TpScrLk.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoft....com/activescan (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Mise à jour de logiciels ThinkPad - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\k062lajo1doc.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

[Trevuren]

You have the latest version of VX2.

1. Download L2mfix from one of these two locations:

http://www.atribune....oads/l2mfix.exe
http://www.downloads....org/l2mfix.exe

2. Save the file to your desktop and double click l2mfix.exe.

• Click the Install button to extract the files and follow the prompts.
• Open the newly added l2mfix folder on your desktop.
• Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter.
• This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log.
• Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

Note: If you receive, while running option #1, an error similar to:

''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...

• Then please use option 5 or,
• The web page link in the l2mfix folder to solve this error condition.

Do not run the fix portion without fixing this first.

Regards,

Trevuren

[Alain Grondin]

Here the l2mfix log,

L2MFIX find log 1.04a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ThemeManager]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\k062lajo1doc.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{27516F29-F23A-055D-60ED-2CE7F902E4DA}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage �cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="�tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="�num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions"
"{506F4668-F13E-4AA1-BB04-B43203AB3CC0}"="{506F4668-F13E-4AA1-BB04-B43203AB3CC0}"
"{D66DC78C-4F61-447F-942B-3FB6980118CF}"="{D66DC78C-4F61-447F-942B-3FB6980118CF}"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{F4F299B9-22F9-41AC-B6F9-4477058480EC}"=""
"{59A345A0-D7D4-4B6D-97AF-489B946912B4}"=""
"{17C60DB7-CF23-4064-A6FE-A00AA60E461F}"=""
"{F2B39BFC-E081-48C4-A7DF-7252F1D4E99B}"=""
"{0E335C49-7BE9-424D-BA41-69415C31AAF7}"=""
"{08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7}"=""
"{9EC1C60F-8479-449D-BB4F-1CDF1F05E864}"=""
"{6350AF99-4588-470D-8179-F1650ADEFEE3}"=""
"{64AD4419-29F5-47D0-BD9F-057CA9256A97}"=""
"{6171D8FD-F33F-4021-A1C6-23DDB15DA3DA}"=""
"{1669018D-1CE7-4BD7-A9FD-C8BBE4861F23}"=""
"{E819633C-4BD2-4606-9C63-D951CE3BAE29}"=""
"{C5595552-3E7F-4E2F-B177-C24B9AE1F8D4}"=""
"{82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB}"=""
"{339D5C0E-E737-44BD-A189-700057208CE8}"=""
"{C999C73E-B4EF-4C2D-8858-4A3E122191A4}"=""
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{A3DE5886-D661-4896-AF75-8C5610D63C78}"=""
"{CE4E2484-4922-4FE1-94BF-CBBAE2499E08}"=""
"{3873968D-4021-4255-9AE6-4C11D12C850D}"=""
"{4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B}"=""
"{676658C2-ABC9-4563-A8D8-308DEEF2BA5C}"=""
"{B9C9BD24-1CCE-4350-854F-4DEEC07E5032}"=""
"{72D309F0-8C01-4581-B4F9-6155FDC68160}"=""
"{7B8ABE9A-91B3-4179-B563-C8AA784FB9F4}"=""
"{BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79}"=""
"{F7F7771D-6282-4798-B2BF-E63E6E99E8D2}"=""
"{99B74387-4355-4DD8-ABC9-ED5FB4F17419}"=""
"{96881219-DB38-4290-8758-EC44B24E61DE}"=""
"{BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7}"=""
"{C9741E85-6843-4884-9D64-C89A21F14920}"=""
"{EE169E10-D1DF-4D94-B894-902BF96F01F5}"=""
"{D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4}"=""
"{DC6276ED-FBB0-488D-B2EE-B78E8AC88876}"=""
"{33624939-9EBC-489D-8FBA-ACB6CB24ED72}"=""
"{FEFE5241-02A7-41D7-9F62-39AAE7784F70}"=""
"{129BF8A4-7EA6-4362-8D80-A2574D91185F}"=""
"{3F050AFD-94F2-4A99-ADD8-8F43C8C0501E}"=""
"{BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C}"=""
"{3F62E383-79F7-4FBE-90AB-189AC9FB4736}"=""
"{39C9BA24-D140-48D0-B793-E80BC03C8D2E}"=""
"{7FEE3F4B-C567-49F6-87CF-D55729778DE7}"=""
"{A9AEAA5B-F1A3-475D-BF61-96906F10AFED}"=""
"{A895DC8E-844A-42FF-8081-53B04A9EE3D1}"=""
"{341ABDE5-E3AC-482E-9E9D-7F86315557CC}"=""
"{B9C95369-A005-4498-9729-AF238A171918}"=""
"{D53CFC85-390A-4329-AA96-EF4D6057CF13}"=""
"{5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"
"{3030DE1B-8B1E-4513-AA36-C8339DDA408A}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F4F299B9-22F9-41AC-B6F9-4477058480EC}]
@=""
"IDEx"="ADDR"

