Help Needed Please

Hello webmax
There are several serious issues with your PC. The fix will require that you download and use several programs. However, there is one that stands out as the most serious and that is that you are quite far behind with your Microsoft Critical Updates. Until you decide to visit Microsoft and get your PC current, we are fighting a losing battle trying to keep the parasites off your system. However, it would not be wise to attempt doing so until we have your system clean and have added a lot of additional protection.

The first thing I would ask you to do is post a current Hijack This log here, in this string, using the Add Reply feature, so I will be notified.

Hi webmax
Well, we nearly had this whipped, but now we have a VX2 infestation to deal with.
Lets get some protection on that machine before going any further and then we can take care of the rest.
After completing the suggestions below, please post a fresh Hijack This log and we will get on with the cleanup. There is no need to run Ad-Aware or Spybot S&D at this time, just want to be sure they are present.

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  
  Download the new Ad-Aware SE version, and follow the instructions on how to do a full scan: http://forums.spywareinfo.com/index.php?showtopic=11150
  -reboot after using Ad-Aware SE. Also while there get the VX2 plugin and follow the instructions to run it also.
  
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

To protect yourself further:

• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.
  
And also see TonyKlein's good advice
So how did I get infected in the first place?

Hi webmax

Part 1
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

Piatan, Heres the log….. webmax —————————- L2MFIX find log 1.02a These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellScrap] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\s2rslc971f.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{28211924-EC43-4DD0-B60B-CEB76C048528}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{A4DF5659-0801-4A60-9607-1C48695EFDA9}"="Share-to-Web Upload Folder" "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}"="My Logitech Pictures" "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79307-84BE-11CE-9641-444553540000}"="WinZip" "{57C51AF9-DEF7-11D3-A801-00C04F163490}"="Ghost Shell Extension" "{E7F5FE9D-B7E2-4095-95B2-E1DC0320900A}"="" "{20429EA5-F866-44AE-81E1-1CD820EB9E2E}"="" "{3C9C449E-7B8F-48E9-BDCB-2E455CF2CC05}"="" "{8AA1F52B-00D5-4123-B6F4-1EB0A2AA1AF1}"="" "{C2226E36-03F8-4A4C-A13D-5E1674DA9927}"="" "{9070B740-85E4-46CD-BDE2-2C16C95B49B2}"="" "{AA1F8EC4-8D20-4947-B307-EC9AEB1FC06A}"="" "{9AA9F48C-CE10-4A86-B692-2D6EB845DF42}"="" "{6A3435CE-6F03-4EB0-A3A2-366D9CBA229C}"="" "{FE3F521A-663D-4C79-8520-5AC1401293D2}"="" "{B305434E-BB16-47F6-ACF6-B8EAF3FDAAC7}"="" "{A4C54606-E134-473B-A292-1B20358C2F3F}"="" "{8F26C4E3-A07B-46B8-9E9D-F84F475FE766}"="" "{63EDBFE7-1FBA-419C-9818-A64D453C9452}"="" "{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension" "{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension" "{9B81652C-61F5-415C-B6A7-0E539136DB5B}"="" "{46A4E298-68D1-4EDC-81D4-4BE8F9125DDB}"="" "{549F505B-B43B-4D49-89C1-3500D7C036D5}"="" "{949AA20B-DE6A-42D2-B2C0-00E572015EA4}"="" "{A8F01255-0D8B-427B-9F5A-E7CD5D25A62E}"="" "{D39A5766-1CAD-4264-817B-71CAEB83ABF5}"="" "{D1A96EC3-EC52-4924-971E-63F8D8484CC5}"="" "{9F3BC4BF-57B1-4DE2-B4C0-E44CA23C4DFA}"="" "{A22AC782-9672-46DD-BDA7-24DA0F290C68}"="" "{9F652DE5-DB99-4ED4-84A1-CDB45DC319F5}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{E7F5FE9D-B7E2-4095-95B2-E1DC0320900A}] @="" [HKEY_CLASSES_ROOT\CLSID\{E7F5FE9D-B7E2-4095-95B2-E1DC0320900A}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{E7F5FE9D-B7E2-4095-95B2-E1DC0320900A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{E7F5FE9D-B7E2-4095-95B2-E1DC0320900A}\InprocServer32] @="C:\\WINDOWS\\system32\\bEtmeter.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{20429EA5-F866-44AE-81E1-1CD820EB9E2E}] @="" [HKEY_CLASSES_ROOT\CLSID\{20429EA5-F866-44AE-81E1-1CD820EB9E2E}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{20429EA5-F866-44AE-81E1-1CD820EB9E2E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{20429EA5-F866-44AE-81E1-1CD820EB9E2E}\InprocServer32] @="C:\\WINDOWS\\system32\\mwdtctm.