Siggyx
Download the tool below and post the log it produces please.
http://www.pchell.com/downloads/VX2Finder9x.exe
http://www.pchell.com/downloads/VX2Finder9x.exe
Spyware / Malware / Virus Removal
Log for review
30 min read
sls5050
is this right?
Log for VX2.BetterInternet File Finder
Files Found—
User Agent String—
{52E4D257-FE0F-C798-0CDA-D1DAB1B516AE}
Siggyx
Please download l2m9xfix at http://www.geekstogo.com/downloads/l2m9xfix.exe
Save it to the desktop and run it. Extract the files. Then open the l2m9xfix folder you just created and run RunThis.bat.
A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed.
Then restart your computer, and post a new HijackThis log as well as the log.txt file which should be in the same folder as RunThis.bat.
Save it to the desktop and run it. Extract the files. Then open the l2m9xfix folder you just created and run RunThis.bat.
A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed.
Then restart your computer, and post a new HijackThis log as well as the log.txt file which should be in the same folder as RunThis.bat.
sls5050
new logs :
Logfile of HijackThis v1.99.1
Scan saved at 5:46:05 PM, on 8/17/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\4XKDDS.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\D3DBCT.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\D3DBCT.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4xkdds.exe reg_run
O4 - HKLM\..\Run: [autoupdate] rundll32 C:\WINDOWS\SYSTEM\DATADX.DLL,SHStart
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [D3DBCT] C:\WINDOWS\SYSTEM\D3DBCT.exe
O4 - HKCU\..\RunOnce: [D3DBCT] C:\WINDOWS\SYSTEM\D3DBCT.exe
O4 - Startup: pudc.exe
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Log of L2M9XFix v1
************
Running from directory:
C:\WINDOWS\Desktop\l2m9xfix
************
Files found:
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WU5INF32.DLL
C:\WINDOWS\system\WU5INF32.DLL
C:\WINDOWS\system\WU5INF32.DLL
C:\WINDOWS\system\WU5INF32.DLL
************
Registry entries found:
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{52E4D257-FE0F-C798-0CDA-D1DAB1B516AE}"=""
************
Killing Explorer
Done!
Killing Rundll32
Done!
Removing malicious CLSID(s)
Done!
Restarting Explorer
Done!
Deleting malicious files
Done!
Finished!
Logfile of HijackThis v1.99.1
Scan saved at 5:46:05 PM, on 8/17/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\4XKDDS.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\D3DBCT.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\D3DBCT.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4xkdds.exe reg_run
O4 - HKLM\..\Run: [autoupdate] rundll32 C:\WINDOWS\SYSTEM\DATADX.DLL,SHStart
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [D3DBCT] C:\WINDOWS\SYSTEM\D3DBCT.exe
O4 - HKCU\..\RunOnce: [D3DBCT] C:\WINDOWS\SYSTEM\D3DBCT.exe
O4 - Startup: pudc.exe
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Log of L2M9XFix v1
************
Running from directory:
C:\WINDOWS\Desktop\l2m9xfix
************
Files found:
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\AHVPACK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CBSEQCHK.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\CEL3D.DLL
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\cfral.dll
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CGSEQCHK.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHMCTL32.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CHSEQCHK.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CJL3D.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CKUTOA.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\CNMMCTRL.DLL
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\cnral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\csral.dll
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CVDIAL32.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CXL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\CZL3D.DLL
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\dcmasf.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DevX.dll
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DGIME.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DISYNTH.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DKCVW_32.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DLMSSOCN.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DNKTRF.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DONDI.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIMAN.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQIME.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DQTMSFT.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DRUSIC16.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DTWAVE.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\DUTMSFT.DLL
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\dvvx_xx11.dll
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DWRAW16.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\DYVMGR32.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EPABLE3.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\EQSEC32.DLL
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\haoctk16.dll
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\HFD.DLL
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\hfowin01.dll
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HJD.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\HOINK.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IDAGING.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IEGSHL.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IGNPSTUB.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IHWDIAL.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\IJ41_QC.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITGUTIL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\ITWDIAL.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IWNPSTUB.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\IY1XDD.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\LYRTREND.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\MAWMDM.DLL
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\Mbeg16.dll
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MBJET35.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MCLS31.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MDUNI11.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MFWSOSP.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MHNSSPC.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\MIEXCH40.DLL
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mjmcids.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\mkvcr71.dll
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MMCN30.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\MOC42ENU.DLL
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\moident.dll
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\MOWSOCK.DLL
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\mQpi32x.dll
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\MTANG.DLL
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\mUpi32.dll
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVLS31.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MVPRINT.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWNSSPC.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MWR2C.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MXC30.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MYIQTZ32.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\MZXDM.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NDTAPI.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NKTOS.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NOTDI.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\NWTOS.DLL
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\nzarch32.dll
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\ORBCTRAC.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\OREPRO32.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PAXPERM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PDTSCOM.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\PGWEROLD.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QDDIT.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\QFDWIPES.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RAASMM.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RGCHED32.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED20.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RKCHED32.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RLAPH.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RPR20.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RQABASE.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTAPH.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\RTR20.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SDOOLSS.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SEORAGE.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SIELL.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SISTHUNK.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SKNDMAIL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SLELL.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\SRRAPI.DLL
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\srrmdll.dll
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SRTUPAPI.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\SSNDMAIL.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\STNCUI.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SWLSRV32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SXTUPX32.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZSDETMG.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\SZTUP4.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\URBUI.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\UYBMON.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VDAJET32.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VVAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\VYAME.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\WGNASPI.DLL
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\wgspdmoe.dll
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WJASPI32.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WKNETMGR.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WLNMM.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WMADSS.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WSPLENC.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WTWIZDLL.DLL
C:\WINDOWS\system\WU5INF32.DLL
C:\WINDOWS\system\WU5INF32.DLL
C:\WINDOWS\system\WU5INF32.DLL
C:\WINDOWS\system\WU5INF32.DLL
************
Registry entries found:
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
[HKEY_CLASSES_ROOT\CLSID\{7BBEAE00-E797-4CA5-A0ED-CAAE39499806}\InprocServer32]
@="C:\\WINDOWS\\SYSTEM\\DWRAW16.DLL"
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{52E4D257-FE0F-C798-0CDA-D1DAB1B516AE}"=""
************
Killing Explorer
Done!
Killing Rundll32
Done!
Removing malicious CLSID(s)
Done!
Restarting Explorer
Done!
Deleting malicious files
Done!
Finished!
Siggyx
Scan with hijackthis and put a check beside these lines and choose FIX
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4xkdds.exe reg_run
O4 - HKLM\..\Run: [autoupdate] rundll32 C:\WINDOWS\SYSTEM\DATADX.DLL,SHStart
O4 - HKCU\..\Run: [D3DBCT] C:\WINDOWS\SYSTEM\D3DBCT.exe
O4 - HKCU\..\RunOnce: [D3DBCT] C:\WINDOWS\SYSTEM\D3DBCT.exe
O4 - Startup: pudc.exe
Then reboot and post a new log please.
sls5050
Logfile of HijackThis v1.99.1
Scan saved at 6:39:55 PM, on 8/17/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\WINDOWS\4XKDDS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Scan saved at 6:39:55 PM, on 8/17/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\WINDOWS\4XKDDS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Siggyx
Looks good how is it running?
sls5050
Sorry, forgot to reboot before i pasted the log above. this one is the correct one.
Logfile of HijackThis v1.99.1
Scan saved at 6:46:42 PM, on 8/17/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\4XKDDS.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\WINDOWS\SYSTEM\MPRADR.EXE
C:\WINDOWS\SYSTEM\MPRADR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4xkdds.exe reg_run
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [MPRADR] C:\WINDOWS\SYSTEM\MPRADR.exe
O4 - HKCU\..\RunOnce: [MPRADR] C:\WINDOWS\SYSTEM\MPRADR.exe
O4 - Startup: pudc.exe
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Logfile of HijackThis v1.99.1
Scan saved at 6:46:42 PM, on 8/17/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\4XKDDS.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\WINDOWS\SYSTEM\MPRADR.EXE
C:\WINDOWS\SYSTEM\MPRADR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4xkdds.exe reg_run
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [MPRADR] C:\WINDOWS\SYSTEM\MPRADR.exe
O4 - HKCU\..\RunOnce: [MPRADR] C:\WINDOWS\SYSTEM\MPRADR.exe
O4 - Startup: pudc.exe
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Siggyx
Can yopu please scan the files below at the linl supplied. One at a time is required and it will producer a log for each please post those logs.
C:\WINDOWS\4xkdds.exe
C:\WINDOWS\SYSTEM\MPRADR.exe
pudc.exe
Scan here >>>>> http://www.virustotal.com/flash/index_en.html
C:\WINDOWS\4xkdds.exe
C:\WINDOWS\SYSTEM\MPRADR.exe
pudc.exe
Scan here >>>>> http://www.virustotal.com/flash/index_en.html
sls5050
This is a report processed by VirusTotal on 08/18/2005 at 17:24:44 (CET) after scanning the file "mpradr.exe" file.
Antivirus Version Update Result
AntiVir 6.31.1.0 08.18.2005 TR/Spy.VB.EH.13
Avast 4.6.695.0 08.17.2005 no virus found
AVG 718 08.17.2005 no virus found
Avira 6.31.1.0 08.18.2005 TR/Spy.VB.EH.13
BitDefender 7.0 08.18.2005 no virus found
CAT-QuickHeal 7.03 08.18.2005 no virus found
ClamAV devel-20050725 08.18.2005 no virus found
DrWeb 4.32b 08.18.2005 BACKDOOR.Trojan
eTrust-Iris 7.1.194.0 08.17.2005 no virus found
eTrust-Vet 11.9.1.0 08.18.2005 no virus found
Fortinet 2.41.0.0 08.18.2005 Spy/Prutec
F-Prot 3.16c 08.17.2005 no virus found
Ikarus 0.2.59.0 08.18.2005 no virus found
Kaspersky 4.0.2.24 08.18.2005 Trojan-Spy.Win32.VB.eh
McAfee 4562 08.18.2005 Prutec
NOD32v2 1.1196 08.17.2005 no virus found
Norman 5.70.10 08.17.2005 no virus found
Panda 8.02.00 08.18.2005 no virus found
Sophos 3.96.0 08.18.2005 no virus found
Sybari 7.5.1314 08.18.2005 Trojan-Spy.Win32.VB.eh
Symantec 8.0 08.18.2005 no virus found
TheHacker 5.8.2.091 08.18.2005 no virus found
VBA32 3.10.4 08.18.2005 Trojan-Spy.Win32.VB.eh
This is a report processed by VirusTotal on 08/18/2005 at 17:18:36 (CET) after scanning the file "pudc.exe" file.
Antivirus Version Update Result
AntiVir 6.31.1.0 08.18.2005 no virus found
Avast 4.6.695.0 08.17.2005 no virus found
AVG 718 08.17.2005 no virus found
Avira 6.31.1.0 08.18.2005 no virus found
BitDefender 7.0 08.18.2005 no virus found
CAT-QuickHeal 7.03 08.18.2005 (Suspicious) - DNAScan
ClamAV devel-20050725 08.18.2005 no virus found
DrWeb 4.32b 08.18.2005 no virus found
eTrust-Iris 7.1.194.0 08.17.2005 no virus found
eTrust-Vet 11.9.1.0 08.18.2005 no virus found
Fortinet 2.41.0.0 08.18.2005 no virus found
F-Prot 3.16c 08.17.2005 no virus found
Ikarus 0.2.59.0 08.18.2005 no virus found
Kaspersky 4.0.2.24 08.18.2005 no virus found
McAfee 4562 08.18.2005 potentially unwanted program Adware-Qoolaid
NOD32v2 1.1196 08.17.2005 a variant of Win32/TrojanDownloader.Qoologic
Norman 5.70.10 08.17.2005 no virus found
Panda 8.02.00 08.18.2005 Adware/QoolShown
Sophos 3.96.0 08.18.2005 no virus found
Sybari 7.5.1314 08.18.2005 no virus found
Symantec 8.0 08.18.2005 no virus found
TheHacker 5.8.2.091 08.18.2005 no virus found
VBA32 3.10.4 08.18.2005 no virus found
This is a report processed by VirusTotal on 08/18/2005 at 17:20:33 (CET) after scanning the file "4xkdds.exe" file.
Antivirus Version Update Result
AntiVir 6.31.1.0 08.18.2005 no virus found
Avast 4.6.695.0 08.17.2005 no virus found
AVG 718 08.17.2005 no virus found
Avira 6.31.1.0 08.18.2005 no virus found
BitDefender 7.0 08.18.2005 no virus found
CAT-QuickHeal 7.03 08.18.2005 (Suspicious) - DNAScan
ClamAV devel-20050725 08.18.2005 no virus found
DrWeb 4.32b 08.18.2005 no virus found
eTrust-Iris 7.1.194.0 08.17.2005 no virus found
eTrust-Vet 11.9.1.0 08.18.2005 no virus found
Fortinet 2.41.0.0 08.18.2005 no virus found
F-Prot 3.16c 08.17.2005 no virus found
Ikarus 0.2.59.0 08.18.2005 no virus found
Kaspersky 4.0.2.24 08.18.2005 no virus found
McAfee 4562 08.18.2005 potentially unwanted program Adware-Qoolaid
NOD32v2 1.1196 08.17.2005 a variant of Win32/TrojanDownloader.Qoologic
Norman 5.70.10 08.17.2005 no virus found
Panda 8.02.00 08.18.2005 Adware/QoolShown
Sophos 3.96.0 08.18.2005 no virus found
Sybari 7.5.1314 08.18.2005 no virus found
Symantec 8.0 08.18.2005 no virus found
TheHacker 5.8.2.091 08.18.2005 no virus found
VBA32 3.10.4 08.18.2005 no virus found
Siggyx
Go here, download, extract the files from the zip:
http://forums.skads.org/index.php?act=Attach&type=post&id=66
Go to the new qoologic folder and run the batch file. Give it time to complete. Look for a log called C:\log.txt - post the contents here.
http://forums.skads.org/index.php?act=Attach&type=post&id=66
Go to the new qoologic folder and run the batch file. Give it time to complete. Look for a log called C:\log.txt - post the contents here.
sls5050
ECHO is off
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder…………
————————
C:\WINDOWS\vsapi32.dll: ASPACK EXE
C:\WINDOWS\vsapi32.dll: ASPACK2 EXE
C:\WINDOWS\vsapi32.dll: ASPack 1.08.04
C:\WINDOWS\vsapi32.dll: ASPack 1.08.03
C:\WINDOWS\vsapi32.dll: ASPack 1.08.02b
C:\WINDOWS\vsapi32.dll: ASPack 1.08.01
C:\WINDOWS\vsapi32.dll: ASPack 1.08
C:\WINDOWS\vsapi32.dll: ASPack 1.07b
C:\WINDOWS\vsapi32.dll: ASPack 1.61
C:\WINDOWS\vsapi32.dll: ASPack 1.05b
C:\WINDOWS\vsapi32.dll: ASPack 1.03
C:\WINDOWS\vsapi32.dll: ASPack 1.02
C:\WINDOWS\vsapi32.dll: ASPack 1.01
C:\WINDOWS\vsapi32.dll: ASPack 1.00
Files Found in all users startup Folder…………
————————
Files Found in all users windows Folder…………
————————
C:\WINDOWS\USER.DAT: qoologic
C:\WINDOWS\USER.DAT: 007TROJ_QOOLOGIC.N
C:\WINDOWS\USER.DAT: qoologic.com
C:\WINDOWS\USER.DAT: 007TROJ_QOOLOGIC.N
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.P
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.N
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.I
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.H
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.E
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.D
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.G
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.C
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.B
C:\WINDOWS\LPT$VPN.777: TROJ_QOOLOGIC.A
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.P
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.N
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.I
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.H
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.E
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.D
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.G
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.C
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.B
C:\WINDOWS\VPTNFILE.777: TROJ_QOOLOGIC.A
Finished
sls5050
I hope this is the right log?
Siggyx
Please download l2m9xfix at http://www.geekstogo.com/downloads/l2m9xfix.exe
Save it to the desktop and run it. Extract the files. Then open the l2m9xfix folder you just created and run RunThis.bat.
A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed.
Then restart your computer, and post a new HijackThis log as well as the log.txt file which should be in the same folder as RunThis.bat.
Save it to the desktop and run it. Extract the files. Then open the l2m9xfix folder you just created and run RunThis.bat.
A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed.
Then restart your computer, and post a new HijackThis log as well as the log.txt file which should be in the same folder as RunThis.bat.
sls5050
Log of L2M9XFix v1
************
Running from directory:
C:\WINDOWS\Desktop\l2m9xfix
************
Files found:
************
Registry entries found:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
************
Killing Explorer
Done!
Killing Rundll32
Done!
Removing malicious CLSID(s)
Done!
Restarting Explorer
Done!
Deleting malicious files
Done!
Finished!
Logfile of HijackThis v1.99.1
Scan saved at 12:02:07 PM, on 8/20/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\4XKDDS.EXE
C:\WINDOWS\SYSTEM\NVRR2C.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\NVRR2C.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4xkdds.exe reg_run
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [NVRR2C] C:\WINDOWS\SYSTEM\NVRR2C.exe
O4 - HKCU\..\RunOnce: [NVRR2C] C:\WINDOWS\SYSTEM\NVRR2C.exe
O4 - Startup: pudc.exe
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
************
Running from directory:
C:\WINDOWS\Desktop\l2m9xfix
************
Files found:
************
Registry entries found:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
************
Killing Explorer
Done!
Killing Rundll32
Done!
Removing malicious CLSID(s)
Done!
Restarting Explorer
Done!
Deleting malicious files
Done!
Finished!
Logfile of HijackThis v1.99.1
Scan saved at 12:02:07 PM, on 8/20/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\IWP\NPFMNTOR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\HIDSERV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE
C:\COMPAQ\CPQINET\CPQINET.EXE
C:\WINDOWS\PCTVOICE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE
C:\WINDOWS\4XKDDS.EXE
C:\WINDOWS\SYSTEM\NVRR2C.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\NVRR2C.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOSTART.EXE
C:\PROGRAM FILES\HP OFFICEJET SERIES 600\BIN\HPOJVDIX.EXE
C:\WINDOWS\SYSTEM\HPOMLCH.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dsl.sbc.yahoo.com/
F1 - win.ini: load=c:\oplimit\ocraware.exe
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Panicware BHO Class - {00000000-6C30-11D8-9363-000AE6309658} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWIBHO.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Pop-Up Stopper Anti-Spyware Toolbar - {E4CAA75E-9B5F-45EB-8E4E-8B743B44F171} - C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER ANTI-SPYWARE\PWITB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\cpqeadm.exe
O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe
O4 - HKLM\..\Run: [CPQInet] c:\compaq\CPQInet\CpqInet.exe
O4 - HKLM\..\Run: [PCTVOICE] pctvoice.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\4xkdds.exe reg_run
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [NPFMonitor] C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - HKCU\..\Run: [NVRR2C] C:\WINDOWS\SYSTEM\NVRR2C.exe
O4 - HKCU\..\RunOnce: [NVRR2C] C:\WINDOWS\SYSTEM\NVRR2C.exe
O4 - Startup: pudc.exe
O4 - Startup: HP OfficeJet Series 600 StartUp.lnk = C:\Program Files\HP OfficeJet Series 600\bin\HPOstart.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…415/mcfscan.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab33902.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O16 - DPF: {4208FB4D-4E53-4F5A-BF7A-3E047DDB5281} (ActiveX Control) - http://www.icannnews.com/app/ST/ActiveX.ocx
O16 - DPF: {4EC8E993-32C1-47F5-A07A-5B0574655AD4} (WXcom Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…ntr_current.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI