What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

MEP Snaped

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Here's my log: :scratch:


Logfile of HijackThis v1.99.1
Scan saved at 11:43:42 AM, on 9/15/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\WINNT\Explorer.exe
C:\Program Files\atce\trdb.exe
C:\WINNT\system32\??mbols\winword.exe
C:\Palm\HOTSYNC.EXE
C:\WINNT\system32\wuauclt.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Documents and Settings\MEP\Desktop\hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SDWin32 Class - {55DCDC95-C290-4FC0-B734-E4F1E332FB34} - C:\WINNT\system32\oszme.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKCU\..\Run: [Brct] C:\Program Files\atce\trdb.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - https://bba.bloomberg.net/Citrix/ICAWEB/en/ica32/wficat.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/19901bdf81ef61…ip/RdxIE601.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…367/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = seanoshea.com
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O20 - Winlogon Notify: Unimodem - C:\WINNT\system32\dqsapi.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
Post #2
I am adding a new HJT log because it's been a few days.
Thanks.

Logfile of HijackThis v1.99.1
Scan saved at 10:42:28 AM, on 9/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\WINNT\bWVw\command.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\WINNT\Explorer.exe
C:\WINNT\SysCheckBop32.exe
C:\WINNT\win3207391312033.exe
C:\winnt\system32\xyvzfwp.exe
C:\WINNT\tvanxcm.exe
C:\WINNT\system32\ddqqhk4m.exe
C:\Program Files\ISTsvc\istsvc.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\atce\trdb.exe
C:\WINNT\sys09131203339.exe
C:\Program Files\Internet Optimizer\optimize.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\WINNT\system32\spimmo.exe
C:\WINNT\system32\spimmo.exe
C:\Program Files\Common Files\Windows\services32.exe
C:\WINNT\SysCheckBop32.exe
C:\WINNT\system32\cmd.exe
C:\Program Files\Common Files\services.exe
C:\Palm\HOTSYNC.EXE
c:\winnt\system32\opdxrego.exe
C:\WINNT\system32\qsysrq2d.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\PROGRA~1\COMMON~1\oooi\oooil.exe
C:\Documents and Settings\MEP\Desktop\hijackthis\HijackThis.exe

R3 - URLSearchHook: (no name) - _{1EA52319-84B1-2646-F9A6-C53732D753A0} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINNT\nem220.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll
O2 - BHO: SDWin32 Class - {4E08AF12-5EC2-4164-9B39-151AB3348408} - C:\WINNT\system32\dvxbr.dll
O2 - BHO: (no name) - {4E508AC4-84C8-7A89-C4C4-8F0AE9FBDCA0} - C:\WINNT\Zakoijac.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SDWin32 Class - {55DCDC95-C290-4FC0-B734-E4F1E332FB34} - C:\WINNT\system32\oszme.dll (file missing)
O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\WINNT\system32\qlink32.dll
O2 - BHO: BAHelper Class - {A3FDD654-A057-4971-9844-4ED8E67DBBB8} - C:\Program Files\SideFind\sfbho.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINNT\system32\msbe.dll (file missing)
O2 - BHO: (no name) - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SystemCheck] C:\WINNT\SysCheckBop32
O4 - HKLM\..\Run: [win3207391312033] C:\WINNT\win3207391312033.exe
O4 - HKLM\..\Run: [TagASaurus] C:\Program Files\TagASaurus\TagASaurus
O4 - HKLM\..\Run: [testit.exe] C:\WINNT\system32\testit.exe
O4 - HKLM\..\Run: [mmxp2passion.exe] C:\WINNT\system32\mmxp2passion.exe
O4 - HKLM\..\Run: [mediapluscash.exe] C:\WINNT\system32\mediapluscash.exe
O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\lslkps.exe reg_run
O4 - HKLM\..\Run: [xyvzfwp] c:\winnt\system32\xyvzfwp.exe -start
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [SysStart] C:\WINNT\system32\qsysrq2d.exe DO0605
O4 - HKLM\..\Run: [CDG7G] C:\WINNT\tvanxcm.exe
O4 - HKLM\..\Run: [ddqqhk4m] C:\WINNT\system32\ddqqhk4m.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [dvxbrc] C:\WINNT\system32\dvxbrc.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [MediaGateway.exe] C:\WINNT\system32\MediaGateway.exe
O4 - HKLM\..\Run: [sys09131203339] C:\WINNT\sys09131203339.exe
O4 - HKLM\..\Run: [cashfortool.exe] C:\WINNT\system32\cashfortool.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKLM\..\Run: [ntdll.dll] c:\winnt\system32\opdxrego.exe SQ001
O4 - HKCU\..\Run: [Brct] C:\Program Files\atce\trdb.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [SysCheck32] C:\WINNT\SysCheckBop32.exe
O4 - HKCU\..\Run: [spimmo] C:\WINNT\system32\spimmo.exe
O4 - HKCU\..\Run: [oooi] C:\PROGRA~1\COMMON~1\oooi\oooim.exe
O4 - HKCU\..\RunOnce: [spimmo] C:\WINNT\system32\spimmo.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Startup: Zstart.lnk = C:\WINNT\SYSTEM32\zxinst_sq001.exe
O4 - Startup: Zeno.lnk = C:\WINNT\SYSTEM32\qsysrq2d.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\Program Files\SideFind\sidefind.dll
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - https://bba.bloomberg.net/Citrix/ICAWEB/en/ica32/wficat.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…367/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = seanoshea.com
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\WINNT\system32\qlink32.dll
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: WindowsUpdate - C:\WINNT\system32\dxkquota.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\bWVw\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
Post #3
Hello dawson, welcome to the TC.

BEFORE BEGINNING, Please read completely through the instructions below and download the files from the links provided. You may want to save or print out these instructions for easier reference.

First, download Ewido Security Suite.

Next, download Lavasoft's Ad-Aware and the VX2 Cleaner Plug-in. Install Ad-Aware using the default options, then install vx2cleaner_inst.exe, taking all the defaults there as well.

Run Ad-Aware, update to the latest definitions, then click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK", then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.

Reboot your PC and run Ad-Aware again. This time, click on the Start button in Ad-Aware, select "Perform smart system scan" and click Next. Once the scan finishes, click "Next" again. Select all objects found (right click anywhere in the list of found objects and click "Select All Objects"). Click "Next" one more time, then "OK" to confirm the removal.

You will be prompted to set Ad-Aware to run on reboot, click "OK". Exit Ad-Aware and restart your PC once again.

When Ad-Aware starts up, click on "Start", then "Next". Follow the steps above if anything is found, or click "Finish", then exit Ad-Aware.

For a final cleanup, please install and run Ewido.
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".

  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.

  • From the main ewido screen, click on update in the left menu, then click the Start update button.

  • After the update finishes (the status bar at the bottom will display "Update successful")

  • Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.

  • If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

  • When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.
Please finish up by rebooting your system once more, and posting a new HijackThis log and the log from the Ewido scan.
Post #4
I think I have a big problem. Our tech guy really screwed things up and now I can't even get on the web with IE or firefox. Here's my latest scan after the genius got done messing around:
Logfile of HijackThis v1.99.1
Scan saved at 7:11:33 PM, on 9/20/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\WINNT\Explorer.exe
C:\WINNT\SYSTEM32\RUNDLL32.EXE
C:\Documents and Settings\MEP\Desktop\hijackthis\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe C:\WINNT\Nail.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - https://bba.bloomberg.net/Citrix/ICAWEB/en/ica32/wficat.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…367/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = seanoshea.com
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\WINNT\system32\qlink32.dll
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: App Management - C:\WINNT\system32\dxkquota.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\bWVw\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
Post #5

I think I have a big problem. Our tech guy really screwed things up and now I can't even get on the web with IE or firefox.

