What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hi
like everybody else, I am having some problems with this Notify thing, and i cant delete the DeleteDll.bat file,
I know someone can help me with this!!!. thx

this is my HijackThis log

Logfile of HijackThis v1.99.1
Scan saved at 1:20:55 a.m., on 08/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe
F:\ARCHIV~1\PANICW~1\POP-UP~1\dpps2.exe
C:\Archivos de programa\TuneUp Utilities 2004\MemOptimizer.exe
C:\Archivos de programa\BitComet\BitComet.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
c:\archiv~1\intern~1\iexplore.exe
C:\Archivos de programa\Microsoft AntiSpyware\gcasDtServ.exe
C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Carlos\Escritorio\ESCRITORIO AGOSTO 2005\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\Archivos de programa\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Archivos de programa\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {54E07D82-2612-3CE1-4FB1-33715D3E23AC} - C:\DOCUME~1\Carlos\DATOSD~1\OKAYCO~1\Debug Loud.exe
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\ARCHIV~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Archivos de programa\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Pop-Up Stopper] "F:\ARCHIV~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [KIND KNOB TRAY MEDIA] C:\Documents and Settings\All Users\Datos de programa\bore pop kind knob\ScrMail.exe
O4 - HKCU\..\Run: [GreyStop] C:\DOCUME~1\Carlos\DATOSD~1\Dvdmeal\Cdrom clock.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] C:\Archivos de programa\TuneUp Utilities 2004\MemOptimizer.exe autostart
O4 - HKCU\..\Run: [BitComet] "C:\Archivos de programa\BitComet\BitComet.exe"
O8 - Extra context menu item: &Google Search - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Archivos de programa\MSN Toolbar Suite\TB\02.01.0000.2214\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Download all by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download All Links with IDM - F:\Archivos de programa\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with IDM - F:\Archivos de programa\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Instantánea de caché de la página - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Páginas similares - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Páginas vinculadas - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Translate Site with Google - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\gtranslate.htm
O8 - Extra context menu item: Zoom &In - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\tuzoomin.htm
O8 - Extra context menu item: Zoom &Out - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\tuzoomout.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup156.cab
O20 - Winlogon Notify: Explorer - C:\WINDOWS\system32\mhihnd.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Archivos de programa\TuneUp Utilities 2004\WinStylerThemeSvc.exe
Post #2
Greetings and welcome to TomCoyote.org!

We need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes that we need to make.
  • Open Microsoft AntiSpyware.
  • Click on Options, Settings.
  • In the left pane, click on Real-time Protection.
  • Under Startup Options uncheck Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
  • Under Real-time spyware threat protection uncheck Enable real-time spyware threat protection (recommended).
  • After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
  • Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.
After all of the fixes are complete it is very important that you enable Real-time Protection again.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {54E07D82-2612-3CE1-4FB1-33715D3E23AC} - C:\DOCUME~1\Carlos\DATOSD~1\OKAYCO~1\Debug Loud.exe

O4 - HKLM\..\Run: [KIND KNOB TRAY MEDIA] C:\Documents and Settings\All Users\Datos de programa\bore pop kind knob\ScrMail.exe

O4 - HKCU\..\Run: [GreyStop] C:\DOCUME~1\Carlos\DATOSD~1\Dvdmeal\Cdrom clock.exe

O20 - Winlogon Notify: Explorer - C:\WINDOWS\system32\mhihnd.dll

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\documents and settings\all users\datos de programa\bore pop kind knob <— FOLDER

c:\documents and settings\carlos\datos de programa\dvdmeal <— FOLDER

c:\documents and settings\carlos\datos de programa\okayco~1 <— FOLDER

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #3
thank you men, I did what you told me to do, and this is the hijackthis log that i got after I did that….

Logfile of HijackThis v1.99.1
Scan saved at 9:50:08 p.m., on 08/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe
F:\ARCHIV~1\PANICW~1\POP-UP~1\dpps2.exe
C:\Archivos de programa\TuneUp Utilities 2004\MemOptimizer.exe
C:\Archivos de programa\BitComet\BitComet.exe
C:\Archivos de programa\Microsoft AntiSpyware\gcasDtServ.exe
C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Archivos de programa\Microsoft AntiSpyware\gcasServ.exe
C:\Archivos de programa\WinAVI VideoConverter\WinAVI.exe
C:\Documents and Settings\Carlos\Escritorio\ESCRITORIO AGOSTO 2005\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webalta.com/?p1=313&p2=2&p3=42e…93f25034d27025d
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\Archivos de programa\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Archivos de programa\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\ARCHIV~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Archivos de programa\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Pop-Up Stopper] "F:\ARCHIV~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] C:\Archivos de programa\TuneUp Utilities 2004\MemOptimizer.exe autostart
O4 - HKCU\..\Run: [BitComet] "C:\Archivos de programa\BitComet\BitComet.exe"
O8 - Extra context menu item: &Google Search - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Archivos de programa\MSN Toolbar Suite\TB\02.01.0000.2214\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Download all by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download All Links with IDM - F:\Archivos de programa\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with IDM - F:\Archivos de programa\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Instantánea de caché de la página - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Páginas similares - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Páginas vinculadas - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Translate Site with Google - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\gtranslate.htm
O8 - Extra context menu item: Zoom &In - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\tuzoomin.htm
O8 - Extra context menu item: Zoom &Out - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\tuzoomout.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup156.cab
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\ARCHIV~1\BT2Net\BT2PLU~1.DLL
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\ARCHIV~1\BT2Net\BT2PLU~1.DLL
O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\mhihnd.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Archivos de programa\TuneUp Utilities 2004\WinStylerThemeSvc.exe

I hope you find something usefull
I am going to keep running the system to see if we got goo results.
thx God Blesss You!!!!
Post #4
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe

http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing .

This will scan your computer and it may appear nothing is happening, then, after a minute or 2, Notepad will open with a log. Copy/paste the contents of that log into this thread.


IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
Post #5
here is the l2mfix log. I ran the application, and this is the result. thanks for your help. keep the good work. L2MFIX find log 1.04a These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Media Center] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\mhihnd.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Usuarios (ID-IO) ALLOW Read BUILTIN\Usuarios (ID-NI) ALLOW Read BUILTIN\Usuarios avanzados (ID-IO) ALLOW Read BUILTIN\Usuarios avanzados (ID-NI) ALLOW Full access BUILTIN\Administradores (ID-IO) ALLOW Full access BUILTIN\Administradores (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{894DD667-17A8-13D8-E795-ADF71BE5ECEF}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Hoja de propiedades de archivos multimedia" "{176d6597-26d3-11d1-b350-080036a75b03}"="Administraci¢n de esc ner ICM" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="P gina de seguridad NTFS" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="P gina de propiedades del archivo de documentos OLE" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensiones de interfaz para uso compartido" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extensi¢n CPL del adaptador de pantalla" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extensi¢n CPL del monitor de pantalla" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extensi¢n de paneo de pantalla del Panel de control" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="P gina de seguridad DS" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="P gina de compatibilidad" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extensi¢n de copia de discos" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensiones del shell para objetos de la red de Microsoft Windows" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Administraci¢n de monitor ICM" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Administraci¢n de impresora ICM" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensiones del shell para compresi¢n de archivos" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extensi¢n del shell de impresora en Web" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Men£ de contexto de cifrado" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Malet¡n" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extensi¢n de icono de HyperTerminal" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fuentes" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Perfil de ICC" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="P gina de seguridad de impresoras" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensiones de interfaz para uso compartido" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extensi¢n PKO cifrada" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extensi¢n de firma cifrada" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Conexiones de red" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Conexiones de red" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&C maras y esc neres" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&C maras y esc neres" "{905667aa-acd6-11d2-8080-00805f6596d2}"="&C maras y esc neres" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&C maras y esc neres" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&C maras y esc neres" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensiones del shell para Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="V¡nculos a datos de Microsoft" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tareas programadas" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barra de tareas y men£ Inicio" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Buscar" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Ayuda y soporte t‚cnico" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Ayuda y soporte t‚cnico" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ejecutar…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Correo electr¢nico" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fuentes" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Herramientas administrativas" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barra de herramientas de Microsoft Internet" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Estado de la descarga" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Carpeta Shell aumentada" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Carpeta 2 Shell aumentada" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Banda del explorador de Microsoft" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Banda de b£squeda" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="B£squeda en panel" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="B£squeda Web" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilidad de opciones del rbol de Registro" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Direcci¢n" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Cuadro de la direcci¢n" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Autocompletar de Microsoft" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="Lista autocompleta MRU" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Lista autocompleta MRU personalizada" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barra de progreso emergente" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Lista autocompleta de la historia de Microsoft" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Lista autocompleta de la carpeta Shell de Microsoft" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Contenedor de la Lista m£ltiple de Microsoft" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Men£ de sitio de bandas Shell" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barra de escritorio Shell" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Asistencia al usuario" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Configuraci¢n de carpeta global" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Servicio de Historial de las direcciones URL de Microsoft" "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historial" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Archivos temporales de Internet" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Archivos temporales de Internet" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Hook de b£squeda de direcciones URL de Microsoft" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Pantalla de bienvenida de IE4 Suite" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Banda de Explorador" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="Carpeta del cach‚ de ActiveX" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Carpeta de suscripciones" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Administrador de aplicaciones de Shell" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Enumerador de aplicaciones instaladas" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extractor de vistas en miniatura de archivos GDI+" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Controlador de la informaci¢n de resumen para vistas en miniatura (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extractor de vistas en miniatura HTML" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Asistente para la publicaci¢n en Web" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Pedido de impresiones v¡a web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objeto de Asistente de publicaci¢n de shell" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Asistente para obtener pasaporte" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Cuentas de usuario" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Carpeta de archivos sin conexi¢n" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="&Personas…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{A2569D1F-4E06-43EC-9825-0088B471BE47}"="IntelliType Pro Wireless Control Panel Property Page" "{111D8120-25EB-4E1C-A4DF-C9EE5FCA35CB}"="IntelliType Pro Scrolling Control Panel Property Page" "{ED6E87C6-8A83-43aa-8208-8DBC8247F4D2}"="IntelliType Pro Key Settings Control Panel Property Page" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{efb97cb8-a4a4-4357-a261-002ffaed0267}"="CD Slideshow Powertoy" "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79307-84BE-11CE-9641-444553540000}"="WinZip" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Carpetas Web" "{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{00DF1F20-0849-A4D1-0239-00D0AF3E9CB0}"="TuneUp Shredder Shell Context Menu Extension" "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{29e3fb5b-cf62-45b5-b8bf-1ad500385fc7}"="Shell Context Menu Handler for Application References" "{29e3fb5b-cf62-45b5-b8bf-1ad500385fc6}"="Shell Context Menu Handler for Application Manifests" "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}"="Shell Icon Handler for Application References" "{472083B0-C522-11CF-8763-00608CC02F24}"="avast" "{13E7F612-F261-4391-BEA2-39DF4F3FA311}"="Windows Desktop Search" "{97090E2F-3062-4459-855B-014F0D3CDBB1}"="MSN Deskbar" "{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx" "{43F925F2-D0AD-4942-A4A7-7FAE91BD1166}"="" "{B327765E-D724-4347-8B16-78AE18552FC3}"="NeroDigitalIconHandler" "{7F1CF152-04F8-453A-B34C-E609530A9DC8}"="NeroDigitalPropSheetHandler" "{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.5 Context Menu Shell Extension" "{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.5 DragDrop Shell Extension" "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.5 Context Menu Shell Extension" "{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.5 Property Sheet Shell Extension" "{6BC97BAA-20D4-4A6E-A6FE-5BF8773A2FA8}"="" "{C911E85E-B98E-4002-ABA9-AE2BB325A84F}"="" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Archivo de canal" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Acceso directo al canal" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Objeto de control de canal" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{A4DF5659-0801-4A60-9607-1C48695EFDA9}"="Carpeta de carga de Share-to-Web" "{515BD146-AB03-4158-B7DF-A9BB4BF80CF0}"="" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{4F432BB8-1DC5-4B43-939C-9CADD0079DC1}] @="One-click audio converter" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{D426CFD0-87FC-4906-98D9-A23F5D515D61}] @="MSN Desktop Search Outlook Express ISearchFolder Class" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{C911E85E-B98E-4002-ABA9-AE2BB325A84F}] @="" [HKEY_CLASSES_ROOT\CLSID\{C911E85E-B98E-4002-ABA9-AE2BB325A84F}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{C911E85E-B98E-4002-ABA9-AE2BB325A84F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{C911E85E-B98E-4002-ABA9-AE2BB325A84F}\InprocServer32] @="C:\\WINDOWS\\system32\\bdpass_idd.dll" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{515BD146-AB03-4158-B7DF-A9BB4BF80CF0}] @="" [HKEY_CLASSES_ROOT\CLSID\{515BD146-AB03-4158-B7DF-A9BB4BF80CF0}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{515BD146-AB03-4158-B7DF-A9BB4BF80CF0}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{515BD146-AB03-4158-B7DF-A9BB4BF80CF0}\InprocServer32] @="C:\\WINDOWS\\system32\\wpaspi32.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ bdpass~1.dll Wed Aug 31 2005 1:51:56a ..S.R 417,792 408.00 K cemsnap.dll Sat Jul 23 2005 9:06:48p ..S.R 417,792 408.00 K cwmcat.dll Sun Aug 14 2005 11:34:30p ..S.R 417,792 408.00 K dhnlobby.dll Wed Jul 13 2005 7:35:46p A.S.R 417,792 408.00 K drct16.dll Tue Jul 19 2005 1:40:10a A…. 0 0.00 K drvtrntm.dll Sun Jun 5 2005 10:17:16p A…. 53,760 52.50 K ffkutil.dll Mon Aug 15 2005 12:17:20a ..S.R 417,792 408.00 K fpusd.dll Mon Aug 15 2005 1:06:24a ..S.R 417,792 408.00 K fwapi.dll Sat Jun 11 2005 2:47:36p A…. 36,924 36.06 K gccoll~1.dll Tue Jul 12 2005 3:35:14p A…. 126,680 123.71 K gcunco~1.dll Tue Jul 12 2005 3:35:10p A…. 95,448 93.21 K hashlib.dll Tue Jul 12 2005 3:35:14p A…. 117,976 115.21 K icm32.dll Tue Jun 28 2005 8:49:44p A…. 254,976 249.00 K idmmbc.dll Wed Jun 29 2005 8:43:14a A…. 131,072 128.00 K interc~1.dll Fri Jul 8 2005 9:07:56a A…. 36,864 36.00 K ioxrip.dll Sun Aug 14 2005 11:22:10p ..S.R 417,792 408.00 K ktdcz.dll Mon Aug 15 2005 12:11:12a ..S.R 417,792 408.00 K mbr2c.dll Mon Jul 11 2005 9:02:08p A.S.R 417,792 408.00 K mfts50.dll Mon Aug 1 2005 8:47:18p A…. 0 0.00 K mgtlsapi.dll Mon Jul 11 2005 6:08:00p A.S.R 417,792 408.00 K mhihnd.dll Fri Aug 26 2005 4:58:10a ..S.R 417,792 408.00 K mjpmsp.dll Mon Jul 11 2005 9:02:02p A.S.R 417,792 408.00 K mqc40.dll Sat Aug 6 2005 10:15:12a ..S.R 417,792 408.00 K mqvbvm60.dll Mon Jul 11 2005 6:08:06p A.S.R 417,792 408.00 K mscms.dll Tue Jun 28 2005 8:49:44p A…. 74,240 72.50 K mucsubs.dll Mon Aug 15 2005 12:54:04a ..S.R 417,792 408.00 K mxieftp.dll Mon Aug 15 2005 1:43:48a ..S.R 417,792 408.00 K nkdeapi.dll Sun Aug 14 2005 11:59:02p ..S.R 417,792 408.00 K openal32.dll Mon Jun 13 2005 9:54:32a A…. 81,920 80.00 K ove32.dll Sun Aug 14 2005 11:02:42p ..S.R 417,792 408.00 K parpnsp.dll Tue Aug 30 2005 12:21:14p ..S.R 417,792 408.00 K qsdit.dll Sun Aug 14 2005 11:10:02p ..S.R 417,792 408.00 K rjsser.dll Mon Aug 15 2005 12:41:48a ..S.R 417,792 408.00 K rostls.dll Sun Aug 14 2005 11:52:52p ..S.R 417,792 408.00 K rtsmontr.dll Mon Jul 11 2005 4:48:14p A.S.R 417,792 408.00 K rysmontr.dll Mon Jul 11 2005 4:48:22p A.S.R 417,792 408.00 K sjp32.dll Mon Aug 22 2005 7:57:42a ..S.R 417,792 408.00 K survdeps.dll Mon Aug 15 2005 1:31:22a ..S.R 417,792 408.00 K thnlib20.dll Mon Jul 11 2005 2:08:32p A.S.R 417,792 408.00 K tsrmmgr.dll Mon Jul 11 2005 11:20:50a A.S.R 417,792 408.00 K uinpui.dll Sat Aug 6 2005 12:31:12p ..S.R 417,792 408.00 K ultra.dll Mon Jul 18 2005 3:27:02p A…. 0 0.00 K uprlbva.dll Mon Jul 11 2005 7:37:06p A.S.R 417,792 408.00 K uxrvpa.dll Mon Jul 11 2005 7:37:02p A.S.R 417,792 408.00 K wgapi.dll Mon Aug 15 2005 12:29:36a ..S.R 417,792 408.00 K wnaspi32.dll Sat Jun 11 2005 2:14:40a A…. 45,056 44.00 K wpaspi32.dll Wed Aug 31 2005 10:41:14a ..S.R 417,792 408.00 K wqaspint.dll Mon Jul 11 2005 10:05:04p A.S.R 417,792 408.00 K wqauserv.dll Sat Aug 6 2005 12:52:28p ..S.R 417,792 408.00 K wrap_oal.dll Mon Jun 13 2005 9:54:32a A…. 221,184 216.00 K wvhext.dll Sun Aug 14 2005 11:40:40p ..S.R 417,792 408.00 K xilehlp.dll Mon Aug 15 2005 1:18:48a ..S.R 417,792 408.00 K 52 items found: 52 files (37 H/S), 0 directories. Total of file sizes: 16,734,404 bytes 15.96 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ guard.tmp Tue Jul 12 2005 6:20:10a ..S.R 417,792 408.00 K 1 item found: 1 file (1 H/S), 0 directories. Total of file sizes: 417,792 bytes 408.00 K ********************************************************************************** Directory Listing of system files: El volumen de la unidad C es Sistema El n£mero de serie del volumen es: B80D-1176 Directorio de C:\WINDOWS\System32 08/31/2005 10:41 a.m. 417,792 wpaspi32.dll 08/31/2005 01:51 a.m. 417,792 bdpass_idd.dll 08/30/2005 12:21 p.m. 417,792 parpnsp.dll 08/26/2005 04:58 a.m. 417,792 mhihnd.dll 08/22/2005 07:57 a.m. 417,792 SJP32.DLL 08/16/2005 07:26 a.m. dllcache 08/15/2005 01:43 a.m. 417,792 mxieftp.dll 08/15/2005 01:31 a.m. 417,792 survdeps.dll 08/15/2005 01:18 a.m. 417,792 xilehlp.dll 08/15/2005 01:06 a.m. 417,792 fpusd.dll 08/15/2005 12:54 a.m. 417,792 mucsubs.dll 08/15/2005 12:41 a.m. 417,792 rJsser.dll 08/15/2005 12:29 a.m. 417,792 wgapi.dll 08/15/2005 12:17 a.m. 417,792 ffkutil.dll 08/15/2005 12:11 a.m. 417,792 ktdcz.dll 08/14/2005 11:59 p.m. 417,792 nkdeapi.dll 08/14/2005 11:52 p.m. 417,792 rOstls.dll 08/14/2005 11:40 p.m. 417,792 wvhext.dll 08/14/2005 11:34 p.m. 417,792 cwmcat.dll 08/14/2005 11:22 p.m. 417,792 ioxrip.dll 08/14/2005 11:10 p.m. 417,792 qsdit.dll 08/14/2005 11:02 p.m. 417,792 ove32.dll 08/06/2005 12:52 p.m. 417,792 wqauserv.dll 08/06/2005 12:31 p.m. 417,792 uinpui.dll 08/06/2005 10:15 a.m. 417,792 mqc40.dll 07/25/2005 10:00 a.m. 56 14933338E6.sys 07/25/2005 10:00 a.m. 13,560 KGyGaAvL.sys 07/23/2005 09:06 p.m. 417,792 cemsnap.dll 07/13/2005 07:35 p.m. 417,792 dhnlobby.dll 07/12/2005 06:20 a.m. 417,792 guard.tmp 07/11/2005 10:05 p.m. 417,792 WQASPINT.DLL 07/11/2005 09:02 p.m. 417,792 mbr2c.dll 07/11/2005 09:02 p.m. 417,792 MjPMSP.dll 07/11/2005 07:37 p.m. 417,792 uprlbva.dll 07/11/2005 07:37 p.m. 417,792 uxrvpa.dll 07/11/2005 06:08 p.m. 417,792 mqvbvm60.dll 07/11/2005 06:07 p.m. 417,792 mgtlsapi.dll 07/11/2005 04:48 p.m. 417,792 rYsmontr.dll 07/11/2005 04:48 p.m. 417,792 rTsmontr.dll 07/11/2005 02:08 p.m. 417,792 ThnLib20.dll 07/11/2005 11:20 a.m. 417,792 tsrmmgr.dll 04/05/2005 05:42 p.m. Microsoft 40 archivos 15,889,712 bytes 2 dirs 5,352,177,664 bytes libres
Post #6
Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing , then press any key to reboot your computer.

