Hijack Problem -need Help!

hello LorJJan4,

look in add/remove programs panel and uninstall:
new net or new dot net
any toolbars or search bars/helpers.
if present uninstall then reboot computer.

next download, install, update and run these two:
Spybot - Search & Destroy from http://security.kolla.de

and

ad aware SE personal edition:
http://www.lavasoft.de/

also from the ad aware web sit get the vx2 plugin cleaner:
How to use Lavasoft’s VX2 Cleaner add-on

Close Ad-Aware and Ad-Watch (if running)
Download the free VX2 Cleaner here
Install the VX2 Cleaner
Start Ad-Aware
Go to “Add-ons”
Select the VX2 Cleaner add-on and click “Run Tool”
If your computer isn’t infected, click “Close”.



If your computer is infected

Select “Clean System”
Reboot your computer
Scan your computer with Ad-Aware
Remove any VX2 objects detected
Reboot your computer again
Run a second scan to make sure the files have been removed from your computer
——————————————————————–
afterwards post a new HJt log……………………..shelf life

hello LorJJan4,

well i have good and bad news.

the good new is you got rid of new dot and some others.
the bad news is you may have a new vx2 infection. by new i mean it hasnt been around for long and fixes for it are still kind of fuzzy.
to start lets try this:
———————————————–

Make sure your PC is configured to show hidden files

Double click my computers & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Run HJT and check the following items:
Close all open windows except HiJackThis and press 'Fix Checked'

R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=C:\MUSICRCK\MIXERON.EXE
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file)
O3 - Toolbar: (no name) - {094176F9-BF35-4bcb-B68A-108DFB8C3825} - (no file)
O4 - HKLM\..\Run: [FX] C:\WINNT\Downloaded Program Files\ieloader.exe

O8 - Extra context menu item: &Search - http://bar.mytotalsearch.com/menusearch.html?p=VN

ok next boot into SAFE MODE by tapping F8 key at start up, chose safe mode from the options.
once in safe mode;
find and delete>>ieloader.exe<> C:\WINNT\Downloaded Program Files

also in safe mode;
Empty your Temp folders. Go to Start > Run and type:cleanmgr. Windows will scan. When done check these 3 and press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin


Click Start>Run then type %temp%
Hit OK. Delete all the files you can, some wont delete.
————————————————————
afterward reboot normally go to one of these online scanners:
http://www.ravantivirus.com/scan/indexn.php
http://virusscan.jotti.dhs.org/
http://www.virustotal.com/xhtml/index_en.html

upload this file to get it checked out:

>>starter.exe<< located here: C:\WINNT\system32

post new HJT log. if the 01 items show up again we will have more work to do.

shelf life….

hello LorJJan4, the fix for the new vx2 variant is still fuzzy.iam going to need some time for a fix. shelf life

Okay, I'll wait…. thank you so much for your help so far , I'm pretty sure my RUNDLL problem is gone for good. Now, I hope a sure fix comes quick for the VX2 problem! I guess the add-on for VX2 in Ad-Aware doesn't kill it for good. It really seems to be a stubborn little bugger. I went to Bleepingcomputer.com and saw Killbox download …it mentions it gets rid of VX2… would it kill my version of the virus or is mine different?

hello, hang on, you will need more than just kill-box to get rid of it.

hello LorJJan4,

ok we can try– this is all removal by hand. i understand a more automated fix may be available soon.
ok here we go:
download two apps:

Find It NT-2K-XP.zip
Pocket Killbox

we will use Find It nt-2k-xp first:

• Unzip the contents of Find It NT-2K-XP.zip to a convenient location.
• Navigate to the Find It NT-2K-XP folder and double-click on find.bat.
• A command prompt will open and it will search your computer for malicious files.
• Once it has finished a Notepad window will pop up with output.txt.
• Copy the entire contents of output.txt into your next post.

next we will id the "bad" files and use killbox to delete them then do some clean up and hopefully that will take care of it………