[HKEY_CLASSES_ROOT\CLSID\{F4F299B9-22F9-41AC-B6F9-4477058480EC}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F4F299B9-22F9-41AC-B6F9-4477058480EC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{59A345A0-D7D4-4B6D-97AF-489B946912B4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{59A345A0-D7D4-4B6D-97AF-489B946912B4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{59A345A0-D7D4-4B6D-97AF-489B946912B4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F2B39BFC-E081-48C4-A7DF-7252F1D4E99B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F2B39BFC-E081-48C4-A7DF-7252F1D4E99B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F2B39BFC-E081-48C4-A7DF-7252F1D4E99B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F2B39BFC-E081-48C4-A7DF-7252F1D4E99B}\InprocServer32]
@="C:\\WINDOWS\\system32\\wS0n5msg.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0E335C49-7BE9-424D-BA41-69415C31AAF7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0E335C49-7BE9-424D-BA41-69415C31AAF7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0E335C49-7BE9-424D-BA41-69415C31AAF7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0E335C49-7BE9-424D-BA41-69415C31AAF7}\InprocServer32]
@="C:\\WINDOWS\\system32\\cnbcatq.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7}\InprocServer32]
@="C:\\WINDOWS\\system32\\GUABL1FR.Dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9EC1C60F-8479-449D-BB4F-1CDF1F05E864}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EC1C60F-8479-449D-BB4F-1CDF1F05E864}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EC1C60F-8479-449D-BB4F-1CDF1F05E864}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9EC1C60F-8479-449D-BB4F-1CDF1F05E864}\InprocServer32]
@="C:\\WINDOWS\\system32\\WWVCreator.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6350AF99-4588-470D-8179-F1650ADEFEE3}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6350AF99-4588-470D-8179-F1650ADEFEE3}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6350AF99-4588-470D-8179-F1650ADEFEE3}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6350AF99-4588-470D-8179-F1650ADEFEE3}\InprocServer32]
@="C:\\WINDOWS\\system32\\vlrsion.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{64AD4419-29F5-47D0-BD9F-057CA9256A97}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{64AD4419-29F5-47D0-BD9F-057CA9256A97}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{64AD4419-29F5-47D0-BD9F-057CA9256A97}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{64AD4419-29F5-47D0-BD9F-057CA9256A97}\InprocServer32]
@="C:\\WINDOWS\\system32\\ozbcbcp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6171D8FD-F33F-4021-A1C6-23DDB15DA3DA}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6171D8FD-F33F-4021-A1C6-23DDB15DA3DA}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6171D8FD-F33F-4021-A1C6-23DDB15DA3DA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6171D8FD-F33F-4021-A1C6-23DDB15DA3DA}\InprocServer32]
@="C:\\WINDOWS\\system32\\sgdpsrv.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{1669018D-1CE7-4BD7-A9FD-C8BBE4861F23}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1669018D-1CE7-4BD7-A9FD-C8BBE4861F23}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1669018D-1CE7-4BD7-A9FD-C8BBE4861F23}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{1669018D-1CE7-4BD7-A9FD-C8BBE4861F23}\InprocServer32]
@="C:\\WINDOWS\\system32\\rIcpldlg.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E819633C-4BD2-4606-9C63-D951CE3BAE29}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E819633C-4BD2-4606-9C63-D951CE3BAE29}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E819633C-4BD2-4606-9C63-D951CE3BAE29}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E819633C-4BD2-4606-9C63-D951CE3BAE29}\InprocServer32]
@="C:\\WINDOWS\\system32\\noevent.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C5595552-3E7F-4E2F-B177-C24B9AE1F8D4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C5595552-3E7F-4E2F-B177-C24B9AE1F8D4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C5595552-3E7F-4E2F-B177-C24B9AE1F8D4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C5595552-3E7F-4E2F-B177-C24B9AE1F8D4}\InprocServer32]
@="C:\\WINDOWS\\system32\\dwwsock.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB}\InprocServer32]
@="C:\\WINDOWS\\system32\\mdacm32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{339D5C0E-E737-44BD-A189-700057208CE8}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{339D5C0E-E737-44BD-A189-700057208CE8}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{339D5C0E-E737-44BD-A189-700057208CE8}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{339D5C0E-E737-44BD-A189-700057208CE8}\InprocServer32]
@="C:\\WINDOWS\\system32\\moxml3r.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C999C73E-B4EF-4C2D-8858-4A3E122191A4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C999C73E-B4EF-4C2D-8858-4A3E122191A4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C999C73E-B4EF-4C2D-8858-4A3E122191A4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C999C73E-B4EF-4C2D-8858-4A3E122191A4}\InprocServer32]
@="C:\\WINDOWS\\system32\\kjrnel32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A3DE5886-D661-4896-AF75-8C5610D63C78}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A3DE5886-D661-4896-AF75-8C5610D63C78}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A3DE5886-D661-4896-AF75-8C5610D63C78}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{CE4E2484-4922-4FE1-94BF-CBBAE2499E08}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CE4E2484-4922-4FE1-94BF-CBBAE2499E08}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CE4E2484-4922-4FE1-94BF-CBBAE2499E08}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{CE4E2484-4922-4FE1-94BF-CBBAE2499E08}\InprocServer32]
@="C:\\WINDOWS\\system32\\IDSENG.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3873968D-4021-4255-9AE6-4C11D12C850D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3873968D-4021-4255-9AE6-4C11D12C850D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3873968D-4021-4255-9AE6-4C11D12C850D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3873968D-4021-4255-9AE6-4C11D12C850D}\InprocServer32]
@="C:\\WINDOWS\\system32\\sirmdll.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B}\InprocServer32]
@="C:\\WINDOWS\\system32\\abctres.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{676658C2-ABC9-4563-A8D8-308DEEF2BA5C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{676658C2-ABC9-4563-A8D8-308DEEF2BA5C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{676658C2-ABC9-4563-A8D8-308DEEF2BA5C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{676658C2-ABC9-4563-A8D8-308DEEF2BA5C}\InprocServer32]
@="C:\\WINDOWS\\system32\\oobcji32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B9C9BD24-1CCE-4350-854F-4DEEC07E5032}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9C9BD24-1CCE-4350-854F-4DEEC07E5032}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9C9BD24-1CCE-4350-854F-4DEEC07E5032}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9C9BD24-1CCE-4350-854F-4DEEC07E5032}\InprocServer32]
@="C:\\WINDOWS\\system32\\ddvenum.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{72D309F0-8C01-4581-B4F9-6155FDC68160}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{72D309F0-8C01-4581-B4F9-6155FDC68160}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{72D309F0-8C01-4581-B4F9-6155FDC68160}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{72D309F0-8C01-4581-B4F9-6155FDC68160}\InprocServer32]
@="C:\\WINDOWS\\system32\\suhannel.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7B8ABE9A-91B3-4179-B563-C8AA784FB9F4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7B8ABE9A-91B3-4179-B563-C8AA784FB9F4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7B8ABE9A-91B3-4179-B563-C8AA784FB9F4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7B8ABE9A-91B3-4179-B563-C8AA784FB9F4}\InprocServer32]
@="C:\\WINDOWS\\system32\\wsbhits.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79}\InprocServer32]
@="C:\\WINDOWS\\system32\\ovexl32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F7F7771D-6282-4798-B2BF-E63E6E99E8D2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F7F7771D-6282-4798-B2BF-E63E6E99E8D2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F7F7771D-6282-4798-B2BF-E63E6E99E8D2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F7F7771D-6282-4798-B2BF-E63E6E99E8D2}\InprocServer32]
@="C:\\WINDOWS\\system32\\cbrpol.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{99B74387-4355-4DD8-ABC9-ED5FB4F17419}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{99B74387-4355-4DD8-ABC9-ED5FB4F17419}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{99B74387-4355-4DD8-ABC9-ED5FB4F17419}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{99B74387-4355-4DD8-ABC9-ED5FB4F17419}\InprocServer32]
@="C:\\WINDOWS\\system32\\is32_32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{96881219-DB38-4290-8758-EC44B24E61DE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{96881219-DB38-4290-8758-EC44B24E61DE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{96881219-DB38-4290-8758-EC44B24E61DE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{96881219-DB38-4290-8758-EC44B24E61DE}\InprocServer32]
@="C:\\WINDOWS\\system32\\mbexch40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7}\InprocServer32]
@="C:\\WINDOWS\\system32\\wfadmod.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{C9741E85-6843-4884-9D64-C89A21F14920}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C9741E85-6843-4884-9D64-C89A21F14920}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C9741E85-6843-4884-9D64-C89A21F14920}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{C9741E85-6843-4884-9D64-C89A21F14920}\InprocServer32]
@="C:\\WINDOWS\\system32\\dznwsock.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EE169E10-D1DF-4D94-B894-902BF96F01F5}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EE169E10-D1DF-4D94-B894-902BF96F01F5}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EE169E10-D1DF-4D94-B894-902BF96F01F5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EE169E10-D1DF-4D94-B894-902BF96F01F5}\InprocServer32]
@="C:\\WINDOWS\\system32\\khdbene.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4}\InprocServer32]
@="C:\\WINDOWS\\system32\\WHonfig.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DC6276ED-FBB0-488D-B2EE-B78E8AC88876}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DC6276ED-FBB0-488D-B2EE-B78E8AC88876}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DC6276ED-FBB0-488D-B2EE-B78E8AC88876}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DC6276ED-FBB0-488D-B2EE-B78E8AC88876}\InprocServer32]
@="C:\\WINDOWS\\system32\\mfexch40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{33624939-9EBC-489D-8FBA-ACB6CB24ED72}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{33624939-9EBC-489D-8FBA-ACB6CB24ED72}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{33624939-9EBC-489D-8FBA-ACB6CB24ED72}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{33624939-9EBC-489D-8FBA-ACB6CB24ED72}\InprocServer32]
@="C:\\WINDOWS\\system32\\wwadefui.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FEFE5241-02A7-41D7-9F62-39AAE7784F70}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FEFE5241-02A7-41D7-9F62-39AAE7784F70}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FEFE5241-02A7-41D7-9F62-39AAE7784F70}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FEFE5241-02A7-41D7-9F62-39AAE7784F70}\InprocServer32]
@="C:\\WINDOWS\\system32\\mppbde40.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{129BF8A4-7EA6-4362-8D80-A2574D91185F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{129BF8A4-7EA6-4362-8D80-A2574D91185F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{129BF8A4-7EA6-4362-8D80-A2574D91185F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{129BF8A4-7EA6-4362-8D80-A2574D91185F}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3F050AFD-94F2-4A99-ADD8-8F43C8C0501E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3F050AFD-94F2-4A99-ADD8-8F43C8C0501E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3F050AFD-94F2-4A99-ADD8-8F43C8C0501E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3F050AFD-94F2-4A99-ADD8-8F43C8C0501E}\InprocServer32]
@="C:\\WINDOWS\\system32\\wjbhits.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C}\InprocServer32]
@="C:\\WINDOWS\\system32\\fyamebuf.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3F62E383-79F7-4FBE-90AB-189AC9FB4736}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3F62E383-79F7-4FBE-90AB-189AC9FB4736}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3F62E383-79F7-4FBE-90AB-189AC9FB4736}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3F62E383-79F7-4FBE-90AB-189AC9FB4736}\InprocServer32]
@="C:\\WINDOWS\\system32\\SBRIPTLE.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{39C9BA24-D140-48D0-B793-E80BC03C8D2E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{39C9BA24-D140-48D0-B793-E80BC03C8D2E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{39C9BA24-D140-48D0-B793-E80BC03C8D2E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{39C9BA24-D140-48D0-B793-E80BC03C8D2E}\InprocServer32]
@="C:\\WINDOWS\\system32\\jsmd400.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7FEE3F4B-C567-49F6-87CF-D55729778DE7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7FEE3F4B-C567-49F6-87CF-D55729778DE7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7FEE3F4B-C567-49F6-87CF-D55729778DE7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7FEE3F4B-C567-49F6-87CF-D55729778DE7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A9AEAA5B-F1A3-475D-BF61-96906F10AFED}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A9AEAA5B-F1A3-475D-BF61-96906F10AFED}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A9AEAA5B-F1A3-475D-BF61-96906F10AFED}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A9AEAA5B-F1A3-475D-BF61-96906F10AFED}\InprocServer32]
@="C:\\WINDOWS\\system32\\pGpsvc.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A895DC8E-844A-42FF-8081-53B04A9EE3D1}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A895DC8E-844A-42FF-8081-53B04A9EE3D1}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A895DC8E-844A-42FF-8081-53B04A9EE3D1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A895DC8E-844A-42FF-8081-53B04A9EE3D1}\InprocServer32]
@="C:\\WINDOWS\\system32\\sbredir.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{341ABDE5-E3AC-482E-9E9D-7F86315557CC}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{341ABDE5-E3AC-482E-9E9D-7F86315557CC}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{341ABDE5-E3AC-482E-9E9D-7F86315557CC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{341ABDE5-E3AC-482E-9E9D-7F86315557CC}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B9C95369-A005-4498-9729-AF238A171918}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9C95369-A005-4498-9729-AF238A171918}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9C95369-A005-4498-9729-AF238A171918}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B9C95369-A005-4498-9729-AF238A171918}\InprocServer32]
@="C:\\WINDOWS\\system32\\qjartz.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D53CFC85-390A-4329-AA96-EF4D6057CF13}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D53CFC85-390A-4329-AA96-EF4D6057CF13}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D53CFC85-390A-4329-AA96-EF4D6057CF13}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D53CFC85-390A-4329-AA96-EF4D6057CF13}\InprocServer32]
@="C:\\WINDOWS\\system32\\PGDLIB32.DLL"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B}\InprocServer32]
@="C:\\WINDOWS\\system32\\DQO_SRS_WOWXT.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3030DE1B-8B1E-4513-AA36-C8339DDA408A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3030DE1B-8B1E-4513-AA36-C8339DDA408A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3030DE1B-8B1E-4513-AA36-C8339DDA408A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3030DE1B-8B1E-4513-AA36-C8339DDA408A}\InprocServer32]
@="C:\\WINDOWS\\system32\\PJLCOMM.DLL"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
cdosys.dll Fri 2005-09-09 21:06:04 A.... 2 025 984 1,93 M
danim.dll Fri 2005-09-02 10:08:16 A.... 988 672 965,50 K
dxtrans.dll Fri 2005-09-02 15:35:16 A.... 192 000 187,50 K
fpcall.dll Wed 2005-08-24 0:10:00 A.... 45 056 44,00 K
glenl1fr.dll Tue 2005-11-01 9:29:32 ..S.R 234 463 228,96 K
gwabl1fr.dll Wed 2005-08-03 0:15:06 A.... 57 344 56,00 K
gwabp1fr.dll Wed 2005-08-03 0:15:08 A.... 53 248 52,00 K
gwabs1fr.dll Wed 2005-08-03 0:15:08 A.... 53 248 52,00 K
gwshl1fr.dll Wed 2005-08-03 0:02:56 A.... 24 576 24,00 K
hr8805~1.dll Tue 2005-11-01 20:47:18 ..S.R 236 444 230,90 K
interc~1.dll Sun 2005-10-16 15:42:12 A.... 36 864 36,00 K
islzma.dll Fri 2005-10-21 15:50:14 A.... 102 912 100,50 K
k062la~1.dll Tue 2005-11-01 9:29:40 ..S.R 235 497 229,98 K
linkinfo.dll Wed 2005-08-31 20:50:42 A.... 16 384 16,00 K
mshtml.dll Tue 2005-10-04 11:34:14 A.... 2 700 288 2,57 M
msieftp.dll Fri 2005-08-05 12:24:24 A.... 233 984 228,50 K
mstime.dll Fri 2005-09-02 16:32:12 A.... 496 128 484,50 K
netman.dll Mon 2005-08-22 13:37:10 A.... 154 624 151,00 K
nwwks.dll Thu 2005-08-11 10:22:02 A.... 57 856 56,50 K
quartz.dll Tue 2005-08-30 8:26:24 A.... 1 233 920 1,18 M
s32evnt1.dll Thu 2005-08-18 9:04:22 A.... 83 208 81,26 K
shell32.dll Thu 2005-09-22 22:28:40 A.... 8 405 504 8,02 M
shlwapi.dll Wed 2005-08-31 17:50:42 A.... 409 600 400,00 K
tp4hook.dll Wed 2005-08-24 0:10:00 A.... 40 960 40,00 K
umpnpmgr.dll Mon 2005-08-22 22:52:22 A.... 112 640 110,00 K
urlmon.dll Fri 2005-09-02 16:32:12 A.... 459 264 448,50 K
winsrv.dll Wed 2005-08-31 20:50:42 A.... 278 528 272,00 K
wrlogo~1.dll Thu 2005-10-27 16:41:02 A.... 492 544 481,00 K
wrlzma.dll Thu 2005-10-27 16:40:58 A.... 17 920 17,50 K
xpsp2res.dll Mon 2005-09-26 19:41:24 A.... 612 864 598,50 K
__dele~1.dll Tue 2005-11-01 20:17:18 A.... 236 444 230,90 K
__dele~2.dll Tue 2005-11-01 20:48:32 A.... 235 497 229,98 K

32 items found: 32 files (3 H/S), 0 directories.
Total of file sizes: 20 564 465 bytes 19,61 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Tue 2005-11-01 20:48:36 A.... 236 012 230,48 K

1 item found: 1 file, 0 directories.
Total of file sizes: 236 012 bytes 230,48 K
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 8037-569A

R‚pertoire de C:\WINDOWS\System32

2005-11-01 20:47 236ÿ444 hr8805lue.dll
2005-11-01 09:29 235ÿ497 k062lajo1doc.dll
2005-11-01 09:29 234ÿ463 GLENL1FR.Dll
2005-10-19 09:38 <REP> dllcache
2005-06-30 18:11 <REP> Microsoft
3 fichier(s) 706ÿ404 octets
2 R‚p(s) 19ÿ765ÿ809ÿ152 octets libres

[Alain Grondin]

Trevuren

How did you see that I had the latest version of VX2 ?

Alain

[Trevuren]

Close any programs you have open since this step requires a reboot.

• From the l2mfix folder on your desktop, double click l2mfix.bat.
• Select option #2 for Run Fix by typing 2 and then pressing enter.
• Press any key to reboot your computer.
• After a reboot, your desktop and icons will appear, then disappear (this is normal).
• L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.
• Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

Note: If after the reboot the desktop icons dont dissappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix

Regards,

Trevuren

[Trevuren]

VX2 shows up in the 020 line of the HJT log. Then you have to do a Search for the legitimacy of the file in question. A lot of the files are LEGITIMATE so don't go deleting all 020 files.


Trevuren

Edited by Trevuren, 01 November 2005 - 10:59 PM.

[Alain Grondin]

Trevuren
As your request...

L2Mfix 1.04a

Running From:
C:\Documents and Settings\agrondin\Bureau\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrateurs
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE



Setting up for Reboot


Starting Reboot!

Setting Directory
C:\Documents and Settings\agrondin\Bureau\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\agrondin\Bureau\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 532 'explorer.exe'
Killing PID 532 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 724 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\__delete_on_reboot__cpmsnap.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\__delete_on_reboot__DQO_SRS_WOWXT.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\GLENL1FR.Dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\ir20l5fm1.dll
1 fichier(s) copi‚(s).
Backing Up: C:\WINDOWS\system32\mxdrv.dll
1 fichier(s) copi‚(s).
deleting: C:\WINDOWS\system32\__delete_on_reboot__cpmsnap.dll
Successfully Deleted: C:\WINDOWS\system32\__delete_on_reboot__cpmsnap.dll
deleting: C:\WINDOWS\system32\__delete_on_reboot__DQO_SRS_WOWXT.dll
Successfully Deleted: C:\WINDOWS\system32\__delete_on_reboot__DQO_SRS_WOWXT.dll
deleting: C:\WINDOWS\system32\GLENL1FR.Dll
Successfully Deleted: C:\WINDOWS\system32\GLENL1FR.Dll
deleting: C:\WINDOWS\system32\ir20l5fm1.dll
Successfully Deleted: C:\WINDOWS\system32\ir20l5fm1.dll
deleting: C:\WINDOWS\system32\mxdrv.dll
Successfully Deleted: C:\WINDOWS\system32\mxdrv.dll


Zipping up files for submission:
adding: GLENL1FR.Dll (164 bytes security) (deflated 5%)
adding: ir20l5fm1.dll (164 bytes security) (deflated 5%)
adding: mxdrv.dll (164 bytes security) (deflated 5%)
adding: __delete_on_reboot__cpmsnap.dll (164 bytes security) (deflated 5%)
adding: __delete_on_reboot__DQO_SRS_WOWXT.dll (164 bytes security) (deflated 5%)
adding: clear.reg (164 bytes security) (deflated 72%)
adding: echo.reg (164 bytes security) (deflated 11%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 77%)
adding: readme.txt (164 bytes security) (deflated 52%)
adding: report.txt (164 bytes security) (deflated 77%)
adding: test.txt (164 bytes security) (deflated 57%)
adding: test2.txt (164 bytes security) (deflated 50%)
adding: test3.txt (164 bytes security) (deflated 50%)
adding: test5.txt (164 bytes security) (deflated 50%)
adding: xfind.txt (164 bytes security) (deflated 52%)
adding: backregs/08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7.reg (164 bytes security) (deflated 70%)
adding: backregs/0E335C49-7BE9-424D-BA41-69415C31AAF7.reg (164 bytes security) (deflated 70%)
adding: backregs/129BF8A4-7EA6-4362-8D80-A2574D91185F.reg (164 bytes security) (deflated 70%)
adding: backregs/1669018D-1CE7-4BD7-A9FD-C8BBE4861F23.reg (164 bytes security) (deflated 70%)
adding: backregs/3030DE1B-8B1E-4513-AA36-C8339DDA408A.reg (164 bytes security) (deflated 70%)
adding: backregs/33624939-9EBC-489D-8FBA-ACB6CB24ED72.reg (164 bytes security) (deflated 70%)
adding: backregs/339D5C0E-E737-44BD-A189-700057208CE8.reg (164 bytes security) (deflated 70%)
adding: backregs/341ABDE5-E3AC-482E-9E9D-7F86315557CC.reg (164 bytes security) (deflated 70%)
adding: backregs/3873968D-4021-4255-9AE6-4C11D12C850D.reg (164 bytes security) (deflated 70%)
adding: backregs/39C9BA24-D140-48D0-B793-E80BC03C8D2E.reg (164 bytes security) (deflated 70%)
adding: backregs/3F050AFD-94F2-4A99-ADD8-8F43C8C0501E.reg (164 bytes security) (deflated 70%)
adding: backregs/3F62E383-79F7-4FBE-90AB-189AC9FB4736.reg (164 bytes security) (deflated 70%)
adding: backregs/4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B.reg (164 bytes security) (deflated 70%)
adding: backregs/59A345A0-D7D4-4B6D-97AF-489B946912B4.reg (164 bytes security) (deflated 69%)
adding: backregs/5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B.reg (164 bytes security) (deflated 70%)
adding: backregs/6171D8FD-F33F-4021-A1C6-23DDB15DA3DA.reg (164 bytes security) (deflated 70%)
adding: backregs/6350AF99-4588-470D-8179-F1650ADEFEE3.reg (164 bytes security) (deflated 70%)
adding: backregs/64AD4419-29F5-47D0-BD9F-057CA9256A97.reg (164 bytes security) (deflated 70%)
adding: backregs/676658C2-ABC9-4563-A8D8-308DEEF2BA5C.reg (164 bytes security) (deflated 70%)
adding: backregs/72D309F0-8C01-4581-B4F9-6155FDC68160.reg (164 bytes security) (deflated 70%)
adding: backregs/7B8ABE9A-91B3-4179-B563-C8AA784FB9F4.reg (164 bytes security) (deflated 70%)
adding: backregs/7FEE3F4B-C567-49F6-87CF-D55729778DE7.reg (164 bytes security) (deflated 70%)
adding: backregs/82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB.reg (164 bytes security) (deflated 70%)
adding: backregs/96881219-DB38-4290-8758-EC44B24E61DE.reg (164 bytes security) (deflated 70%)
adding: backregs/99B74387-4355-4DD8-ABC9-ED5FB4F17419.reg (164 bytes security) (deflated 70%)
adding: backregs/9EC1C60F-8479-449D-BB4F-1CDF1F05E864.reg (164 bytes security) (deflated 70%)
adding: backregs/A3DE5886-D661-4896-AF75-8C5610D63C78.reg (164 bytes security) (deflated 69%)
adding: backregs/A895DC8E-844A-42FF-8081-53B04A9EE3D1.reg (164 bytes security) (deflated 70%)
adding: backregs/A9AEAA5B-F1A3-475D-BF61-96906F10AFED.reg (164 bytes security) (deflated 70%)
adding: backregs/B9C95369-A005-4498-9729-AF238A171918.reg (164 bytes security) (deflated 70%)
adding: backregs/B9C9BD24-1CCE-4350-854F-4DEEC07E5032.reg (164 bytes security) (deflated 70%)
adding: backregs/BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79.reg (164 bytes security) (deflated 70%)
adding: backregs/BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C.reg (164 bytes security) (deflated 70%)
adding: backregs/BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7.reg (164 bytes security) (deflated 70%)
adding: backregs/C5595552-3E7F-4E2F-B177-C24B9AE1F8D4.reg (164 bytes security) (deflated 70%)
adding: backregs/C9741E85-6843-4884-9D64-C89A21F14920.reg (164 bytes security) (deflated 70%)
adding: backregs/C999C73E-B4EF-4C2D-8858-4A3E122191A4.reg (164 bytes security) (deflated 70%)
adding: backregs/CE4E2484-4922-4FE1-94BF-CBBAE2499E08.reg (164 bytes security) (deflated 71%)
adding: backregs/D53CFC85-390A-4329-AA96-EF4D6057CF13.reg (164 bytes security) (deflated 70%)
adding: backregs/D6622274-2EE6-4EA3-AE69-0B4FA85AE3E3.reg (164 bytes security) (deflated 70%)
adding: backregs/D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4.reg (164 bytes security) (deflated 70%)
adding: backregs/DC6276ED-FBB0-488D-B2EE-B78E8AC88876.reg (164 bytes security) (deflated 70%)
adding: backregs/E819633C-4BD2-4606-9C63-D951CE3BAE29.reg (164 bytes security) (deflated 70%)
adding: backregs/EE169E10-D1DF-4D94-B894-902BF96F01F5.reg (164 bytes security) (deflated 70%)
adding: backregs/F2B39BFC-E081-48C4-A7DF-7252F1D4E99B.reg (164 bytes security) (deflated 70%)
adding: backregs/F4F299B9-22F9-41AC-B6F9-4477058480EC.reg (164 bytes security) (deflated 68%)
adding: backregs/F7F7771D-6282-4798-B2BF-E63E6E99E8D2.reg (164 bytes security) (deflated 70%)
adding: backregs/FEFE5241-02A7-41D7-9F62-39AAE7784F70.reg (164 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(NI) ALLOW Full access AUTORITE NT\SYSTEM
(IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Utilisateurs
(ID-IO) ALLOW Read BUILTIN\Utilisateurs
(ID-NI) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-IO) ALLOW Read BUILTIN\Utilisateurs avec pouvoir
(ID-NI) ALLOW Full access BUILTIN\Administrateurs
(ID-IO) ALLOW Full access BUILTIN\Administrateurs
(ID-NI) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access AUTORITE NT\SYSTEM
(ID-IO) ALLOW Full access CREATEUR PROPRIETAIRE


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332

Restoring Windows Update Certificates.:

deleting local copy: __delete_on_reboot__cpmsnap.dll
deleting local copy: __delete_on_reboot__DQO_SRS_WOWXT.dll
deleting local copy: GLENL1FR.Dll
deleting local copy: ir20l5fm1.dll
deleting local copy: mxdrv.dll

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\__delete_on_reboot__cpmsnap.dll
C:\WINDOWS\system32\__delete_on_reboot__DQO_SRS_WOWXT.dll
C:\WINDOWS\system32\GLENL1FR.Dll
C:\WINDOWS\system32\ir20l5fm1.dll
C:\WINDOWS\system32\mxdrv.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{F4F299B9-22F9-41AC-B6F9-4477058480EC}"=-
"{59A345A0-D7D4-4B6D-97AF-489B946912B4}"=-
"{17C60DB7-CF23-4064-A6FE-A00AA60E461F}"=-
"{F2B39BFC-E081-48C4-A7DF-7252F1D4E99B}"=-
"{0E335C49-7BE9-424D-BA41-69415C31AAF7}"=-
"{08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7}"=-
"{9EC1C60F-8479-449D-BB4F-1CDF1F05E864}"=-
"{6350AF99-4588-470D-8179-F1650ADEFEE3}"=-
"{64AD4419-29F5-47D0-BD9F-057CA9256A97}"=-
"{6171D8FD-F33F-4021-A1C6-23DDB15DA3DA}"=-
"{1669018D-1CE7-4BD7-A9FD-C8BBE4861F23}"=-
"{E819633C-4BD2-4606-9C63-D951CE3BAE29}"=-
"{C5595552-3E7F-4E2F-B177-C24B9AE1F8D4}"=-
"{82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB}"=-
"{339D5C0E-E737-44BD-A189-700057208CE8}"=-
"{C999C73E-B4EF-4C2D-8858-4A3E122191A4}"=-
"{A3DE5886-D661-4896-AF75-8C5610D63C78}"=-
"{CE4E2484-4922-4FE1-94BF-CBBAE2499E08}"=-
"{3873968D-4021-4255-9AE6-4C11D12C850D}"=-
"{4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B}"=-
"{676658C2-ABC9-4563-A8D8-308DEEF2BA5C}"=-
"{B9C9BD24-1CCE-4350-854F-4DEEC07E5032}"=-
"{72D309F0-8C01-4581-B4F9-6155FDC68160}"=-
"{7B8ABE9A-91B3-4179-B563-C8AA784FB9F4}"=-
"{BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79}"=-
"{F7F7771D-6282-4798-B2BF-E63E6E99E8D2}"=-
"{99B74387-4355-4DD8-ABC9-ED5FB4F17419}"=-
"{96881219-DB38-4290-8758-EC44B24E61DE}"=-
"{BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7}"=-
"{C9741E85-6843-4884-9D64-C89A21F14920}"=-
"{EE169E10-D1DF-4D94-B894-902BF96F01F5}"=-
"{D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4}"=-
"{DC6276ED-FBB0-488D-B2EE-B78E8AC88876}"=-
"{33624939-9EBC-489D-8FBA-ACB6CB24ED72}"=-
"{FEFE5241-02A7-41D7-9F62-39AAE7784F70}"=-
"{129BF8A4-7EA6-4362-8D80-A2574D91185F}"=-
"{3F050AFD-94F2-4A99-ADD8-8F43C8C0501E}"=-
"{BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C}"=-
"{3F62E383-79F7-4FBE-90AB-189AC9FB4736}"=-
"{39C9BA24-D140-48D0-B793-E80BC03C8D2E}"=-
"{7FEE3F4B-C567-49F6-87CF-D55729778DE7}"=-
"{A9AEAA5B-F1A3-475D-BF61-96906F10AFED}"=-
"{A895DC8E-844A-42FF-8081-53B04A9EE3D1}"=-
"{341ABDE5-E3AC-482E-9E9D-7F86315557CC}"=-
"{B9C95369-A005-4498-9729-AF238A171918}"=-
"{D53CFC85-390A-4329-AA96-EF4D6057CF13}"=-
"{5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B}"=-
"{3030DE1B-8B1E-4513-AA36-C8339DDA408A}"=-
"{D6622274-2EE6-4EA3-AE69-0B4FA85AE3E3}"=-
[-HKEY_CLASSES_ROOT\CLSID\{F4F299B9-22F9-41AC-B6F9-4477058480EC}]
[-HKEY_CLASSES_ROOT\CLSID\{59A345A0-D7D4-4B6D-97AF-489B946912B4}]
[-HKEY_CLASSES_ROOT\CLSID\{17C60DB7-CF23-4064-A6FE-A00AA60E461F}]
[-HKEY_CLASSES_ROOT\CLSID\{F2B39BFC-E081-48C4-A7DF-7252F1D4E99B}]
[-HKEY_CLASSES_ROOT\CLSID\{0E335C49-7BE9-424D-BA41-69415C31AAF7}]
[-HKEY_CLASSES_ROOT\CLSID\{08C6BD70-9E16-4B88-AB86-EEA4FAD26FC7}]
[-HKEY_CLASSES_ROOT\CLSID\{9EC1C60F-8479-449D-BB4F-1CDF1F05E864}]
[-HKEY_CLASSES_ROOT\CLSID\{6350AF99-4588-470D-8179-F1650ADEFEE3}]
[-HKEY_CLASSES_ROOT\CLSID\{64AD4419-29F5-47D0-BD9F-057CA9256A97}]
[-HKEY_CLASSES_ROOT\CLSID\{6171D8FD-F33F-4021-A1C6-23DDB15DA3DA}]
[-HKEY_CLASSES_ROOT\CLSID\{1669018D-1CE7-4BD7-A9FD-C8BBE4861F23}]
[-HKEY_CLASSES_ROOT\CLSID\{E819633C-4BD2-4606-9C63-D951CE3BAE29}]
[-HKEY_CLASSES_ROOT\CLSID\{C5595552-3E7F-4E2F-B177-C24B9AE1F8D4}]
[-HKEY_CLASSES_ROOT\CLSID\{82DF3820-EDC5-40A6-9BF9-D5C16D9F0ACB}]
[-HKEY_CLASSES_ROOT\CLSID\{339D5C0E-E737-44BD-A189-700057208CE8}]
[-HKEY_CLASSES_ROOT\CLSID\{C999C73E-B4EF-4C2D-8858-4A3E122191A4}]
[-HKEY_CLASSES_ROOT\CLSID\{A3DE5886-D661-4896-AF75-8C5610D63C78}]
[-HKEY_CLASSES_ROOT\CLSID\{CE4E2484-4922-4FE1-94BF-CBBAE2499E08}]
[-HKEY_CLASSES_ROOT\CLSID\{3873968D-4021-4255-9AE6-4C11D12C850D}]
[-HKEY_CLASSES_ROOT\CLSID\{4E4BB7B7-ABAB-4A34-81DB-ADF37D9FD94B}]
[-HKEY_CLASSES_ROOT\CLSID\{676658C2-ABC9-4563-A8D8-308DEEF2BA5C}]
[-HKEY_CLASSES_ROOT\CLSID\{B9C9BD24-1CCE-4350-854F-4DEEC07E5032}]
[-HKEY_CLASSES_ROOT\CLSID\{72D309F0-8C01-4581-B4F9-6155FDC68160}]
[-HKEY_CLASSES_ROOT\CLSID\{7B8ABE9A-91B3-4179-B563-C8AA784FB9F4}]
[-HKEY_CLASSES_ROOT\CLSID\{BC8E1A2A-85D7-4BBB-9E7D-E18E7398DC79}]
[-HKEY_CLASSES_ROOT\CLSID\{F7F7771D-6282-4798-B2BF-E63E6E99E8D2}]
[-HKEY_CLASSES_ROOT\CLSID\{99B74387-4355-4DD8-ABC9-ED5FB4F17419}]
[-HKEY_CLASSES_ROOT\CLSID\{96881219-DB38-4290-8758-EC44B24E61DE}]
[-HKEY_CLASSES_ROOT\CLSID\{BF6F4C9B-A417-4B8F-AF21-51C7CB3020E7}]
[-HKEY_CLASSES_ROOT\CLSID\{C9741E85-6843-4884-9D64-C89A21F14920}]
[-HKEY_CLASSES_ROOT\CLSID\{EE169E10-D1DF-4D94-B894-902BF96F01F5}]
[-HKEY_CLASSES_ROOT\CLSID\{D7DC5AD0-0F27-4D32-AB0A-82CB21BF4AE4}]
[-HKEY_CLASSES_ROOT\CLSID\{DC6276ED-FBB0-488D-B2EE-B78E8AC88876}]
[-HKEY_CLASSES_ROOT\CLSID\{33624939-9EBC-489D-8FBA-ACB6CB24ED72}]
[-HKEY_CLASSES_ROOT\CLSID\{FEFE5241-02A7-41D7-9F62-39AAE7784F70}]
[-HKEY_CLASSES_ROOT\CLSID\{129BF8A4-7EA6-4362-8D80-A2574D91185F}]
[-HKEY_CLASSES_ROOT\CLSID\{3F050AFD-94F2-4A99-ADD8-8F43C8C0501E}]
[-HKEY_CLASSES_ROOT\CLSID\{BD6BC41E-2CD7-48DA-B4EC-850AA3DC4F5C}]
[-HKEY_CLASSES_ROOT\CLSID\{3F62E383-79F7-4FBE-90AB-189AC9FB4736}]
[-HKEY_CLASSES_ROOT\CLSID\{39C9BA24-D140-48D0-B793-E80BC03C8D2E}]
[-HKEY_CLASSES_ROOT\CLSID\{7FEE3F4B-C567-49F6-87CF-D55729778DE7}]
[-HKEY_CLASSES_ROOT\CLSID\{A9AEAA5B-F1A3-475D-BF61-96906F10AFED}]
[-HKEY_CLASSES_ROOT\CLSID\{A895DC8E-844A-42FF-8081-53B04A9EE3D1}]
[-HKEY_CLASSES_ROOT\CLSID\{341ABDE5-E3AC-482E-9E9D-7F86315557CC}]
[-HKEY_CLASSES_ROOT\CLSID\{B9C95369-A005-4498-9729-AF238A171918}]
[-HKEY_CLASSES_ROOT\CLSID\{D53CFC85-390A-4329-AA96-EF4D6057CF13}]
[-HKEY_CLASSES_ROOT\CLSID\{5AB17A28-E4FB-454E-BC84-ECCCDD0D9E9B}]
[-HKEY_CLASSES_ROOT\CLSID\{3030DE1B-8B1E-4513-AA36-C8339DDA408A}]
[-HKEY_CLASSES_ROOT\CLSID\{D6622274-2EE6-4EA3-AE69-0B4FA85AE3E3}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************



Logfile of HijackThis v1.99.1
Scan saved at 08:31:42, on 2005-11-02
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\TpShocks.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\TpScrLk.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\System32\TpScrLk.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoft....com/activescan (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Mise à jour de logiciels ThinkPad - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

[Trevuren]

On dirait qu'on l'a eu !!!

• Please RUN HijackThis.
  . Click the SCAN button to produce a log.
  
  
• Place a check mark beside each one of the following items:
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
  
  
• Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
  
  
• Reboot Your System
  
  
  
• Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now. In addition, please tell me if there are any more malware problems that you are aware of.

Regards,

Trevuren

[Alain Grondin]

It look good,
The line R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = is always in my log. I tried to remove two times with HijackThis.
It's normal ?

Logfile of HijackThis v1.99.1
Scan saved at 13:31:55, on 2005-11-02
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\System32\TpScrLk.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\System32\TpScrLk.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoft....com/activescan (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Mise à jour de logiciels ThinkPad - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

[Trevuren]

That's no big problem Alain,

Your log is looking much better but I would like to check out your whole system, just to be sure.

I need you to download MWav to a convenient location.

This scan might take around 3+ hours to finish when set to scan everything.
I need you to run MWav by double-clicking on mwav.exe. This scan only produces a report, it doesn't clean your system. I will analyze the report and recommend a course of action depending on the results.

Put a check next to the below items before scanning:

• Memory
• Startup Folders
• Drive - All Local Drives
• Folder - then click "browse" to change the directory to C: (default is C:\Windows)
• Registry
• System Folders
• Services
• Include Sub-Directory
• Scan All Files

Please make sure ALL of these are checked, then press the Scan button. This typically will take hours to complete.

**NOTE*** Sometimes MWav will pause and it appears to be finished, but it isn't done. Just let it run until it says it's complete.

On the bottom portion of the window, you will see the lower panel where MWav is listing "infected items", please highlight everything in that lower panel and copy them by holding CTRL + C then paste it here. The whole log will be extremely BIG so there is no way to post the log. I just need the infected items list.

Regards,

Trevuren

[Alain Grondin]

Here my MWav log. MWav ran over 5 hours

Wed Nov 02 21:56:52 2005 => ***** Scanning complete. *****
Wed Nov 02 21:56:52 2005 => Total Objects Scanned: 175454
Wed Nov 02 21:56:52 2005 => Total Virus(es) Found: 60
Wed Nov 02 21:56:52 2005 => Total Disinfected Files: 0
Wed Nov 02 21:56:52 2005 => Total Files Renamed: 0
Wed Nov 02 21:56:52 2005 => Total Deleted Objects: 0
Wed Nov 02 21:56:52 2005 => Total Errors: 61
Wed Nov 02 21:56:52 2005 => Time Elapsed: 05:09:48
Wed Nov 02 21:56:52 2005 => Virus Database Date: 2005/11/02
Wed Nov 02 21:56:52 2005 => Virus Database Count: 157742

Wed Nov 02 21:56:52 2005 => Scan Completed.

File C:\Documents and Settings\agrondin\Bureau\Home Folder\agrondin\DTM\Telecom\SolarWinds-TFTP-Server.exe tagged as not-a-virus:Server-FTP.Win32.Tftp.500. No Action Taken.
File C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
Object "searchexe Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "addestroyer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "virtual bouncer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "addestroyer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "virtual bouncer Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "imiserver ieplugin Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "imiserver ieplugin Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "coolwebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "claria Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "savingbot shopper Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: No Action Taken.
Object "savingbot shopper Spyware/Adware" found in File System! Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ACPIR.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\IbmEgath.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RACtrl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\System32\egathdrv.sys". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\System32\LegitCheckControl.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\LegitCheckControl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\egathdrv.sys". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\IbmEgath.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\ACPIR.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RACtrl.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\InterVideo\Common\Bin\InstActivation.dll". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\InterVideo\Common\Bin\MSVCP60.DLL". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\Adobe\Acrobat 6.0\TempIccProfiles\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\Adobe\Acrobat 6.0\TempIccProfiles\Non-Recommended\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\IBMSHARE\". Action Taken: No Action Taken.
Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\SMI2\". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".CDR". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".DS_Store". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".id=". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".LMF". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pcf". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pf". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".TMP". Action Taken: No Action Taken.
Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: No Action Taken.
Entry "HKCR\TypeLib\{0873B694-E6FF-4C09-B306-E62CD942F98B}" refers to invalid object "C:\DOCUME~1\agrondin\LOCALS~1\Temp\Excel8.0\MSForms.exd". Action Taken: No Action Taken.
Entry "HKCR\CHROME\shell\open\command" refers to invalid object "C:\PROGRA~1\MOZILL~1\FIREFOX.EXE -url "%1"". Action Taken: No Action Taken.
Entry "HKCR\ppifile\shell\open\command" refers to invalid object "%SystemRoot%\System32\msppcnfg.exe /Config %1". Action Taken: No Action Taken.
File C:\Documents and Settings\agrondin\Bureau\Home Folder\agrondin\DTM\Telecom\SolarWinds-TFTP-Server.exe tagged as not-a-virus:Server-FTP.Win32.Tftp.500. No Action Taken.
File C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\Documents and Settings\agrondin\Mes documents\Tools\bos_pass.exe tagged as not-a-virus:PSWTool.Win32.GetPass.e. No Action Taken.
File C:\Documents and Settings\agrondin\Mes documents\Tools\SolarWinds-TFTP-Server.exe tagged as not-a-virus:Server-FTP.Win32.PremierServer.Tftp.503. No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000078.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000091.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000101.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000108.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000118.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000119.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000125.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000130.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000131.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000132.Dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000133.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000134.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\Documents and Settings\agrondin\Bureau\Home Folder\agrondin\DTM\Telecom\SolarWinds-TFTP-Server.exe tagged as not-a-virus:Server-FTP.Win32.Tftp.500. No Action Taken.
File C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\Documents and Settings\agrondin\Mes documents\Tools\bos_pass.exe tagged as not-a-virus:PSWTool.Win32.GetPass.e. No Action Taken.
File C:\Documents and Settings\agrondin\Mes documents\Tools\SolarWinds-TFTP-Server.exe tagged as not-a-virus:Server-FTP.Win32.PremierServer.Tftp.503. No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000078.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000091.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000101.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP3\A0000108.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000118.DLL tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000119.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000125.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000130.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000131.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000132.Dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000133.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.
File C:\System Volume Information\_restore{5173DE42-1766-493C-9C50-99E2354689FB}\RP4\A0000134.dll tagged as "not-a-virus:AdWare.Win32.Look2Me.ab". Action Taken: No Action Taken.

[Trevuren]

I had a "feeling" that we would find more stuff in there:

A. . Please download the 30-day free trial of Kaspersky anti virus

. Install the program
. Run the definition update module.
. Scan your whole system and let the program remove anything it wants.
. When finished, REBOOT your system

B. Download, install, update, configure, and run Ad-Aware SE Personal 1.06.

• Download Ad-Aware SE Personal 1.06:
  • Download Ad-Aware SE Personal 1.06.
  • Save aawsepersonal.exe to a convenient location.
• Install Ad-Aware SE Personal 1.06:
  • Double-click on aawsepersonal.exe to install the program.
  • Follow the default settings for installation.
  • After the program has finished installing uncheck the "Perform a full system scan now", "Update definition file now", and "Open the help file now" boxes.
• Update Ad-Aware SE Personal 1.06:
  • Double-click the Ad-Aware SE Personal icon on your desktop.
  • Click "Check for updates now" then click "Connect".
  • It will check for any updates. If any are found click "OK" to download and install the updates. Once it has finished click "Finish".
• Configure Ad-Aware SE Personal 1.06:
  • Click on the Gear button at the top of the window.
  • Click "General" on the left hand side to display the General Settings box.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Automatically save logfile"
      • "Automatically quarantine objects prior to removal"
      • "Safe Mode (always request confirmation)"
      • "Prompt to update outdated definitions" - change to 7 days from the default 14.
  • Click "Scanning" on the left hand side to display the Scan Settings box.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
    • "Scan within archives"
    • "Select drives & folders to scan" - select your hard drive(s).
    • "Scan active processes"
    • "Scan registry"
    • "Deep-scan registry"
    • "Scan my IE favorites for banned URLs"
    • "Scan my Hosts file"
  • Click "Advanced" on the left hand side to display the Advanced Settings box.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
    • "Move deleted files to Recycle Bin"
    • "Include additional object information"
    • "Include negligible objects information"
    • "Include environment information"
  • Click "Defaults" on the left hand side to display the Default Settings box.
    • Make sure these items have your preferred settings in them.:
    • "Default homepage"
    • "Default searchpage"
  • Click "Tweak" on the left hand side to display the Tweak Settings box.
    • Click the + (plus) sign next to the Log Files section. This will expand the section.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Include basic Ad-Aware settings in log file"
      • "Include additional Ad-Aware settings in log file"
      • "Include reference summary in log file"
      • "Include alternate data stream details in log file"
    • Click the + (plus) sign next to the Scanning Engine section. This will expand the section.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Unload recognized processes & modules during scan"
      • "Scan registry for all users instead of current user only"
      • "Obtain command line of scanned processes"
    • Click the + (plus) sign next to the Cleaning Engine section. This will expand the section.
    • Make sure these items have a green check next to them. If they do not, click once on the circle next to them to put a green checkmark in it.:
      • "Always try to unload modules before deletion"
      • "During removal, unload Explorer and IE if necessary"
      • "Let Windows remove files in use at next reboot"
      • "Delete quarantined objects after restoring"
  • Once you are done with these settings, click "Proceed" to save them.
  • This will take you back to the main screen.
• Run Ad-Aware SE Personal 1.06:
  • Click the "Start" button.
  • Uncheck the "Search for negligible risk entries" entry.
  • Choose the "Use custom scanning options" scan mode.
  • Click the "Next" button.
  • Ad-Aware will begin to scan for malware residing on your computer.
  • Allow the scan to finish.
  • Right-click on any entry in the list and click "Select All" to select the whole list.
  • Click "Next" and choose "OK" at the prompt to quarantine and remove the objects.

3. Please follow the instructions provided, you may want to print out these instructions and use them as a reference.

• Please download ewido security suite it is a trial version of the program.
  
  • Install ewido security suite
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will prompt you to update click the OK button
  • The program will now go to the main screen
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Click on Start
  • The update will start and a progress bar will show the updates being installed.
• Once the updates are installed do the following:
  • REBOOT into Safe Mode
  • Run EWIDO
  • Click on scanner
  • Click on Start Scan
  • Let the program scan the machine
  • While the scan is in progress you will be prompted to clean files, click OK
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report
  • Save the report to your desktop
• Reboot your machine and post back a new HJT log and the ewido .txt log file you saved by using Add Reply

Regards,

Trevuren

[Alain Grondin]

Logfile of HijackThis v1.99.1
Scan saved at 17:04:46, on 2005-11-03
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\TpShocks.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\System32\TpScrLk.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\System32\TpScrLk.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoft....com/activescan (file missing)
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Mise à jour de logiciels ThinkPad - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\Lenovo\PkgMgr\\PkgMgr.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: QConGina - C:\WINDOWS\SYSTEM32\QConGina.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Program Files\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: QCONSVC - Lenovo - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXE
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

---------------------------------------------------------
ewido security suite - Rapport de scan
---------------------------------------------------------

+ Créé le: 16:59:34, 2005-11-03
+ Somme de contrôle: 1A9A88F6

+ Résultats du scan:

C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip/GLENL1FR.Dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip/ir20l5fm1.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip/mxdrv.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip/__delete_on_reboot__cpmsnap.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\agrondin\Bureau\l2mfix\backup.zip/__delete_on_reboot__DQO_SRS_WOWXT.dll -> Spyware.Look2Me : Nettoyer et sauvegarder
C:\Documents and Settings\agrondin\Bureau\PROTECTION\VundoFix.exe -> TrojanDropper.Agent.xd : Nettoyer et sauvegarder
C:\Documents and Settings\agrondin\Local Settings\Temporary Internet Files\Content.IE5\BNWS3T0M\mm[1].js -> Spyware.Chitika : Nettoyer et sauvegarder


::Fin du rapport