System Gone Wild

I used to think of myself as a fairly savvy computer user—no more—My most recent problems have kicked my butt.I use Mcafee Virus Scan ,Ad-Aware,Spybot S&D update and run them religiously.Suddenly started getting virus alerts,run scan,no infected files.Then started getting tons of pop-ups and programs installed without my knowledge.When I run programs it says suspicious files removed,or will be removed on reboot.I reboot and it starts all over again.I've had to start this post 3 times because I get so many pop-ups I can't finish.Please help!!!

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

L2MFIX find log 1.02b These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Paths] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\j8p0li7m18.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{C2B9D38E-6E1A-4E7E-A341-D1D05FA6C4F3}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip" "{c7745760-8ead-11ce-b750-02608ca5202c}"="IomegaWare Shell Extension" "{c7745761-8ead-11ce-b750-02608ca5202c}"="IomegaWare Shell Extension" "{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes" "{4CE50513-7B57-46F3-8BED-5E5646574946}"="" "{FA010552-4A27-4cb1-A1BB-3E2D697F1639}"="SpySubtract Shell Extension" "{F0DF4C7D-BD0C-45DD-8740-124E90AC758F}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{4CE50513-7B57-46F3-8BED-5E5646574946}] @="" [HKEY_CLASSES_ROOT\CLSID\{4CE50513-7B57-46F3-8BED-5E5646574946}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{4CE50513-7B57-46F3-8BED-5E5646574946}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{4CE50513-7B57-46F3-8BED-5E5646574946}\InprocServer32] @="C:\\WINDOWS\\system32\\guard.tmp" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{F0DF4C7D-BD0C-45DD-8740-124E90AC758F}] @="" [HKEY_CLASSES_ROOT\CLSID\{F0DF4C7D-BD0C-45DD-8740-124E90AC758F}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{F0DF4C7D-BD0C-45DD-8740-124E90AC758F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{F0DF4C7D-BD0C-45DD-8740-124E90AC758F}\InprocServer32] @="C:\\WINDOWS\\system32\\sxbcsp.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ 2b3fsk0h.dll Thu Jan 27 2005 11:33:28a A…. 73,728 72.00 K ala32.dll Thu Dec 9 2004 12:33:58p A…. 90,112 88.00 K apexreg.dll Thu Dec 9 2004 6:18:04p A…. 1,646,592 1.57 M aunbho.dll Sat Mar 5 2005 11:19:02a A…. 43,496 42.48 K aunps.dll Sat Mar 5 2005 11:19:02a A…. 25,600 25.00 K browseui.dll Thu Jan 27 2005 12:13:16p A…. 1,016,832 993.00 K cdfview.dll Thu Jan 27 2005 12:13:16p A…. 151,040 147.50 K dnn201~1.dll Sat Mar 5 2005 11:31:28a ..S.R 229,329 223.95 K dnr801~1.dll Sat Mar 5 2005 10:27:18p ….. 231,938 226.50 K docore.dll Thu Mar 3 2005 4:20:34p A…. 151,552 148.00 K dolsp.dll Thu Mar 3 2005 4:20:36p A…. 139,264 136.00 K dosync.dll Thu Mar 3 2005 4:20:34p A…. 114,688 112.00 K ennsl1~1.dll Sun Mar 6 2005 10:57:16a ..S.R 228,919 223.55 K g6400g~1.dll Sat Mar 5 2005 11:32:28a ..S.R 229,078 223.71 K h24mlc~1.dll Sat Mar 5 2005 10:08:30a ..S.R 231,463 226.04 K iepeers.dll Thu Jan 27 2005 12:13:16p A…. 249,856 244.00 K inseng.dll Thu Jan 27 2005 12:13:16p A…. 96,256 94.00 K j8p0li~1.dll Sun Mar 6 2005 10:20:26a A…. 229,341 223.96 K jt8u07~1.dll Fri Mar 4 2005 4:10:46a ..S.R 230,912 225.50 K k0440a~1.dll Fri Mar 4 2005 7:08:54p ..S.R 231,023 225.61 K k8pmli~1.dll Sat Mar 5 2005 10:28:18p ..S.R 231,047 225.63 K kt08l7~1.dll Sat Mar 5 2005 6:35:06p A…. 230,885 225.47 K l22s0c~1.dll Sun Mar 6 2005 1:58:24a ..S.R 231,938 226.50 K lnzhw.dll Sun Mar 6 2005 12:11:26a A…. 98,816 96.50 K mesip32.dll Thu Mar 3 2005 2:47:24p A…. 229,736 224.35 K mshtml.dll Thu Jan 27 2005 12:13:18p A…. 3,006,976 2.87 M mvp0l9~1.dll Sat Mar 5 2005 7:09:02p ..S.R 229,078 223.71 K n02u0a~1.dll Sun Mar 6 2005 12:19:06p ..S.R 229,341 223.96 K ole32.dll Fri Jan 14 2005 3:55:50a A…. 1,285,120 1.22 M olecli32.dll Fri Jan 14 2005 3:55:50a A…. 74,752 73.00 K olecnv32.dll Fri Jan 14 2005 3:55:50a A…. 37,888 37.00 K p4p60e~1.dll Sun Mar 6 2005 9:42:12a ..S.R 228,919 223.55 K q4nu0e~1.dll Sat Mar 5 2005 12:43:24p ..S.R 229,078 223.71 K q8860i~1.dll Sat Mar 5 2005 6:32:30p ..S.R 229,766 224.38 K rpcss.dll Fri Jan 14 2005 3:55:50a A…. 395,776 386.50 K shdocvw.dll Thu Jan 27 2005 12:13:18p A…. 1,483,264 1.41 M shell32.dll Tue Dec 21 2004 3:49:36p A…. 8,450,048 8.06 M shlwapi.dll Thu Jan 27 2005 12:13:18p A…. 473,600 462.50 K srvsvc.dll Tue Dec 7 2004 2:32:34p A…. 96,768 94.50 K sxbcsp.dll Sat Mar 5 2005 9:12:54a ..S.R 230,583 225.18 K szcpack.dll Sat Mar 5 2005 1:15:16p A…. 229,078 223.71 K urlmon.dll Thu Jan 27 2005 12:13:18p A…. 607,744 593.50 K wininet.dll Thu Jan 27 2005 12:13:18p A…. 656,896 641.50 K 43 items found: 43 files (14 H/S), 0 directories. Total of file sizes: 24,838,116 bytes 23.68 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ guard.tmp Mon Mar 7 2005 12:43:20a ….. 229,341 223.96 K 1 item found: 1 file, 0 directories. Total of file sizes: 229,341 bytes 223.96 K ********************************************************************************** Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is A885-F063 Directory of C:\WINDOWS\System32 03/06/2005 12:19 PM 229,341 n02u0af9ed2.dll 03/06/2005 10:57 AM 228,919 ennsl1571.dll 03/06/2005 09:42 AM 228,919 p4p60e7seh.dll 03/06/2005 01:58 AM 231,938 l22s0cf7ef2.dll 03/05/2005 10:28 PM 231,047 k8pmli7118.dll 03/05/2005 07:09 PM 229,078 mvp0l97m1.dll 03/05/2005 06:32 PM 229,766 q8860ilse8q60.dll 03/05/2005 12:43 PM 229,078 q4nu0e59eh.dll 03/05/2005 11:32 AM 229,078 g6400ghme64a0.dll 03/05/2005 11:31 AM 229,329 dnn2015oe.dll 03/05/2005 10:08 AM 231,463 h24mlch11f4.dll 03/05/2005 09:12 AM 230,583 sxbcsp.dll 03/04/2005 07:08 PM 231,023 k0440ahqed4e0.dll 03/04/2005 04:10 AM 230,912 jt8u07l9e.dll 03/04/2005 04:03 AM DLLCACHE 11/30/2003 11:20 AM 1,020 Xej7.a7q 03/06/2002 11:51 PM Microsoft 15 File(s) 3,221,494 bytes 2 Dir(s) 55,176,278,016 bytes free

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

L2Mfix 1.02b Running From: C:\Documents and Settings\[removed]\Desktop\l2mfix RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Denying C access for really "Everyone" - adding new ACCESS DENY entry Registry Permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (CI) DENY –C——- Everyone (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Setting up for Reboot Starting Reboot! C:\Documents and Settings\Terry\Desktop\l2mfix System Rebooted! Running From: C:\Documents and Settings\[removed]\Desktop\l2mfix killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 [removed] Killing PID 1284 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 [removed] Error, Cannot find a process with an image name of rundll32.exe Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! Backing Up: C:\WINDOWS\system32\dn8q01l5e.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\dnn2015oe.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\dnr8019ue.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\ennsl1571.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\fp4603hse.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\g6400ghme64a0.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\h24mlch11f4.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\jt8u07l9e.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\k0440ahqed4e0.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\k080lalm1dqa.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\k8pmli7118.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\kt08l7du1.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\l22s0cf7ef2.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\m8640ijqe8oe0.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MESIP32.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\mvp0l97m1.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\p4p60e7seh.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\q4nu0e59eh.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\q8860ilse8q60.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\r0r6la9s1d.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\sxbcsp.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\SZCPACK.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\guard.tmp 1 file(s) copied. deleting: C:\WINDOWS\system32\dn8q01l5e.dll Successfully Deleted: C:\WINDOWS\system32\dn8q01l5e.dll deleting: C:\WINDOWS\system32\dnn2015oe.dll Successfully Deleted: C:\WINDOWS\system32\dnn2015oe.dll deleting: C:\WINDOWS\system32\dnr8019ue.dll Successfully Deleted: C:\WINDOWS\system32\dnr8019ue.dll deleting: C:\WINDOWS\system32\ennsl1571.dll Successfully Deleted: C:\WINDOWS\system32\ennsl1571.dll deleting: C:\WINDOWS\system32\fp4603hse.dll Successfully Deleted: C:\WINDOWS\system32\fp4603hse.dll deleting: C:\WINDOWS\system32\g6400ghme64a0.dll Successfully Deleted: C:\WINDOWS\system32\g6400ghme64a0.dll deleting: C:\WINDOWS\system32\h24mlch11f4.dll Successfully Deleted: C:\WINDOWS\system32\h24mlch11f4.dll deleting: C:\WINDOWS\system32\jt8u07l9e.dll Successfully Deleted: C:\WINDOWS\system32\jt8u07l9e.dll deleting: C:\WINDOWS\system32\k0440ahqed4e0.dll Successfully Deleted: C:\WINDOWS\system32\k0440ahqed4e0.dll deleting: C:\WINDOWS\system32\k080lalm1dqa.dll Successfully Deleted: C:\WINDOWS\system32\k080lalm1dqa.dll deleting: C:\WINDOWS\system32\k8pmli7118.dll Successfully Deleted: C:\WINDOWS\system32\k8pmli7118.dll deleting: C:\WINDOWS\system32\kt08l7du1.dll Successfully Deleted: C:\WINDOWS\system32\kt08l7du1.dll deleting: C:\WINDOWS\system32\l22s0cf7ef2.dll Successfully Deleted: C:\WINDOWS\system32\l22s0cf7ef2.dll deleting: C:\WINDOWS\system32\m8640ijqe8oe0.dll Successfully Deleted: C:\WINDOWS\system32\m8640ijqe8oe0.dll deleting: C:\WINDOWS\system32\MESIP32.DLL Successfully Deleted: C:\WINDOWS\system32\MESIP32.DLL deleting: C:\WINDOWS\system32\mvp0l97m1.dll Successfully Deleted: C:\WINDOWS\system32\mvp0l97m1.dll deleting: C:\WINDOWS\system32\p4p60e7seh.dll Successfully Deleted: C:\WINDOWS\system32\p4p60e7seh.dll deleting: C:\WINDOWS\system32\q4nu0e59eh.dll Successfully Deleted: C:\WINDOWS\system32\q4nu0e59eh.dll deleting: C:\WINDOWS\system32\q8860ilse8q60.dll Successfully Deleted: C:\WINDOWS\system32\q8860ilse8q60.dll deleting: C:\WINDOWS\system32\r0r6la9s1d.dll Successfully Deleted: C:\WINDOWS\system32\r0r6la9s1d.dll deleting: C:\WINDOWS\system32\sxbcsp.dll Successfully Deleted: C:\WINDOWS\system32\sxbcsp.dll deleting: C:\WINDOWS\system32\SZCPACK.DLL Successfully Deleted: C:\WINDOWS\system32\SZCPACK.DLL deleting: C:\WINDOWS\system32\guard.tmp Successfully Deleted: C:\WINDOWS\system32\guard.tmp Desktop.ini sucessfully removed Zipping up files for submission: adding: dn8q01l5e.dll (184 bytes security) (deflated 5%) adding: dnn2015oe.dll (184 bytes security) (deflated 5%) adding: dnr8019ue.dll (184 bytes security) (deflated 6%) adding: ennsl1571.dll (184 bytes security) (deflated 4%) adding: fp4603hse.dll (184 bytes security) (deflated 5%) adding: g6400ghme64a0.dll (184 bytes security) (deflated 4%) adding: h24mlch11f4.dll (184 bytes security) (deflated 5%) adding: jt8u07l9e.dll (184 bytes security) (deflated 5%) adding: k0440ahqed4e0.dll (184 bytes security) (deflated 5%) adding: k080lalm1dqa.dll (184 bytes security) (deflated 5%) adding: k8pmli7118.dll (184 bytes security) (deflated 5%) adding: kt08l7du1.dll (184 bytes security) (deflated 5%) adding: l22s0cf7ef2.dll (184 bytes security) (deflated 6%) adding: m8640ijqe8oe0.dll (184 bytes security) (deflated 5%) adding: MESIP32.DLL (184 bytes security) (deflated 5%) adding: mvp0l97m1.dll (184 bytes security) (deflated 4%) adding: p4p60e7seh.dll (184 bytes security) (deflated 4%) adding: q4nu0e59eh.dll (184 bytes security) (deflated 4%) adding: q8860ilse8q60.dll (184 bytes security) (deflated 5%) adding: r0r6la9s1d.dll (184 bytes security) (deflated 5%) adding: sxbcsp.dll (184 bytes security) (deflated 5%) adding: SZCPACK.DLL (184 bytes security) (deflated 4%) adding: guard.tmp (184 bytes security) (deflated 5%) adding: clear.reg (184 bytes security) (deflated 37%) adding: echo.reg (184 bytes security) (deflated 8%) adding: desktop.ini (184 bytes security) (deflated 13%) adding: direct.txt (184 bytes security) (stored 0%) adding: lo2.txt (184 bytes security) (deflated 82%) adding: readme.txt (184 bytes security) (deflated 49%) adding: report.txt (184 bytes security) (deflated 66%) adding: test.txt (184 bytes security) (deflated 76%) adding: test2.txt (184 bytes security) (deflated 17%) adding: test3.txt (184 bytes security) (deflated 17%) adding: test5.txt (184 bytes security) (deflated 17%) adding: xfind.txt (184 bytes security) (deflated 70%) adding: backregs/4CE50513-7B57-46F3-8BED-5E5646574946.reg (184 bytes security) (deflated 70%) adding: backregs/F0DF4C7D-BD0C-45DD-8740-124E90AC758F.reg (184 bytes security) (deflated 70%) adding: backregs/shell.reg (184 bytes security) (deflated 74%) Restoring Registry Permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Revoking access for really "Everyone" Registry permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrators … successful deleting local copy: dn8q01l5e.dll deleting local copy: dnn2015oe.dll deleting local copy: dnr8019ue.dll deleting local copy: ennsl1571.dll deleting local copy: fp4603hse.dll deleting local copy: g6400ghme64a0.dll deleting local copy: h24mlch11f4.dll deleting local copy: jt8u07l9e.dll deleting local copy: k0440ahqed4e0.dll deleting local copy: k080lalm1dqa.dll deleting local copy: k8pmli7118.dll deleting local copy: kt08l7du1.dll deleting local copy: l22s0cf7ef2.dll deleting local copy: m8640ijqe8oe0.dll deleting local copy: MESIP32.DLL deleting local copy: mvp0l97m1.dll deleting local copy: p4p60e7seh.dll deleting local copy: q4nu0e59eh.dll deleting local copy: q8860ilse8q60.dll deleting local copy: r0r6la9s1d.dll deleting local copy: sxbcsp.dll deleting local copy: SZCPACK.DLL deleting local copy: guard.tmp The following Is the Current Export of the Winlogon notify key: **************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 The following are the files found: **************************************************************************** C:\WINDOWS\system32\dn8q01l5e.dll C:\WINDOWS\system32\dnn2015oe.dll C:\WINDOWS\system32\dnr8019ue.dll C:\WINDOWS\system32\ennsl1571.dll C:\WINDOWS\system32\fp4603hse.dll C:\WINDOWS\system32\g6400ghme64a0.dll C:\WINDOWS\system32\h24mlch11f4.dll C:\WINDOWS\system32\jt8u07l9e.dll C:\WINDOWS\system32\k0440ahqed4e0.dll C:\WINDOWS\system32\k080lalm1dqa.dll C:\WINDOWS\system32\k8pmli7118.dll C:\WINDOWS\system32\kt08l7du1.dll C:\WINDOWS\system32\l22s0cf7ef2.dll C:\WINDOWS\system32\m8640ijqe8oe0.dll C:\WINDOWS\system32\MESIP32.DLL C:\WINDOWS\system32\mvp0l97m1.dll C:\WINDOWS\system32\p4p60e7seh.dll C:\WINDOWS\system32\q4nu0e59eh.dll C:\WINDOWS\system32\q8860ilse8q60.dll C:\WINDOWS\system32\r0r6la9s1d.dll C:\WINDOWS\system32\sxbcsp.dll C:\WINDOWS\system32\SZCPACK.DLL C:\WINDOWS\system32\guard.tmp Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. **************************************************************************** REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{4CE50513-7B57-46F3-8BED-5E5646574946}"=- "{F0DF4C7D-BD0C-45DD-8740-124E90AC758F}"=- [-HKEY_CLASSES_ROOT\CLSID\{4CE50513-7B57-46F3-8BED-5E5646574946}] [-HKEY_CLASSES_ROOT\CLSID\{F0DF4C7D-BD0C-45DD-8740-124E90AC758F}] REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{C2B9D38E-6E1A-4E7E-A341-D1D05FA6C4F3}"=- "SV1"="" **************************************************************************** Desktop.ini Contents: **************************************************************************** [.ShellClassInfo] CLSID={645FF040-5081-101B-9F08-00AA002F954E} {C2B9D38E-6E1A-4E7E-A341-D1D05FA6C4F3} DS3 200 **************************************************************************** 

Now post a hijackthis log

You should uninstall weatherbug, it is known adware.

You are using an out of date version of hijackthis. Download the most recent version here.

http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Run another hijackthis scan. Place a check next to the following entries, then close all other windows and click the fix button.

R3 - Default URLSearchHook is missing
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://wdownload.weatherbug.com/minibug/tr…uginstaller.cab
O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0008.exe
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

Then reboot into safe mode and delete these folders.
C:\WINDOWS\isrvs

You may have to enable hidden files to find all the files.

Then reboot and run another hijackthis scan and post your new log here.

Have hijackthis fix this entry.
O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0008.exe

Then reboot and lets see one more log.

Your log looks good.

How are things on your end?

You should read this to help prevent future problems.

So how did I get infected

Everythings great on my end so far–i got my old system back–thanks so much for all your help!

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.