[RoadSongs]

[SIZE=1]

Hi there

I really need someones help I have been getting these popups from loadingwebsite and urllogic and they are driving me nuts ....this is as far as my brains can take me any help much appriciated
best wishes Steve :mad:

L2MFIX find log 1.02a
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Setup]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\g622lgfo162c.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{72C92B96-6FAC-4F40-B713-B4060C74CD0A}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{BF96875C-C94B-4FB2-9570-62092B6B84FF}"=""
"{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BF96875C-C94B-4FB2-9570-62092B6B84FF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BF96875C-C94B-4FB2-9570-62092B6B84FF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BF96875C-C94B-4FB2-9570-62092B6B84FF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BF96875C-C94B-4FB2-9570-62092B6B84FF}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
akcore.dll Fri 4 Feb 2005 10:01:02 A.... 188,416 184.00 K
akrules.dll Wed 9 Feb 2005 12:02:38 A.... 110,592 108.00 K
akupd.dll Fri 4 Feb 2005 10:00:46 A.... 155,648 152.00 K
browseui.dll Thu 27 Jan 2005 17:13:16 A.... 1,016,832 993.00 K
cdfview.dll Thu 27 Jan 2005 17:13:16 A.... 151,040 147.50 K
docore.dll Sun 6 Feb 2005 19:43:42 A.... 151,552 148.00 K
dolsp.dll Sun 6 Feb 2005 19:43:44 A.... 139,264 136.00 K
dosync.dll Sun 6 Feb 2005 19:43:40 A.... 114,688 112.00 K
enapi.dll Mon 7 Feb 2005 9:05:00 ..S.R 232,157 226.71 K
enbteg.dll Fri 4 Feb 2005 20:31:00 A.... 230,055 224.66 K
g622lg~1.dll Wed 9 Feb 2005 20:31:34 ..S.R 231,494 226.07 K
gccoll~1.dll Fri 31 Dec 2004 18:00:00 A.... 134,880 131.72 K
gcmd5q~1.dll Wed 9 Feb 2005 19:34:26 A.... 10,752 10.50 K
gcunco~1.dll Fri 31 Dec 2004 16:14:32 A.... 130,272 127.22 K
hashlib.dll Fri 31 Dec 2004 18:00:00 A.... 81,120 79.22 K
hlink.dll Tue 16 Nov 2004 21:17:00 A.... 68,096 66.50 K
iepeers.dll Thu 27 Jan 2005 17:13:16 A.... 249,856 244.00 K
iipzue.dll Sun 6 Feb 2005 19:01:38 A.... 24,576 24.00 K
inseng.dll Thu 27 Jan 2005 17:13:16 A.... 96,256 94.00 K
ir22l5~1.dll Sun 6 Feb 2005 9:21:14 A.... 228,812 223.45 K
j4p0le~1.dll Mon 7 Feb 2005 12:04:50 ..S.R 232,157 226.71 K
jkproxy.dll Fri 4 Feb 2005 20:16:28 A.... 229,736 224.35 K
lgngwrbk.dll Wed 9 Feb 2005 4:48:22 A.... 230,547 225.14 K
lmcmp12n.dll Tue 8 Feb 2005 13:06:56 A.... 230,547 225.14 K
lsawd10n.dll Wed 9 Feb 2005 20:40:32 A.... 228,816 223.45 K
lv0809~1.dll Wed 9 Feb 2005 20:45:36 ..S.R 228,816 223.45 K
lvjm09~1.dll Fri 4 Feb 2005 20:28:26 ..S.R 229,736 224.35 K
mmstkprp.dll Fri 4 Feb 2005 14:21:06 A.... 229,736 224.35 K
mshtml.dll Thu 27 Jan 2005 17:13:18 A.... 3,006,976 2.87 M
mxxml4a.dll Fri 4 Feb 2005 9:24:34 A.... 229,736 224.35 K
n68o0g~1.dll Fri 4 Feb 2005 20:16:26 ..S.R 230,122 224.73 K
ole32.dll Fri 14 Jan 2005 8:55:50 A.... 1,285,120 1.22 M
olecli32.dll Fri 14 Jan 2005 8:55:50 A.... 74,752 73.00 K
olecnv32.dll Fri 14 Jan 2005 8:55:50 A.... 37,888 37.00 K
rpcss.dll Fri 14 Jan 2005 8:55:50 A.... 395,776 386.50 K
shdocvw.dll Thu 27 Jan 2005 17:13:18 A.... 1,483,264 1.41 M
shell32.dll Tue 21 Dec 2004 20:49:36 A.... 8,450,048 8.06 M
shlwapi.dll Thu 27 Jan 2005 17:13:18 A.... 473,600 462.50 K
srvsvc.dll Tue 7 Dec 2004 19:32:34 A.... 96,768 94.50 K
urlmon.dll Thu 27 Jan 2005 17:13:18 A.... 607,744 593.50 K
wininet.dll Thu 27 Jan 2005 17:13:18 A.... 656,896 641.50 K

41 items found: 41 files (6 H/S), 0 directories.
Total of file sizes: 22,615,139 bytes 21.57 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
guard.tmp Wed 9 Feb 2005 20:51:32 A.... 231,494 226.07 K

1 item found: 1 file, 0 directories.
Total of file sizes: 231,494 bytes 226.07 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is C4DC-F8E5

Directory of C:\WINDOWS\System32

09/02/2005 20:45 228,816 lv0809due.dll
09/02/2005 20:31 231,494 g622lgfo162c.dll
07/02/2005 12:04 232,157 j4p0le7m1h.dll
07/02/2005 09:04 232,157 ENAPI.dll
04/02/2005 20:28 229,736 lvjm0911e.dll
04/02/2005 20:16 230,122 n68o0gl3e6q.dll
06/10/2004 14:19 <DIR> DLLCACHE
04/08/2004 06:55 10,022 KGyGaAvL.sys
11/10/2002 18:41 <DIR> Microsoft
20/09/2002 08:00 181,296 SCSIACC.EXE
8 File(s) 1,575,800 bytes
2 Dir(s) 49,916,305,408 bytes free


Hope this is going to the right post 1st timer sorry If i have screwed up where i post this

Steve

[Advertisements]

Hi steve
And welcome to the forum

First we need a HijackThis log then we can start the fix.

Click Here download the latest version of Hijack This (1.99.0). It's better able to catch the latest threats.

Thank You

Kc

[RoadSongs]

Logfile of HijackThis v1.99.0
Scan saved at 20:19:00, on 10/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Soulseek\slsk.exe
C:\DOCUME~1\STEVEF~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\VFH3V1KS\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emusic.co...lp/success.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: (no name) - {5BFDA4F8-1202-552D-3802-CE60A3A086DA} - C:\WINDOWS\system32\swoawtvq.dll
O2 - BHO: (no name) - {823E2691-4C22-5D5E-5123-D40E5E0404C4} - C:\WINDOWS\system32\zjzubnhf.dll
O2 - BHO: (no name) - {C6D08BDF-D4F6-D1E4-C29E-B51C99AB541B} - C:\WINDOWS\system32\klygppqo.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AOL Spyware Protection] C:\PROGRA~1\COMMON~1\aol\AOLSPY~1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {00C0A1F2-D492-4DBA-A8E2-76CB1B791724} (TNPLDownloader Control) - https://dtwx2.accuwe...LDownloader.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc....kup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.a...84/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots....SDownloader.ocx
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://www.newsstand...k1/isetupml.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://cm4all08.1and...ivex/msxml4.cab
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\system\intralaunch.CAB
O16 - DPF: {B817734E-046C-11D3-B674-00104BA25195} - http://pmb001.3m.com...es/psnudate.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.a...,21/mcgdmgr.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60B68012-2A35-43A6-ACA4-0B1B2AC996F2}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{DFEDB4E4-89E1-45C0-B2A0-9F9585797C7C}: NameServer = 152.163.0.26 205.188.64.153
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service - Unknown - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Personal Firewall Service - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: oamgkupboyjx - Unknown - C:\WINDOWS\system32\oodpuuyv5.exe (file missing)

[RoadSongs]

Hi there
was away fora few days is this what you need, sorry if it't not
Best, Steve


Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
atsmsext.dll Thu 10 Feb 2005 17:53:38 A.... 231,494 226.07 K
browseui.dll Thu 27 Jan 2005 17:13:16 A.... 1,016,832 993.00 K
cdfview.dll Thu 27 Jan 2005 17:13:16 A.... 151,040 147.50 K
docore.dll Sun 6 Feb 2005 19:43:42 A.... 151,552 148.00 K
dolsp.dll Sun 6 Feb 2005 19:43:44 A.... 139,264 136.00 K
dosync.dll Sun 6 Feb 2005 19:43:40 A.... 114,688 112.00 K
enapi.dll Mon 7 Feb 2005 9:05:00 ..S.R 232,157 226.71 K
enbteg.dll Fri 4 Feb 2005 20:31:00 A.... 230,055 224.66 K
ennsl1~1.dll Thu 10 Feb 2005 14:05:58 ..S.R 228,816 223.45 K
gccoll~1.dll Fri 31 Dec 2004 18:00:00 A.... 134,880 131.72 K
gcmd5q~1.dll Wed 9 Feb 2005 19:34:26 A.... 10,752 10.50 K
gcunco~1.dll Fri 31 Dec 2004 16:14:32 A.... 130,272 127.22 K
hashlib.dll Fri 31 Dec 2004 18:00:00 A.... 81,120 79.22 K
hlink.dll Tue 16 Nov 2004 21:17:00 A.... 68,096 66.50 K
iepeers.dll Thu 27 Jan 2005 17:13:16 A.... 249,856 244.00 K
inseng.dll Thu 27 Jan 2005 17:13:16 A.... 96,256 94.00 K
ir22l5~1.dll Sun 6 Feb 2005 9:21:14 A.... 228,812 223.45 K
j4p0le~1.dll Mon 7 Feb 2005 12:04:50 ..S.R 232,157 226.71 K
jkproxy.dll Fri 4 Feb 2005 20:16:28 A.... 229,736 224.35 K
l2j80c~1.dll Thu 10 Feb 2005 20:32:48 ..S.R 231,720 226.29 K
lgngwrbk.dll Wed 9 Feb 2005 4:48:22 A.... 230,547 225.14 K
lmcmp12n.dll Tue 8 Feb 2005 13:06:56 A.... 230,547 225.14 K
lsawd10n.dll Wed 9 Feb 2005 20:40:32 A.... 228,816 223.45 K
lvjm09~1.dll Fri 4 Feb 2005 20:28:26 ..S.R 229,736 224.35 K
mmstkprp.dll Fri 4 Feb 2005 14:21:06 A.... 229,736 224.35 K
mshtml.dll Thu 27 Jan 2005 17:13:18 A.... 3,006,976 2.87 M
muorcl32.dll Sat 12 Feb 2005 13:55:06 A.... 229,085 223.71 K
mxxml4a.dll Fri 4 Feb 2005 9:24:34 A.... 229,736 224.35 K
n68o0g~1.dll Fri 4 Feb 2005 20:16:26 ..S.R 230,122 224.73 K
n84sli~1.dll Thu 10 Feb 2005 20:51:56 ..S.R 229,074 223.70 K
ole32.dll Fri 14 Jan 2005 8:55:50 A.... 1,285,120 1.22 M
olecli32.dll Fri 14 Jan 2005 8:55:50 A.... 74,752 73.00 K
olecnv32.dll Fri 14 Jan 2005 8:55:50 A.... 37,888 37.00 K
q0psla~1.dll Thu 10 Feb 2005 21:46:20 ..S.R 229,085 223.71 K
q486le~1.dll Thu 10 Feb 2005 17:26:04 ..S.R 231,494 226.07 K
rpcss.dll Fri 14 Jan 2005 8:55:50 A.... 395,776 386.50 K
shdocvw.dll Thu 27 Jan 2005 17:13:18 A.... 1,483,264 1.41 M
shell32.dll Tue 21 Dec 2004 20:49:36 A.... 8,450,048 8.06 M
shlwapi.dll Thu 27 Jan 2005 17:13:18 A.... 473,600 462.50 K
srvsvc.dll Tue 7 Dec 2004 19:32:34 A.... 96,768 94.50 K
t48ule~1.dll Sat 12 Feb 2005 13:55:06 ..S.R 231,069 225.65 K
urlmon.dll Thu 27 Jan 2005 17:13:18 A.... 607,744 593.50 K
wininet.dll Thu 27 Jan 2005 17:13:18 A.... 656,896 641.50 K

43 items found: 43 files (10 H/S), 0 directories.
Total of file sizes: 23,517,434 bytes 22.43 M
Locate .tmp files:

[RoadSongs]

Hi again
l2mfix option 2
L2Mfix 1.02a




RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting registry permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Denying C access for really "Everyone"
- adding new ACCESS DENY entry


Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER



Setting up for Reboot


Starting Reboot!

C:\Documents and Settings\Steve Fullerton\Desktop\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Steve Fullerton\Desktop\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 1964 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Error, Cannot find a process with an image name of rundll32.exe

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\atsmsext.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ENAPI.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ENBTEG.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ennsl1571.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ir22l5fo1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\j4p0le7m1h.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jkproxy.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\l2j80c1uef.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\LGNGWRBK.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\LMCMP12N.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lsawd10N.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lvjm0911e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mmstkprp.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\muorcl32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mxxml4a.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\n68o0gl3e6q.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\n84slih7184.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\q486lels1hq6.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\t48ulel91hq.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\atsmsext.dll
Successfully Deleted: C:\WINDOWS\system32\atsmsext.dll
deleting: C:\WINDOWS\system32\ENAPI.dll
Successfully Deleted: C:\WINDOWS\system32\ENAPI.dll
deleting: C:\WINDOWS\system32\ENBTEG.DLL
Successfully Deleted: C:\WINDOWS\system32\ENBTEG.DLL
deleting: C:\WINDOWS\system32\ennsl1571.dll
Successfully Deleted: C:\WINDOWS\system32\ennsl1571.dll
deleting: C:\WINDOWS\system32\ir22l5fo1.dll
Successfully Deleted: C:\WINDOWS\system32\ir22l5fo1.dll
deleting: C:\WINDOWS\system32\j4p0le7m1h.dll
Successfully Deleted: C:\WINDOWS\system32\j4p0le7m1h.dll
deleting: C:\WINDOWS\system32\jkproxy.dll
Successfully Deleted: C:\WINDOWS\system32\jkproxy.dll
deleting: C:\WINDOWS\system32\l2j80c1uef.dll
Successfully Deleted: C:\WINDOWS\system32\l2j80c1uef.dll
deleting: C:\WINDOWS\system32\LGNGWRBK.DLL
Successfully Deleted: C:\WINDOWS\system32\LGNGWRBK.DLL
deleting: C:\WINDOWS\system32\LMCMP12N.DLL
Successfully Deleted: C:\WINDOWS\system32\LMCMP12N.DLL
deleting: C:\WINDOWS\system32\lsawd10N.dll
Successfully Deleted: C:\WINDOWS\system32\lsawd10N.dll
deleting: C:\WINDOWS\system32\lvjm0911e.dll
Successfully Deleted: C:\WINDOWS\system32\lvjm0911e.dll
deleting: C:\WINDOWS\system32\mmstkprp.dll
Successfully Deleted: C:\WINDOWS\system32\mmstkprp.dll
deleting: C:\WINDOWS\system32\muorcl32.dll
Successfully Deleted: C:\WINDOWS\system32\muorcl32.dll
deleting: C:\WINDOWS\system32\mxxml4a.dll
Successfully Deleted: C:\WINDOWS\system32\mxxml4a.dll
deleting: C:\WINDOWS\system32\n68o0gl3e6q.dll
Successfully Deleted: C:\WINDOWS\system32\n68o0gl3e6q.dll
deleting: C:\WINDOWS\system32\n84slih7184.dll
Successfully Deleted: C:\WINDOWS\system32\n84slih7184.dll
deleting: C:\WINDOWS\system32\q486lels1hq6.dll
Successfully Deleted: C:\WINDOWS\system32\q486lels1hq6.dll
deleting: C:\WINDOWS\system32\t48ulel91hq.dll
Successfully Deleted: C:\WINDOWS\system32\t48ulel91hq.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Desktop.ini sucessfully removed

Zipping up files for submission:
adding: atsmsext.dll (140 bytes security) (deflated 5%)
adding: ENAPI.dll (140 bytes security) (deflated 6%)
adding: ENBTEG.DLL (140 bytes security) (deflated 5%)
adding: ennsl1571.dll (140 bytes security) (deflated 4%)
adding: ir22l5fo1.dll (140 bytes security) (deflated 4%)
adding: j4p0le7m1h.dll (140 bytes security) (deflated 6%)
adding: jkproxy.dll (140 bytes security) (deflated 5%)
adding: l2j80c1uef.dll (140 bytes security) (deflated 5%)
adding: LGNGWRBK.DLL (140 bytes security) (deflated 5%)
adding: LMCMP12N.DLL (140 bytes security) (deflated 5%)
adding: lsawd10N.dll (140 bytes security) (deflated 4%)
adding: lvjm0911e.dll (140 bytes security) (deflated 5%)
adding: mmstkprp.dll (140 bytes security) (deflated 5%)
adding: muorcl32.dll (140 bytes security) (deflated 4%)
adding: mxxml4a.dll (140 bytes security) (deflated 5%)
adding: n68o0gl3e6q.dll (140 bytes security) (deflated 5%)
adding: n84slih7184.dll (140 bytes security) (deflated 4%)
adding: q486lels1hq6.dll (140 bytes security) (deflated 5%)
adding: t48ulel91hq.dll (140 bytes security) (deflated 5%)
adding: guard.tmp (140 bytes security) (deflated 4%)
adding: clear.reg (140 bytes security) (deflated 22%)
adding: echo.reg (140 bytes security) (deflated 9%)
adding: desktop.ini (140 bytes security) (deflated 15%)
adding: direct.txt (140 bytes security) (stored 0%)
adding: lo2.txt (140 bytes security) (deflated 81%)
adding: readme.txt (140 bytes security) (deflated 49%)
adding: report.txt (140 bytes security) (deflated 73%)
adding: test.txt (140 bytes security) (deflated 76%)
adding: test2.txt (140 bytes security) (stored 0%)
adding: test3.txt (140 bytes security) (stored 0%)
adding: test5.txt (140 bytes security) (stored 0%)
adding: xfind.txt (140 bytes security) (deflated 69%)
adding: backregs/BF96875C-C94B-4FB2-9570-62092B6B84FF.reg (140 bytes security) (deflated 70%)
adding: backregs/shell.reg (140 bytes security) (deflated 63%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for really "Everyone"


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

deleting local copy: atsmsext.dll
deleting local copy: ENAPI.dll
deleting local copy: ENBTEG.DLL
deleting local copy: ennsl1571.dll
deleting local copy: ir22l5fo1.dll
deleting local copy: j4p0le7m1h.dll
deleting local copy: jkproxy.dll
deleting local copy: l2j80c1uef.dll
deleting local copy: LGNGWRBK.DLL
deleting local copy: LMCMP12N.DLL
deleting local copy: lsawd10N.dll
deleting local copy: lvjm0911e.dll
deleting local copy: mmstkprp.dll
deleting local copy: muorcl32.dll
deleting local copy: mxxml4a.dll
deleting local copy: n68o0gl3e6q.dll
deleting local copy: n84slih7184.dll
deleting local copy: q486lels1hq6.dll
deleting local copy: t48ulel91hq.dll
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\atsmsext.dll
C:\WINDOWS\system32\ENAPI.dll
C:\WINDOWS\system32\ENBTEG.DLL
C:\WINDOWS\system32\ennsl1571.dll
C:\WINDOWS\system32\ir22l5fo1.dll
C:\WINDOWS\system32\j4p0le7m1h.dll
C:\WINDOWS\system32\jkproxy.dll
C:\WINDOWS\system32\l2j80c1uef.dll
C:\WINDOWS\system32\LGNGWRBK.DLL
C:\WINDOWS\system32\LMCMP12N.DLL
C:\WINDOWS\system32\lsawd10N.dll
C:\WINDOWS\system32\lvjm0911e.dll
C:\WINDOWS\system32\mmstkprp.dll
C:\WINDOWS\system32\muorcl32.dll
C:\WINDOWS\system32\mxxml4a.dll
C:\WINDOWS\system32\n68o0gl3e6q.dll
C:\WINDOWS\system32\n84slih7184.dll
C:\WINDOWS\system32\q486lels1hq6.dll
C:\WINDOWS\system32\t48ulel91hq.dll
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{BF96875C-C94B-4FB2-9570-62092B6B84FF}"=-
[-HKEY_CLASSES_ROOT\CLSID\{BF96875C-C94B-4FB2-9570-62092B6B84FF}]
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{72C92B96-6FAC-4F40-B713-B4060C74CD0A}"=-
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
<IDone>{72C92B96-6FAC-4F40-B713-B4060C74CD0A}</IDone>
<IDtwo>VT00</IDtwo>
<VERSION>200</VERSION>
****************************************************************************


[RoadSongs]

HIJACKTHIS LOG

Logfile of HijackThis v1.99.0
Scan saved at 17:38:47, on 12/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\WINDOWS\system32\gsicon.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emusic.co...lp/success.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: (no name) - {5BFDA4F8-1202-552D-3802-CE60A3A086DA} - (no file)
O2 - BHO: (no name) - {823E2691-4C22-5D5E-5123-D40E5E0404C4} - (no file)
O2 - BHO: (no name) - {C6D08BDF-D4F6-D1E4-C29E-B51C99AB541B} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60B68012-2A35-43A6-ACA4-0B1B2AC996F2}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{DFEDB4E4-89E1-45C0-B2A0-9F9585797C7C}: NameServer = 152.163.0.26 205.188.64.153
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service - Unknown - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: McAfee Personal Firewall Service - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: oamgkupboyjx - Unknown - C:\WINDOWS\system32\oodpuuyv5.exe (file missing)

MANY MANY thanx for all your time and help

Steve

[RoadSongs]

Hi there
Sorry for the delay but AOL went don in my area last night some BT problem here's the new Hijackthis Log..again mucho appreciados for all your help I owe you a few beers if ever in St Leonards let me know

Steve

Logfile of HijackThis v1.99.0
Scan saved at 07:08:14, on 13/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AOL 9.0a\aoltray.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emusic.co...lp/success.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {5BFDA4F8-1202-552D-3802-CE60A3A086DA} - (no file)
O2 - BHO: (no name) - {823E2691-4C22-5D5E-5123-D40E5E0404C4} - (no file)
O2 - BHO: (no name) - {C6D08BDF-D4F6-D1E4-C29E-B51C99AB541B} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60B68012-2A35-43A6-ACA4-0B1B2AC996F2}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{DFEDB4E4-89E1-45C0-B2A0-9F9585797C7C}: NameServer = 152.163.0.26 205.188.64.153
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service - Unknown - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: McAfee Personal Firewall Service - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[RoadSongs]

Here's the new HijackThisLog

Logfile of HijackThis v1.99.0
Scan saved at 09:03:17, on 13/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

[RoadSongs]

Sorry is this better


Logfile of HijackThis v1.99.0
Scan saved at 09:33:09, on 13/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,First Home Page = C:\Program Files\AOL Toolbar\welcome.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.emusic.co...lp/success.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {5BFDA4F8-1202-552D-3802-CE60A3A086DA} - (no file)
O2 - BHO: (no name) - {823E2691-4C22-5D5E-5123-D40E5E0404C4} - (no file)
O2 - BHO: (no name) - {C6D08BDF-D4F6-D1E4-C29E-B51C99AB541B} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0a\aoltray.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60B68012-2A35-43A6-ACA4-0B1B2AC996F2}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{DFEDB4E4-89E1-45C0-B2A0-9F9585797C7C}: NameServer = 152.163.0.26 205.188.64.153
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\aol\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service - Unknown - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: McAfee Personal Firewall Service - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe