okay……
L2Mfix 1.02
Running From:
C:\Documents and Settings\Jerry\Desktop\l2mfix
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C access for really "Everyone"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY –C——- Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\Jerry\Desktop\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Jerry\Desktop\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 1572 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 1900 'rundll32.exe'
Killing PID 1948 'rundll32.exe'
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Backing Up: C:\WINDOWS\system32\dn4o01h3e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dn6o01j3e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\e0020adoed0c0.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\en8ul1l91.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fp4003hme.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fpn6035se.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\fpr8039ue.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\g2402chmgf4a2.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\gp28l3fu1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\gpl8l33u1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\gpr8l39u1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr0805due.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr8405lqe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hrru0599e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\irn4l55q1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\j06m0aj1edo.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jtj0071me.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jtnm0751e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\l2j8lc1u1f.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\l2l60c3sef.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lv8009lme.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\m2nq0c55ef.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\m8poli7318.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\o4660ejseho60.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\o8lu0i39e8.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\omcache.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\p06s0aj7edo.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\p0r40a9qed.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\pe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\q4nu0e59eh.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wfpasf.dll
1 file(s) copied.
deleting: C:\WINDOWS\system32\dn4o01h3e.dll
Successfully Deleted: C:\WINDOWS\system32\dn4o01h3e.dll
deleting: C:\WINDOWS\system32\dn6o01j3e.dll
Successfully Deleted: C:\WINDOWS\system32\dn6o01j3e.dll
deleting: C:\WINDOWS\system32\e0020adoed0c0.dll
Successfully Deleted: C:\WINDOWS\system32\e0020adoed0c0.dll
deleting: C:\WINDOWS\system32\en8ul1l91.dll
Successfully Deleted: C:\WINDOWS\system32\en8ul1l91.dll
deleting: C:\WINDOWS\system32\fp4003hme.dll
Successfully Deleted: C:\WINDOWS\system32\fp4003hme.dll
deleting: C:\WINDOWS\system32\fpn6035se.dll
Successfully Deleted: C:\WINDOWS\system32\fpn6035se.dll
deleting: C:\WINDOWS\system32\fpr8039ue.dll
Successfully Deleted: C:\WINDOWS\system32\fpr8039ue.dll
deleting: C:\WINDOWS\system32\g2402chmgf4a2.dll
Successfully Deleted: C:\WINDOWS\system32\g2402chmgf4a2.dll
deleting: C:\WINDOWS\system32\gp28l3fu1.dll
Successfully Deleted: C:\WINDOWS\system32\gp28l3fu1.dll
deleting: C:\WINDOWS\system32\gpl8l33u1.dll
Successfully Deleted: C:\WINDOWS\system32\gpl8l33u1.dll
deleting: C:\WINDOWS\system32\gpr8l39u1.dll
Successfully Deleted: C:\WINDOWS\system32\gpr8l39u1.dll
deleting: C:\WINDOWS\system32\hr0805due.dll
Successfully Deleted: C:\WINDOWS\system32\hr0805due.dll
deleting: C:\WINDOWS\system32\hr8405lqe.dll
Successfully Deleted: C:\WINDOWS\system32\hr8405lqe.dll
deleting: C:\WINDOWS\system32\hrru0599e.dll
Successfully Deleted: C:\WINDOWS\system32\hrru0599e.dll
deleting: C:\WINDOWS\system32\irn4l55q1.dll
Successfully Deleted: C:\WINDOWS\system32\irn4l55q1.dll
deleting: C:\WINDOWS\system32\j06m0aj1edo.dll
Successfully Deleted: C:\WINDOWS\system32\j06m0aj1edo.dll
deleting: C:\WINDOWS\system32\jtj0071me.dll
Successfully Deleted: C:\WINDOWS\system32\jtj0071me.dll
deleting: C:\WINDOWS\system32\jtnm0751e.dll
Successfully Deleted: C:\WINDOWS\system32\jtnm0751e.dll
deleting: C:\WINDOWS\system32\l2j8lc1u1f.dll
Successfully Deleted: C:\WINDOWS\system32\l2j8lc1u1f.dll
deleting: C:\WINDOWS\system32\l2l60c3sef.dll
Successfully Deleted: C:\WINDOWS\system32\l2l60c3sef.dll
deleting: C:\WINDOWS\system32\lv8009lme.dll
Successfully Deleted: C:\WINDOWS\system32\lv8009lme.dll
deleting: C:\WINDOWS\system32\m2nq0c55ef.dll
Successfully Deleted: C:\WINDOWS\system32\m2nq0c55ef.dll
deleting: C:\WINDOWS\system32\m8poli7318.dll
Successfully Deleted: C:\WINDOWS\system32\m8poli7318.dll
deleting: C:\WINDOWS\system32\o4660ejseho60.dll
Successfully Deleted: C:\WINDOWS\system32\o4660ejseho60.dll
deleting: C:\WINDOWS\system32\o8lu0i39e8.dll
Successfully Deleted: C:\WINDOWS\system32\o8lu0i39e8.dll
deleting: C:\WINDOWS\system32\omcache.dll
Successfully Deleted: C:\WINDOWS\system32\omcache.dll
deleting: C:\WINDOWS\system32\p06s0aj7edo.dll
Successfully Deleted: C:\WINDOWS\system32\p06s0aj7edo.dll
deleting: C:\WINDOWS\system32\p0r40a9qed.dll
Successfully Deleted: C:\WINDOWS\system32\p0r40a9qed.dll
deleting: C:\WINDOWS\system32\pe.dll
Successfully Deleted: C:\WINDOWS\system32\pe.dll
deleting: C:\WINDOWS\system32\q4nu0e59eh.dll
Successfully Deleted: C:\WINDOWS\system32\q4nu0e59eh.dll
deleting: C:\WINDOWS\system32\wfpasf.dll
Successfully Deleted: C:\WINDOWS\system32\wfpasf.dll
Desktop.ini sucessfully removed
Zipping up files for submission:
adding: dn4o01h3e.dll (164 bytes security) (deflated 3%)
adding: dn6o01j3e.dll (164 bytes security) (deflated 4%)
adding: e0020adoed0c0.dll (164 bytes security) (deflated 4%)
adding: en8ul1l91.dll (164 bytes security) (deflated 3%)
adding: fp4003hme.dll (164 bytes security) (deflated 5%)
adding: fpn6035se.dll (164 bytes security) (deflated 3%)
adding: fpr8039ue.dll (164 bytes security) (deflated 3%)
adding: g2402chmgf4a2.dll (164 bytes security) (deflated 3%)
adding: gp28l3fu1.dll (164 bytes security) (deflated 5%)
adding: gpl8l33u1.dll (164 bytes security) (deflated 5%)
adding: gpr8l39u1.dll (164 bytes security) (deflated 3%)
adding: hr0805due.dll (164 bytes security) (deflated 3%)
adding: hr8405lqe.dll (164 bytes security) (deflated 3%)
adding: hrru0599e.dll (164 bytes security) (deflated 4%)
adding: irn4l55q1.dll (164 bytes security) (deflated 3%)
adding: j06m0aj1edo.dll (164 bytes security) (deflated 3%)
adding: jtj0071me.dll (164 bytes security) (deflated 5%)
adding: jtnm0751e.dll (164 bytes security) (deflated 4%)
adding: l2j8lc1u1f.dll (164 bytes security) (deflated 5%)
adding: l2l60c3sef.dll (164 bytes security) (deflated 4%)
adding: lv8009lme.dll (164 bytes security) (deflated 4%)
adding: m2nq0c55ef.dll (164 bytes security) (deflated 4%)
adding: m8poli7318.dll (164 bytes security) (deflated 4%)
adding: o4660ejseho60.dll (164 bytes security) (deflated 4%)
adding: o8lu0i39e8.dll (164 bytes security) (deflated 4%)
adding: omcache.dll (164 bytes security) (deflated 3%)
adding: p06s0aj7edo.dll (164 bytes security) (deflated 3%)
adding: p0r40a9qed.dll (164 bytes security) (deflated 3%)
adding: pe.dll (164 bytes security) (deflated 4%)
adding: q4nu0e59eh.dll (164 bytes security) (deflated 4%)
adding: wfpasf.dll (164 bytes security) (deflated 4%)
adding: cecho.reg (164 bytes security) (deflated 2%)
adding: clear.reg (164 bytes security) (deflated 22%)
adding: echo.reg (164 bytes security) (deflated 8%)
adding: desktop.ini (164 bytes security) (deflated 15%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 84%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 65%)
adding: test.txt (164 bytes security) (deflated 81%)
adding: test2.txt (164 bytes security) (stored 0%)
adding: xfind.txt (164 bytes security) (deflated 76%)
adding: backregs/7093144C-A368-443D-AB7A-3A8C916B8A62.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 74%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for really "Everyone"
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators … successful
deleting local copy: dn4o01h3e.dll
deleting local copy: dn6o01j3e.dll
deleting local copy: e0020adoed0c0.dll
deleting local copy: en8ul1l91.dll
deleting local copy: fp4003hme.dll
deleting local copy: fpn6035se.dll
deleting local copy: fpr8039ue.dll
deleting local copy: g2402chmgf4a2.dll
deleting local copy: gp28l3fu1.dll
deleting local copy: gpl8l33u1.dll
deleting local copy: gpr8l39u1.dll
deleting local copy: hr0805due.dll
deleting local copy: hr8405lqe.dll
deleting local copy: hrru0599e.dll
deleting local copy: irn4l55q1.dll
deleting local copy: j06m0aj1edo.dll
deleting local copy: jtj0071me.dll
deleting local copy: jtnm0751e.dll
deleting local copy: l2j8lc1u1f.dll
deleting local copy: l2l60c3sef.dll
deleting local copy: lv8009lme.dll
deleting local copy: m2nq0c55ef.dll
deleting local copy: m8poli7318.dll
deleting local copy: o4660ejseho60.dll
deleting local copy: o8lu0i39e8.dll
deleting local copy: omcache.dll
deleting local copy: p06s0aj7edo.dll
deleting local copy: p0r40a9qed.dll
deleting local copy: pe.dll
deleting local copy: q4nu0e59eh.dll
deleting local copy: wfpasf.dll
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"Logoff"="NavLogoffEvent"
"StartShell"="NavStartShellEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
The following are the files found:
****************************************************************************
C:\WINDOWS\system32\dn4o01h3e.dll
C:\WINDOWS\system32\dn6o01j3e.dll
C:\WINDOWS\system32\e0020adoed0c0.dll
C:\WINDOWS\system32\en8ul1l91.dll
C:\WINDOWS\system32\fp4003hme.dll
C:\WINDOWS\system32\fpn6035se.dll
C:\WINDOWS\system32\fpr8039ue.dll
C:\WINDOWS\system32\g2402chmgf4a2.dll
C:\WINDOWS\system32\gp28l3fu1.dll
C:\WINDOWS\system32\gpl8l33u1.dll
C:\WINDOWS\system32\gpr8l39u1.dll
C:\WINDOWS\system32\hr0805due.dll
C:\WINDOWS\system32\hr8405lqe.dll
C:\WINDOWS\system32\hrru0599e.dll
C:\WINDOWS\system32\irn4l55q1.dll
C:\WINDOWS\system32\j06m0aj1edo.dll
C:\WINDOWS\system32\jtj0071me.dll
C:\WINDOWS\system32\jtnm0751e.dll
C:\WINDOWS\system32\l2j8lc1u1f.dll
C:\WINDOWS\system32\l2l60c3sef.dll
C:\WINDOWS\system32\lv8009lme.dll
C:\WINDOWS\system32\m2nq0c55ef.dll
C:\WINDOWS\system32\m8poli7318.dll
C:\WINDOWS\system32\o4660ejseho60.dll
C:\WINDOWS\system32\o8lu0i39e8.dll
C:\WINDOWS\system32\omcache.dll
C:\WINDOWS\system32\p06s0aj7edo.dll
C:\WINDOWS\system32\p0r40a9qed.dll
C:\WINDOWS\system32\pe.dll
C:\WINDOWS\system32\q4nu0e59eh.dll
C:\WINDOWS\system32\wfpasf.dll
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{7093144C-A368-443D-AB7A-3A8C916B8A62}"=-
[-HKEY_CLASSES_ROOT\CLSID\{7093144C-A368-443D-AB7A-3A8C916B8A62}]
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{32DCB0E3-1A83-4C25-8053-05B09EB7D9D2}"=-
****************************************************************************
Desktop.ini Contents:
****************************************************************************
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
{32DCB0E3-1A83-4C25-8053-05B09EB7D9D2}
VT00
200
****************************************************************************
Classid's found from regsearch:
****************************************************************************
Logfile of HijackThis v1.98.2
Scan saved at 9:19:49 PM, on 1/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Toolbar\TBPSSvc.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Windows TaskAd\WinTaskAd.exe
C:\WINDOWS\system32\wvkyvq.exe
C:\Program Files\Windows TaskAd\WinSched.exe
C:\WINDOWS\System32\rsvnxv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\NavNT\vptray.exe
C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\PROGRA~1\Toolbar\PIB.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\WINDOWS\System32\Cvjih0C.exe
C:\WINDOWS\System32\Uzz7TPXa.exe
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.websearch.com/ie.aspx?tb_id=50032
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant =
http://www.websearch.com/ie.aspx?tb_id=50032
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.websearch.com/ie.aspx?tb_id=50032
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
N2 - Netscape 6: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js)
N2 - Netscape 6: user_pref("browser.search.defaultengine", "
http://www.google.com/"); (C:\Documents and Settings\Jerry\Application Data\Mozilla\Profiles\default\ri50341f.slt\prefs.js)
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O2 - BHO: ZServObj Class - {00000000-C1EC-0345-6EC2-4D0300000000} - C:\WINDOWS\ZServ.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe
O4 - HKLM\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O4 - HKLM\..\Run: [4S2NSLA3QS#366] C:\WINDOWS\System32\OwmQ9t0X.exe
O4 - HKLM\..\Run: [rwwuzgaljav] C:\WINDOWS\System32\rsvnxv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKCU\..\Run: [SurfSideKick 2] C:\Program Files\SurfSideKick 2\Ssk.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aklsp.dll
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) -
http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} -
http://static.topconverting.com/activex/loader2.ocx
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
_