How are you posting this HJT log if you can't get on the web?
Post #6
I am saving the log on the network and posting from a co-worker's computer. For some reason, IE starts to load and then generates an error message and Firefox doesn't even begin to load before an error message appears.
Post #9
I am no longer at the office. I will try to get the adaware plug in tomorrow and run that along with the regedit program. I will post a new log tomorrow morning. Thanks for your help.
Post #11
I ran the VX2 cleaner and it found a variant of VX2 but it could not clean it. Said I need a newer cleaner. I also ran AdAware, Ewido, and Winsockfix. Here are the HJT and Ewido logs:
Logfile of HijackThis v1.99.1
Scan saved at 10:36:14 AM, on 9/21/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\WINNT\bWVw\command.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\lslkps.exe
C:\WINNT\sys01312033391.exe
C:\WINNT\YourMonitor.exe
C:\WINNT\YourMonitor.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Documents and Settings\MEP\Desktop\hijackthis\HijackThis.exe

O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O4 - HKLM\..\Run: [ntdll.dll] C:\WINNT\system32\lslkps.exe reg_run
O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\lslkps.exe reg_run
O4 - HKLM\..\Run: [sys01312033391] C:\WINNT\sys01312033391.exe
O4 - HKLM\..\Run: [YourMonitor] C:\WINNT\YourMonitor
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [YourMonitor] C:\WINNT\YourMonitor.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: nrnd.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - https://bba.bloomberg.net/Citrix/ICAWEB/en/ica32/wficat.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…367/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = seanoshea.com
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: Setup - C:\WINNT\system32\dxkquota.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\bWVw\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe



———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 10:35:32 AM, 9/21/2005
+ Report-Checksum: 8AC83168

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{3643ABC2-21BF-46B9-B230-F247DB0C6FD6} -> Spyware.E2Give : Cleaned with backup
HKLM\SOFTWARE\Classes\IeBHOs.Control -> Spyware.E2G : Cleaned with backup
HKLM\SOFTWARE\Classes\IeBHOs.Control\CLSID -> Spyware.E2G : Cleaned with backup
HKLM\SOFTWARE\Classes\IeBHOs.Control\CurVer -> Spyware.E2G : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3643ABC2-21BF-46B9-B230-F247DB0C6FD6} -> Spyware.E2Give : Cleaned with backup
HKLM\SOFTWARE\SecureWin -> Spyware.Adlogix : Cleaned with backup
[580] C:\WINNT\system32\mjdmo.dll -> Spyware.Look2Me : Error during cleaning
[1388] C:\Program Files\E2G\IeBHOs.dll -> Spyware.E2Give : Cleaned with backup
[1600] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
[1624] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Error during cleaning
[1684] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Error during cleaning
[1720] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Error during cleaning
[1660] C:\Program Files\Common Files\Windows\services32.exe -> Spyware.Maxifiles : Cleaned with backup
C:\WINNT\SYSTEM32\AUNPS2.dll -> Spyware.Hijacker.Generic : Cleaned with backup
C:\WINNT\SYSTEM32\jetsyn.exe -> TrojanSpy.VB.eh : Cleaned with backup
C:\WINNT\SYSTEM32\dvxbrd.exe -> Spyware.Adstart : Cleaned with backup
C:\WINNT\SYSTEM32\NLTEVENT.DLL -> Spyware.Look2Me : Cleaned with backup
C:\WINNT\SYSTEM32\qsysrq2d.exe -> Spyware.ZenoSearch : Cleaned with backup
C:\WINNT\SYSTEM32\spimmo.exe -> TrojanSpy.VB.eh : Cleaned with backup
C:\WINNT\SYSTEM32\aclmws.exe -> TrojanSpy.VB.eh : Cleaned with backup
C:\WINNT\SYSTEM32\jgslgn.exe -> TrojanSpy.VB.eh : Cleaned with backup
C:\WINNT\SYSTEM32\oszmed.exe -> Spyware.Adstart : Cleaned with backup
C:\WINNT\SYSTEM32\dun.exe -> Spyware.DealHelper : Cleaned with backup
C:\WINNT\SYSTEM32\mediapluscash.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\WINNT\SYSTEM32\wuauclt.dll -> TrojanDownloader.Small : Cleaned with backup
C:\WINNT\SYSTEM32\vgactl.cpl -> TrojanDownloader.Qoologic.ad : Cleaned with backup
C:\WINNT\SYSTEM32\pwpqu.dat -> TrojanDownloader.Qoologic.ac : Cleaned with backup
C:\WINNT\SYSTEM32\bdbcadd.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
C:\WINNT\SYSTEM32\2bundle.exe -> TrojanDropper.Agent.hl : Cleaned with backup
C:\WINNT\SYSTEM32\MTE2ODI6ODoxNg.exe -> Spyware.ISearch : Cleaned with backup
C:\WINNT\SYSTEM32\msclock32.dll -> Dialer.Generic : Cleaned with backup
C:\WINNT\temp\b.com -> TrojanDropper.Agent.pb : Cleaned with backup
C:\WINNT\temp\MediaAccessInstPack.exe -> Spyware.WinAD : Cleaned with backup
C:\WINNT\temp\180SAInstallerAdPerform.exe/clientax.dll -> Spyware.180Solutions : Cleaned with backup
C:\WINNT\temp\180SAInstallerAdPerform.exe/clientax.dll -> Spyware.180Solutions : Cleaned with backup
C:\WINNT\temp\res2E.tmp -> Spyware.180Solutions : Cleaned with backup
C:\WINNT\temp\jfghjfgudk.exe -> TrojanDownloader.IstBar.lq : Cleaned with backup
C:\WINNT\temp\CLEANexp.exe -> TrojanDownloader.Small.abd : Cleaned with backup
C:\WINNT\icont.exe -> Spyware.AdURL : Cleaned with backup
C:\RECYCLED\Dc598.tmp -> Spyware.180Solutions : Cleaned with backup
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\M13L9QOV\!update-2524[1].0000 -> TrojanDownloader.PurityScan.an : Cleaned with backup
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\M3QKH8GF\!update-2534[1].0000 -> TrojanDownloader.PurityScan.an : Cleaned with backup
C:\Documents and Settings\MEP\Cookies\[removed][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\MEP\Cookies\mep@linkbuddies[1].txt -> Spyware.Cookie.Linkbuddies : Cleaned with backup
C:\Documents and Settings\MEP\Cookies\[removed][1].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\MEP\Cookies\[removed][3].txt -> Spyware.Cookie.Liveperson : Cleaned with backup
C:\Documents and Settings\MEP\Cookies\[removed][2].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
C:\Documents and Settings\MEP\Desktop\hijackthis\backups\backup-20050920-172752-571.dll -> Spyware.E2Give : Cleaned with backup
C:\Documents and Settings\MEP\Desktop\hijackthis\backups\backup-20050920-182921-974.dll -> Spyware.E2Give : Cleaned with backup
C:\Documents and Settings\MEP\Desktop\hijackthis\backups\backup-20050920-182922-588.dll -> Spyware.Adstart : Cleaned with backup
C:\Documents and Settings\MEP\Desktop\hijackthis\backups\backup-20050920-183155-653.dll -> Spyware.E2Give : Cleaned with backup
C:\Documents and Settings\MEP\Desktop\hijackthis\backups\backup-20050920-190800-541-nrnd.exe -> TrojanDownloader.Qoologic.ac : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O9QX4TCJ\AppWrap[2].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O9QX4TCJ\AppWrap[4].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O9QX4TCJ\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O9QX4TCJ\AppWrap[3].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O5EJC5UN\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O5EJC5UN\AppWrap[2].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O5EJC5UN\AppWrap[3].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\09UV0DAB\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\09UV0DAB\maxifilesdns[1].zip/gui.exe -> TrojanDownloader.Agent.rv : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\09UV0DAB\AppWrap[2].exe -> Spyware.AdURL : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\09UV0DAB\AppWrap[3].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\KLYJ6509\rcverlib[1].exe -> Trojan.Pakes : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\KLYJ6509\AppWrap[1].exe -> Spyware.AdURL : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\ei.exe -> TrojanDownloader.Small.bgl : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\b.com -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\!update.exe -> TrojanDownloader.PurityScan.an : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\tm5622.exe -> Trojan.Pakes : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\01E6LNIC.dll -> Adware.SAHA : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\180sainstallersilsais1.exe/clientax.dll -> Spyware.180Solutions : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\180sainstallersilsais1.exe/clientax.dll -> Spyware.180Solutions : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\MediaAccessInstPack.exe -> Spyware.WinAD : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\180sainstallersca.exe/clientax.dll -> Spyware.180Solutions : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\180sainstallersca.exe/clientax.dll -> Spyware.180Solutions : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temp\res18A.tmp -> Spyware.180Solutions : Cleaned with backup
:mozilla.8:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.9:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.10:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.11:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.12:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.13:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.19:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
-> : Error during cleaning
:mozilla.21:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.22:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.34:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
:mozilla.38:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.39:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
:mozilla.55:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.56:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.57:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup
:mozilla.89:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.90:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.91:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.92:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.93:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.94:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.95:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup
:mozilla.102:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.103:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.104:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.105:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.106:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
:mozilla.115:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.116:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.117:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.118:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.119:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.120:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.121:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
:mozilla.133:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.134:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup
:mozilla.150:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.151:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
:mozilla.177:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup
:mozilla.178:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
C:\Program Files\Common Files\Windows\services32.exe -> Spyware.Maxifiles : Cleaned with backup
C:\Program Files\Common Files\oooi\oooil.exe -> TrojanDownloader.TSUpdate.j : Cleaned with backup
C:\Program Files\Common Files\oooi\oooip.exe -> Spyware.Xupiter : Cleaned with backup
C:\Program Files\Common Files\oooi\oooia.exe -> TrojanDownloader.TSUpdate.l : Cleaned with backup
C:\Program Files\Common Files\services.exe -> Spyware.Maxifiles : Cleaned with backup
C:\Program Files\Common Files\system32.dll/gui.exe -> TrojanDownloader.Agent.rv : Cleaned with backup
C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL -> Spyware.MyWay : Cleaned with backup
C:\Program Files\Creative\NOMAD Jukebox Zen NX\Creative File Manager 2\MTE2NzY6ODoxNg.exe -> Spyware.ISearch : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\5FD0BF32-731C-403E-862B-6BF2C5\5B79B929-99A1-437E-8CA8-DEEBDF -> Trojan.Agent.iw : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\EE6C9084-E3F2-49DB-A220-D76E94\FB24A8B9-D531-4970-B64C-E5D609 -> Trojan.Agent.iw : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\3FF40C8C-1A41-4108-8501-55F82F\4E042F16-827D-4DC3-B368-030F42 -> Spyware.180Solutions : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\51CF3628-ED02-44F7-A055-BE818F\B00E630A-86FD-40F1-BD49-582521 -> Spyware.E2Give : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\B87C2B8A-0E11-473E-A90F-A8E347\20C449A5-86B5-44EA-993F-791941 -> Spyware.E2Give : Cleaned with backup
C:\Program Files\Mozilla Firefox\plugins\npzango.dll -> Spyware.WinAD : Cleaned with backup
C:\Program Files\DNS\gui.exe -> TrojanDownloader.Agent.rv : Cleaned with backup
C:\Program Files\E2G\IeBHOs.dll -> Spyware.E2Give : Cleaned with backup


::Report End
Post #12
Are you able to use the web now?

Let's run these again. No need to download them again, just run per instructions.




BEFORE BEGINNING, Please read completely through the instructions below and download the files from the links provided. You may want to save or print out these instructions for easier reference.

First, download Ewido Security Suite.

Next, download Lavasoft's Ad-Aware and the VX2 Cleaner Plug-in. Install Ad-Aware using the default options, then install vx2cleaner_inst.exe, taking all the defaults there as well.

Run Ad-Aware, update to the latest definitions, then click on Add-ons in the lefthand column. Select VX2 Cleaner V2.0 and click Run Tool. Click "OK", then, if something is found, click "Clean" as in the directions given. Click "Close", and exit Ad-Aware.

Reboot your PC and run Ad-Aware again. This time, click on the Start button in Ad-Aware, select "Perform smart system scan" and click Next. Once the scan finishes, click "Next" again. Select all objects found (right click anywhere in the list of found objects and click "Select All Objects"). Click "Next" one more time, then "OK" to confirm the removal.

You will be prompted to set Ad-Aware to run on reboot, click "OK". Exit Ad-Aware and restart your PC once again.

When Ad-Aware starts up, click on "Start", then "Next". Follow the steps above if anything is found, or click "Finish", then exit Ad-Aware.

For a final cleanup, please install and run Ewido.
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".

  • When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.

  • From the main ewido screen, click on update in the left menu, then click the Start update button.

  • After the update finishes (the status bar at the bottom will display "Update successful")

  • Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.

  • If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

  • When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.
Please finish up by rebooting your system once more, and posting a new HijackThis log and the log from the Ewido scan.
Post #13
It still says the VX2 clean failed. Here are the new logs :rofl:

———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 6:21:57 PM, 9/21/2005
+ Report-Checksum: 2E9E7F45

+ Scan result:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Surf SideKick -> Spyware.SurfSide : Cleaned with backup
[1248] C:\WINNT\system32\soorprop.dll -> Spyware.Look2Me : Error during cleaning
[1344] C:\WINNT\system32\jejda.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
[1456] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
[1464] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Error during cleaning
[1516] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Error during cleaning
[1588] C:\WINNT\system32\sfsdsff.dll -> TrojanDownloader.Qoologic.ac : Error during cleaning
[1432] C:\Program Files\Common Files\Windows\services32.exe -> Spyware.Maxifiles : Cleaned with backup
C:\WINNT\SYSTEM32\pwpqu.dat -> TrojanDownloader.Qoologic.ac : Cleaned with backup
C:\WINNT\SYSTEM32\ngsh33.dll -> Spyware.AdBlaster : Cleaned with backup
C:\WINNT\SYSTEM32\jejda.dll -> TrojanDownloader.Qoologic.ac : Cleaned with backup
C:\WINNT\sngsh33.dll -> Spyware.AdBlaster : Cleaned with backup
C:\WINNT\temp\b.com -> TrojanDropper.Agent.pb : Cleaned with backup
C:\WINNT\temp\i9B.tmp -> Spyware.SurfSide : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\O5EJC5UN\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
C:\Documents and Settings\MEP\Local Settings\Temporary Internet Files\Content.IE5\09UV0DAB\AppWrap[1].exe -> TrojanDropper.Agent.pb : Cleaned with backup
:mozilla.10:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.11:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
:mozilla.14:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
:mozilla.20:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.21:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.22:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.23:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.31:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.36:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.37:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.38:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.39:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.40:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.41:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.42:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.43:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.44:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup
:mozilla.45:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.52:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.54:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
:mozilla.56:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.68:C:\Documents and Settings\MEP\Application Data\Mozilla\Firefox\Profiles\bpqwijwg.default\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Program Files\Common Files\Windows\services32.exe -> Spyware.Maxifiles : Cleaned with backup
C:\Program Files\Common Files\services.exe -> Spyware.Maxifiles : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\921890DF-7541-4F64-AD3C-3E311C\B2614E22-A5A1-4830-A8F0-DF19CE -> Spyware.E2Give : Cleaned with backup


::Report End


Logfile of HijackThis v1.99.1
Scan saved at 6:22:27 PM, on 9/21/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
C:\WINNT\bWVw\command.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\Program Files\NavNT\defwatch.exe
C:\DMI\WIN32\bin\DellDmi.exe
C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
C:\Program Files\Dell\OpenManage\Client\DLT.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\dmi\win32\bin\Win32sl.exe
C:\WINNT\system32\MsPMSPSv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\SYSTEM32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\lslkps.exe
C:\WINNT\sys01312033391.exe
C:\WINNT\YourMonitor.exe
C:\WINNT\YourMonitor.exe
C:\Palm\HOTSYNC.EXE
C:\Documents and Settings\MEP\Desktop\hijackthis\HijackThis.exe

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O4 - HKLM\..\Run: [ntdll.dll] C:\WINNT\system32\lslkps.exe reg_run
O4 - HKLM\..\Run: [winsync] C:\WINNT\system32\lslkps.exe reg_run
O4 - HKLM\..\Run: [sys01312033391] C:\WINNT\sys01312033391.exe
O4 - HKLM\..\Run: [YourMonitor] C:\WINNT\YourMonitor
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [adprot] C:\WINNT\system32\adprot.exe
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000106.exe
O4 - HKCU\..\Run: [YourMonitor] C:\WINNT\YourMonitor.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: nrnd.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra 'Tools' menuitem: Java - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - https://bba.bloomberg.net/Citrix/ICAWEB/en/ica32/wficat.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…367/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = seanoshea.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = seanoshea.com
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: Applets - C:\WINNT\system32\dxkquota.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINNT\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: ActionAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINNT\bWVw\command.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: DellDmi - Dell Computer Corporation - C:\DMI\WIN32\bin\DellDmi.exe
O23 - Service: DEventAgent - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
O23 - Service: DLT - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\DLT.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: Win32Sl - Intel - C:\dmi\win32\bin\Win32sl.exe
Post #14
You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."…then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.
Post #15
I got the error you mentioned when I ran l2mfix but it still generated a log. (I tried 5 and the link and unzipped the files and did it again but I still got the error plus a log). The log I got is: L2MFIX find log 1.04a These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Applets] "Asynchronous"=dword:00000000 "DllName"="C:\\WINNT\\system32\\dxkquota.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Read BUILTIN\Power Users (ID-IO) ALLOW Read BUILTIN\Power Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{244DC9BB-28F4-8DD6-65CD-E2BCDEF8212F}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network and Dial-up Connections" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder" "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="My Computer" "{86747AC0-42A0-1069-A2E6-08002B30309D}"="Briefcase Folder" "{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Folder Shortcut" "{12518493-00B2-11d2-9FA5-9E3420524153}"="Mounted Volume" "{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension" "{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page" "{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook" "{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service" "{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service" "{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service" "{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View" "{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Start Menu" "{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service" "{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service" "{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler" "{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions" "{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop" "{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension" "{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon" "{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag and Drop helper" "{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Add encryption item to context menus in explorer" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder" "{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band" "{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu" "{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site" "{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails" "{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor" "{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{BDA77241-42F6-11d0-85E2-00AA001FE28C}"="LDVP Shell Extensions" "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79307-84BE-11CE-9641-444553540000}"="WinZip" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{A68865DD-EE3C-4442-9BE9-1BAB2576E3FA}"="NOMAD Jukebox 2/3/Zen" "{4366F83A-2009-4DF7-99F9-4F7DD1B255EE}"="" "{5C4FEF43-6538-456A-AAE1-26468F277560}"="" "{4DC7B699-53FF-406D-A5BD-899FA5123893}"="" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{5C4FEF43-6538-456A-AAE1-26468F277560}] @="" [HKEY_CLASSES_ROOT\CLSID\{5C4FEF43-6538-456A-AAE1-26468F277560}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{5C4FEF43-6538-456A-AAE1-26468F277560}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{5C4FEF43-6538-456A-AAE1-26468F277560}\InprocServer32] @="C:\\WINNT\\system32\\IAMP.DLL" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{4DC7B699-53FF-406D-A5BD-899FA5123893}] @="" [HKEY_CLASSES_ROOT\CLSID\{4DC7B699-53FF-406D-A5BD-899FA5123893}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{4DC7B699-53FF-406D-A5BD-899FA5123893}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{4DC7B699-53FF-406D-A5BD-899FA5123893}\InprocServer32] @="C:\\WINNT\\system32\\soorprop.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is 07D2-010B Directory of C:\WINNT\System32 09/21/2005 05:54p 417,792 soorprop.dll 09/16/2005 11:32a 417,792 dxkquota.dll 01/11/2002 06:20a dllcache 2 File(s) 835,584 bytes 1 Dir(s) 6,200,688,640 bytes free

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI