POP UPS HAVE TAKEN OVER!

Hello fatherkevin and welcome to TomCoyote.

Download this tool : LQfix.zip

• Unzip it to your Desktop.
• Don't use it yet!

IMPORTANT! Reboot the computer into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').

Doubleclick LQfix.bat that you saved on your desktop before.A dos window will open and close again, that is normal.
Reboot into normal mode and download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

L2MFIX find log 1.03b These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\kcdcr.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{AF787ED7-4553-3946-D084-2E7A46EA6F42}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{c7745760-8ead-11ce-b750-02608ca5202c}"="IomegaWare Shell Extension" "{c7745761-8ead-11ce-b750-02608ca5202c}"="IomegaWare Shell Extension" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{52B87208-9CCF-42C9-B88E-069281105805}"="Trojan Remover Shell Extension" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{248A7248-2D62-4B49-ACFB-0C1B70C04F0D}"="PKZIP Shell Extension" "{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler" "{acb4a560-3606-11d3-aef4-00104bd0f92d}"="KodakShellExtension" "{D0F20C9B-4AB9-45E4-9757-153139A7A5E7}"="" "{2DCF0378-FA5C-4D7C-A199-3319C20378D9}"="" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{D0F20C9B-4AB9-45E4-9757-153139A7A5E7}] @="" [HKEY_CLASSES_ROOT\CLSID\{D0F20C9B-4AB9-45E4-9757-153139A7A5E7}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{D0F20C9B-4AB9-45E4-9757-153139A7A5E7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{D0F20C9B-4AB9-45E4-9757-153139A7A5E7}\InprocServer32] @="C:\\WINDOWS\\system32\\BOMSM168(3).dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{2DCF0378-FA5C-4D7C-A199-3319C20378D9}] @="" [HKEY_CLASSES_ROOT\CLSID\{2DCF0378-FA5C-4D7C-A199-3319C20378D9}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{2DCF0378-FA5C-4D7C-A199-3319C20378D9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{2DCF0378-FA5C-4D7C-A199-3319C20378D9}\InprocServer32] @="C:\\WINDOWS\\system32\\kedbu.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ aunps2.dll Thu Jun 23 2005 3:29:50p A…. 24,576 24.00 K browseui.dll Sat Jul 2 2005 10:11:28p A…. 1,019,904 996.00 K ccmdlg32.dll Sun Jun 19 2005 6:51:34a ..S.R 417,792 408.00 K cdfview.dll Sat Jul 2 2005 10:11:28p A…. 151,040 147.50 K cdm.dll Thu May 26 2005 4:16:24a A…. 75,544 73.77 K crdjm.dll Mon Aug 15 2005 4:54:20p A…. 98,816 96.50 K hhsetup.dll Thu May 26 2005 10:04:28p A…. 41,472 40.50 K icm32.dll Tue Jun 28 2005 9:46:00p A…. 254,976 249.00 K iepeers.dll Sat Jul 2 2005 10:11:28p A…. 251,392 245.50 K inseng.dll Sat Jul 2 2005 10:11:28p A…. 96,256 94.00 K itircl.dll Thu May 26 2005 10:04:28p A…. 155,136 151.50 K itss.dll Thu May 26 2005 10:04:28p A…. 137,216 134.00 K iuengine.dll Thu May 26 2005 4:16:24a A…. 198,424 193.77 K kcdcr.dll Thu Jul 28 2005 4:41:06p ..S.R 417,792 408.00 K kedbu.dll Mon Aug 15 2005 10:17:06p ..S.R 417,792 408.00 K kerberos.dll Wed Jun 15 2005 1:49:30p A…. 295,936 289.00 K kesys32.dll Mon Jun 20 2005 6:51:14a ..S.R 417,792 408.00 K kudbr.dll Thu Jul 28 2005 4:41:12p ..S.R 417,792 408.00 K ljasrv.dll Mon Jun 20 2005 10:47:02a ..S.R 417,792 408.00 K mlicda.dll Thu Jul 28 2005 3:18:52p ..S.R 417,792 408.00 K mscms.dll Tue Jun 28 2005 9:46:00p A…. 74,240 72.50 K mshtml.dll Tue Jul 19 2005 10:00:30p A…. 3,014,144 2.87 M mshtmled.dll Sat Jul 2 2005 10:11:30p A…. 448,512 438.00 K msrating.dll Sat Jul 2 2005 10:11:30p A…. 146,432 143.00 K myimusic.dll Mon Aug 15 2005 6:12:14p ..S.R 417,792 408.00 K nsg44.dll Wed Jul 6 2005 1:45:18p A…. 151,552 148.00 K nsqe.dll Wed Jul 6 2005 1:45:18p A…. 151,552 148.00 K pngfilt.dll Sat Jul 2 2005 10:11:30p A…. 39,424 38.50 K s32evnt1.dll Thu Jul 28 2005 2:52:18p A…. 91,856 89.70 K shdocvw.dll Sat Jul 2 2005 10:11:30p A…. 1,483,776 1.41 M shlwapi.dll Sat Jul 2 2005 10:11:30p A…. 473,600 462.50 K supdate.dll Tue Aug 9 2005 2:39:50a A…. 29,184 28.50 K tapisrv.dll Fri Jul 8 2005 12:27:56p A…. 249,344 243.50 K umpnpmgr.dll Wed Jun 29 2005 10:02:40p A…. 118,272 115.50 K urlmon.dll Sat Jul 2 2005 10:11:30p A…. 607,744 593.50 K wininet.dll Sat Jul 2 2005 10:11:30p A…. 658,432 643.00 K wuapi.dll Thu May 26 2005 4:16:30a A…. 465,176 454.27 K wuaueng.dll Thu May 26 2005 4:16:30a A…. 1,343,768 1.28 M wuaueng1.dll Thu May 26 2005 4:16:30a A…. 194,328 189.77 K wucltui.dll Thu May 26 2005 4:16:30a A…. 127,256 124.27 K wups.dll Thu May 26 2005 4:16:30a A…. 41,240 40.27 K wups2.dll Thu May 26 2005 4:16:30a A…. 18,200 17.77 K wuweb.dll Thu May 26 2005 4:19:32a A…. 173,536 169.47 K 43 items found: 43 files (8 H/S), 0 directories. Total of file sizes: 16,244,592 bytes 15.49 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ guard.tmp Sun Jun 19 2005 10:17:28p ..S.R 417,792 408.00 K 1 item found: 1 file (1 H/S), 0 directories. Total of file sizes: 417,792 bytes 408.00 K ********************************************************************************** Directory Listing of system files: Volume in drive C is Local Disk Volume Serial Number is F8CD-1907 Directory of C:\WINDOWS\System32 08/15/2005 10:17 PM 417,792 kedbu.dll 08/15/2005 06:12 PM 417,792 MYIMUSIC.DLL 08/11/2005 08:57 AM 82,432 eetu.exe 08/10/2005 12:31 PM dllcache 08/01/2005 08:57 AM 417,792 BOMSM168(3).dll 07/28/2005 04:41 PM 417,792 kudbr.dll 07/28/2005 04:41 PM 417,792 kcdcr.dll 07/28/2005 03:18 PM 417,792 mlicda.dll 06/20/2005 10:47 AM 417,792 ljasrv.dll 06/20/2005 06:51 AM 417,792 kesys32.dll 06/19/2005 10:17 PM 417,792 guard.tmp 06/19/2005 06:51 AM 417,792 ccmdlg32.dll 06/04/2004 08:34 PM 1,188 Pwbm74i.k9s 05/31/2004 07:33 AM 1,188 GnsDk.b90 05/28/2004 06:45 PM 1,188 IpuFld.016 05/26/2004 09:10 PM 1,188 Yek8.b76 04/16/2004 07:20 AM 1,020 UbgrYPnp.exd 04/15/2004 08:48 PM 1,104 Zgl8.du7 05/25/2003 07:04 PM 32 {671C9379-6AE4-449C-B011-F794FA5CC504}.dat 05/25/2003 06:45 PM Microsoft 18 File(s) 4,267,260 bytes 2 Dir(s) 38,353,502,208 bytes free

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!

Note : Once the pc has restarted if a log does not appear or the icons didn't dissappear, run the "second.bat" located inside the L2mfix folder.

I couldn't find much information on this file. Do you know what it is? Right click on the file and choose 'properties', than on the 'version' tab note what the "Company" and "Version" are.

C:\WINDOWS\System32\win32cfg\win32cfg.exe

If you still are unsure what this file is, please submit it to the following link for a scan.
http://virusscan.jotti.org/

Let me know what you find out about it.


Step 1
Open HijackThis, run a scan, then check the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/…://my.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [uhfcjd] c:\windows\system32\uhfcjd.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\ojbojq.exe reg_run

With all other programs and browsers closed, click fix checked.


Step 2
Please download the trial version of Ewido security suite.

Install and Update Ewido:

• Download and install Ewido security suite.
• When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
• Launch Ewido, there should be an icon on your desktop for it to double-click.
  • The program will prompt you to update, click the OK button.
  • The program will now go to the main screen.
• You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Click on Start Update.
  • The update will start and a progress bar will show the updates being installed.
• Once the updates are installed, close the program.

Scanning With Ewido:

• Reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
• Launch Ewido again.
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • While the scan is in progress you will be prompted to clean files, click OK
  • When it asks if you want to clean the first file, put a check in the lower left corner of the boxes that say "Perform action on all infections"and "Create encrypted backup" then choose clean and click OK.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
• Now close ewido security suite.

Step 3
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.

They have infected the pc they get to use with spyware from music and game downloads. Will this process work on that pc as well, or should I submit a help request?

To avoid confusion, we like to have each computer in a seperate topic.

I need you to disable SpywareGuard as it will interfere with the registry changes we will need to do.

• Right click the running icon of Spywareguard, it will open the program.
• Then go to Menu, file, exit.
• Then confirm the program is closed.

Open HijackThis, run a scan, then check the following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

With all other programs and browsers closed, click fix checked.

• Download WinPFind
• Right Click the Zip Folder and Select "Extract All"
• Extract it somewhere you will remember like the Desktop
• Dont do anything with it yet!

Download Track qoo

• Save it somewhere you will remember like the Desktop

Reboot into Safe Mode
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Doubleclick WinPFind.exe

• Click "Start Scan"
• It will scan the entire System, so please be patient!
• Once the Scan is Complete
• Go to the WinPFind folder
• Locate WinPFind.txt
• Place those results in the next post!

Reboot back to Normal Mode!

Double Click on "Track qoo.vbs"

Note - If your Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless!

Wait a few seconds and a notepad page will pop up, Copy & Paste those results and place them in the next post along with the results of WinPFind!


After posting the two requested logs, please post the results of the Ewido log from the previous fix in a seperate reply. I forgot to have you do that the last time.

——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 11:28:15 AM, 8/17/2005 + Report-Checksum: 392C6E25 + Scan result: HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{5886A6DC-AAF4-45E9-979A-8E5E6DEE30E7} -> Spyware.TotalVelocity : Cleaned with backup HKLM\SOFTWARE\Mvu -> Spyware.Delfin : Cleaned with backup C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\6YNUJT3G\!update-2264[1].0000 -> Spyware.MediaTickets : Cleaned with backup C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\HFVB9AWX\!update-2234[1].0000 -> TrojanDownloader.PurityScan.y : Cleaned with backup :mozilla.8:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.15:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.24:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.25:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.26:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.27:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.28:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.29:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.30:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.31:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.32:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.47:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.60:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.61:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.63:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup :mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\2twevuk5.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup C:\Documents and Settings\Owner\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/BOMSM168(3).dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/ccmdlg32.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/kcdcr.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/kesys32.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/krdtat.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/kudbr.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/ljasrv.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/mlicda.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/MYIMUSIC.DLL -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/vwdex.dll -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Desktop\l2mfix\backup.zip/guard.tmp -> Spyware.Look2Me : Error during cleaning C:\Documents and Settings\Owner\Local Settings\Temp\329042_1028_220_2788_62.41.tmp -> Spyware.EliteBar : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\459796_1028_220_2308_62.41.tmp -> Spyware.EliteBar : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\460376_1028_220_1924_62.41.tmp -> Spyware.EliteBar : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\525650_1028_220_672_62.41.tmp -> Spyware.EliteBar : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\525650_1028_220_672_62.41.tmp1 -> Spyware.EliteBar : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\66894_1028_220_3328_62.41.tmp -> Spyware.EliteBar : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\b.com -> TrojanDropper.Agent.pb : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@advertising[1].txt -> Spyware.Cookie.Advertising : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\owner@qksrv[2].txt -> Spyware.Cookie.Qksrv : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Advertising : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temp\uninstall.exe -> Spyware.EliteBar : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NSF4JYJ\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6NSF4JYJ\AppWrap[2].exe -> TrojanDropper.Agent.pb : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WI0YZBFT\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WI0YZBFT\AppWrap[2].exe -> TrojanDropper.Agent.pb : Cleaned with backup C:\Documents and Settings\Owner\My Documents\BUSN 575 Concept to Market\Mod 10 Final Touches\zangoinstaller.exe -> Spyware.180Solutions : Cleaned with backup C:\Program Files\backup-20050731-134415-901.dll -> Spyware.Look2Me : Cleaned with backup C:\Program Files\Microsoft AntiSpyware\Quarantine\5D7B9CB3-01F6-456C-A8BB-118F07\61B6E3CC-0BA2-4903-B7DE-7840E3 -> Spyware.VirtualBouncer : Cleaned with backup C:\Program Files\rdso\eetu(2)(2).exe -> TrojanDownloader.PurityScan.y : Cleaned with backup C:\Program Files\rdso\eetu.exe -> Spyware.MediaTickets : Cleaned with backup C:\Program Files\sdf.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\Program Files\Spyware Killer\backup\1470828.cxt/C.cxz//WINDOWS/system32/AlxRes.dll.bak -> Spyware.Alexa : Error during cleaning C:\Program Files\Spyware Killer\backup\1470828.cxt/C.cxz//Documents and Settings/Owner/Local Settings/Temp/~513309.tmp -> Spyware.Wintools : Error during cleaning C:\Program Files\Spyware Killer\backup\1470828.cxt/C.cxz//Documents and Settings/Owner/Local Settings/Temp/~910260.tmp -> Spyware.Wintools : Error during cleaning C:\SaveInstCm.exe -> Adware.SaveNow : Cleaned with backup C:\WINDOWS\Downloaded Program Files\CONFLICT.3\HDPlugin1015.dll -> Spyware.Browsertoolbar : Cleaned with backup C:\WINDOWS\icont.exe -> Spyware.AdURL : Cleaned with backup C:\WINDOWS\ru.exe -> Spyware.PurityScan : Cleaned with backup C:\WINDOWS\system\UpdInst.exe -> Spyware.Look2Me : Cleaned with backup C:\WINDOWS\system32\AUNPS2.dll -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\61H6TP0U\!update-2264[1].0000 -> Spyware.MediaTickets : Cleaned with backup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FHAZF16U\!update-2224[1].0000 -> TrojanDownloader.PurityScan.y : Cleaned with backup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\FHAZF16U\!update-2274[1].0000 -> Spyware.MediaTickets : Cleaned with backup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G0QTUUVK\!update-2114[1].0000 -> Spyware.Look2Me : Cleaned with backup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G0QTUUVK\!update-2154[1].0000 -> Spyware.Look2Me : Cleaned with backup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\G0QTUUVK\!update-2214[1].0000 -> TrojanDownloader.PurityScan.y : Cleaned with backup C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\XIW57F6T\!update-2234[1].0000 -> TrojanDownloader.PurityScan.y : Cleaned with backup C:\WINDOWS\system32\crdjmf.exe -> Spyware.Adstart : Cleaned with backup C:\WINDOWS\system32\cxtpls_loader.exe -> TrojanDownloader.Apropo.ae : Cleaned with backup C:\WINDOWS\system32\dist006.exe -> TrojanDownloader.Agent.qg : Cleaned with backup C:\WINDOWS\system32\eetu.exe -> Spyware.PurityScan : Cleaned with backup C:\WINDOWS\system32\exp -> TrojanDownloader.Small.abd : Cleaned with backup C:\WINDOWS\system32\InstallAPS.exe -> TrojanDropper.Agent.lu : Cleaned with backup C:\WINDOWS\system32\mseggo.gif -> TrojanSpy.Delf.dx : Cleaned with backup C:\WINDOWS\system32\nsg44.dll -> Spyware.HotSearchBar : Cleaned with backup C:\WINDOWS\system32\nsqE.dll -> Spyware.HotSearchBar : Cleaned with backup C:\WINDOWS\system32\s030109.Stub.exe -> TrojanDropper.Agent.hl : Cleaned with backup C:\WINDOWS\system32\seedcorn_2_215.exe -> TrojanDropper.Agent.hl : Cleaned with backup C:\WINDOWS\system32\smsca.exe -> TrojanDropper.Agent.hl : Cleaned with backup C:\WINDOWS\system32\SSK39.exe -> TrojanDropper.Small.qn : Cleaned with backup C:\WINDOWS\system32\supdate.dll -> TrojanDownloader.Qoologic.p : Cleaned with backup C:\WINDOWS\system32\VB3.exe -> TrojanDropper.Agent.hl : Cleaned with backup C:\WINDOWS\Temp\!update.exe -> Spyware.MediaTickets : Cleaned with backup C:\WINDOWS\Temp\b.com -> TrojanDropper.Agent.pb : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Addynamix : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\WINDOWS\Temp\Cookies\owner@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup C:\WINDOWS\Temp\Cookies\owner@trafficmp[1].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Epilot : Cleaned with backup C:\WINDOWS\Temp\Cookies\owner@yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup C:\WINDOWS\Temp\Cookies\[removed][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup C:\WINDOWS\Temp\MediaAccessInstPack.exe -> Spyware.WinAD : Cleaned with backup C:\WINDOWS\Temp\seedcorn_2_215 -> TrojanDownloader.Qoologic.v : Cleaned with backup C:\WINDOWS\Temp\upd206.exe -> Spyware.Look2Me : Cleaned with backup C:\WINDOWS\Temp\upd208.exe -> Spyware.Look2Me : Cleaned with backup C:\WINDOWS\Temp\upd209.exe -> Spyware.Look2Me : Cleaned with backup ::Report End WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600 Internet Explorer Version: 6.0.2900.2180 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» Checking %SystemDrive% folder… UPX! 11/18/2003 3:00:50 PM 160768 C:\HijackThis.exe UPX! 9/22/2003 3:34:34 PM 98304 C:\install-tag001.exe UPX! 5/31/2003 1:54:24 PM 24887 C:\Win2000.exe Checking %ProgramFilesDir% folder… UPX! 4/10/2004 6:37:14 PM 175104 C:\Program Files\emailstripper.exe UPX! 2/16/2005 11:06:16 AM 218112 C:\Program Files\HijackThis.exe PTech 1/19/2005 10:24:58 AM 48909288 C:\Program Files\msprod2.exe Checking %WinDir% folder… PEC2 5/25/2002 5:28:42 PM 365056 C:\WINDOWS\Dotest.exe PECompact2 6/11/2004 8:49:02 AM 8791546 C:\WINDOWS\LPT$VPN.903 UPX! 4/15/2005 10:57:08 PM 3328797 C:\WINDOWS\pPokerSetup.exe PECompact2 6/11/2004 8:49:02 AM 8791546 C:\WINDOWS\VPTNFILE.903 UPX! 6/4/2004 9:01:48 PM 1036800 C:\WINDOWS\vsapi32.dll aspack 6/4/2004 9:01:48 PM 1036800 C:\WINDOWS\vsapi32.dll Checking %System% folder… abetterinternet.com 11/25/2003 11:45:14 PM 131072 C:\WINDOWS\SYSTEM32\biL.exe UPX! 11/25/2003 12:48:48 PM 224768 C:\WINDOWS\SYSTEM32\c35b7s.dll UPX! 11/25/2003 11:45:14 PM 222720 C:\WINDOWS\SYSTEM32\c55bLs.dll PEC2 9/3/2002 12:30:40 PM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc PTech 7/12/2005 6:04:22 PM 520456 C:\WINDOWS\SYSTEM32\LegitCheckControl.dll UPX! 8/15/2005 7:37:30 PM 121433 C:\WINDOWS\SYSTEM32\mc-58-12-0000117.exe PECompact2 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe aspack 8/4/2005 9:31:38 PM 1449304 C:\WINDOWS\SYSTEM32\MRT.exe UPX! 8/22/2001 8:00:00 PM 86030 C:\WINDOWS\SYSTEM32\msdjgk.dll UPX! 8/22/2001 8:00:00 PM 170496 C:\WINDOWS\SYSTEM32\msiaih.dll aspack 8/4/2004 3:56:36 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll UPX! 8/9/2005 1:58:28 AM 223232 C:\WINDOWS\SYSTEM32\Pop2.exe Umonitor 8/4/2004 3:56:44 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll winsync 9/3/2002 1:10:48 PM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu Checking %System%\Drivers folder and sub-folders… PTech 8/4/2004 1:41:38 AM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts Checking the Windows folder and sub-folders for system and hidden files within the last 60 days… S 8/18/2005 9:36:04 AM 2048 C:\WINDOWS\bootstat.dat H 8/12/2005 10:38:42 PM 8628 C:\WINDOWS\pcdoc.GID H 8/18/2005 8:54:34 AM 54156 C:\WINDOWS\QTFont.qfn H 8/18/2005 9:33:34 AM 1751 C:\WINDOWS\sbconfig.dat SH 8/5/2005 10:58:50 AM 7680 C:\WINDOWS\Thumbs.db H 7/25/2005 12:06:12 PM 10820 C:\WINDOWS\Help\nocontnt.GID H 8/2/2005 2:00:36 PM 0 C:\WINDOWS\inf\oem44.inf H 8/5/2005 9:09:40 AM 65536 C:\WINDOWS\Minidump\Mini080505-01.dmp SH 8/2/2005 2:42:42 PM 286777 C:\WINDOWS\PCHealth\HelpCtr\PackageStore\package_56.cab H 8/18/2005 8:54:50 AM 895 C:\WINDOWS\system32\vsconfig.xml S 7/8/2005 4:23:18 PM 12143 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB893756.cat S 6/30/2005 9:06:34 AM 11437 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896423.cat S 7/19/2005 7:18:10 PM 18913 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896727.cat S 6/30/2005 1:42:18 PM 11084 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899587.cat S 6/30/2005 2:21:10 PM 11084 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899588.cat S 6/30/2005 8:46:18 AM 11084 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB899591.cat S 6/28/2005 7:12:56 PM 11845 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB901214.cat S 7/2/2005 4:18:16 AM 9445 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB903235.cat H 8/18/2005 9:35:54 AM 8192 C:\WINDOWS\system32\config\default.LOG H 8/18/2005 9:36:18 AM 1024 C:\WINDOWS\system32\config\SAM.LOG H 8/18/2005 9:36:06 AM 16384 C:\WINDOWS\system32\config\SECURITY.LOG H 8/18/2005 9:37:26 AM 20480 C:\WINDOWS\system32\config\software.LOG H 8/18/2005 9:36:14 AM 1015808 C:\WINDOWS\system32\config\system.LOG H 8/10/2005 12:31:46 PM 1024 C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG S 8/2/2005 5:03:16 PM 7652 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\Content\E891C648621A40AC7F773694A17FE76C S 8/2/2005 5:03:16 PM 134 C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\CryptnetUrlCache\MetaData\E891C648621A40AC7F773694A17FE76C SH 8/16/2005 11:01:58 PM 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\8a182f22-f3ac-4bc7-8e47-1a43b5c1e4dc SH 8/16/2005 11:01:58 PM 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred H 8/18/2005 9:34:46 AM 6 C:\WINDOWS\Tasks\SA.DAT SH 8/2/2005 6:31:54 AM 113 C:\WINDOWS\Temp\History\History.IE5\desktop.ini SH 8/6/2005 3:59:08 PM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\desktop.ini SH 8/6/2005 3:59:08 PM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\6FY9WDYJ\desktop.ini SH 8/6/2005 3:59:08 PM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\A3O1OLQ9\desktop.ini SH 8/6/2005 3:59:08 PM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\AZK9ANCJ\desktop.ini SH 8/6/2005 3:59:08 PM 67 C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\U5QV0NGH\desktop.ini Checking for CPL files… Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl Iomega Corporation 9/24/2002 4:44:10 PM 151552 C:\WINDOWS\SYSTEM32\ADPanel.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl 11/12/1999 6:11:00 AM 183808 C:\WINDOWS\SYSTEM32\BDEADMIN.CPL Microsoft Corporation 8/4/2004 3:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl Intel Corporation 6/19/2002 7:10:10 PM 94208 C:\WINDOWS\SYSTEM32\igfxcpl.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl Sun Microsystems 6/28/2003 9:56:38 AM 229487 C:\WINDOWS\SYSTEM32\jpicpl32.cpl Microsoft Corporation 9/3/2002 12:40:02 PM 187904 C:\WINDOWS\SYSTEM32\main.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl Microsoft Corporation 9/3/2002 12:47:04 PM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl Sun Microsystems 11/26/2001 10:24:30 PM 45148 C:\WINDOWS\SYSTEM32\plugincpl131_02.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl Apple Computer, Inc. 10/3/2003 3:14:30 PM 314880 C:\WINDOWS\SYSTEM32\QuickTime.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl Microsoft Corporation 9/3/2002 1:06:38 PM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl Microsoft Corporation 8/4/2004 3:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl Microsoft Corporation 5/26/2005 4:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl Microsoft Corporation 9/3/2002 12:40:02 PM 187904 C:\WINDOWS\SYSTEM32\dllcache\main.cpl Microsoft Corporation 9/3/2002 12:47:04 PM 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl Microsoft Corporation 9/3/2002 1:06:38 PM 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl Intel Corporation 6/19/2002 7:10:10 PM 94208 C:\WINDOWS\SYSTEM32\ReinstallBackups\0007\DriverFiles\igfxcpl.cpl »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» Checking files in %ALLUSERSPROFILE%\Startup folder… 2/3/2005 11:34:38 AM 1940 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk 12/22/2004 8:47:48 PM 1767 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk 5/4/2005 3:22:24 PM 1833 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk 8/5/2005 9:40:22 AM 1740 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk 7/28/2005 5:49:26 PM 763 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk 7/28/2005 5:49:22 PM 813 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk 8/11/2005 9:15:50 AM 1873 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk Checking files in %ALLUSERSPROFILE%\Application Data folder… 12/11/2004 10:36:52 PM 5 C:\Documents and Settings\All Users\Application Data\DirectCDUserNameD.txt Checking files in %USERPROFILE%\Startup folder… 8/2/2005 1:37:00 PM 664 C:\Documents and Settings\Owner\Start Menu\Programs\Startup\SpywareGuard.lnk Checking files in %USERPROFILE%\Application Data folder… 12/22/2004 8:45:32 PM 881 C:\Documents and Settings\Owner\Application Data\AdobeDLM.log 12/22/2004 8:45:30 PM 0 C:\Documents and Settings\Owner\Application Data\dm.ini 5/4/2005 9:59:24 AM 118736 C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 8/16/2005 8:21:04 AM 9668 C:\Documents and Settings\Owner\Application Data\ViewerApp.dat 8/17/2005 10:04:42 AM 17078 C:\Documents and Settings\Owner\Application Data\ViewerTN.tn »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] SV1 = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] {81559C35-8464-49F7-BB0E-07A383BEF910} = C:\Program Files\SpywareGuard\spywareguard.dll [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\CnvShell {A118FEA0-1D1B-4165-BC37-88F95B250E7A} = C:\WINDOWS\System32\cnvshell.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\PKZIP Shell Extension {248A7248-2D62-4B49-ACFB-0C1B70C04F0D} = C:\Program Files\Common Files\PKWARE\PKZIP7\PKCOM700.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Start Menu Pin = %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\CnvShell {A118FEA0-1D1B-4165-BC37-88F95B250E7A} = C:\WINDOWS\System32\cnvshell.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PKZIP Shell Extension {248A7248-2D62-4B49-ACFB-0C1B70C04F0D} = C:\Program Files\Common Files\PKWARE\PKZIP7\PKCOM700.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} = C:\Program Files\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627} = C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A368E80-174F-4872-96B5-0B27DDD11DB2} SpywareGuardDLBLOCK.CBrowserHelper = C:\Program Files\SpywareGuard\dlprotect.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F} = C:\PROGRA~1\SPYBOT~1\SDHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E3215F20-3212-11D6-9F8B-00D0B743919D} STOPzilla Browser Helper Object = C:\WINDOWS\System32\SZIEBHO.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\System32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : C:\WINDOWS\System32\msjava.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263} ButtonText = Research : HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} ButtonText = AIM : C:\PROGRA~1\AIM95\aim.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683} ButtonText = Messenger : C:\Program Files\Messenger\msmsgs.exe [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{4528BBE0-4E08-11D5-AD55-00010333D0AD} = HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} File Search Explorer Band = %SystemRoot%\system32\SHELL32.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E} Favorites Band = %SystemRoot%\System32\shdocvw.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E} History Band = %SystemRoot%\System32\shdocvw.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E} Explorer Band = %SystemRoot%\System32\shdocvw.dll [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {7CEE1864-769C-447A-A5E6-EB680DCBA8F9} = : HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = Norton AntiVirus : C:\Program Files\Norton AntiVirus\NavShExt.dll {4D5C8C2A-D075-11D0-B416-00C04FB90376} = Microsoft CommBand : %SystemRoot%\System32\browseui.dll {7CEE1864-769C-447A-A5E6-EB680DCBA8F9} = : {EC813151-448A-4558-A54F-9FDB28C1F50B} = : {40D41A8B-D79B-43D7-99A7-9EE0F344C385} = AIM Search : C:\Program Files\AIM Toolbar\AIMBar.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] IgfxTray C:\WINDOWS\System32\igfxtray.exe HotKeysCmds C:\WINDOWS\System32\hkcmd.exe ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" ccRegVfy "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" 2wSysTray C:\Program Files\2Wire\HomePortal\2PortalMon.exe ADUserMon C:\Program Files\Iomega\AutoDisk\ADUserMon.exe Iomega Drive Icons C:\Program Files\Iomega\DriveIcons\ImgIcon.exe Deskup C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART Microsoft Works Update Detection C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime BCMSMMSG BCMSMMSG.exe AdaptecDirectCD "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" Creative WebCam Tray C:\Program Files\Creative\PC-CAM Center\CAMTRAY.EXE PC-CAM 350 STI App Registration RunDLL32.exe P1060pin.dll,RunDLL32EP 513 STOPzilla "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun ViewMgr C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot TrojanScanner C:\Program Files\Trojan Remover\Trjscan.exe AdobeVersionCue C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe Symantec NetDriver Monitor C:\PROGRA~1\SymNetDrv\SNDMon.exe /Consumer Zone Labs Client C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe Cyber-Defender C:\Program Files\UWCDS\uwcdsvr.exe WinPatrol C:\PROGRA~1\BillP Studios\WinPatrol\winpatrol.exe gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" mmtask C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe MMTray C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe 1Win32Cfg C:\WINDOWS\System32\win32cfg\win32cfg.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = 1 MAPI Installed = 1 MSFS Installed = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] AIM C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl ctfmon.exe C:\WINDOWS\system32\ctfmon.exe updateMgr C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_1 NoAdware3 "C:\Program Files\NoAdware3\NoAdware3.exe" /s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = {0DF44EAA-FF21-4412-828E-260A8728E7F1} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 undockwithoutlogon 1 VerboseStatus 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 145 ClearRecentDocsOnExit 0 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System DisableTaskMgr 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, Shell = Explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain = crypt32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet = cryptnet.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll = cscdll.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui = igfxsrvc.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy = sclgntfy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn = WlNotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif = wzcdlg.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.3.0 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 8/18/2005 9:46:21 AM REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "ccRegVfy"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe\"" "2wSysTray"="C:\\Program Files\\2Wire\\HomePortal\\2PortalMon.exe" "ADUserMon"="C:\\Program Files\\Iomega\\AutoDisk\\ADUserMon.exe" "Iomega Drive Icons"="C:\\Program Files\\Iomega\\DriveIcons\\ImgIcon.exe" "Deskup"="C:\\Program Files\\Iomega\\DriveIcons\\deskup.exe /IMGSTART" "Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "BCMSMMSG"="BCMSMMSG.exe" "AdaptecDirectCD"="\"C:\\Program Files\\Roxio\\Easy CD Creator 5\\DirectCD\\DirectCD.exe\"" "Creative WebCam Tray"="C:\\Program Files\\Creative\\PC-CAM Center\\CAMTRAY.EXE" "PC-CAM 350 STI App Registration"="RunDLL32.exe P1060pin.dll,RunDLL32EP 513" "STOPzilla"="\"C:\\Program Files\\STOPzilla!\\Stopzilla.exe\" /autorun" "ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "TrojanScanner"="C:\\Program Files\\Trojan Remover\\Trjscan.exe" "AdobeVersionCue"="C:\\Program Files\\Adobe\\Adobe Version Cue\\ControlPanel\\VersionCueTray.exe" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SymNetDrv\\SNDMon.exe /Consumer" "Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe" "Cyber-Defender"="C:\\Program Files\\UWCDS\\uwcdsvr.exe" "WinPatrol"="C:\\PROGRA~1\\BillP Studios\\WinPatrol\\winpatrol.exe" "gcasServ"="\"C:\\Program Files\\Microsoft AntiSpyware\\gcasServ.exe\"" "mmtask"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mmtask.exe" "MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe" "1Win32Cfg"="C:\\WINDOWS\\System32\\win32cfg\\win32cfg.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" —————– HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers Subkey — CnvShell {A118FEA0-1D1B-4165-BC37-88F95B250E7A} C:\WINDOWS\System32\cnvshell.dll Subkey — Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} C:\WINDOWS\System32\cscui.dll Subkey — Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} C:\WINDOWS\system32\SHELL32.dll Subkey — Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} C:\WINDOWS\system32\SHELL32.dll Subkey — PKZIP Shell Extension {248A7248-2D62-4B49-ACFB-0C1B70C04F0D} C:\Program Files\Common Files\PKWARE\PKZIP7\PKCOM700.dll Subkey — Symantec.Norton.Antivirus.IEContextMenu {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} C:\Program Files\Norton AntiVirus\NavShExt.dll Subkey — {a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Start Menu Pin C:\WINDOWS\system32\SHELL32.dll ===================== HKEY_CLASSES_ROOT\Folder\shellex\ColumnHandlers Subkey — {0D2E74C4-3C34-11d2-A27E-00C04FC30871} C:\WINDOWS\system32\SHELL32.dll Subkey — {24F14F01-7B1C-11d1-838f-0000F80461CF} C:\WINDOWS\system32\SHELL32.dll Subkey — {24F14F02-7B1C-11d1-838f-0000F80461CF} C:\WINDOWS\system32\SHELL32.dll Subkey — {66742402-F9B9-11D1-A202-0000F81FEDEE} C:\WINDOWS\system32\SHELL32.dll Subkey — {F9DB5320-233E-11D1-9F84-707F02C10627} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll ============================== C:\Documents and Settings\All Users\Start Menu\Programs\Startup Adobe Gamma Loader.lnk Adobe Reader Speed Launch.lnk desktop.ini Kodak EasyShare software.lnk Microsoft Office.lnk Picture Package Menu.lnk Picture Package VCD Maker.lnk QuickBooks Update Agent.lnk ============================== C:\Documents and Settings\Owner\Start Menu\Programs\Startup Adobe Gamma Loader.lnk Adobe Reader Speed Launch.lnk desktop.ini Kodak EasyShare software.lnk Microsoft Office.lnk Picture Package Menu.lnk Picture Package VCD Maker.lnk QuickBooks Update Agent.lnk desktop.ini SpywareGuard.lnk ============================== C:\WINDOWS\system32 cpl files access.cpl Microsoft Corporation ADPanel.cpl Iomega Corporation appwiz.cpl Microsoft Corporation BDEADMIN.CPL Inprise Corporation bthprops.cpl Microsoft Corporation desk.cpl Microsoft Corporation firewall.cpl Microsoft Corporation hdwwiz.cpl Microsoft Corporation igfxcpl.cpl Intel Corporation inetcpl.cpl Microsoft Corporation intl.cpl Microsoft Corporation irprops.cpl Microsoft Corporation joy.cpl Microsoft Corporation jpicpl32.cpl Sun Microsystems main.cpl Microsoft Corporation mmsys.cpl Microsoft Corporation ncpa.cpl Microsoft Corporation netsetup.cpl Microsoft Corporation nusrmgr.cpl Microsoft Corporation odbccp32.cpl Microsoft Corporation plugincpl131_02.cpl Sun Microsystems powercfg.cpl Microsoft Corporation QuickTime.cpl Apple Computer, Inc. sysdm.cpl Microsoft Corporation telephon.cpl Microsoft Corporation timedate.cpl Microsoft Corporation wscui.cpl Microsoft Corporation wuaucpl.cpl Microsoft Corporation

Delete these files:

C:\WINDOWS\SYSTEM32\msdjgk.dll
C:\WINDOWS\SYSTEM32\msiaih.dll
C:\WINDOWS\sbconfig.dat


Scan with HijackThis and post a new log as a reply to this thread.

This is the only thing I can find close to that error message. You can follow the instructions there to delete that file (ssmod.dll) and see if the problem goes away.

It looks like some of the items came back.


I need you to disable SpywareGuard as it will interfere with the registry changes we will need to do.

• Right click the running icon of Spywareguard, it will open the program.
• Then go to Menu, file, exit.
• Then confirm the program is closed.

Download this tool : LQfix.zip

• Unzip it to your Desktop.
• Don't use it yet!

Scan with HijackThis and check the following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [exp] C:\WINDOWS\System32\exp
O4 - HKLM\..\Run: [uhfcjd] c:\windows\system32\uhfcjd.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\ojbojq.exe reg_run

With all other programs and browsers closed, click Fix Checked.


Click Here to download Killbox by Option^Explicit.
Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
In the killbox program, select the Delete on Reboot option.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

C:\WINDOWS\System32\exp
c:\windows\system32\uhfcjd.exe
C:\WINDOWS\system32\ojbojq.exe

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


IMPORTANT! During reboot, starting tapping the F8 key to enter Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').

Doubleclick LQfix.bat that you saved on your desktop before.A dos window will open and close again, that is normal.

Reboot normally and scan with HijackThis. Post the fresh log as a reply to this thread.

I need you to disable SpywareGuard as it will interfere with the registry changes we will need to do.

• Right click the running icon of Spywareguard, it will open the program.
• Then go to Menu, file, exit.
• Then confirm the program is closed.

Fix this line with HijackThis

O4 - HKLM\..\Run: [second] C:\Documents and Settings\Owner\Desktop\l2mfix\second.bat


Please run the Panda ActiveScan, then do a full system scan. Make sure the autoclean box is checked!
Save the scan log and post it along with a new HijackThis Log

By "fix" the line you mean delete, correct?