Alright , here is my Output.txt file… Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\My Download Files\PCProtectionUtilities\Nt2kXp\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/20/2004 10:11p 225,824 dgmrtp.dll 12/20/2004 10:10p 225,824 lvpo0973e.dll 12/20/2004 09:38p 225,824 k8pm0i71e8.dll 12/20/2004 09:09p 225,824 rDsctrs.dll 12/20/2004 08:21p 225,824 pZnmap.dll 12/20/2004 08:21p 222,698 t08u0al9edq.dll 12/20/2004 03:12p 225,824 vcajet32.dll 12/20/2004 03:12p 222,545 p4p60e7seh.dll 12/20/2004 02:48p 222,625 n4l80e3ueh.dll 12/20/2004 02:33p 225,947 fp2m03f1e.dll 12/19/2004 09:27p 225,028 lv2q09f5e.dll 12/19/2004 08:41p dllcache 12/19/2004 08:28p 224,177 6Imrmfc11x.dll 12/18/2004 06:27p 225,649 LWCALSPL.DLL 12/18/2004 05:39p 223,798 iaubgrnd.dll 12/18/2004 10:53a 223,585 NIDLL.DLL 12/18/2004 10:12a 223,472 OFBC32GT.dll 12/18/2004 02:35a 223,053 LKCMP70N.DLL 12/16/2004 10:24p 224,967 k044lahq1d4e.dll 12/16/2004 09:42p 226,216 i0lola331d.dll 12/16/2004 12:39p 224,967 WZNINET.DLL 12/15/2004 10:42p 224,967 strrun.dll 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 22 File(s) 4,718,670 bytes 1 Dir(s) 33,813,110,784 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/19/2004 08:41p dllcache 12/18/2004 02:45a 4,212 zllictbl.dat 03/20/2004 12:38a 23,148 Atmenuxx.GID 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 02/28/2004 03:26p GroupPolicy 02/28/2004 03:16p 21,692 folder.htt 02/28/2004 03:16p 271 desktop.ini 5 File(s) 49,355 bytes 2 Dir(s) 33,813,110,784 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/19/2004 03:53p 59 E_S35.tmp 09/18/2004 04:26p 1,008 tmpmpt1.tmp 12/07/1999 07:00a 2,577 CONFIG.TMP 3 File(s) 3,644 bytes 0 Dir(s) 33,813,106,688 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{3F2B631E-FBB7-4805-9311-395CED10EFFE}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Controls Folder] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\k8pm0i71e8.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 —————— Locate.com Results —————— C:\WINNT\SYSTEM32\ 6imrmf~1.dll Sun Dec 19 2004 8:28:46p ..S.R 224,177 218.92 K dgmrtp.dll Mon Dec 20 2004 10:11:54p ..S.R 225,824 220.53 K fp2m03~1.dll Mon Dec 20 2004 2:33:24p ..S.R 225,947 220.65 K i0lola~1.dll Thu Dec 16 2004 9:42:10p ..S.R 226,216 220.91 K iaubgrnd.dll Sat Dec 18 2004 5:39:42p ..S.R 223,798 218.55 K k044la~1.dll Thu Dec 16 2004 10:24:14p ..S.R 224,967 219.69 K k8pm0i~1.dll Mon Dec 20 2004 9:38:42p ..S.R 225,824 220.53 K lkcmp70n.dll Sat Dec 18 2004 2:35:10a ..S.R 223,053 217.82 K lv2q09~1.dll Sun Dec 19 2004 9:27:10p ..S.R 225,028 219.75 K lvpo09~1.dll Mon Dec 20 2004 10:10:08p ..S.R 225,824 220.53 K lwcalspl.dll Sat Dec 18 2004 6:27:28p ..S.R 225,649 220.36 K n4l80e~1.dll Mon Dec 20 2004 2:48:14p ..S.R 222,625 217.41 K nidll.dll Sat Dec 18 2004 10:53:32a ..S.R 223,585 218.34 K ofbc32gt.dll Sat Dec 18 2004 10:12:30a ..S.R 223,472 218.23 K p4p60e~1.dll Mon Dec 20 2004 3:12:16p ..S.R 222,545 217.33 K pznmap.dll Mon Dec 20 2004 8:21:52p ..S.R 225,824 220.53 K rdsctrs.dll Mon Dec 20 2004 9:09:42p ..S.R 225,824 220.53 K strrun.dll Wed Dec 15 2004 10:42:30p ..S.R 224,967 219.69 K t08u0a~1.dll Mon Dec 20 2004 8:21:52p ..S.R 222,698 217.48 K vcajet32.dll Mon Dec 20 2004 3:12:16p ..S.R 225,824 220.53 K wzninet.dll Thu Dec 16 2004 12:39:32p ..S.R 224,967 219.69 K zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K 22 items found: 22 files, 0 directories. Total of file sizes: 4,722,850 bytes 4.50 M ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "AtiPTA"="atiptaxx.exe" "ccRegVfy"="C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe" "Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE" "InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h" "RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE" "EPSON Stylus C62 Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\"" "ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory Deluxe\\ReminderApp.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r" 

hello, sorry for delay. ok could you post a new output.txt file from running findit again. the file names can randomly change. iam assuming that you have restarted your computer by now of course. run again, dont reboot until we can id and use killbox to get rid of the files. i will try to respond sooner this time, sorry.. if by chance you havent rebooted since posting findit log we should be good to go……..shelf life

That's alright… it's almost Christmas and this is a BAD time to have a virus on a computer! Yeah, you're right I've definitely rebooted since then, so here ya go , I just ran it after reading your last post, here is my very latest Output.txt file: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\My Download Files\PCProtectionUtilities\Nt2kXp\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/22/2004 07:50p 222,978 mgapsspc.dll 12/22/2004 07:50p 224,208 h0l2la3o1d.dll 12/22/2004 07:05p 222,978 l04qlah51d4.dll 12/22/2004 01:50p 225,824 iuetpp.dll 12/21/2004 06:02p 225,824 icxsap.dll 12/21/2004 06:02p 222,783 i0nmla511d.dll 12/20/2004 10:11p 225,824 dgmrtp.dll 12/20/2004 09:09p 225,824 rDsctrs.dll 12/20/2004 08:21p 225,824 pZnmap.dll 12/20/2004 08:21p 222,698 t08u0al9edq.dll 12/20/2004 03:12p 225,824 vcajet32.dll 12/20/2004 03:12p 222,545 p4p60e7seh.dll 12/20/2004 02:48p 222,625 n4l80e3ueh.dll 12/20/2004 02:33p 225,947 fp2m03f1e.dll 12/19/2004 09:27p 225,028 lv2q09f5e.dll 12/19/2004 08:41p dllcache 12/19/2004 08:28p 224,177 6Imrmfc11x.dll 12/18/2004 06:27p 225,649 LWCALSPL.DLL 12/18/2004 05:39p 223,798 iaubgrnd.dll 12/18/2004 10:53a 223,585 NIDLL.DLL 12/18/2004 10:12a 223,472 OFBC32GT.dll 12/18/2004 02:35a 223,053 LKCMP70N.DLL 12/16/2004 10:24p 224,967 k044lahq1d4e.dll 12/16/2004 09:42p 226,216 i0lola331d.dll 12/16/2004 12:39p 224,967 WZNINET.DLL 12/15/2004 10:42p 224,967 strrun.dll 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 26 File(s) 5,611,617 bytes 1 Dir(s) 33,636,622,336 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/19/2004 08:41p dllcache 12/18/2004 02:45a 4,212 zllictbl.dat 03/20/2004 12:38a 23,148 Atmenuxx.GID 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 02/28/2004 03:26p GroupPolicy 02/28/2004 03:16p 21,692 folder.htt 02/28/2004 03:16p 271 desktop.ini 5 File(s) 49,355 bytes 2 Dir(s) 33,636,622,336 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/19/2004 03:53p 59 E_S35.tmp 09/18/2004 04:26p 1,008 tmpmpt1.tmp 12/07/1999 07:00a 2,577 CONFIG.TMP 3 File(s) 3,644 bytes 0 Dir(s) 33,636,618,240 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{3F2B631E-FBB7-4805-9311-395CED10EFFE}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\l04qlah51d4.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 —————— Locate.com Results —————— C:\WINNT\SYSTEM32\ 6imrmf~1.dll Sun Dec 19 2004 8:28:46p ..S.R 224,177 218.92 K dgmrtp.dll Mon Dec 20 2004 10:11:54p ..S.R 225,824 220.53 K fp2m03~1.dll Mon Dec 20 2004 2:33:24p ..S.R 225,947 220.65 K h0l2la~1.dll Wed Dec 22 2004 7:50:14p ..S.R 224,208 218.95 K i0lola~1.dll Thu Dec 16 2004 9:42:10p ..S.R 226,216 220.91 K i0nmla~1.dll Tue Dec 21 2004 6:02:12p ..S.R 222,783 217.56 K iaubgrnd.dll Sat Dec 18 2004 5:39:42p ..S.R 223,798 218.55 K icxsap.dll Tue Dec 21 2004 6:02:12p ..S.R 225,824 220.53 K iuetpp.dll Wed Dec 22 2004 1:50:44p ..S.R 225,824 220.53 K k044la~1.dll Thu Dec 16 2004 10:24:14p ..S.R 224,967 219.69 K l04qla~1.dll Wed Dec 22 2004 7:05:12p ..S.R 222,978 217.75 K lkcmp70n.dll Sat Dec 18 2004 2:35:10a ..S.R 223,053 217.82 K lv2q09~1.dll Sun Dec 19 2004 9:27:10p ..S.R 225,028 219.75 K lwcalspl.dll Sat Dec 18 2004 6:27:28p ..S.R 225,649 220.36 K mgapsspc.dll Wed Dec 22 2004 7:50:14p ..S.R 222,978 217.75 K n4l80e~1.dll Mon Dec 20 2004 2:48:14p ..S.R 222,625 217.41 K nidll.dll Sat Dec 18 2004 10:53:32a ..S.R 223,585 218.34 K ofbc32gt.dll Sat Dec 18 2004 10:12:30a ..S.R 223,472 218.23 K p4p60e~1.dll Mon Dec 20 2004 3:12:16p ..S.R 222,545 217.33 K pznmap.dll Mon Dec 20 2004 8:21:52p ..S.R 225,824 220.53 K rdsctrs.dll Mon Dec 20 2004 9:09:42p ..S.R 225,824 220.53 K strrun.dll Wed Dec 15 2004 10:42:30p ..S.R 224,967 219.69 K t08u0a~1.dll Mon Dec 20 2004 8:21:52p ..S.R 222,698 217.48 K vcajet32.dll Mon Dec 20 2004 3:12:16p ..S.R 225,824 220.53 K wzninet.dll Thu Dec 16 2004 12:39:32p ..S.R 224,967 219.69 K zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K 26 items found: 26 files, 0 directories. Total of file sizes: 5,615,797 bytes 5.36 M ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe /logon" "AtiPTA"="atiptaxx.exe" "ccRegVfy"="C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe" "Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE" "InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTAN~1.EXE /h" "RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\REGIST~1.EXE" "EPSON Stylus C62 Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BIC1.EXE /P23 \"EPSON Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\"" "ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory Deluxe\\ReminderApp.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD.exe -r" 

Shelf Life, Disregard that last Output.txt….realized its better if I do this in the morning and just leave my computer on. Here's my output.txt from this morning…12/23 9:00AM: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\My Download Files\PCProtectionUtilities\Nt2kXp\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/23/2004 08:34a 224,208 ialM6.dll 12/23/2004 08:34a 225,984 q6pslg7716.dll 12/23/2004 07:48a 224,208 notdtect.dll 12/23/2004 07:48a 224,572 l46o0ej3eho.dll 12/22/2004 07:50p 224,208 h0l2la3o1d.dll 12/22/2004 01:50p 225,824 iuetpp.dll 12/21/2004 06:02p 225,824 icxsap.dll 12/21/2004 06:02p 222,783 i0nmla511d.dll 12/20/2004 10:11p 225,824 dgmrtp.dll 12/20/2004 09:09p 225,824 rDsctrs.dll 12/20/2004 08:21p 225,824 pZnmap.dll 12/20/2004 08:21p 222,698 t08u0al9edq.dll 12/20/2004 03:12p 225,824 vcajet32.dll 12/20/2004 03:12p 222,545 p4p60e7seh.dll 12/20/2004 02:48p 222,625 n4l80e3ueh.dll 12/20/2004 02:33p 225,947 fp2m03f1e.dll 12/19/2004 09:27p 225,028 lv2q09f5e.dll 12/19/2004 08:41p dllcache 12/19/2004 08:28p 224,177 6Imrmfc11x.dll 12/18/2004 06:27p 225,649 LWCALSPL.DLL 12/18/2004 05:39p 223,798 iaubgrnd.dll 12/18/2004 10:53a 223,585 NIDLL.DLL 12/18/2004 10:12a 223,472 OFBC32GT.dll 12/18/2004 02:35a 223,053 LKCMP70N.DLL 12/16/2004 10:24p 224,967 k044lahq1d4e.dll 12/16/2004 09:42p 226,216 i0lola331d.dll 12/16/2004 12:39p 224,967 WZNINET.DLL 12/15/2004 10:42p 224,967 strrun.dll 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 28 File(s) 6,064,633 bytes 1 Dir(s) 33,636,339,712 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/19/2004 08:41p dllcache 12/18/2004 02:45a 4,212 zllictbl.dat 03/20/2004 12:38a 23,148 Atmenuxx.GID 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 02/28/2004 03:26p GroupPolicy 02/28/2004 03:16p 21,692 folder.htt 02/28/2004 03:16p 271 desktop.ini 5 File(s) 49,355 bytes 2 Dir(s) 33,636,339,712 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/19/2004 03:53p 59 E_S35.tmp 09/18/2004 04:26p 1,008 tmpmpt1.tmp 12/07/1999 07:00a 2,577 CONFIG.TMP 3 File(s) 3,644 bytes 0 Dir(s) 33,636,335,616 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\I nternet Settings\User Agent\Post Platform] "{3F2B631E-FBB7-4805-9311-395CED10EFFE}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Unimodem] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\h0l2la3o1d.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 —————— Locate.com Results —————— C:\WINNT\SYSTEM32\ 6imrmf~1.dll Sun Dec 19 2004 8:28:46p ..S.R 224,177 218.92 K dgmrtp.dll Mon Dec 20 2004 10:11:54p ..S.R 225,824 220.53 K fp2m03~1.dll Mon Dec 20 2004 2:33:24p ..S.R 225,947 220.65 K h0l2la~1.dll Wed Dec 22 2004 7:50:14p ..S.R 224,208 218.95 K i0lola~1.dll Thu Dec 16 2004 9:42:10p ..S.R 226,216 220.91 K i0nmla~1.dll Tue Dec 21 2004 6:02:12p ..S.R 222,783 217.56 K ialm6.dll Thu Dec 23 2004 8:34:28a ..S.R 224,208 218.95 K iaubgrnd.dll Sat Dec 18 2004 5:39:42p ..S.R 223,798 218.55 K icxsap.dll Tue Dec 21 2004 6:02:12p ..S.R 225,824 220.53 K iuetpp.dll Wed Dec 22 2004 1:50:44p ..S.R 225,824 220.53 K k044la~1.dll Thu Dec 16 2004 10:24:14p ..S.R 224,967 219.69 K l46o0e~1.dll Thu Dec 23 2004 7:48:02a ..S.R 224,572 219.31 K lkcmp70n.dll Sat Dec 18 2004 2:35:10a ..S.R 223,053 217.82 K lv2q09~1.dll Sun Dec 19 2004 9:27:10p ..S.R 225,028 219.75 K lwcalspl.dll Sat Dec 18 2004 6:27:28p ..S.R 225,649 220.36 K n4l80e~1.dll Mon Dec 20 2004 2:48:14p ..S.R 222,625 217.41 K nidll.dll Sat Dec 18 2004 10:53:32a ..S.R 223,585 218.34 K notdtect.dll Thu Dec 23 2004 7:48:02a ..S.R 224,208 218.95 K ofbc32gt.dll Sat Dec 18 2004 10:12:30a ..S.R 223,472 218.23 K p4p60e~1.dll Mon Dec 20 2004 3:12:16p ..S.R 222,545 217.33 K pznmap.dll Mon Dec 20 2004 8:21:52p ..S.R 225,824 220.53 K q6pslg~1.dll Thu Dec 23 2004 8:34:28a ..S.R 225,984 220.69 K rdsctrs.dll Mon Dec 20 2004 9:09:42p ..S.R 225,824 220.53 K strrun.dll Wed Dec 15 2004 10:42:30p ..S.R 224,967 219.69 K t08u0a~1.dll Mon Dec 20 2004 8:21:52p ..S.R 222,698 217.48 K vcajet32.dll Mon Dec 20 2004 3:12:16p ..S.R 225,824 220.53 K wzninet.dll Thu Dec 16 2004 12:39:32p ..S.R 224,967 219.69 K zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K 28 items found: 28 files, 0 directories. Total of file sizes: 6,068,813 bytes 5.79 M ———— Strings.exe Qoologic Results ———— ————– Strings.exe Aspack Results ————- —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\R un] "Synchronization Manager"="mobsync.exe /logon" "AtiPTA"="atiptaxx.exe" "ccRegVfy"="C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe" "Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE" "InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTA N~1.EXE /h" "RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\ \REGIST~1.EXE" "EPSON Stylus C62 Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BI C1.EXE /P23 \"EPSON Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\"" "ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory Deluxe\\ReminderApp.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD .exe -r" 