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{3C9C449E-7B8F-48E9-BDCB-2E455CF2CC05}] @="" [HKEY_CLASSES_ROOT\CLSID\{3C9C449E-7B8F-48E9-BDCB-2E455CF2CC05}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{3C9C449E-7B8F-48E9-BDCB-2E455CF2CC05}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{3C9C449E-7B8F-48E9-BDCB-2E455CF2CC05}\InprocServer32] @="C:\\WINDOWS\\system32\\uwrv80a.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{8AA1F52B-00D5-4123-B6F4-1EB0A2AA1AF1}] @="" [HKEY_CLASSES_ROOT\CLSID\{8AA1F52B-00D5-4123-B6F4-1EB0A2AA1AF1}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{8AA1F52B-00D5-4123-B6F4-1EB0A2AA1AF1}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{8AA1F52B-00D5-4123-B6F4-1EB0A2AA1AF1}\InprocServer32] @="C:\\WINDOWS\\system32\\cxrtmgr.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{C2226E36-03F8-4A4C-A13D-5E1674DA9927}] @="" [HKEY_CLASSES_ROOT\CLSID\{C2226E36-03F8-4A4C-A13D-5E1674DA9927}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{C2226E36-03F8-4A4C-A13D-5E1674DA9927}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{C2226E36-03F8-4A4C-A13D-5E1674DA9927}\InprocServer32] @="C:\\WINDOWS\\system32\\guard.tmp" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{9070B740-85E4-46CD-BDE2-2C16C95B49B2}] @="" [HKEY_CLASSES_ROOT\CLSID\{9070B740-85E4-46CD-BDE2-2C16C95B49B2}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{9070B740-85E4-46CD-BDE2-2C16C95B49B2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{9070B740-85E4-46CD-BDE2-2C16C95B49B2}\InprocServer32] @="C:\\WINDOWS\\system32\\dprgres.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{AA1F8EC4-8D20-4947-B307-EC9AEB1FC06A}] @="" [HKEY_CLASSES_ROOT\CLSID\{AA1F8EC4-8D20-4947-B307-EC9AEB1FC06A}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{AA1F8EC4-8D20-4947-B307-EC9AEB1FC06A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{AA1F8EC4-8D20-4947-B307-EC9AEB1FC06A}\InprocServer32] @="C:\\WINDOWS\\system32\\guard.tmp" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{9AA9F48C-CE10-4A86-B692-2D6EB845DF42}] @="" [HKEY_CLASSES_ROOT\CLSID\{9AA9F48C-CE10-4A86-B692-2D6EB845DF42}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{9AA9F48C-CE10-4A86-B692-2D6EB845DF42}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{9AA9F48C-CE10-4A86-B692-2D6EB845DF42}\InprocServer32] @="C:\\WINDOWS\\system32\\ohtext32.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{6A3435CE-6F03-4EB0-A3A2-366D9CBA229C}] @="" [HKEY_CLASSES_ROOT\CLSID\{6A3435CE-6F03-4EB0-A3A2-366D9CBA229C}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{6A3435CE-6F03-4EB0-A3A2-366D9CBA229C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{6A3435CE-6F03-4EB0-A3A2-366D9CBA229C}\InprocServer32] @="C:\\WINDOWS\\system32\\cucdll.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{FE3F521A-663D-4C79-8520-5AC1401293D2}] @="" [HKEY_CLASSES_ROOT\CLSID\{FE3F521A-663D-4C79-8520-5AC1401293D2}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{FE3F521A-663D-4C79-8520-5AC1401293D2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{FE3F521A-663D-4C79-8520-5AC1401293D2}\InprocServer32] @="C:\\WINDOWS\\system32\\sttupapi.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{B305434E-BB16-47F6-ACF6-B8EAF3FDAAC7}] @="" [HKEY_CLASSES_ROOT\CLSID\{B305434E-BB16-47F6-ACF6-B8EAF3FDAAC7}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{B305434E-BB16-47F6-ACF6-B8EAF3FDAAC7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{B305434E-BB16-47F6-ACF6-B8EAF3FDAAC7}\InprocServer32] @="C:\\WINDOWS\\system32\\wkpshell.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{A4C54606-E134-473B-A292-1B20358C2F3F}] @="" [HKEY_CLASSES_ROOT\CLSID\{A4C54606-E134-473B-A292-1B20358C2F3F}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{A4C54606-E134-473B-A292-1B20358C2F3F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{A4C54606-E134-473B-A292-1B20358C2F3F}\InprocServer32] @="C:\\WINDOWS\\system32\\guard.tmp" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{8F26C4E3-A07B-46B8-9E9D-F84F475FE766}] @="" [HKEY_CLASSES_ROOT\CLSID\{8F26C4E3-A07B-46B8-9E9D-F84F475FE766}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{8F26C4E3-A07B-46B8-9E9D-F84F475FE766}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{8F26C4E3-A07B-46B8-9E9D-F84F475FE766}\InprocServer32] @="C:\\WINDOWS\\system32\\ms4sdmod.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{63EDBFE7-1FBA-419C-9818-A64D453C9452}] @="" [HKEY_CLASSES_ROOT\CLSID\{63EDBFE7-1FBA-419C-9818-A64D453C9452}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{63EDBFE7-1FBA-419C-9818-A64D453C9452}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{63EDBFE7-1FBA-419C-9818-A64D453C9452}\InprocServer32] @="C:\\WINDOWS\\system32\\amrsvc.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{9B81652C-61F5-415C-B6A7-0E539136DB5B}] @="" [HKEY_CLASSES_ROOT\CLSID\{9B81652C-61F5-415C-B6A7-0E539136DB5B}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{9B81652C-61F5-415C-B6A7-0E539136DB5B}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{9B81652C-61F5-415C-B6A7-0E539136DB5B}\InprocServer32] @="C:\\WINDOWS\\system32\\rvsutils.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{46A4E298-68D1-4EDC-81D4-4BE8F9125DDB}] @="" [HKEY_CLASSES_ROOT\CLSID\{46A4E298-68D1-4EDC-81D4-4BE8F9125DDB}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{46A4E298-68D1-4EDC-81D4-4BE8F9125DDB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{46A4E298-68D1-4EDC-81D4-4BE8F9125DDB}\InprocServer32] @="C:\\WINDOWS\\system32\\rJsapi32.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{549F505B-B43B-4D49-89C1-3500D7C036D5}] @="" [HKEY_CLASSES_ROOT\CLSID\{549F505B-B43B-4D49-89C1-3500D7C036D5}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{549F505B-B43B-4D49-89C1-3500D7C036D5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{549F505B-B43B-4D49-89C1-3500D7C036D5}\InprocServer32] @="C:\\WINDOWS\\system32\\mdisip.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{949AA20B-DE6A-42D2-B2C0-00E572015EA4}] @="" [HKEY_CLASSES_ROOT\CLSID\{949AA20B-DE6A-42D2-B2C0-00E572015EA4}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{949AA20B-DE6A-42D2-B2C0-00E572015EA4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{949AA20B-DE6A-42D2-B2C0-00E572015EA4}\InprocServer32] @="C:\\WINDOWS\\system32\\nwxpnt.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{A8F01255-0D8B-427B-9F5A-E7CD5D25A62E}] @="" [HKEY_CLASSES_ROOT\CLSID\{A8F01255-0D8B-427B-9F5A-E7CD5D25A62E}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{A8F01255-0D8B-427B-9F5A-E7CD5D25A62E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{A8F01255-0D8B-427B-9F5A-E7CD5D25A62E}\InprocServer32] @="C:\\WINDOWS\\system32\\giedit.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{D39A5766-1CAD-4264-817B-71CAEB83ABF5}] @="" [HKEY_CLASSES_ROOT\CLSID\{D39A5766-1CAD-4264-817B-71CAEB83ABF5}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{D39A5766-1CAD-4264-817B-71CAEB83ABF5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{D39A5766-1CAD-4264-817B-71CAEB83ABF5}\InprocServer32] @="C:\\WINDOWS\\system32\\ahcups.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{D1A96EC3-EC52-4924-971E-63F8D8484CC5}] @="" [HKEY_CLASSES_ROOT\CLSID\{D1A96EC3-EC52-4924-971E-63F8D8484CC5}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{D1A96EC3-EC52-4924-971E-63F8D8484CC5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{D1A96EC3-EC52-4924-971E-63F8D8484CC5}\InprocServer32] @="C:\\WINDOWS\\system32\\mxl_qic.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{9F3BC4BF-57B1-4DE2-B4C0-E44CA23C4DFA}] @="" [HKEY_CLASSES_ROOT\CLSID\{9F3BC4BF-57B1-4DE2-B4C0-E44CA23C4DFA}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{9F3BC4BF-57B1-4DE2-B4C0-E44CA23C4DFA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{9F3BC4BF-57B1-4DE2-B4C0-E44CA23C4DFA}\InprocServer32] @="C:\\WINDOWS\\system32\\mgxbde40.