[yellowclaw]

Please help me remove this message. "An exception occurred while trying to run ""C:\windows\system32\wqnnls.dll", UMonitor". Along with this are many pop ups. Thanks you for all the help.

L2MFIX find log 1.02a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Management]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\p6p6lg7s16.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{DE252768-2BEE-469F-8DC4-989AC13B78F0}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{E226D257-17F8-44D3-A453-3C900CBDC0ED}"=""
"{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}"=""
"{6992B2FA-BD0A-4158-8DF9-27B569522B80}"=""
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}]
@="SpywareGuard.Handler"

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\Implemented Categories]

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}]

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\InprocServer32]
@="C:\\Program Files\\SpywareGuard\\spywareguard.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\ProgID]
@="SpywareGuard.Handler"

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\Programmable]

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\TypeLib]
@="{F444B57C-5883-4D43-9AB8-344FC5606836}"

[HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\VERSION]
@="1.1"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E226D257-17F8-44D3-A453-3C900CBDC0ED}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E226D257-17F8-44D3-A453-3C900CBDC0ED}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E226D257-17F8-44D3-A453-3C900CBDC0ED}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E226D257-17F8-44D3-A453-3C900CBDC0ED}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{6992B2FA-BD0A-4158-8DF9-27B569522B80}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6992B2FA-BD0A-4158-8DF9-27B569522B80}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6992B2FA-BD0A-4158-8DF9-27B569522B80}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{6992B2FA-BD0A-4158-8DF9-27B569522B80}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:



Here's the HJT Log.

Logfile of HijackThis v1.99.0
Scan saved at 9:36:55 AM, on 02/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
C:\WINDOWS\system32\vmss\vmss.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\ezula\mmod.exe
C:\PROGRA~1\Web Offer\wo.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\notepad.exe
C:\Documents and Settings\Owner\My Documents\VirusFixSoftware\hijackthis\HijackThis.exe

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINDOWS\system32\vmss\vmss.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[Advertisements]

Here's the log after running option #2

L2Mfix 1.02a

Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C access for really "Everyone"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Owner\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1148 'explorer.exe'
Killing PID 1148 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of rundll32.exe

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\aza40e1qeh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cwvfat.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\desec.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dn4s01h7e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dn6m01j1e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dorpsetu.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ducprop.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\f6l0lg3m16.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fp2003fme.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\gp0ol3d31.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\h20qlcd51f0.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\h4n00e5meh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\h60qlgd5160.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr0005dme.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr2205foe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hrpu0579e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ib32_32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\imaksie.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\j2n20c5oef.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\j8n2li5o18.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kwdlv1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\l2l60c3sef.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvlq0935e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvrq0995e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mltime.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mmi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mv8ql9l51.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\n4l80e3ueh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\n62ulgf9162.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\o0lula391d.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\oohlp30t.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rCsmxs.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\vpa64k.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wahcon.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wffeman.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wm2_32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\aza40e1qeh.dll
Successfully Deleted: C:\WINDOWS\system32\aza40e1qeh.dll
deleting: C:\WINDOWS\system32\cwvfat.dll
Successfully Deleted: C:\WINDOWS\system32\cwvfat.dll
deleting: C:\WINDOWS\system32\desec.dll
Successfully Deleted: C:\WINDOWS\system32\desec.dll
deleting: C:\WINDOWS\system32\dn4s01h7e.dll
Successfully Deleted: C:\WINDOWS\system32\dn4s01h7e.dll
deleting: C:\WINDOWS\system32\dn6m01j1e.dll
Successfully Deleted: C:\WINDOWS\system32\dn6m01j1e.dll
deleting: C:\WINDOWS\system32\dorpsetu.dll
Successfully Deleted: C:\WINDOWS\system32\dorpsetu.dll
deleting: C:\WINDOWS\system32\ducprop.dll
Successfully Deleted: C:\WINDOWS\system32\ducprop.dll
deleting: C:\WINDOWS\system32\f6l0lg3m16.dll
Successfully Deleted: C:\WINDOWS\system32\f6l0lg3m16.dll
deleting: C:\WINDOWS\system32\fp2003fme.dll
Successfully Deleted: C:\WINDOWS\system32\fp2003fme.dll
deleting: C:\WINDOWS\system32\gp0ol3d31.dll
Successfully Deleted: C:\WINDOWS\system32\gp0ol3d31.dll
deleting: C:\WINDOWS\system32\h20qlcd51f0.dll
Successfully Deleted: C:\WINDOWS\system32\h20qlcd51f0.dll
deleting: C:\WINDOWS\system32\h4n00e5meh.dll
Successfully Deleted: C:\WINDOWS\system32\h4n00e5meh.dll
deleting: C:\WINDOWS\system32\h60qlgd5160.dll
Successfully Deleted: C:\WINDOWS\system32\h60qlgd5160.dll
deleting: C:\WINDOWS\system32\hr0005dme.dll
Successfully Deleted: C:\WINDOWS\system32\hr0005dme.dll
deleting: C:\WINDOWS\system32\hr2205foe.dll
Successfully Deleted: C:\WINDOWS\system32\hr2205foe.dll
deleting: C:\WINDOWS\system32\hrpu0579e.dll
Successfully Deleted: C:\WINDOWS\system32\hrpu0579e.dll
deleting: C:\WINDOWS\system32\ib32_32.dll
Successfully Deleted: C:\WINDOWS\system32\ib32_32.dll
deleting: C:\WINDOWS\system32\imaksie.dll
Successfully Deleted: C:\WINDOWS\system32\imaksie.dll
deleting: C:\WINDOWS\system32\j2n20c5oef.dll
Successfully Deleted: C:\WINDOWS\system32\j2n20c5oef.dll
deleting: C:\WINDOWS\system32\j8n2li5o18.dll
Successfully Deleted: C:\WINDOWS\system32\j8n2li5o18.dll
deleting: C:\WINDOWS\system32\kwdlv1.dll
Successfully Deleted: C:\WINDOWS\system32\kwdlv1.dll
deleting: C:\WINDOWS\system32\l2l60c3sef.dll
Successfully Deleted: C:\WINDOWS\system32\l2l60c3sef.dll
deleting: C:\WINDOWS\system32\lvlq0935e.dll
Successfully Deleted: C:\WINDOWS\system32\lvlq0935e.dll
deleting: C:\WINDOWS\system32\lvrq0995e.dll
Successfully Deleted: C:\WINDOWS\system32\lvrq0995e.dll
deleting: C:\WINDOWS\system32\mltime.dll
Successfully Deleted: C:\WINDOWS\system32\mltime.dll
deleting: C:\WINDOWS\system32\mmi.dll
Successfully Deleted: C:\WINDOWS\system32\mmi.dll
deleting: C:\WINDOWS\system32\mv8ql9l51.dll
Successfully Deleted: C:\WINDOWS\system32\mv8ql9l51.dll
deleting: C:\WINDOWS\system32\n4l80e3ueh.dll
Successfully Deleted: C:\WINDOWS\system32\n4l80e3ueh.dll
deleting: C:\WINDOWS\system32\n62ulgf9162.dll
Successfully Deleted: C:\WINDOWS\system32\n62ulgf9162.dll
deleting: C:\WINDOWS\system32\o0lula391d.dll
Successfully Deleted: C:\WINDOWS\system32\o0lula391d.dll
deleting: C:\WINDOWS\system32\oohlp30t.dll
Successfully Deleted: C:\WINDOWS\system32\oohlp30t.dll
deleting: C:\WINDOWS\system32\rCsmxs.dll
Successfully Deleted: C:\WINDOWS\system32\rCsmxs.dll
deleting: C:\WINDOWS\system32\vpa64k.dll
Successfully Deleted: C:\WINDOWS\system32\vpa64k.dll
deleting: C:\WINDOWS\system32\wahcon.dll
Successfully Deleted: C:\WINDOWS\system32\wahcon.dll
deleting: C:\WINDOWS\system32\wffeman.dll
Successfully Deleted: C:\WINDOWS\system32\wffeman.dll
deleting: C:\WINDOWS\system32\wm2_32.dll
Successfully Deleted: C:\WINDOWS\system32\wm2_32.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: aza40e1qeh.dll (164 bytes security) (deflated 4%)
adding: cwvfat.dll (164 bytes security) (deflated 3%)
adding: desec.dll (164 bytes security) (deflated 4%)
adding: dn4s01h7e.dll (164 bytes security) (deflated 4%)
adding: dn6m01j1e.dll (164 bytes security) (deflated 4%)
adding: dorpsetu.dll (164 bytes security) (deflated 5%)
adding: ducprop.dll (164 bytes security) (deflated 3%)
adding: f6l0lg3m16.dll (164 bytes security) (deflated 4%)
adding: fp2003fme.dll (164 bytes security) (deflated 4%)
adding: gp0ol3d31.dll (164 bytes security) (deflated 5%)
adding: h20qlcd51f0.dll (164 bytes security) (deflated 3%)
adding: h4n00e5meh.dll (164 bytes security) (deflated 4%)
adding: h60qlgd5160.dll (164 bytes security) (deflated 4%)
adding: hr0005dme.dll (164 bytes security) (deflated 4%)
adding: hr2205foe.dll (164 bytes security) (deflated 4%)
adding: hrpu0579e.dll (164 bytes security) (deflated 4%)
adding: ib32_32.dll (164 bytes security) (deflated 3%)
adding: imaksie.dll (164 bytes security) (deflated 4%)
adding: j2n20c5oef.dll (164 bytes security) (deflated 5%)
adding: j8n2li5o18.dll (164 bytes security) (deflated 3%)
adding: kwdlv1.dll (164 bytes security) (deflated 4%)
adding: l2l60c3sef.dll (164 bytes security) (deflated 4%)
adding: lvlq0935e.dll (164 bytes security) (deflated 3%)
adding: lvrq0995e.dll (164 bytes security) (deflated 4%)
adding: mltime.dll (164 bytes security) (deflated 5%)
adding: mmi.dll (164 bytes security) (deflated 4%)
adding: mv8ql9l51.dll (164 bytes security) (deflated 4%)
adding: n4l80e3ueh.dll (164 bytes security) (deflated 4%)
adding: n62ulgf9162.dll (164 bytes security) (deflated 4%)
adding: o0lula391d.dll (164 bytes security) (deflated 4%)
adding: oohlp30t.dll (164 bytes security) (deflated 3%)
adding: rCsmxs.dll (164 bytes security) (deflated 5%)
adding: vpa64k.dll (164 bytes security) (deflated 3%)
adding: wahcon.dll (164 bytes security) (deflated 4%)
adding: wffeman.dll (164 bytes security) (deflated 4%)
adding: wm2_32.dll (164 bytes security) (deflated 3%)
adding: guard.tmp (164 bytes security) (deflated 5%)
adding: clear.reg (164 bytes security) (deflated 46%)
adding: echo.reg (164 bytes security) (deflated 9%)
adding: desktop.ini (164 bytes security) (deflated 14%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 85%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 77%)
adding: test.txt (164 bytes security) (deflated 82%)
adding: test2.txt (164 bytes security) (deflated 33%)
adding: test3.txt (164 bytes security) (deflated 27%)
adding: test5.txt (164 bytes security) (deflated 33%)
adding: xfind.txt (164 bytes security) (deflated 77%)
adding: backregs/6992B2FA-BD0A-4158-8DF9-27B569522B80.reg (164 bytes security) (deflated 70%)
adding: backregs/E226D257-17F8-44D3-A453-3C900CBDC0ED.reg (164 bytes security) (deflated 70%)
adding: backregs/FC9073F4-CCD1-4F0F-812C-F12A48185A7C.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 63%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for really "Everyone"


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: aza40e1qeh.dll
deleting local copy: cwvfat.dll
deleting local copy: desec.dll
deleting local copy: dn4s01h7e.dll
deleting local copy: dn6m01j1e.dll
deleting local copy: dorpsetu.dll
deleting local copy: ducprop.dll
deleting local copy: f6l0lg3m16.dll
deleting local copy: fp2003fme.dll
deleting local copy: gp0ol3d31.dll
deleting local copy: h20qlcd51f0.dll
deleting local copy: h4n00e5meh.dll
deleting local copy: h60qlgd5160.dll
deleting local copy: hr0005dme.dll
deleting local copy: hr2205foe.dll
deleting local copy: hrpu0579e.dll
deleting local copy: ib32_32.dll
deleting local copy: imaksie.dll
deleting local copy: j2n20c5oef.dll
deleting local copy: j8n2li5o18.dll
deleting local copy: kwdlv1.dll
deleting local copy: l2l60c3sef.dll
deleting local copy: lvlq0935e.dll
deleting local copy: lvrq0995e.dll
deleting local copy: mltime.dll
deleting local copy: mmi.dll
deleting local copy: mv8ql9l51.dll
deleting local copy: n4l80e3ueh.dll
deleting local copy: n62ulgf9162.dll
deleting local copy: o0lula391d.dll
deleting local copy: oohlp30t.dll
deleting local copy: rCsmxs.dll
deleting local copy: vpa64k.dll
deleting local copy: wahcon.dll
deleting local copy: wffeman.dll
deleting local copy: wm2_32.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\aza40e1qeh.dll
C:\WINDOWS\system32\cwvfat.dll
C:\WINDOWS\system32\desec.dll
C:\WINDOWS\system32\dn4s01h7e.dll
C:\WINDOWS\system32\dn6m01j1e.dll
C:\WINDOWS\system32\dorpsetu.dll
C:\WINDOWS\system32\ducprop.dll
C:\WINDOWS\system32\f6l0lg3m16.dll
C:\WINDOWS\system32\fp2003fme.dll
C:\WINDOWS\system32\gp0ol3d31.dll
C:\WINDOWS\system32\h20qlcd51f0.dll
C:\WINDOWS\system32\h4n00e5meh.dll
C:\WINDOWS\system32\h60qlgd5160.dll
C:\WINDOWS\system32\hr0005dme.dll
C:\WINDOWS\system32\hr2205foe.dll
C:\WINDOWS\system32\hrpu0579e.dll
C:\WINDOWS\system32\ib32_32.dll
C:\WINDOWS\system32\imaksie.dll
C:\WINDOWS\system32\j2n20c5oef.dll
C:\WINDOWS\system32\j8n2li5o18.dll
C:\WINDOWS\system32\kwdlv1.dll
C:\WINDOWS\system32\l2l60c3sef.dll
C:\WINDOWS\system32\lvlq0935e.dll
C:\WINDOWS\system32\lvrq0995e.dll
C:\WINDOWS\system32\mltime.dll
C:\WINDOWS\system32\mmi.dll
C:\WINDOWS\system32\mv8ql9l51.dll
C:\WINDOWS\system32\n4l80e3ueh.dll
C:\WINDOWS\system32\n62ulgf9162.dll
C:\WINDOWS\system32\o0lula391d.dll
C:\WINDOWS\system32\oohlp30t.dll
C:\WINDOWS\system32\rCsmxs.dll
C:\WINDOWS\system32\vpa64k.dll
C:\WINDOWS\system32\wahcon.dll
C:\WINDOWS\system32\wffeman.dll
C:\WINDOWS\system32\wm2_32.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{E226D257-17F8-44D3-A453-3C900CBDC0ED}"=-
"{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}"=-
"{6992B2FA-BD0A-4158-8DF9-27B569522B80}"=-
[-HKEY_CLASSES_ROOT\CLSID\{E226D257-17F8-44D3-A453-3C900CBDC0ED}]
[-HKEY_CLASSES_ROOT\CLSID\{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}]
[-HKEY_CLASSES_ROOT\CLSID\{6992B2FA-BD0A-4158-8DF9-27B569522B80}]
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{DE252768-2BEE-469F-8DC4-989AC13B78F0}"=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{DE252768-2BEE-469F-8DC4-989AC13B78F0}</IDone>
<IDtwo>VT00</IDtwo>
<VERSION>200</VERSION>
****************************************************************************


[yellowclaw]

Here's the log after running option #2

L2Mfix 1.02a

Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix



RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C access for really "Everyone"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Owner\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Owner\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1148 'explorer.exe'
Killing PID 1148 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of rundll32.exe

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\aza40e1qeh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\cwvfat.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\desec.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dn4s01h7e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dn6m01j1e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dorpsetu.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ducprop.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\f6l0lg3m16.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fp2003fme.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\gp0ol3d31.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\h20qlcd51f0.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\h4n00e5meh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\h60qlgd5160.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr0005dme.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr2205foe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hrpu0579e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ib32_32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\imaksie.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\j2n20c5oef.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\j8n2li5o18.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\kwdlv1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\l2l60c3sef.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvlq0935e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvrq0995e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mltime.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mmi.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mv8ql9l51.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\n4l80e3ueh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\n62ulgf9162.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\o0lula391d.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\oohlp30t.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\rCsmxs.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\vpa64k.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wahcon.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wffeman.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wm2_32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\aza40e1qeh.dll
Successfully Deleted: C:\WINDOWS\system32\aza40e1qeh.dll
deleting: C:\WINDOWS\system32\cwvfat.dll
Successfully Deleted: C:\WINDOWS\system32\cwvfat.dll
deleting: C:\WINDOWS\system32\desec.dll
Successfully Deleted: C:\WINDOWS\system32\desec.dll
deleting: C:\WINDOWS\system32\dn4s01h7e.dll
Successfully Deleted: C:\WINDOWS\system32\dn4s01h7e.dll
deleting: C:\WINDOWS\system32\dn6m01j1e.dll
Successfully Deleted: C:\WINDOWS\system32\dn6m01j1e.dll
deleting: C:\WINDOWS\system32\dorpsetu.dll
Successfully Deleted: C:\WINDOWS\system32\dorpsetu.dll
deleting: C:\WINDOWS\system32\ducprop.dll
Successfully Deleted: C:\WINDOWS\system32\ducprop.dll
deleting: C:\WINDOWS\system32\f6l0lg3m16.dll
Successfully Deleted: C:\WINDOWS\system32\f6l0lg3m16.dll
deleting: C:\WINDOWS\system32\fp2003fme.dll
Successfully Deleted: C:\WINDOWS\system32\fp2003fme.dll
deleting: C:\WINDOWS\system32\gp0ol3d31.dll
Successfully Deleted: C:\WINDOWS\system32\gp0ol3d31.dll
deleting: C:\WINDOWS\system32\h20qlcd51f0.dll
Successfully Deleted: C:\WINDOWS\system32\h20qlcd51f0.dll
deleting: C:\WINDOWS\system32\h4n00e5meh.dll
Successfully Deleted: C:\WINDOWS\system32\h4n00e5meh.dll
deleting: C:\WINDOWS\system32\h60qlgd5160.dll
Successfully Deleted: C:\WINDOWS\system32\h60qlgd5160.dll
deleting: C:\WINDOWS\system32\hr0005dme.dll
Successfully Deleted: C:\WINDOWS\system32\hr0005dme.dll
deleting: C:\WINDOWS\system32\hr2205foe.dll
Successfully Deleted: C:\WINDOWS\system32\hr2205foe.dll
deleting: C:\WINDOWS\system32\hrpu0579e.dll
Successfully Deleted: C:\WINDOWS\system32\hrpu0579e.dll
deleting: C:\WINDOWS\system32\ib32_32.dll
Successfully Deleted: C:\WINDOWS\system32\ib32_32.dll
deleting: C:\WINDOWS\system32\imaksie.dll
Successfully Deleted: C:\WINDOWS\system32\imaksie.dll
deleting: C:\WINDOWS\system32\j2n20c5oef.dll
Successfully Deleted: C:\WINDOWS\system32\j2n20c5oef.dll
deleting: C:\WINDOWS\system32\j8n2li5o18.dll
Successfully Deleted: C:\WINDOWS\system32\j8n2li5o18.dll
deleting: C:\WINDOWS\system32\kwdlv1.dll
Successfully Deleted: C:\WINDOWS\system32\kwdlv1.dll
deleting: C:\WINDOWS\system32\l2l60c3sef.dll
Successfully Deleted: C:\WINDOWS\system32\l2l60c3sef.dll
deleting: C:\WINDOWS\system32\lvlq0935e.dll
Successfully Deleted: C:\WINDOWS\system32\lvlq0935e.dll
deleting: C:\WINDOWS\system32\lvrq0995e.dll
Successfully Deleted: C:\WINDOWS\system32\lvrq0995e.dll
deleting: C:\WINDOWS\system32\mltime.dll
Successfully Deleted: C:\WINDOWS\system32\mltime.dll
deleting: C:\WINDOWS\system32\mmi.dll
Successfully Deleted: C:\WINDOWS\system32\mmi.dll
deleting: C:\WINDOWS\system32\mv8ql9l51.dll
Successfully Deleted: C:\WINDOWS\system32\mv8ql9l51.dll
deleting: C:\WINDOWS\system32\n4l80e3ueh.dll
Successfully Deleted: C:\WINDOWS\system32\n4l80e3ueh.dll
deleting: C:\WINDOWS\system32\n62ulgf9162.dll
Successfully Deleted: C:\WINDOWS\system32\n62ulgf9162.dll
deleting: C:\WINDOWS\system32\o0lula391d.dll
Successfully Deleted: C:\WINDOWS\system32\o0lula391d.dll
deleting: C:\WINDOWS\system32\oohlp30t.dll
Successfully Deleted: C:\WINDOWS\system32\oohlp30t.dll
deleting: C:\WINDOWS\system32\rCsmxs.dll
Successfully Deleted: C:\WINDOWS\system32\rCsmxs.dll
deleting: C:\WINDOWS\system32\vpa64k.dll
Successfully Deleted: C:\WINDOWS\system32\vpa64k.dll
deleting: C:\WINDOWS\system32\wahcon.dll
Successfully Deleted: C:\WINDOWS\system32\wahcon.dll
deleting: C:\WINDOWS\system32\wffeman.dll
Successfully Deleted: C:\WINDOWS\system32\wffeman.dll
deleting: C:\WINDOWS\system32\wm2_32.dll
Successfully Deleted: C:\WINDOWS\system32\wm2_32.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: aza40e1qeh.dll (164 bytes security) (deflated 4%)
adding: cwvfat.dll (164 bytes security) (deflated 3%)
adding: desec.dll (164 bytes security) (deflated 4%)
adding: dn4s01h7e.dll (164 bytes security) (deflated 4%)
adding: dn6m01j1e.dll (164 bytes security) (deflated 4%)
adding: dorpsetu.dll (164 bytes security) (deflated 5%)
adding: ducprop.dll (164 bytes security) (deflated 3%)
adding: f6l0lg3m16.dll (164 bytes security) (deflated 4%)
adding: fp2003fme.dll (164 bytes security) (deflated 4%)
adding: gp0ol3d31.dll (164 bytes security) (deflated 5%)
adding: h20qlcd51f0.dll (164 bytes security) (deflated 3%)
adding: h4n00e5meh.dll (164 bytes security) (deflated 4%)
adding: h60qlgd5160.dll (164 bytes security) (deflated 4%)
adding: hr0005dme.dll (164 bytes security) (deflated 4%)
adding: hr2205foe.dll (164 bytes security) (deflated 4%)
adding: hrpu0579e.dll (164 bytes security) (deflated 4%)
adding: ib32_32.dll (164 bytes security) (deflated 3%)
adding: imaksie.dll (164 bytes security) (deflated 4%)
adding: j2n20c5oef.dll (164 bytes security) (deflated 5%)
adding: j8n2li5o18.dll (164 bytes security) (deflated 3%)
adding: kwdlv1.dll (164 bytes security) (deflated 4%)
adding: l2l60c3sef.dll (164 bytes security) (deflated 4%)
adding: lvlq0935e.dll (164 bytes security) (deflated 3%)
adding: lvrq0995e.dll (164 bytes security) (deflated 4%)
adding: mltime.dll (164 bytes security) (deflated 5%)
adding: mmi.dll (164 bytes security) (deflated 4%)
adding: mv8ql9l51.dll (164 bytes security) (deflated 4%)
adding: n4l80e3ueh.dll (164 bytes security) (deflated 4%)
adding: n62ulgf9162.dll (164 bytes security) (deflated 4%)
adding: o0lula391d.dll (164 bytes security) (deflated 4%)
adding: oohlp30t.dll (164 bytes security) (deflated 3%)
adding: rCsmxs.dll (164 bytes security) (deflated 5%)
adding: vpa64k.dll (164 bytes security) (deflated 3%)
adding: wahcon.dll (164 bytes security) (deflated 4%)
adding: wffeman.dll (164 bytes security) (deflated 4%)
adding: wm2_32.dll (164 bytes security) (deflated 3%)
adding: guard.tmp (164 bytes security) (deflated 5%)
adding: clear.reg (164 bytes security) (deflated 46%)
adding: echo.reg (164 bytes security) (deflated 9%)
adding: desktop.ini (164 bytes security) (deflated 14%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 85%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 77%)
adding: test.txt (164 bytes security) (deflated 82%)
adding: test2.txt (164 bytes security) (deflated 33%)
adding: test3.txt (164 bytes security) (deflated 27%)
adding: test5.txt (164 bytes security) (deflated 33%)
adding: xfind.txt (164 bytes security) (deflated 77%)
adding: backregs/6992B2FA-BD0A-4158-8DF9-27B569522B80.reg (164 bytes security) (deflated 70%)
adding: backregs/E226D257-17F8-44D3-A453-3C900CBDC0ED.reg (164 bytes security) (deflated 70%)
adding: backregs/FC9073F4-CCD1-4F0F-812C-F12A48185A7C.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 63%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for really "Everyone"


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: aza40e1qeh.dll
deleting local copy: cwvfat.dll
deleting local copy: desec.dll
deleting local copy: dn4s01h7e.dll
deleting local copy: dn6m01j1e.dll
deleting local copy: dorpsetu.dll
deleting local copy: ducprop.dll
deleting local copy: f6l0lg3m16.dll
deleting local copy: fp2003fme.dll
deleting local copy: gp0ol3d31.dll
deleting local copy: h20qlcd51f0.dll
deleting local copy: h4n00e5meh.dll
deleting local copy: h60qlgd5160.dll
deleting local copy: hr0005dme.dll
deleting local copy: hr2205foe.dll
deleting local copy: hrpu0579e.dll
deleting local copy: ib32_32.dll
deleting local copy: imaksie.dll
deleting local copy: j2n20c5oef.dll
deleting local copy: j8n2li5o18.dll
deleting local copy: kwdlv1.dll
deleting local copy: l2l60c3sef.dll
deleting local copy: lvlq0935e.dll
deleting local copy: lvrq0995e.dll
deleting local copy: mltime.dll
deleting local copy: mmi.dll
deleting local copy: mv8ql9l51.dll
deleting local copy: n4l80e3ueh.dll
deleting local copy: n62ulgf9162.dll
deleting local copy: o0lula391d.dll
deleting local copy: oohlp30t.dll
deleting local copy: rCsmxs.dll
deleting local copy: vpa64k.dll
deleting local copy: wahcon.dll
deleting local copy: wffeman.dll
deleting local copy: wm2_32.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\aza40e1qeh.dll
C:\WINDOWS\system32\cwvfat.dll
C:\WINDOWS\system32\desec.dll
C:\WINDOWS\system32\dn4s01h7e.dll
C:\WINDOWS\system32\dn6m01j1e.dll
C:\WINDOWS\system32\dorpsetu.dll
C:\WINDOWS\system32\ducprop.dll
C:\WINDOWS\system32\f6l0lg3m16.dll
C:\WINDOWS\system32\fp2003fme.dll
C:\WINDOWS\system32\gp0ol3d31.dll
C:\WINDOWS\system32\h20qlcd51f0.dll
C:\WINDOWS\system32\h4n00e5meh.dll
C:\WINDOWS\system32\h60qlgd5160.dll
C:\WINDOWS\system32\hr0005dme.dll
C:\WINDOWS\system32\hr2205foe.dll
C:\WINDOWS\system32\hrpu0579e.dll
C:\WINDOWS\system32\ib32_32.dll
C:\WINDOWS\system32\imaksie.dll
C:\WINDOWS\system32\j2n20c5oef.dll
C:\WINDOWS\system32\j8n2li5o18.dll
C:\WINDOWS\system32\kwdlv1.dll
C:\WINDOWS\system32\l2l60c3sef.dll
C:\WINDOWS\system32\lvlq0935e.dll
C:\WINDOWS\system32\lvrq0995e.dll
C:\WINDOWS\system32\mltime.dll
C:\WINDOWS\system32\mmi.dll
C:\WINDOWS\system32\mv8ql9l51.dll
C:\WINDOWS\system32\n4l80e3ueh.dll
C:\WINDOWS\system32\n62ulgf9162.dll
C:\WINDOWS\system32\o0lula391d.dll
C:\WINDOWS\system32\oohlp30t.dll
C:\WINDOWS\system32\rCsmxs.dll
C:\WINDOWS\system32\vpa64k.dll
C:\WINDOWS\system32\wahcon.dll
C:\WINDOWS\system32\wffeman.dll
C:\WINDOWS\system32\wm2_32.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{E226D257-17F8-44D3-A453-3C900CBDC0ED}"=-
"{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}"=-
"{6992B2FA-BD0A-4158-8DF9-27B569522B80}"=-
[-HKEY_CLASSES_ROOT\CLSID\{E226D257-17F8-44D3-A453-3C900CBDC0ED}]
[-HKEY_CLASSES_ROOT\CLSID\{FC9073F4-CCD1-4F0F-812C-F12A48185A7C}]
[-HKEY_CLASSES_ROOT\CLSID\{6992B2FA-BD0A-4158-8DF9-27B569522B80}]
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{DE252768-2BEE-469F-8DC4-989AC13B78F0}"=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{DE252768-2BEE-469F-8DC4-989AC13B78F0}</IDone>
<IDtwo>VT00</IDtwo>
<VERSION>200</VERSION>
****************************************************************************


[yellowclaw]

I reboot and ran Spybot and Adaware. Web Offer is still in the Add/Remove Program section. The add/remove button doesn't seem to remove it. Any suggestion? Thank you in advance. Here's my current HJT Log.

Logfile of HijackThis v1.99.0
Scan saved at 10:41:53 AM, on 02/04/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Documents and Settings\Owner\My Documents\VirusFixSoftware\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

[yellowclaw]

Web Offer was under C:\Windows\System32\ezPopStub.exe. I found this by going to Regedit... Locate the exe file in Explore and removed it. Then went to Add/Remove Programs in Control Pannel and was able to remove it from there. Although I didn't give anyone a chance to reply, this forum was great for pointing me in the right direction. Couldn't have done it without everyone here. Thank you.