hello LorJJan4,

ok here we go. i assume you downloaded pocket killbox.


Download the Pocket Killbox.
Unzip the contents of KillBox.zip to a convenient location.
Double-click on KillBox.exe.

1-Click "Replace on Reboot" and check the "2-Use Dummy" box.
Paste this file into the top "Full Path of File to Delete" box.

C:\WINNT\System32\ ialM6.dll

3-Click the "Delete File" button which looks like a stop sign.
4-Click "Yes" at the Replace on Reboot prompt.
5-Click "No" at the Pending Operations prompt.
Repeat steps 1-5 above for these files:

C:\WINNT\System32\q6pslg7716.dll
C:\WINNT\System32\notdtect.dll
C:\WINNT\System32\l46o0ej3eho.dll
C:\WINNT\System32\h0l2la3o1d.dll
C:\WINNT\System32\iuetpp.dll
C:\WINNT\System32\icxsap.dll
C:\WINNT\System32\i0nmla511d.dll
C:\WINNT\System32\dgmrtp.dll
C:\WINNT\System32\rDsctrs.dll
C:\WINNT\System32\pZnmap.dll
C:\WINNT\System32\ t08u0al9edq.dll
C:\WINNT\System32\vcajet32.dll
C:\WINNT\System32\p4p60e7seh.dll
C:\WINNT\System32\n4l80e3ueh.dll
C:\WINNT\System32\fp2m03f1e.dll
C:\WINNT\System32\lv2q09f5e.dll
C:\WINNT\System32\6Imrmfc11x.dll
C:\WINNT\System32\LWCALSPL.DLL
C:\WINNT\System32\iaubgrnd.dll
C:\WINNT\System32\NIDLL.DLL
C:\WINNT\System32\OFBC32GT.dll
C:\WINNT\System32\LKCMP70N.DLL
C:\WINNT\System32\k044lahq1d4e.dll
C:\WINNT\System32\i0lola331d.dll
C:\WINNT\System32\WZNINET.DLL
C:\WINNT\System32\ strrun.dll
when all done;
Click "Yes" at the Replace on Reboot prompt.
Click "Yes" at the Pending Operations prompt to restart your computer.

after reboot:
run findit again and post new (hopefully changed) output .txt

Shelf life, Did everything you said, quite sure the output.txt file looks better…and those files I killed are gone and hopefully gone for good! Now, I got a question though… recently the other day while online I've had a Winlogon.exe error and it said it had to restart computer…was this virus the cause? Plus I researched it and it mentions WIN 2000 may be corrupt and I may need to do an in-place update of Win 2000. Will I need to do this? Ok, Here's the new file: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. Find.bat is running from: C:\Find-It\Find It NT-2K-XP ——- System Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/23/2004 05:08p dllcache 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 1 File(s) 32 bytes 1 Dir(s) 33,626,542,080 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/23/2004 05:08p dllcache 12/18/2004 02:45a 4,212 zllictbl.dat 03/20/2004 12:38a 23,148 Atmenuxx.GID 03/18/2004 06:09p 32 {990EB9DE-96C2-4F4E-8EC9-9DE1DC76ED6D}.dat 02/28/2004 03:26p GroupPolicy 02/28/2004 03:16p 21,692 folder.htt 02/28/2004 03:16p 271 desktop.ini 5 File(s) 49,355 bytes 2 Dir(s) 33,626,542,080 bytes free ———- Files Named "Guard" ————- Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/24/2004 01:34a 224,208 guard.tmp 1 File(s) 224,208 bytes 0 Dir(s) 33,626,542,080 bytes free ——— Temp Files in System32 Directory ——– Volume in drive C has no label. Volume Serial Number is 00B8-A5AB Directory of C:\WINNT\System32 12/24/2004 01:34a 224,208 guard.tmp 12/19/2004 03:53p 59 E_S35.tmp 09/18/2004 04:26p 1,008 tmpmpt1.tmp 12/07/1999 07:00a 2,577 CONFIG.TMP 4 File(s) 227,852 bytes 0 Dir(s) 33,626,542,080 bytes free —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\I nternet Settings\User Agent\Post Platform] "{3F2B631E-FBB7-4805-9311-395CED10EFFE}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\q6pslg7716.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 —————— Locate.com Results —————— C:\WINNT\SYSTEM32\ zllictbl.dat Sat Dec 18 2004 2:45:22a …H. 4,212 4.11 K 1 item found: 1 file, 0 directories. Total of file sizes: 4,212 bytes 4.11 K ———— Strings.exe Qoologic Results ———— C:\WINNT\system32\cgcucu.dll: updates.qoologic.com C:\WINNT\system32\ezepep.dll: updates.qoologic.com C:\WINNT\system32\hphuhu.exe: updates.qoologic.com ————– Strings.exe Aspack Results ————- C:\WINNT\system32\pqpupu.dat: .aspack C:\WINNT\system32\wywuwu.exe: .aspack C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\hyhghg.exe: .aspack —————– HKLM Run Key —————— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\R un] "Synchronization Manager"="mobsync.exe /logon" "AtiPTA"="atiptaxx.exe" "ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\"" "Advanced Tools Check"="C:\\PROGRA~1\\NORTON~1\\AdvTools\\ADVCHK.EXE" "InstantAccess"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\\INSTA N~1.EXE /h" "RegisterDropHandler"="C:\\PROGRA~1\\ScanSoft\\TEXTBR~1.0\\Bin\ \REGIST~1.EXE" "EPSON Stylus C62 Series"="C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S0BI C1.EXE /P23 \"EPSON Stylus C62 Series\" /O5 \"LPT2:\" /M \"Stylus C62\"" "ReminderApp"="C:\\Program Files\\Nova Development\\Greeting Card Factory Deluxe\\ReminderApp.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "WinampAgent"="\"C:\\Program Files\\Winamp\\Winampa.exe\"" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "Narrator"="C:\\WINNT\\system32\\wywuwu.exe" "C:\\WINNT\\adsbpthugx.exe"="C:\\WINNT\\adsbpthugx.exe" "CreateCD"="C:\\PROGRA~1\\Adaptec\\EASYCD~1\\CreateCD\\CreateCD .exe -r"