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}] @="SpywareGuard.Handler" [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\Implemented Categories] [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}] [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\InprocServer32] @="C:\\Program Files\\SpywareGuard\\spywareguard.dll" "ThreadingModel"="Apartment" [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\ProgID] @="SpywareGuard.Handler" [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\Programmable] [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\TypeLib] @="{F444B57C-5883-4D43-9AB8-344FC5606836}" [HKEY_CLASSES_ROOT\CLSID\{81559C35-8464-49F7-BB0E-07A383BEF910}\VERSION] @="1.1" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{A22AC782-9672-46DD-BDA7-24DA0F290C68}] @="" [HKEY_CLASSES_ROOT\CLSID\{A22AC782-9672-46DD-BDA7-24DA0F290C68}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{A22AC782-9672-46DD-BDA7-24DA0F290C68}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{A22AC782-9672-46DD-BDA7-24DA0F290C68}\InprocServer32] @="C:\\WINDOWS\\system32\\iudounin.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{9F652DE5-DB99-4ED4-84A1-CDB45DC319F5}] @="" [HKEY_CLASSES_ROOT\CLSID\{9F652DE5-DB99-4ED4-84A1-CDB45DC319F5}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{9F652DE5-DB99-4ED4-84A1-CDB45DC319F5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{9F652DE5-DB99-4ED4-84A1-CDB45DC319F5}\InprocServer32] @="C:\\WINDOWS\\system32\\sylfx.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ ahcups.dll Wed 2 Feb 2005 10:12:32 A…. 229,053 223.68 K akcore.dll Tue 25 Jan 2005 21:58:02 A…. 188,416 184.00 K amrsvc.dll Fri 28 Jan 2005 17:46:22 A…. 228,995 223.63 K aoldial.dll Tue 9 Nov 2004 22:21:34 A…. 225,280 220.00 K cucdll.dll Fri 28 Jan 2005 16:41:42 A…. 232,107 226.66 K cxrtmgr.dll Thu 27 Jan 2005 11:05:40 A…. 230,038 224.64 K dacprop.dll Wed 2 Feb 2005 11:11:42 ….. 230,729 225.32 K dprgres.dll Thu 27 Jan 2005 11:18:56 A…. 231,263 225.84 K en4ol1~1.dll Wed 26 Jan 2005 10:18:20 ..S.R 231,299 225.88 K fnj021~1.dll Tue 25 Jan 2005 21:25:08 ..S.R 230,038 224.64 K fp0m03~1.dll Thu 3 Feb 2005 17:45:56 ..S.R 229,202 223.83 K fprs03~1.dll Thu 27 Jan 2005 12:40:58 ..S.R 231,263 225.84 K giedit.dll Fri 28 Jan 2005 23:40:14 A…. 231,695 226.26 K hrj205~1.dll Tue 25 Jan 2005 21:27:20 ..S.R 231,791 226.36 K i6420g~1.dll Tue 25 Jan 2005 16:08:54 ..S.R 230,997 225.58 K iaakeng.dll Thu 27 Jan 2005 20:13:42 A…. 231,263 225.84 K iudounin.dll Thu 3 Feb 2005 17:45:46 A…. 231,481 226.05 K jbeo.dll Thu 3 Feb 2005 17:22:14 A…. 36,352 35.50 K jtno07~1.dll Thu 27 Jan 2005 11:17:40 ..S.R 230,038 224.64 K kdd103.dll Tue 25 Jan 2005 19:02:10 A…. 229,736 224.35 K mdisip.dll Fri 28 Jan 2005 22:25:20 A…. 230,059 224.66 K mgxbde40.dll Thu 3 Feb 2005 17:15:20 A…. 230,729 225.32 K ms4sdmod.dll Fri 28 Jan 2005 17:42:22 A…. 231,263 225.84 K mvcuia32.dll Wed 26 Jan 2005 10:34:38 A…. 230,038 224.64 K mwdtctm.dll Tue 25 Jan 2005 20:43:38 A…. 229,736 224.35 K mxl_qic.dll Wed 2 Feb 2005 10:15:24 A…. 231,481 226.05 K n02u0a~1.dll Tue 25 Jan 2005 21:08:38 ..S.R 229,736 224.35 K nwxpnt.dll Fri 28 Jan 2005 22:45:02 A…. 231,108 225.69 K ohtext32.dll Fri 28 Jan 2005 16:19:10 A…. 231,263 225.84 K r46ule~1.dll Fri 28 Jan 2005 16:40:14 ….. 231,263 225.84 K rjsapi32.dll Fri 28 Jan 2005 22:20:12 A…. 231,108 225.69 K rvsutils.dll Fri 28 Jan 2005 18:02:46 A…. 231,108 225.69 K s2rslc~1.dll Thu 3 Feb 2005 17:15:30 ..S.R 231,062 225.64 K sbsvc.dll Fri 28 Jan 2005 18:09:44 ..S.R 230,059 224.66 K sporder.dll Tue 25 Jan 2005 21:58:28 A…. 8,464 8.27 K sttupapi.dll Fri 28 Jan 2005 17:50:08 A…. 229,843 224.45 K sylfx.dll Fri 4 Feb 2005 8:36:38 ..S.R 231,062 225.64 K uwrv80a.dll Wed 26 Jan 2005 10:18:16 A…. 230,038 224.64 K vwqxg.dll Tue 25 Jan 2005 21:22:16 A…. 98,816 96.50 K 39 items found: 39 files (11 H/S), 0 directories. Total of file sizes: 8,399,272 bytes 8.01 M Locate .tmp files: No matches found. ********************************************************************************** Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is 1484-3FBF Directory of C:\WINDOWS\System32 04/02/2005 08:36 231,062 sylfx.dll 03/02/2005 17:45 229,202 fp0m03d1e.dll 03/02/2005 17:15 231,062 s2rslc971f.dll 28/01/2005 18:09 230,059 sbsvc.dll 27/01/2005 12:40 231,263 fprs0397e.dll 27/01/2005 11:17 230,038 jtno0753e.dll 26/01/2005 10:18 231,299 en4ol1h31.dll 25/01/2005 21:27 231,791 hrj2051oe.dll 25/01/2005 21:25 230,038 fnj0211mg.dll 25/01/2005 21:19 dllcache 25/01/2005 21:08 229,736 n02u0af9ed2.dll 25/01/2005 16:08 230,997 i6420ghoe64c0.dll 28/10/2004 19:10 Microsoft 11 File(s) 2,536,547 bytes 2 Dir(s) 8,347,688,960 bytes free

Part 2
Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

Thanks to LD Tate for all his valued assistance with this project.

Hi webmax,

Download the stand-alone version of CWShredder 2.12
http://cwshredder.net/bin/CWShredder.exe

Then close every window, disconnect from Internet and doubleclick the CWShredder icon on your Desktop.
Click Fix and then Next, let it fix everything it asks about.

Then,

Run HijackThis again and put a check by these.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.upaebitzamebrsdbg.uk/F3G1dntJcg…hfiifwBOp/.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

O2 - BHO: (no name) - {06FEF3EF-AEBF-AF93-BDBF-79750984DFC9} - (no file)

O4 - HKLM\..\Run: [Proc Mags Info Bat] C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Cast heart.exe

O4 - HKCU\..\Run: [helpmode] C:\DOCUME~1\Dave\APPLIC~1\DVDSET~1\Sectfree.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

ALL 016's. They'll come back if needed,

O18 - Filter: text/html - {73C1294B-6645-4386-9F24-B36992AF3F8B} - C:\WINDOWS\System32\jbeo.dll

O18 - Filter: text/plain - {73C1294B-6645-4386-9F24-B36992AF3F8B} - C:\WINDOWS\System32\jbeo.dll

O23 - Service: hzaarimopshg - Unknown - C:\WINDOWS\System32\dmgeapze5.exe (file missing)

Close ALL windows and browsers except HijackThis and click "Fix checked"




Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Search for and delete these files if listed: Unless you know what they are.

C:\Documents and Settings\All Users\Application Data\bibsectprocmags\Cast heart.exe
C:\DOCUME~1\Dave\APPLIC~1\DVDSET~1\Sectfree.
C:\WINDOWS\System32\jbeo.dll


Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Hi webmax,

Close all programs and windows, run Hijack This.
Place a check against the following item:

O2 - BHO: (no name) - {06FEF3EF-AEBF-AF93-BDBF-79750984DFC9} - (no file)

Click on Fix Checked and exit HijackThis.

I have to say, I'm very surprised that some of those entries, in your most recent HJT log were fixed so easily.

Post back a fresh HijackThis log and we'll take another look, just to be on the safe side, before we reset your System Restore.