After the reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.


IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
Post #7
hi thx for the help

here is the l2mfix log

Setting Directory
C:\
C:\
System Rebooted!

Running From:
C:\

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 1444 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 412 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\bdpass_idd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\bdpass_idd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\cemsnap.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\cemsnap.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\cwmcat.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\cwmcat.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dhnlobby.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\dhnlobby.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\douiext.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\douiext.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ffkutil.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ffkutil.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\fpusd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\fpusd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ioxrip.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ioxrip.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ktdcz.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ktdcz.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mbr2c.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mbr2c.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mgtlsapi.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mgtlsapi.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mhihnd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mhihnd.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\MjPMSP.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\MjPMSP.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mqc40.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mqc40.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mqvbvm60.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mqvbvm60.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mucsubs.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mucsubs.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mxieftp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\mxieftp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\nkdeapi.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\nkdeapi.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ove32.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ove32.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\parpnsp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\parpnsp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\qsdit.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\qsdit.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rJsser.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rJsser.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rOstls.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rOstls.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rTsmontr.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rTsmontr.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rYsmontr.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\rYsmontr.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\SJP32.DLL
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\SJP32.DLL
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\survdeps.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\survdeps.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ThnLib20.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\ThnLib20.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\tsrmmgr.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\tsrmmgr.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\uinpui.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\uinpui.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\uprlbva.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\uprlbva.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\uxrvpa.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\uxrvpa.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wgapi.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wgapi.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\WQASPINT.DLL
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\WQASPINT.DLL
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wqauserv.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wqauserv.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wvhext.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\wvhext.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\xilehlp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\xilehlp.dll
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 archivos copiados.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 archivos copiados.
deleting: C:\WINDOWS\system32\bdpass_idd.dll
Successfully Deleted: C:\WINDOWS\system32\bdpass_idd.dll
deleting: C:\WINDOWS\system32\bdpass_idd.dll
Successfully Deleted: C:\WINDOWS\system32\bdpass_idd.dll
deleting: C:\WINDOWS\system32\cemsnap.dll
Successfully Deleted: C:\WINDOWS\system32\cemsnap.dll
deleting: C:\WINDOWS\system32\cemsnap.dll
Successfully Deleted: C:\WINDOWS\system32\cemsnap.dll
deleting: C:\WINDOWS\system32\cwmcat.dll
Successfully Deleted: C:\WINDOWS\system32\cwmcat.dll
deleting: C:\WINDOWS\system32\cwmcat.dll
Successfully Deleted: C:\WINDOWS\system32\cwmcat.dll
deleting: C:\WINDOWS\system32\dhnlobby.dll
Successfully Deleted: C:\WINDOWS\system32\dhnlobby.dll
deleting: C:\WINDOWS\system32\dhnlobby.dll
Successfully Deleted: C:\WINDOWS\system32\dhnlobby.dll
deleting: C:\WINDOWS\system32\douiext.dll
Successfully Deleted: C:\WINDOWS\system32\douiext.dll
deleting: C:\WINDOWS\system32\douiext.dll
Successfully Deleted: C:\WINDOWS\system32\douiext.dll
deleting: C:\WINDOWS\system32\ffkutil.dll
Successfully Deleted: C:\WINDOWS\system32\ffkutil.dll
deleting: C:\WINDOWS\system32\ffkutil.dll
Successfully Deleted: C:\WINDOWS\system32\ffkutil.dll
deleting: C:\WINDOWS\system32\fpusd.dll
Successfully Deleted: C:\WINDOWS\system32\fpusd.dll
deleting: C:\WINDOWS\system32\fpusd.dll
Successfully Deleted: C:\WINDOWS\system32\fpusd.dll
deleting: C:\WINDOWS\system32\ioxrip.dll
Successfully Deleted: C:\WINDOWS\system32\ioxrip.dll
deleting: C:\WINDOWS\system32\ioxrip.dll
Successfully Deleted: C:\WINDOWS\system32\ioxrip.dll
deleting: C:\WINDOWS\system32\ktdcz.dll
Successfully Deleted: C:\WINDOWS\system32\ktdcz.dll
deleting: C:\WINDOWS\system32\ktdcz.dll
Successfully Deleted: C:\WINDOWS\system32\ktdcz.dll
deleting: C:\WINDOWS\system32\mbr2c.dll
Successfully Deleted: C:\WINDOWS\system32\mbr2c.dll
deleting: C:\WINDOWS\system32\mbr2c.dll
Successfully Deleted: C:\WINDOWS\system32\mbr2c.dll
deleting: C:\WINDOWS\system32\mgtlsapi.dll
Successfully Deleted: C:\WINDOWS\system32\mgtlsapi.dll
deleting: C:\WINDOWS\system32\mgtlsapi.dll
Successfully Deleted: C:\WINDOWS\system32\mgtlsapi.dll
deleting: C:\WINDOWS\system32\mhihnd.dll
Successfully Deleted: C:\WINDOWS\system32\mhihnd.dll
deleting: C:\WINDOWS\system32\mhihnd.dll
Successfully Deleted: C:\WINDOWS\system32\mhihnd.dll
deleting: C:\WINDOWS\system32\MjPMSP.dll
Successfully Deleted: C:\WINDOWS\system32\MjPMSP.dll
deleting: C:\WINDOWS\system32\MjPMSP.dll
Successfully Deleted: C:\WINDOWS\system32\MjPMSP.dll
deleting: C:\WINDOWS\system32\mqc40.dll
Successfully Deleted: C:\WINDOWS\system32\mqc40.dll
deleting: C:\WINDOWS\system32\mqc40.dll
Successfully Deleted: C:\WINDOWS\system32\mqc40.dll
deleting: C:\WINDOWS\system32\mqvbvm60.dll
Successfully Deleted: C:\WINDOWS\system32\mqvbvm60.dll
deleting: C:\WINDOWS\system32\mqvbvm60.dll
Successfully Deleted: C:\WINDOWS\system32\mqvbvm60.dll
deleting: C:\WINDOWS\system32\mucsubs.dll
Successfully Deleted: C:\WINDOWS\system32\mucsubs.dll
deleting: C:\WINDOWS\system32\mucsubs.dll
Successfully Deleted: C:\WINDOWS\system32\mucsubs.dll
deleting: C:\WINDOWS\system32\mxieftp.dll
Successfully Deleted: C:\WINDOWS\system32\mxieftp.dll
deleting: C:\WINDOWS\system32\mxieftp.dll
Successfully Deleted: C:\WINDOWS\system32\mxieftp.dll
deleting: C:\WINDOWS\system32\nkdeapi.dll
Successfully Deleted: C:\WINDOWS\system32\nkdeapi.dll
deleting: C:\WINDOWS\system32\nkdeapi.dll
Successfully Deleted: C:\WINDOWS\system32\nkdeapi.dll
deleting: C:\WINDOWS\system32\ove32.dll
Successfully Deleted: C:\WINDOWS\system32\ove32.dll
deleting: C:\WINDOWS\system32\ove32.dll
Successfully Deleted: C:\WINDOWS\system32\ove32.dll
deleting: C:\WINDOWS\system32\parpnsp.dll
Successfully Deleted: C:\WINDOWS\system32\parpnsp.dll
deleting: C:\WINDOWS\system32\parpnsp.dll
Successfully Deleted: C:\WINDOWS\system32\parpnsp.dll
deleting: C:\WINDOWS\system32\qsdit.dll
Successfully Deleted: C:\WINDOWS\system32\qsdit.dll
deleting: C:\WINDOWS\system32\qsdit.dll
Successfully Deleted: C:\WINDOWS\system32\qsdit.dll
deleting: C:\WINDOWS\system32\rJsser.dll
Successfully Deleted: C:\WINDOWS\system32\rJsser.dll
deleting: C:\WINDOWS\system32\rJsser.dll
Successfully Deleted: C:\WINDOWS\system32\rJsser.dll
deleting: C:\WINDOWS\system32\rOstls.dll
Successfully Deleted: C:\WINDOWS\system32\rOstls.dll
deleting: C:\WINDOWS\system32\rOstls.dll
Successfully Deleted: C:\WINDOWS\system32\rOstls.dll
deleting: C:\WINDOWS\system32\rTsmontr.dll
Successfully Deleted: C:\WINDOWS\system32\rTsmontr.dll
deleting: C:\WINDOWS\system32\rTsmontr.dll
Successfully Deleted: C:\WINDOWS\system32\rTsmontr.dll
deleting: C:\WINDOWS\system32\rYsmontr.dll
Successfully Deleted: C:\WINDOWS\system32\rYsmontr.dll
deleting: C:\WINDOWS\system32\rYsmontr.dll
Successfully Deleted: C:\WINDOWS\system32\rYsmontr.dll
deleting: C:\WINDOWS\system32\SJP32.DLL
Successfully Deleted: C:\WINDOWS\system32\SJP32.DLL
deleting: C:\WINDOWS\system32\SJP32.DLL
Successfully Deleted: C:\WINDOWS\system32\SJP32.DLL
deleting: C:\WINDOWS\system32\survdeps.dll
Successfully Deleted: C:\WINDOWS\system32\survdeps.dll
deleting: C:\WINDOWS\system32\survdeps.dll
Successfully Deleted: C:\WINDOWS\system32\survdeps.dll
deleting: C:\WINDOWS\system32\ThnLib20.dll
Successfully Deleted: C:\WINDOWS\system32\ThnLib20.dll
deleting: C:\WINDOWS\system32\ThnLib20.dll
Successfully Deleted: C:\WINDOWS\system32\ThnLib20.dll
deleting: C:\WINDOWS\system32\tsrmmgr.dll
Successfully Deleted: C:\WINDOWS\system32\tsrmmgr.dll
deleting: C:\WINDOWS\system32\tsrmmgr.dll
Successfully Deleted: C:\WINDOWS\system32\tsrmmgr.dll
deleting: C:\WINDOWS\system32\uinpui.dll
Successfully Deleted: C:\WINDOWS\system32\uinpui.dll
deleting: C:\WINDOWS\system32\uinpui.dll
Successfully Deleted: C:\WINDOWS\system32\uinpui.dll
deleting: C:\WINDOWS\system32\uprlbva.dll
Successfully Deleted: C:\WINDOWS\system32\uprlbva.dll
deleting: C:\WINDOWS\system32\uprlbva.dll
Successfully Deleted: C:\WINDOWS\system32\uprlbva.dll
deleting: C:\WINDOWS\system32\uxrvpa.dll
Successfully Deleted: C:\WINDOWS\system32\uxrvpa.dll
deleting: C:\WINDOWS\system32\uxrvpa.dll
Successfully Deleted: C:\WINDOWS\system32\uxrvpa.dll
deleting: C:\WINDOWS\system32\wgapi.dll
Successfully Deleted: C:\WINDOWS\system32\wgapi.dll
deleting: C:\WINDOWS\system32\wgapi.dll
Successfully Deleted: C:\WINDOWS\system32\wgapi.dll
deleting: C:\WINDOWS\system32\WQASPINT.DLL
Successfully Deleted: C:\WINDOWS\system32\WQASPINT.DLL
deleting: C:\WINDOWS\system32\WQASPINT.DLL
Successfully Deleted: C:\WINDOWS\system32\WQASPINT.DLL
deleting: C:\WINDOWS\system32\wqauserv.dll
Successfully Deleted: C:\WINDOWS\system32\wqauserv.dll
deleting: C:\WINDOWS\system32\wqauserv.dll
Successfully Deleted: C:\WINDOWS\system32\wqauserv.dll
deleting: C:\WINDOWS\system32\wvhext.dll
Successfully Deleted: C:\WINDOWS\system32\wvhext.dll
deleting: C:\WINDOWS\system32\wvhext.dll
Successfully Deleted: C:\WINDOWS\system32\wvhext.dll
deleting: C:\WINDOWS\system32\xilehlp.dll
Successfully Deleted: C:\WINDOWS\system32\xilehlp.dll
deleting: C:\WINDOWS\system32\xilehlp.dll
Successfully Deleted: C:\WINDOWS\system32\xilehlp.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp


Zipping up files for submission:
adding: bdpass_idd.dll (188 bytes security) (deflated 48%)
adding: cemsnap.dll (188 bytes security) (deflated 48%)
adding: cwmcat.dll (188 bytes security) (deflated 48%)
adding: dhnlobby.dll (188 bytes security) (deflated 48%)
adding: douiext.dll (188 bytes security) (deflated 48%)
adding: ffkutil.dll (188 bytes security) (deflated 48%)
adding: fpusd.dll (188 bytes security) (deflated 48%)
adding: ioxrip.dll (188 bytes security) (deflated 48%)
adding: ktdcz.dll (188 bytes security) (deflated 48%)
adding: mbr2c.dll (188 bytes security) (deflated 48%)
adding: mgtlsapi.dll (188 bytes security) (deflated 48%)
adding: mhihnd.dll (188 bytes security) (deflated 48%)
adding: MjPMSP.dll (188 bytes security) (deflated 48%)
adding: mqc40.dll (188 bytes security) (deflated 48%)
adding: mqvbvm60.dll (188 bytes security) (deflated 48%)
adding: mucsubs.dll (188 bytes security) (deflated 48%)
adding: mxieftp.dll (188 bytes security) (deflated 48%)
adding: nkdeapi.dll (188 bytes security) (deflated 48%)
adding: ove32.dll (188 bytes security) (deflated 48%)
adding: parpnsp.dll (188 bytes security) (deflated 48%)
adding: qsdit.dll (188 bytes security) (deflated 48%)
adding: rJsser.dll (188 bytes security) (deflated 48%)
adding: rOstls.dll (188 bytes security) (deflated 48%)
adding: rTsmontr.dll (188 bytes security) (deflated 48%)
adding: rYsmontr.dll (188 bytes security) (deflated 48%)
adding: SJP32.DLL (188 bytes security) (deflated 48%)
adding: survdeps.dll (188 bytes security) (deflated 48%)
adding: ThnLib20.dll (188 bytes security) (deflated 48%)
adding: tsrmmgr.dll (188 bytes security) (deflated 48%)
adding: uinpui.dll (188 bytes security) (deflated 48%)
adding: uprlbva.dll (188 bytes security) (deflated 48%)
adding: uxrvpa.dll (188 bytes security) (deflated 48%)
adding: wgapi.dll (188 bytes security) (deflated 48%)
adding: WQASPINT.DLL (188 bytes security) (deflated 48%)
adding: wqauserv.dll (188 bytes security) (deflated 48%)
adding: wvhext.dll (188 bytes security) (deflated 48%)
adding: xilehlp.dll (188 bytes security) (deflated 48%)
adding: guard.tmp (188 bytes security) (deflated 48%)
adding: clear.reg (188 bytes security) (deflated 51%)
adding: DV.txt (188 bytes security) (deflated 33%)
adding: lo2.txt (188 bytes security) (deflated 92%)
adding: test.txt (188 bytes security) (deflated 90%)
adding: test2.txt (188 bytes security) (deflated 33%)
adding: test3.txt (188 bytes security) (deflated 33%)
adding: test5.txt (188 bytes security) (deflated 33%)
adding: xfind.txt (188 bytes security) (deflated 87%)

Restoring Registry Permissions:


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!


Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!


Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Usuarios
(ID-IO) ALLOW Read BUILTIN\Usuarios
(ID-NI) ALLOW Read BUILTIN\Usuarios avanzados
(ID-IO) ALLOW Read BUILTIN\Usuarios avanzados
(ID-NI) ALLOW Full access BUILTIN\Administradores
(ID-IO) ALLOW Full access BUILTIN\Administradores
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER


Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators … failed (GetAccountSid(Administrators)=1332

Restoring Windows Update Certificates.:

deleting local copy: bdpass_idd.dll
deleting local copy: bdpass_idd.dll
deleting local copy: cemsnap.dll
deleting local copy: cemsnap.dll
deleting local copy: cwmcat.dll
deleting local copy: cwmcat.dll
deleting local copy: dhnlobby.dll
deleting local copy: dhnlobby.dll
deleting local copy: douiext.dll
deleting local copy: douiext.dll
deleting local copy: ffkutil.dll
deleting local copy: ffkutil.dll
deleting local copy: fpusd.dll
deleting local copy: fpusd.dll
deleting local copy: ioxrip.dll
deleting local copy: ioxrip.dll
deleting local copy: ktdcz.dll
deleting local copy: ktdcz.dll
deleting local copy: mbr2c.dll
deleting local copy: mbr2c.dll
deleting local copy: mgtlsapi.dll
deleting local copy: mgtlsapi.dll
deleting local copy: mhihnd.dll
deleting local copy: mhihnd.dll
deleting local copy: MjPMSP.dll
deleting local copy: MjPMSP.dll
deleting local copy: mqc40.dll
deleting local copy: mqc40.dll
deleting local copy: mqvbvm60.dll
deleting local copy: mqvbvm60.dll
deleting local copy: mucsubs.dll
deleting local copy: mucsubs.dll
deleting local copy: mxieftp.dll
deleting local copy: mxieftp.dll
deleting local copy: nkdeapi.dll
deleting local copy: nkdeapi.dll
deleting local copy: ove32.dll
deleting local copy: ove32.dll
deleting local copy: parpnsp.dll
deleting local copy: parpnsp.dll
deleting local copy: qsdit.dll
deleting local copy: qsdit.dll
deleting local copy: rJsser.dll
deleting local copy: rJsser.dll
deleting local copy: rOstls.dll
deleting local copy: rOstls.dll
deleting local copy: rTsmontr.dll
deleting local copy: rTsmontr.dll
deleting local copy: rYsmontr.dll
deleting local copy: rYsmontr.dll
deleting local copy: SJP32.DLL
deleting local copy: SJP32.DLL
deleting local copy: survdeps.dll
deleting local copy: survdeps.dll
deleting local copy: ThnLib20.dll
deleting local copy: ThnLib20.dll
deleting local copy: tsrmmgr.dll
deleting local copy: tsrmmgr.dll
deleting local copy: uinpui.dll
deleting local copy: uinpui.dll
deleting local copy: uprlbva.dll
deleting local copy: uprlbva.dll
deleting local copy: uxrvpa.dll
deleting local copy: uxrvpa.dll
deleting local copy: wgapi.dll
deleting local copy: wgapi.dll
deleting local copy: WQASPINT.DLL
deleting local copy: WQASPINT.DLL
deleting local copy: wqauserv.dll
deleting local copy: wqauserv.dll
deleting local copy: wvhext.dll
deleting local copy: wvhext.dll
deleting local copy: xilehlp.dll
deleting local copy: xilehlp.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\bdpass_idd.dll
C:\WINDOWS\system32\bdpass_idd.dll
C:\WINDOWS\system32\cemsnap.dll
C:\WINDOWS\system32\cemsnap.dll
C:\WINDOWS\system32\cwmcat.dll
C:\WINDOWS\system32\cwmcat.dll
C:\WINDOWS\system32\dhnlobby.dll
C:\WINDOWS\system32\dhnlobby.dll
C:\WINDOWS\system32\douiext.dll
C:\WINDOWS\system32\douiext.dll
C:\WINDOWS\system32\ffkutil.dll
C:\WINDOWS\system32\ffkutil.dll
C:\WINDOWS\system32\fpusd.dll
C:\WINDOWS\system32\fpusd.dll
C:\WINDOWS\system32\ioxrip.dll
C:\WINDOWS\system32\ioxrip.dll
C:\WINDOWS\system32\ktdcz.dll
C:\WINDOWS\system32\ktdcz.dll
C:\WINDOWS\system32\mbr2c.dll
C:\WINDOWS\system32\mbr2c.dll
C:\WINDOWS\system32\mgtlsapi.dll
C:\WINDOWS\system32\mgtlsapi.dll
C:\WINDOWS\system32\mhihnd.dll
C:\WINDOWS\system32\mhihnd.dll
C:\WINDOWS\system32\MjPMSP.dll
C:\WINDOWS\system32\MjPMSP.dll
C:\WINDOWS\system32\mqc40.dll
C:\WINDOWS\system32\mqc40.dll
C:\WINDOWS\system32\mqvbvm60.dll
C:\WINDOWS\system32\mqvbvm60.dll
C:\WINDOWS\system32\mucsubs.dll
C:\WINDOWS\system32\mucsubs.dll
C:\WINDOWS\system32\mxieftp.dll
C:\WINDOWS\system32\mxieftp.dll
C:\WINDOWS\system32\nkdeapi.dll
C:\WINDOWS\system32\nkdeapi.dll
C:\WINDOWS\system32\ove32.dll
C:\WINDOWS\system32\ove32.dll
C:\WINDOWS\system32\parpnsp.dll
C:\WINDOWS\system32\parpnsp.dll
C:\WINDOWS\system32\qsdit.dll
C:\WINDOWS\system32\qsdit.dll
C:\WINDOWS\system32\rJsser.dll
C:\WINDOWS\system32\rJsser.dll
C:\WINDOWS\system32\rOstls.dll
C:\WINDOWS\system32\rOstls.dll
C:\WINDOWS\system32\rTsmontr.dll
C:\WINDOWS\system32\rTsmontr.dll
C:\WINDOWS\system32\rYsmontr.dll
C:\WINDOWS\system32\rYsmontr.dll
C:\WINDOWS\system32\SJP32.DLL
C:\WINDOWS\system32\SJP32.DLL
C:\WINDOWS\system32\survdeps.dll
C:\WINDOWS\system32\survdeps.dll
C:\WINDOWS\system32\ThnLib20.dll
C:\WINDOWS\system32\ThnLib20.dll
C:\WINDOWS\system32\tsrmmgr.dll
C:\WINDOWS\system32\tsrmmgr.dll
C:\WINDOWS\system32\uinpui.dll
C:\WINDOWS\system32\uinpui.dll
C:\WINDOWS\system32\uprlbva.dll
C:\WINDOWS\system32\uprlbva.dll
C:\WINDOWS\system32\uxrvpa.dll
C:\WINDOWS\system32\uxrvpa.dll
C:\WINDOWS\system32\wgapi.dll
C:\WINDOWS\system32\wgapi.dll
C:\WINDOWS\system32\WQASPINT.DLL
C:\WINDOWS\system32\WQASPINT.DLL
C:\WINDOWS\system32\wqauserv.dll
C:\WINDOWS\system32\wqauserv.dll
C:\WINDOWS\system32\wvhext.dll
C:\WINDOWS\system32\wvhext.dll
C:\WINDOWS\system32\xilehlp.dll
C:\WINDOWS\system32\xilehlp.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{43F925F2-D0AD-4942-A4A7-7FAE91BD1166}"=-
"{6BC97BAA-20D4-4A6E-A6FE-5BF8773A2FA8}"=-
"{C911E85E-B98E-4002-ABA9-AE2BB325A84F}"=-
"{515BD146-AB03-4158-B7DF-A9BB4BF80CF0}"=-
[-HKEY_CLASSES_ROOT\CLSID\{43F925F2-D0AD-4942-A4A7-7FAE91BD1166}]
[-HKEY_CLASSES_ROOT\CLSID\{6BC97BAA-20D4-4A6E-A6FE-5BF8773A2FA8}]
[-HKEY_CLASSES_ROOT\CLSID\{C911E85E-B98E-4002-ABA9-AE2BB325A84F}]
[-HKEY_CLASSES_ROOT\CLSID\{515BD146-AB03-4158-B7DF-A9BB4BF80CF0}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************

and here os thi hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 12:11:01 a.m., on 09/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Archivos de programa\Microsoft AntiSpyware\gcasDtServ.exe
C:\Archivos de programa\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Carlos\Escritorio\PARA USO INMEDIATO\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webalta.com/?p1=313&p2=2&p3=42e…93f25034d27025d
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\Archivos de programa\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Archivos de programa\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - F:\ARCHIV~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Archivos de programa\ZyXEL\ADSL USB Modem\CnxDslTb.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Archivos de programa\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Pop-Up Stopper] "F:\ARCHIV~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKCU\..\Run: [TuneUp MemOptimizer] C:\Archivos de programa\TuneUp Utilities 2004\MemOptimizer.exe autostart
O4 - HKCU\..\Run: [BitComet] "C:\Archivos de programa\BitComet\BitComet.exe"
O8 - Extra context menu item: &Google Search - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &MSN Search - res://C:\Archivos de programa\MSN Toolbar Suite\TB\02.01.0000.2214\en-us\msntb.dll/search.htm
O8 - Extra context menu item: Download all by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download All Links with IDM - F:\Archivos de programa\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://F:\Archivos de programa\Free Download Manager\dlpage.htm
O8 - Extra context menu item: Download with IDM - F:\Archivos de programa\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Instantánea de caché de la página - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Páginas similares - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Páginas vinculadas - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Translate Site with Google - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\gtranslate.htm
O8 - Extra context menu item: Zoom &In - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\tuzoomin.htm
O8 - Extra context menu item: Zoom &Out - C:\Documents and Settings\Carlos\Datos de programa\TuneUp Software\TuneUp Utilities\Web\tuzoomout.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup156.cab
O18 - Protocol: bt2 - {1730B77B-F429-498F-9B15-4514D83C8294} - C:\ARCHIV~1\BT2Net\BT2PLU~1.DLL
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - C:\ARCHIV~1\BT2Net\BT2PLU~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Archivos de programa\TuneUp Utilities 2004\WinStylerThemeSvc.exe


God Bless You!!!!!!
Post #8
Looks good!!!! :thumbup:

How's it running? :unsure:

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #9
thx it seems to be fixed, I am going to keep running some stuff in the system, and I`ll do the things you recomende me God Bless you!!!!! :D
Post #10
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI