What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan.Vundo - Norton can't fix

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I hope you can help! If not then thank you for trying.

Norton AntiVirus has detected a virus on my computer. It is a Trojan.Vundo virus in C:\WINDOWS\AppPatch\sommp3.dll. Norton says that it is unable to repair this file. I visited their website and followed their detailed instructions on how to remove this virus but it did not work. Can you help?

I tried to follow the instructions that someone gave to another user that had a vundo virus but I still couldn't get rid of it.

Here is my Hijack this log.

Logfile of HijackThis v1.98.2
Scan saved at 9:23:20 AM, on 10/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\QUICKENW\bagent.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Teresa\My Documents\HJT\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ne1.attbb.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-5812EB50A834} - C:\WINDOWS\AppPatch\commp3.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [System Support] system32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\RunServices: [System Support] system32.exe
O4 - HKCU\..\Run: [System Support] system32.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: symsupportutil - https://www-secure.symantec.com/techsupp/ac…supportutil.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_1/axofupld.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
Post #3
Sorry haven't done this in a long time. I seem to have gotten rid of the C:\WINDOWS\AppPatch\commp3.dll using VUNDOFIX but now I have another one. C:\WINDOWS\Help\SBSI\javaas.dll

Here is the log:

Logfile of HijackThis v1.99.1
Scan saved at 3:25:04 PM, on 10/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\QUICKENW\bagent.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Teresa\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\PANELS\BLANK.HTM
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ne1.attbb.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\Fonts\ftpap.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [System Support] system32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\RunServices: [System Support] system32.exe
O4 - HKCU\..\Run: [System Support] system32.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: symsupportutil - https://www-secure.symantec.com/techsupp/ac…supportutil.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_1/axofupld.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O20 - Winlogon Notify: avw2 - c:\windows\system32\avw2.dll
O20 - Winlogon Notify: commp3 - C:\WINDOWS\
O20 - Winlogon Notify: ftpap - C:\WINDOWS\Fonts\ftpap.dll
O20 - Winlogon Notify: javaas - C:\WINDOWS\Help\SBSI\javaas.dll
O20 - Winlogon Notify: psbas - C:\WINDOWS\
O20 - Winlogon Notify: req - C:\WINDOWS\
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #4
Run Hijack This!

Click the "Open the Misc Tools section" button.

Click the "Open process manager" button.

Check the "Show DLLs" box (upper right).

Click on each item in the upper window, then look in the lower window.

Check to see which processes are using these DLL's:

c:\windows\system32\avw2.dll
C:\WINDOWS\Fonts\ftpap.dll
C:\WINDOWS\Help\SBSI\javaas.dll

Post back letting me know all processes using those DLL's.

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe

http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing .

This will scan your computer and it may appear nothing is happening, then, after a minute or 2, Notepad will open with a log. Copy/paste the contents of that log into this thread.


IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!



Copy the text in the following quote box into Notepad:

dir C:\WINDOWS\Fonts\ /ah > files.txt
dir C:\WINDOWS\Fonts\ >> files.txt
dir C:\WINDOWS\Help\SBSI\ /ah >> files.txt
dir C:\WINDOWS\Help\SBSI\ >> files.txt
notepad files.txt

Save it to your desktop as ff.bat.

Close Notepad

Now, the ff.bat file on the desktop.

Wait for a Notepad window to open up.

Please paste it's contents into your next post.
Post #5
Ok here we go:

C:\WINDOWS\system32\avw2.dll is used by windows\system32\winlogon.exe
C:\WINDOWS\fonts\ftpap.dll is used by windows\explorer.exe
C:\WINDOWS\help\SBSI\javaas.dll is used by windows\system32\winlogon.exe

l2mfix log:

L2MFIX find log 1.03d
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avw2]
"Asynchronous"=dword:00000000
"DllName"="c:\\windows\\system32\\avw2.dll"
"Impersonate"=dword:00000000
"Startup"="LogonWinEvent"
"Logoff"="LogoffWinEvent"
"CLSID"=""

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\commp3]
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ftpap]
"Asynchronous"=dword:00000001
"DllName"="C:\\WINDOWS\\Fonts\\ftpap.dll"
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\javaas]
"Asynchronous"=dword:00000001
"DllName"="C:\\WINDOWS\\Help\\SBSI\\javaas.dll"
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psbas]
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\req]
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000000
"Logon"="Logon"
"Logoff"="Logoff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000


RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access Everyone
(IO) ALLOW Full access Everyone


**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…"
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{A4DF5659-0801-4A60-9607-1C48695EFDA9}"="Share-to-Web Upload Folder"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 84BA-AE56

Directory of C:\WINDOWS\System32

10/08/2005 05:14 PM DLLCACHE
08/29/2005 10:38 PM 26,112 mljjg.dll
08/04/2004 02:56 AM 11,776 regsvr32.exe
08/04/2004 02:56 AM 553,472 oleaut32.dll
08/04/2004 02:56 AM 83,456 olepro32.dll
08/04/2004 02:56 AM 54,784 msvcirt.dll
08/04/2004 02:56 AM 413,696 msvcp60.dll
08/04/2004 02:56 AM 343,040 msvcrt.dll
08/04/2004 02:56 AM 1,028,096 mfc42.dll
02/08/2004 06:35 PM 3,584 Thumbs.db
11/16/2003 09:36 PM 1,020 KrwH5f.117
10/22/2002 11:21 AM Microsoft
10 File(s) 2,519,036 bytes
2 Dir(s) 20,655,902,720 bytes free

ff.bat results:

Volume in drive C has no label.
Volume Serial Number is 84BA-AE56

Directory of C:\WINDOWS\Fonts

08/18/2001 06:00 AM 10,976 8514FIX.FON
08/18/2001 06:00 AM 10,976 8514FIXE.FON
08/18/2001 06:00 AM 11,520 8514FIXG.FON
08/18/2001 06:00 AM 10,976 8514FIXR.FON
08/18/2001 06:00 AM 11,488 8514FIXT.FON
08/18/2001 06:00 AM 12,288 8514OEM.FON
08/18/2001 06:00 AM 13,248 8514OEME.FON
08/18/2001 06:00 AM 12,800 8514OEMG.FON
08/18/2001 06:00 AM 13,200 8514OEMR.FON
08/18/2001 06:00 AM 12,720 8514OEMT.FON
08/18/2001 06:00 AM 9,280 8514SYS.FON
08/18/2001 06:00 AM 9,504 8514SYSE.FON
08/18/2001 06:00 AM 9,856 8514SYSG.FON
08/18/2001 06:00 AM 10,064 8514SYSR.FON
08/18/2001 06:00 AM 9,792 8514SYST.FON
08/18/2001 06:00 AM 12,304 85775.FON
08/18/2001 06:00 AM 12,256 85855.FON
08/18/2001 06:00 AM 10,976 85F1257.FON
08/18/2001 06:00 AM 9,472 85S1257.FON
08/18/2001 06:00 AM 35,808 APP775.FON
08/18/2001 06:00 AM 36,672 APP850.FON
08/18/2001 06:00 AM 36,656 APP852.FON
08/18/2001 06:00 AM 37,296 APP855.FON
08/18/2001 06:00 AM 36,672 APP857.FON
08/18/2001 06:00 AM 37,472 APP866.FON
08/18/2001 06:00 AM 7,216 CGA40737.FON
08/18/2001 06:00 AM 6,352 CGA40850.FON
08/18/2001 06:00 AM 6,672 CGA40852.FON
08/18/2001 06:00 AM 6,672 CGA40857.FON
08/18/2001 06:00 AM 7,232 CGA40866.FON
08/18/2001 06:00 AM 7,216 CGA40869.FON
08/18/2001 06:00 AM 6,336 CGA40WOA.FON
08/18/2001 06:00 AM 5,168 CGA80737.FON
08/18/2001 06:00 AM 4,320 CGA80850.FON
08/18/2001 06:00 AM 5,200 CGA80852.FON
08/18/2001 06:00 AM 4,640 CGA80857.FON
08/18/2001 06:00 AM 5,168 CGA80866.FON
08/18/2001 06:00 AM 5,168 CGA80869.FON
08/18/2001 06:00 AM 4,304 CGA80WOA.FON
08/18/2001 06:00 AM 23,440 COUE1257.FON
08/18/2001 06:00 AM 31,760 COUF1257.FON
08/18/2001 06:00 AM 23,408 COURE.FON
08/18/2001 06:00 AM 23,440 COUREE.FON
08/18/2001 06:00 AM 25,024 COUREG.FON
08/18/2001 06:00 AM 23,440 COURER.FON
08/18/2001 06:00 AM 25,024 COURET.FON
08/18/2001 06:00 AM 31,712 COURF.FON
08/18/2001 06:00 AM 31,776 COURFE.FON
08/18/2001 06:00 AM 33,344 COURFG.FON
08/18/2001 06:00 AM 31,808 COURFR.FON
08/18/2001 06:00 AM 33,360 COURFT.FON
11/15/2001 07:30 AM 67 DESKTOP.INI
08/18/2001 06:00 AM 36,336 DOS737.FON
08/18/2001 06:00 AM 36,656 DOSAPP.FON
08/18/2001 06:00 AM 9,248 EGA40737.FON
08/18/2001 06:00 AM 8,384 EGA40850.FON
08/18/2001 06:00 AM 8,368 EGA40852.FON
08/18/2001 06:00 AM 8,704 EGA40857.FON
08/18/2001 06:00 AM 9,232 EGA40866.FON
08/18/2001 06:00 AM 9,248 EGA40869.FON
08/18/2001 06:00 AM 8,368 EGA40WOA.FON
08/18/2001 06:00 AM 6,192 EGA80737.FON
08/18/2001 06:00 AM 5,328 EGA80850.FON
08/18/2001 06:00 AM 5,344 EGA80852.FON
08/18/2001 06:00 AM 5,648 EGA80857.FON
08/18/2001 06:00 AM 5,280 EGA80866.FON
08/18/2001 06:00 AM 6,192 EGA80869.FON
08/18/2001 06:00 AM 5,312 EGA80WOA.FON
08/18/2001 06:00 AM 24,124 MARLETT.TTF
08/31/2005 02:18 PM 544,624 paptf.bak1
10/14/2005 11:11 AM 335,947 paptf.bak2
10/14/2005 08:17 PM 335,934 paptf.ini
10/14/2005 08:17 PM 335,998 paptf.ini2
08/18/2001 06:00 AM 59,024 SERE1257.FON
08/18/2001 06:00 AM 84,080 SERF1257.FON
08/18/2001 06:00 AM 57,936 SERIFE.FON
08/18/2001 06:00 AM 59,952 SERIFEE.FON
08/18/2001 06:00 AM 60,752 SERIFEG.FON
08/18/2001 06:00 AM 63,296 SERIFER.FON
08/18/2001 06:00 AM 61,024 SERIFET.FON
08/18/2001 06:00 AM 81,728 SERIFF.FON
08/18/2001 06:00 AM 85,360 SERIFFE.FON
08/18/2001 06:00 AM 86,256 SERIFFG.FON
08/18/2001 06:00 AM 90,736 SERIFFR.FON
08/18/2001 06:00 AM 84,848 SERIFFT.FON
08/18/2001 06:00 AM 24,672 SMAE1257.FON
08/18/2001 06:00 AM 19,904 SMAF1257.FON
08/18/2001 06:00 AM 26,112 SMALLE.FON
08/18/2001 06:00 AM 24,784 SMALLEE.FON
08/18/2001 06:00 AM 28,912 SMALLEG.FON
08/18/2001 06:00 AM 24,832 SMALLER.FON
08/18/2001 06:00 AM 29,200 SMALLET.FON
08/18/2001 06:00 AM 21,504 SMALLF.FON
08/18/2001 06:00 AM 19,600 SMALLFE.FON
08/18/2001 06:00 AM 23,120 SMALLFG.FON
08/18/2001 06:00 AM 19,760 SMALLFR.FON
08/18/2001 06:00 AM 23,008 SMALLFT.FON
08/18/2001 06:00 AM 65,456 SSEE1257.FON
08/18/2001 06:00 AM 90,336 SSEF1257.FON
08/18/2001 06:00 AM 64,656 SSERIFE.FON
08/18/2001 06:00 AM 66,464 SSERIFEE.FON
08/18/2001 06:00 AM 65,328 SSERIFEG.FON
08/18/2001 06:00 AM 68,848 SSERIFER.FON
08/18/2001 06:00 AM 64,400 SSERIFET.FON
08/18/2001 06:00 AM 89,856 SSERIFF.FON
08/18/2001 06:00 AM 92,032 SSERIFFE.FON
08/18/2001 06:00 AM 90,288 SSERIFFG.FON
08/18/2001 06:00 AM 98,256 SSERIFFR.FON
08/18/2001 06:00 AM 89,456 SSERIFFT.FON
08/18/2001 06:00 AM 56,336 SYMBOLE.FON
08/18/2001 06:00 AM 5,168 VGA737.FON
08/18/2001 06:00 AM 5,168 VGA775.FON
08/18/2001 06:00 AM 5,232 VGA850.FON
08/18/2001 06:00 AM 6,160 VGA852.FON
08/18/2001 06:00 AM 5,120 VGA855.FON
08/18/2001 06:00 AM 5,552 VGA857.FON
08/18/2001 06:00 AM 5,184 VGA860.FON
08/18/2001 06:00 AM 5,200 VGA863.FON
08/18/2001 06:00 AM 5,184 VGA865.FON
08/18/2001 06:00 AM 6,128 VGA866.FON
08/18/2001 06:00 AM 5,184 VGA869.FON
08/18/2001 06:00 AM 5,376 VGAF1257.FON
08/18/2001 06:00 AM 5,360 VGAFIX.FON
08/18/2001 06:00 AM 5,376 VGAFIXE.FON
08/18/2001 06:00 AM 6,112 VGAFIXG.FON
08/18/2001 06:00 AM 5,600 VGAFIXR.FON
08/18/2001 06:00 AM 6,112 VGAFIXT.FON
08/18/2001 06:00 AM 5,168 VGAOEM.FON
08/18/2001 06:00 AM 6,656 VGAS1257.FON
08/18/2001 06:00 AM 7,280 VGASYS.FON
08/18/2001 06:00 AM 6,608 VGASYSE.FON
08/18/2001 06:00 AM 7,008 VGASYSG.FON
08/18/2001 06:00 AM 6,912 VGASYSR.FON
08/18/2001 06:00 AM 6,912 VGASYST.FON
134 File(s) 4,905,878 bytes
0 Dir(s) 20,656,029,696 bytes free
Volume in drive C has no label.
Volume Serial Number is 84BA-AE56

Directory of C:\WINDOWS\Fonts

08/18/1999 02:13 PM 70,096 Abac.TTF
08/18/1999 02:13 PM 66,480 Abaexbc.TTF
08/18/1999 02:13 PM 70,860 Abalc.TTF
07/29/1998 08:02 PM 47,688 Absalom_.TTF
10/29/1999 02:42 PM 75,272 Alger.TTF
07/29/1998 08:20 PM 63,596 Alibi___.TTF
08/03/1998 02:34 PM 63,396 Andyb.ttf
06/30/1994 11:00 PM 59,776 ANTQUA.TTF
11/12/1998 07:18 AM 151,000 ANTQUAB.TTF
11/12/1998 07:18 AM 150,416 ANTQUABI.TTF
11/12/1998 07:18 AM 149,092 ANTQUAI.TTF
10/24/1997 03:42 PM 65,544 ARBLI___.TTF
07/17/2004 01:39 PM 367,112 arial.ttf
07/17/2004 01:39 PM 352,224 arialbd.ttf
08/18/2001 06:00 AM 226,748 ARIALBI.TTF
08/18/2001 06:00 AM 207,808 ARIALI.TTF
11/12/1998 06:39 PM 134,200 ARIALN.TTF
11/12/1998 06:39 PM 139,128 ArialNb.TTF
11/12/1998 06:39 PM 138,568 ArialNbi.TTF
11/12/1998 06:39 PM 141,408 ArialNi.TTF
08/18/2001 06:00 AM 117,028 ARIBLK.TTF
08/18/1999 02:13 PM 45,260 Arlrdbd.TTF
06/02/2004 01:38 PM 148,688 Austrise.ttf
08/18/1999 02:13 PM 54,976 Baskvill.TTF
07/29/1998 08:10 PM 45,268 Batavia_.TTF
06/02/2004 01:38 PM 153,872 batik.ttf
08/18/1999 02:13 PM 46,176 Bauhs93.TTF
06/04/1997 02:51 PM 36,552 Beesknee.ttf
08/18/1999 02:13 PM 70,656 Bernhc.TTF
03/17/1999 05:06 PM 57,612 BicklySc.TTF
11/12/1998 07:18 AM 155,528 BKANT.TTF
11/04/1998 04:30 PM 160,940 BOOKOS.TTF
11/04/1998 04:30 PM 154,576 BOOKOSB.TTF
11/04/1998 04:30 PM 162,460 BOOKOSBI.TTF
11/04/1998 04:30 PM 160,920 BOOKOSI.TTF
10/15/1999 11:55 AM 105,296 BradhITC.TTF
10/15/1999 11:55 AM 39,472 Bragga.TTF
08/18/1999 02:13 PM 40,728 Britanic.TTF
03/05/1996 08:40 PM 53,328 BROADW.TTF
08/18/1999 02:13 PM 53,456 Brushsci.TTF
06/30/1994 11:00 PM 63,528 BSSYM1.TTF
06/30/1994 11:00 PM 54,376 BSSYM2.TTF
06/30/1994 11:00 PM 25,312 BSSYM3.TTF
04/02/1999 05:31 PM 80,148 Calist.TTF
04/02/1999 05:32 PM 85,080 Calistb.TTF
04/02/1999 05:32 PM 84,960 Calistbi.TTF
04/02/1999 05:32 PM 59,372 Calisti.TTF
12/11/1998 02:05 AM 74,336 casmira_.TTF
10/15/1999 11:55 AM 48,252 Castelar.TTF
10/15/1999 11:55 AM 96,452 Chiller.TTF
06/30/1994 11:00 PM 49,288 COLONNA.TTF
07/17/2004 01:39 PM 127,596 comic.ttf
08/18/2001 06:00 AM 111,476 COMICBD.TTF
08/18/1999 02:13 PM 80,388 Coopbl.TTF
08/18/1999 02:13 PM 61,552 Coprgtb.TTF
08/18/1999 02:13 PM 62,716 Coprgtl.TTF
08/18/2001 06:00 AM 303,296 COUR.TTF
08/18/2001 06:00 AM 312,920 COURBD.TTF
08/18/2001 06:00 AM 236,148 COURBI.TTF
08/18/2001 06:00 AM 245,032 COURI.TTF
02/02/2000 07:28 PM 69,480 Curlz___.TTF
06/30/1994 11:00 PM 54,468 DESDEMON.TTF
03/05/1996 09:01 PM 94,044 EDDA.TTF
09/18/2001 02:31 AM 36,860 Elegance.TTF
06/24/1999 01:40 PM 51,652 Elephnt.TTF
06/24/1999 01:40 PM 54,324 Elephnti.TTF
07/29/1998 08:18 PM 72,060 Ellis___.TTF
07/10/2001 07:53 PM 30,208 ENCTICON.FON
08/07/2001 04:59 PM 40,792 Engr.TTF
08/07/2001 04:59 PM 33,756 Engrb.TTF
07/14/1997 03:02 PM 76,352 Enviro.TTF
08/07/2001 04:59 PM 53,884 Erasdemi.TTF
08/07/2001 04:59 PM 62,540 Eraslght.TTF
08/18/2001 06:00 AM 79,744 ESTRE.TTF
08/18/1999 02:13 PM 43,704 Eurosti.TTF
08/18/1999 02:13 PM 44,304 Eurostib.TTF
07/29/1998 08:17 PM 58,116 Excess__.TTF
04/23/1999 06:22 PM 45,952 Felixti.TTF
03/17/1999 05:07 PM 114,400 FineHand.TTF
06/02/2004 01:38 PM 67,704 flx_girl.ttf
04/23/1996 03:59 PM 54,216 FORTE.TTF
08/07/2001 04:59 PM 141,768 Frabk.TTF
08/07/2001 04:59 PM 158,892 Frabkit.TTF
08/07/2001 04:59 PM 134,240 Fradm.TTF
04/23/1999 07:22 PM 116,940 Fradmcn.TTF
08/07/2001 04:59 PM 125,624 Fradmit.TTF
04/23/1999 07:22 PM 139,400 Frahv.TTF
04/23/1999 07:22 PM 152,700 Frahvit.TTF
08/18/2001 06:00 AM 135,984 FRAMD.TTF
05/05/1999 11:02 PM 132,516 FRAMDCN.TTF
08/18/2001 06:00 AM 152,844 FRAMDIT.TTF
10/15/1999 11:55 AM 69,876 Freescpt.TTF
04/23/1999 06:22 PM 58,580 Frscript.TTF
06/30/1994 11:00 PM 78,096 FTLTLT.TTF
04/16/2005 09:00 PM 419,348 ftpap.dll
11/10/1998 04:52 PM 196,616 Gara.TTF
11/10/1998 04:52 PM 198,604 Garabd.TTF
11/10/1998 04:52 PM 188,988 Garait.TTF
08/18/2001 06:00 AM 214,936 GAUTAMI.TTF
07/29/1998 08:21 PM 49,960 Genuine_.TTF
03/25/2002 09:43 PM 155,068 georgia.ttf
08/18/2001 06:00 AM 141,032 GEORGIAB.TTF
08/18/2001 06:00 AM 157,388 GEORGIAI.TTF
08/18/2001 06:00 AM 159,736 GEORGIAZ.TTF
10/15/1999 11:55 AM 142,072 Gigi.TTF
11/12/1998 06:39 PM 137,568 Gothic.TTF
11/12/1998 06:39 PM 129,676 Gothicb.TTF
11/12/1998 06:39 PM 139,084 Gothicbi.TTF
11/12/1998 06:39 PM 148,520 Gothici.TTF
08/18/1999 02:13 PM 81,376 Goudos.TTF
08/18/1999 02:13 PM 82,796 Goudosb.TTF
08/18/1999 02:13 PM 80,280 Goudosi.TTF
04/23/1996 02:48 PM 48,356 Goudysto.ttf
03/05/1996 09:42 PM 41,380 GRADL.TTF
10/18/2000 02:40 PM 252,708 GRGAREF.TTF
10/15/1999 11:55 AM 55,060 Harlowsi.TTF
08/18/1999 02:14 PM 70,440 Harngton.TTF
07/29/1998 08:14 PM 63,124 Helte___.TTF
07/29/1998 08:17 PM 77,384 Herman__.TTF
08/18/2001 06:00 AM 136,076 IMPACT.TTF
08/18/1999 02:14 PM 60,488 Imprisha.TTF
10/15/1999 11:55 AM 74,968 Infroman.TTF
07/29/1998 08:16 PM 104,864 Isabelle.TTF
10/15/1999 11:55 AM 132,372 ITCBlkad.TTF
10/15/1999 11:55 AM 64,056 ITCEdscr.TTF
10/15/1999 11:55 AM 59,712 ITCKrist.TTF
07/29/1998 08:15 PM 65,852 Joan____.TTF
10/15/1999 11:56 AM 69,752 Jokerman.TTF
10/15/1999 11:56 AM 62,884 Juice___.TTF
07/29/1998 08:08 PM 71,068 Justice_.TTF
07/17/2004 01:39 PM 121,452 kartika.ttf
08/18/1999 02:14 PM 34,592 Kino.TTF
10/15/1999 11:56 AM 63,392 Kunstler.TTF
08/18/2001 06:00 AM 73,292 LATHA.TTF
08/18/1999 02:14 PM 44,824 Latinwd.TTF
03/06/1996 06:37 AM 58,480 LBLACK.TTF
04/15/1996 05:33 PM 64,976 LBRITE.TTF
04/15/1996 09:34 AM 61,040 LBRITED.TTF
04/15/1996 11:34 AM 65,728 LBRITEDI.TTF
04/15/1996 11:35 AM 65,208 LBRITEI.TTF
10/27/1999 05:34 PM 55,464 Lcallig.TTF
10/27/1999 05:34 PM 62,484 Lhandw.TTF
06/30/1994 11:00 PM 80,008 LINEDRAW.TTF
11/15/1999 01:09 PM 64,608 Lsans.TTF
11/15/1999 01:09 PM 59,976 Lsansd.TTF
11/15/1999 01:09 PM 66,320 Lsansdi.TTF
11/15/1999 01:09 PM 65,412 Lsansi.TTF
08/07/2001 04:59 PM 323,980 LSANSUNI.TTF
08/18/2001 06:00 AM 115,068 LUCON.TTF
08/18/2001 06:00 AM 323,980 L_10646.TTF
06/24/1999 09:53 AM 61,384 Maian.TTF
06/24/1999 09:53 AM 60,716 Maiandb.TTF
06/24/1999 09:53 AM 70,280 Maiandit.TTF
07/29/1998 08:28 PM 54,540 Mandela_.TTF
08/18/2001 06:00 AM 143,864 MANGAL.TTF
06/04/1997 04:40 PM 55,984 MATISSE_.TTF
07/29/1998 08:23 PM 61,272 Matte___.TTF
08/18/1999 02:14 PM 51,296 Maturasc.TTF
03/06/1996 03:10 PM 36,668 MERSCRB.TTF
07/29/1998 08:29 PM 60,156 Microdot.TTF
07/18/2004 12:54 AM 460,728 micross.ttf
08/07/2001 04:59 PM 191,716 Mistral.TTF
08/18/1999 02:14 PM 62,612 Mod20.TTF
08/18/2001 06:00 AM 8,704 MODERN.FON
10/18/2000 02:41 PM 35,540 MSREF1.TTF
10/18/2000 02:41 PM 43,096 MSREF2.TTF
11/10/1998 04:52 PM 157,360 MtCorsva.TTF
06/30/1994 11:00 PM 76,920 MTSORTS.TTF
08/18/2001 06:00 AM 40,500 MVBOLI.TTF
07/01/2003 05:31 PM 83,948 myriad.ttf
07/01/2003 05:31 PM 91,636 myriadb.ttf
07/01/2003 05:31 PM 82,836 myriadc.ttf
07/01/2003 05:31 PM 89,788 myriadci.ttf
07/01/2003 05:31 PM 85,748 myriadi.ttf
07/29/1998 08:26 PM 57,976 Natur___.TTF
05/28/1998 01:50 PM 21,400 Nelspec.ttf
07/29/1998 08:24 PM 46,212 Neolith_.TTF
06/02/2004 01:38 PM 67,016 Occident.ttf
10/10/1997 02:43 PM 26,136 Ocra.ttf
04/18/2001 06:24 AM 28,532 ocra2_p.ttf
03/06/1996 02:59 PM 42,852 OCRB.TTF
01/23/2001 10:58 AM 24,612 ocrbmt.ttf
10/15/1999 11:56 AM 93,068 Oldengl.TTF
08/18/1999 02:14 PM 81,044 Onyx.TTF
07/29/1998 08:30 PM 48,508 Openc___.TTF
01/08/1998 04:26 PM 10,028 OUTLOOK.TTF
06/02/2004 01:38 PM 37,048 Outright.ttf
08/18/2001 06:00 AM 489,884 PALA.TTF
08/18/2001 06:00 AM 434,004 PALAB.TTF
08/18/2001 06:00 AM 344,288 PALABI.TTF
08/18/2001 06:00 AM 430,800 PALAI.TTF
06/29/1999 03:57 PM 51,404 Palscri.TTF
08/07/2001 04:59 PM 156,000 Papyrus.TTF
03/06/1996 03:04 PM 59,140 PARADE.TTF
10/15/1999 11:56 AM 151,256 Parchm.TTF
05/27/1997 07:28 PM 48,164 PEPITA.TTF
08/07/2001 04:59 PM 75,620 Perbi___.TTF
06/29/1999 02:54 AM 58,512 Perb____.TTF
08/07/2001 04:59 PM 76,080 Peri____.TTF
06/28/1999 01:17 PM 48,320 Pertibd.TTF
06/28/1999 01:17 PM 43,800 Pertili.TTF
06/29/1999 06:15 AM 60,216 Per_____.TTF
10/18/2000 02:41 PM 32,256 PHONETIC.FON
03/06/1996 03:37 PM 35,328 PLACCOND.TTF
08/18/1999 02:14 PM 46,164 Playbill.TTF
10/15/1999 11:56 AM 76,588 Poorich.TTF
07/29/1998 08:25 PM 64,916 Pretext_.TTF
10/15/1999 11:56 AM 82,680 Pristina.TTF
07/29/1998 08:25 PM 44,876 Puppy___.TTF
04/18/2001 06:24 AM 32,764 qt2c_b.ttf
04/18/2001 06:24 AM 32,012 qt2c_i.ttf
04/18/2001 06:24 AM 35,064 qt2c_p.ttf
04/18/2001 06:24 AM 52,424 qt2m_p.ttf
04/18/2001 06:24 AM 20,900 qt2pi_p.ttf
04/18/2001 06:24 AM 31,276 qt2_b.ttf
04/18/2001 06:24 AM 35,632 qt2_i.ttf
04/18/2001 06:24 AM 30,892 qt2_p.ttf
06/02/2004 01:38 PM 75,364 Quigleyw.ttf
08/18/2001 06:00 AM 57,348 RAAVI.TTF
07/29/1998 08:30 PM 51,668 Radagund.TTF
06/24/1999 11:33 AM 132,600 Rage.TTF
03/06/1996 03:38 PM 71,996 RANSOM.TTF
03/06/1996 03:38 PM 60,032 RANSOMB.TTF
03/06/1996 03:39 PM 61,380 RANSOMBI.TTF
03/06/1996 03:39 PM 58,712 RANSOMI.TTF
07/29/1998 08:28 PM 38,944 Realv___.TTF
10/18/2000 02:41 PM 220,172 REFSAN.TTF
10/18/2000 02:41 PM 218,516 REFSANB.TTF
10/18/2000 02:41 PM 233,620 REFSANBI.TTF
10/18/2000 02:41 PM 226,536 REFSANI.TTF
10/18/2000 02:41 PM 250,968 REFSER.TTF
10/18/2000 02:41 PM 247,772 REFSERB.TTF
10/18/2000 02:41 PM 263,636 REFSERBI.TTF
10/18/2000 02:41 PM 256,700 REFSERI.TTF
10/18/2000 02:41 PM 53,288 REFSPCL.TTF
10/18/2000 02:41 PM 47,372 REFSPEC.TTF
06/29/1999 05:56 AM 72,272 Rock.TTF
06/29/1999 05:56 AM 68,780 Rockb.TTF
06/29/1999 05:56 AM 73,700 Rockbi.TTF
06/29/1999 08:57 AM 49,168 Rockeb.TTF
06/29/1999 04:56 AM 76,756 Rocki.TTF
08/18/2001 06:00 AM 13,312 ROMAN.FON
03/06/1996 03:41 PM 61,816 RUNICCN.TTF
08/18/2001 06:00 AM 12,288 SCRIPT.FON
06/24/1999 11:33 AM 55,500 Scriptbl.TTF
07/29/1998 08:27 PM 52,336 Shelman_.TTF
08/18/2001 06:00 AM 234,280 SHRUTI.TTF
10/15/1999 11:56 AM 63,196 Snap____.TTF
08/18/2001 06:00 AM 221,676 SYLFAEN.TTF
08/18/2001 06:00 AM 69,464 SYMBOL.TTF
07/18/2004 12:54 AM 383,140 tahoma.ttf
07/18/2004 12:54 AM 355,436 tahomabd.ttf
06/02/2004 01:38 PM 110,644 tallpaul.ttf
10/15/1999 11:56 AM 76,100 TempsITC.TTF
07/17/2004 01:39 PM 409,280 times.ttf
07/17/2004 01:39 PM 398,372 timesbd.ttf
08/18/2001 06:00 AM 239,692 TIMESBI.TTF
08/18/2001 06:00 AM 248,368 TIMESI.TTF
03/25/2002 09:43 PM 134,108 trebuc.ttf
08/18/2001 06:00 AM 123,096 TREBUCBD.TTF
08/18/2001 06:00 AM 131,188 TREBUCBI.TTF
08/18/2001 06:00 AM 139,288 TREBUCIT.TTF
07/29/1998 08:31 PM 58,088 Trendy__.TTF
08/18/2001 06:00 AM 148,636 TUNGA.TTF
09/11/1996 03:17 PM 29,368 Txfnt06n.ttf
09/11/1996 03:27 PM 30,736 Txfnt08b.ttf
09/11/1996 03:21 PM 30,480 Txfnt08n.ttf
09/11/1996 03:32 PM 30,116 Txfnt10b.ttf
09/11/1996 03:35 PM 30,264 Txfnt12b.ttf
09/11/1996 03:35 PM 31,140 Txfnt14b.ttf
03/25/2002 09:43 PM 171,792 verdana.ttf
08/18/2001 06:00 AM 137,616 VERDANAB.TTF
08/18/2001 06:00 AM 155,076 VERDANAI.TTF
08/18/2001 06:00 AM 154,800 VERDANAZ.TTF
10/18/2000 02:41 PM 217,624 VERDREF.TTF
10/15/1999 11:56 AM 104,372 VinerITC.TTF
10/15/1999 11:56 AM 64,748 Vivaldii.TTF
10/15/1999 11:56 AM 54,308 Vladimir.TTF
07/17/2004 01:39 PM 252,820 vrinda.ttf
08/18/2001 06:00 AM 118,752 WEBDINGS.TTF
08/18/2001 06:00 AM 81,000 WINGDING.TTF
04/15/1996 05:38 PM 59,696 WINGDNG2.TTF
04/15/1996 05:39 PM 29,236 WINGDNG3.TTF
08/18/2001 06:00 AM 18,880 WST_CZEC.FON
08/18/2001 06:00 AM 18,880 WST_ENGL.FON
08/18/2001 06:00 AM 18,880 WST_FREN.FON
08/18/2001 06:00 AM 18,880 WST_GERM.FON
08/18/2001 06:00 AM 18,880 WST_ITAL.FON
08/18/2001 06:00 AM 18,880 WST_SPAN.FON
08/18/2001 06:00 AM 18,880 WST_SWED.FON
290 File(s) 30,461,020 bytes
0 Dir(s) 20,656,013,312 bytes free
Volume in drive C has no label.
Volume Serial Number is 84BA-AE56

Directory of C:\WINDOWS\Help\SBSI

09/05/2005 08:08 AM 303 saavaj.ini
1 File(s) 303 bytes
0 Dir(s) 20,656,013,312 bytes free
Volume in drive C has no label.
Volume Serial Number is 84BA-AE56

Directory of C:\WINDOWS\Help\SBSI

09/05/2005 08:08 AM .
09/05/2005 08:08 AM ..
09/05/2005 08:08 AM 516,116 javaas.dll
06/16/2005 09:54 PM Training
1 File(s) 516,116 bytes
3 Dir(s) 20,656,013,312 bytes free
Post #6
Please print these instructions out for use in Safe Mode.

Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to extract the files
  • This will create a VundoFix folder on your desktop.
  • After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
  • Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
  • You will first be presented with a warning and a list of forums to seek help at.
    it should look like this

    VundoFix V2.1 by Atri
    By pressing enter you agree that you are using this at your own risk
    Please seek assistance at one of the following forums:
    http://www.atribune.org/forums
    http://www.247fixes.com/forums
    http://www.geekstogo.com/forum
    http://forums.net-integration.net

  • At this point press enter one time.
  • Next you will see:

    Type in the filepath as instructed by the forum staff
    Then Press Enter, Then F6, Then Enter Again to continue with the fix.

  • At this point please type the following file path (make sure to enter it exactly as below!):
    • C:\WINDOWS\Fonts\ftpap.dll
  • Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  • Next you will see:

    Please type in the second filepath as instructed by the forum staff
    Then Press Enter, Then F6, Then Enter Again to continue with the fix.

  • At this point please type the following file path (make sure to enter it exactly as below!):C:\WINDOWS\Help\SBSI\javaas.dll
  • Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
  • The fix will run then HijackThis will open.
  • In HijackThis, please place a check next to the following items and click FIX CHECKED:
    O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\Fonts\ftpap.dll

    O4 - HKLM\..\Run: [System Support] system32.exe

    O4 - HKLM\..\RunServices: [System Support] system32.exe

    O4 - HKCU\..\Run: [System Support] system32.exe

    O20 - Winlogon Notify: avw2 - c:\windows\system32\avw2.dll

    O20 - Winlogon Notify: commp3 - C:\WINDOWS\

    O20 - Winlogon Notify: ftpap - C:\WINDOWS\Fonts\ftpap.dll

    O20 - Winlogon Notify: javaas - C:\WINDOWS\Help\SBSI\javaas.dll

    O20 - Winlogon Notify: psbas - C:\WINDOWS\

    O20 - Winlogon Notify: req - C:\WINDOWS\
  • After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
  • Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
  • Once your machine reboots please continue with the instructions below.
Copy a new HijackThis log and the vundofix.txt file from the vundofix folder into this topic.

After the reboot, delete these files if they still exist:

C:\WINDOWS\System32\mljjg.dll
C:\WINDOWS\Help\SBSI\saavaj.ini
C:\WINDOWS\Fonts\paptf.bak1
C:\WINDOWS\Fonts\paptf.bak2
C:\WINDOWS\Fonts\paptf.ini
C:\WINDOWS\Fonts\paptf.ini2
system32.exe

They will be "hidden".
Be sure to show hidden files when looking for these files.
Post #7
All done. System32.exe was in C:\WINDOWS\System32 but it would not delete.

Here is the new Hijack This

Logfile of HijackThis v1.99.1
Scan saved at 10:34:32 AM, on 10/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\QUICKENW\bagent.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\MsiExec.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Teresa\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\PCHEALTH\HELPCTR\System\PANELS\BLANK.HTM
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ne1.attbb.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\QUICKENW\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: symsupportutil - https://www-secure.symantec.com/techsupp/ac…supportutil.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_1/axofupld.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Here is the vundofix.txt:


Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Suspending PID 196 'smss.exe'
Threads [200][204][208]

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 828 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Error, Cannot find a process with an image name of rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 272 'winlogon.exe'
File Deleted sucessfully.
Files Deleted sucessfully.


Do you know what TrayApp is? All of a sudden my computer is trying to install that and I can't get out of it?


Thank you again for all of your help. I really appreciate it. Not sure where else I would be able to get this kind of help.
Post #8
The log looks good!!!

Download Killbox from here:

Killbox.zip

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Unzip Killbox & run it.

In Killbox select "Delete on Reboot".

Paste the next line into the "Full Path of File to Delete" text box.

C:\WINDOWS\System32\System32.exe

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

When the machine reboots, check to be sure the file is gone.

Do you know what TrayApp is? All of a sudden my computer is trying to install that and I can't get out of it?


I'm not seeing it anywhere in your log???? :scratch:

Could it be this:

TrayApp
Post #9
Thank you again!! Looks like my virus is gone. All your help was greatly appreciated. Not sure if that is the TrayApp program or not. It won't let me out of it. It is asking for a disk that I don't have and it will not accept cancel. It will just try to install again. It is in a loop. When the computer restarts it is back again. I will do some hunting on the internet to see if anyone else is having this problem. Thank you again!
Post #10
Re: TrayApp…found the problem. A week ago I installed a new HP printer. I found someone on the internet who had a similar problem. They reinserted the installation disk and it finished the install. Strange that it would show up all of a sudden but at least it's gone.
Post #11 last edited
The "system32.exe" file made changes to your registry we need to rectify.

Copy the contents of the following quote box into Notepad:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole]
"EnableDCOM"="Y"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"restrictanonymous"=dword:00000000


Save it to the desktop as fixme.reg.

Now the fixme.reg file on the desktop.

You will receive a prompt similar to: "Do you wish to merge the information into the registry?".

Answer 'Yes' and wait for a message to appear similar to "Merged Successfully".

Reboot.

That should do it.

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #13
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI