I thLogfile of HijackThis v1.99.1
Scan saved at 19:45:55, on 09/07/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Documents and Settings\Chris Brownhill\My Documents\My Received Files\New Folder\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1D05C0AD-CD5E-4725-9BA1-A82CAC97162F} - C:\WINDOWS\System32\oppoo.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [STManager] "C:\Program Files\SpeedTouch\Dr SpeedTouch\drst.exe" -b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA9F3AB8-475A-4491-B150-E54B554A4247}: NameServer = 80.225.255.177 80.225.255.185
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: oppoo - C:\WINDOWS\System32\oppoo.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
ink i am infected with numerous virus's - herewith my HJT log file. Any help would be appreciated
Welcome to the forum.
Run Hijack This!
Click the "
Open the Misc Tools section " button.
Click the "
Open process manager " button.
Check the "
Show DLLs " box (upper right).
Click on each item in the upper window, then look in the lower window.
Check to see which processes are using
C:\WINDOWS\SYSTEM32\oppoo.dll
Post back letting me know all processes using that DLL.
Download L2mfix from one of these two locations:
l2mfix.exe (© Shadowwar) l2mfix.exe (© Shadowwar)
Save the file to your desktop and
l2mfix.exe . Click the Install button to extract the files and follow the prompts, then open the newly added
l2mfix folder on your desktop.
l2mfix.bat and select option
#1 for
Run Find Log by typing
1 and then pressing
.
This will scan your computer and it may appear nothing is happening, then, after a minute or 2, Notepad will open with a log.
Copy/paste the contents of that log into this thread.
The following processes are using C:WINDOWS\SYSTEM32\oppoo.all
C:\WINDOWS\SYSTEM32\Winlogon.exe
C:\Programe Files\Webroot\spy Sweeper\WRSSSDK.exe
C:WINDOWS\explorer.exe
Herewith contents of 12mfix.bat logfile ;-
L2MFIX find log 051206
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\oppoo]
"Asynchronous"=dword:00000001
"DllName"="C:\\WINDOWS\\System32\\oppoo.dll"
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{2303D3FB-D94F-6408-E359-7C1A6928EA6E}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…"
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{E28B1EAD-FB19-4C75-846F-8B6F68586857}"=""
"{008E97C5-DD35-4D63-9825-2639AB37A304}"=""
"{CA967362-23C1-467E-B993-8874D9F95894}"=""
"{B9254DF6-73F2-4E30-802A-DAF614D53E18}"=""
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders"
"{698315E0-9BDD-4CCE-B493-5D90CFAFC084}"=""
"{D63C0426-84BB-4952-BAB8-E21788C4E6FC}"=""
"{132EDC98-E1DE-4B72-B513-C74E121F7D87}"=""
"{3F44D27C-B298-4929-B0D5-738DF2A82146}"=""
"{4A97235D-3D5B-4B86-BFAC-6D58A57F9AAD}"=""
"{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}"=""
"{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}"=""
"{785827EA-6E8D-4843-A13E-7E79D2CD5111}"=""
"{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}"=""
"{F3E5EEA7-CEF7-4408-9FDF-6189920FDA0F}"=""
"{27C54D1A-BAA0-4E99-8DD7-7317317796D4}"=""
"{D2E9CB9E-778E-4774-9CDF-679A88C8040B}"=""
"{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}"=""
"{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}"=""
"{C544DAF1-26A9-4EBB-BCEE-C74252DD3615}"=""
"{9E0963FC-40A8-48A3-BFD6-CFC519169889}"=""
"{2979FFFC-8E76-48C5-80E6-C85AC4AA283D}"=""
"{C725566A-3680-48C9-9F9A-38C353073030}"=""
"{55A6E709-15A0-4799-A5C6-E24E01A34927}"=""
"{6B6B8939-F8B3-41C9-B8BD-BD77A0A3F8FE}"=""
"{5AF80F73-0F14-4D71-B208-94B3B404501F}"=""
"{BF552F57-81D9-497D-ACA5-96B26CFD99FE}"=""
"{1D05CD86-929C-4369-B774-AC91510BFC6D}"=""
"{F6B2D57C-49DA-422A-81E8-E043EECFA009}"=""
"{9B3468FF-A0EA-4BCA-BE46-B03B36F4AADF}"=""
"{D571F431-F7EA-4426-9101-7C4C027CCE7B}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\InprocServer32]
@="C:\\WINDOWS\\system32\\khdda.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\InprocServer32]
@="C:\\WINDOWS\\system32\\dacompos.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\InprocServer32]
@="C:\\WINDOWS\\system32\\mrvbvm60.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\InprocServer32]
@="C:\\WINDOWS\\system32\\ribdyctl.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\InprocServer32]
@="C:\\WINDOWS\\system32\\uqnphost.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\InprocServer32]
@="C:\\WINDOWS\\system32\\uep10.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\InprocServer32]
@="C:\\WINDOWS\\system32\\ugat.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\InprocServer32]
@="C:\\WINDOWS\\system32\\kndes.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
awtrpon.dll Fri 7 Jul 2006 19:21:34 ..SH. 39,437 38.51 K
awtturs.dll Thu 6 Jul 2006 18:12:12 ..SH. 39,437 38.51 K
awtussq.dll Thu 6 Jul 2006 22:49:16 ..SH. 39,437 38.51 K
byxvtrq.dll Wed 5 Jul 2006 12:58:38 ….. 39,437 38.51 K
cbxvtrr.dll Wed 5 Jul 2006 13:00:40 ..SH. 39,437 38.51 K
cbxyvvt.dll Wed 5 Jul 2006 13:11:06 ..SH. 39,437 38.51 K
ddcbxxu.dll Thu 6 Jul 2006 20:24:34 ..SH. 39,437 38.51 K
ddcyxvu.dll Thu 6 Jul 2006 18:45:30 ..SH. 39,437 38.51 K
efcbyay.dll Thu 6 Jul 2006 18:17:16 ..SH. 39,437 38.51 K
fccayya.dll Wed 5 Jul 2006 13:27:08 ..SH. 39,437 38.51 K
fcccccd.dll Thu 6 Jul 2006 20:24:36 ..SH. 39,437 38.51 K
gebxvtr.dll Thu 6 Jul 2006 18:12:06 ..SH. 39,437 38.51 K
gebyaxx.dll Thu 6 Jul 2006 17:45:50 ..SH. 39,437 38.51 K
hggffcd.dll Thu 6 Jul 2006 17:58:00 ..SH. 39,437 38.51 K
hgggdaw.dll Thu 6 Jul 2006 17:57:48 ..SH. 39,437 38.51 K
hggghff.dll Thu 6 Jul 2006 12:53:42 ..SH. 39,437 38.51 K
hqghumea.dll Sat 8 Jul 2006 0:11:50 A…. 28,116 27.46 K
iifcbyx.dll Fri 7 Jul 2006 19:31:08 ..SH. 39,437 38.51 K
iifdabc.dll Thu 6 Jul 2006 21:21:14 ..SH. 39,437 38.51 K
iifdefe.dll Wed 5 Jul 2006 0:28:56 ..SH. 39,437 38.51 K
ipsecsnp.dll Sun 14 May 2006 10:13:42 A…. 334,848 327.00 K
ipsecsvc.dll Sun 14 May 2006 10:13:42 A…. 159,744 156.00 K
ipsmsnap.dll Sun 14 May 2006 10:13:42 A…. 364,544 356.00 K
jkkjigg.dll Wed 5 Jul 2006 0:35:52 ..SH. 39,437 38.51 K
jkkkhed.dll Thu 6 Jul 2006 0:43:42 ..SH. 39,437 38.51 K
khfebab.dll Thu 6 Jul 2006 18:06:52 ..SH. 39,437 38.51 K
khfebby.dll Wed 5 Jul 2006 0:28:30 ..SH. 39,437 38.51 K
khfeecb.dll Wed 5 Jul 2006 13:22:58 ..SH. 39,437 38.51 K
legitc~1.dll Wed 17 May 2006 11:23:38 A…. 579,888 566.30 K
ljjijjh.dll Fri 7 Jul 2006 22:13:20 ..SH. 39,437 38.51 K
ljjjged.dll Wed 5 Jul 2006 0:36:18 ..SH. 39,437 38.51 K
msvcp71.dll Wed 5 Jul 2006 0:16:24 A…. 499,712 488.00 K
msvcr71.dll Wed 5 Jul 2006 0:16:24 A…. 348,160 340.00 K
nnnljgh.dll Wed 5 Jul 2006 13:06:44 ..SH. 39,437 38.51 K
nnnlkjg.dll Fri 7 Jul 2006 18:52:00 ..SH. 39,437 38.51 K
nnnmljh.dll Wed 5 Jul 2006 0:27:02 ..SH. 39,437 38.51 K
oakley.dll Sun 14 May 2006 10:13:42 A…. 257,536 251.50 K
opnkkll.dll Fri 7 Jul 2006 21:02:40 ..SH. 39,437 38.51 K
opnklii.dll Thu 6 Jul 2006 20:30:48 ..SH. 39,437 38.51 K
opnlige.dll Wed 5 Jul 2006 13:20:58 ..SH. 39,437 38.51 K
opnljkh.dll Thu 6 Jul 2006 0:33:44 ..SH. 39,437 38.51 K
opnmnmm.dll Wed 5 Jul 2006 13:12:48 ..SH. 39,437 38.51 K
opnnljg.dll Fri 7 Jul 2006 19:41:50 ..SH. 39,437 38.51 K
opnnool.dll Thu 6 Jul 2006 18:16:58 ..SH. 39,437 38.51 K
oppoo.dll Sat 8 Jul 2006 8:58:26 ..SH. 569,396 556.05 K
polstore.dll Sun 14 May 2006 10:13:42 A…. 98,304 96.00 K
qghumeay.dll Fri 7 Jul 2006 23:31:00 A…. 28,116 27.46 K
qomjggh.dll Thu 6 Jul 2006 0:55:24 ..SH. 39,437 38.51 K
qomjigf.dll Thu 6 Jul 2006 18:06:42 ..SH. 39,437 38.51 K
qomjkhi.dll Wed 5 Jul 2006 13:31:04 ..SH. 39,437 38.51 K
qomjkjk.dll Wed 5 Jul 2006 13:02:42 ..SH. 39,437 38.51 K
qomkllk.dll Thu 6 Jul 2006 23:57:36 ..SH. 39,437 38.51 K
qomlmml.dll Wed 5 Jul 2006 0:26:30 ..SH. 39,437 38.51 K
qommmjg.dll Fri 7 Jul 2006 18:59:50 ..SH. 39,437 38.51 K
qomnmki.dll Fri 7 Jul 2006 19:49:04 ..SH. 39,437 38.51 K
rasmans.dll Thu 22 Jun 2006 11:59:18 A…. 169,984 166.00 K
rqrpmnl.dll Thu 6 Jul 2006 17:54:40 ..SH. 39,437 38.51 K
rqrspon.dll Fri 7 Jul 2006 18:16:52 ..SH. 39,437 38.51 K
rqrsqnl.dll Thu 6 Jul 2006 0:21:02 ..SH. 39,437 38.51 K
sirenacm.dll Fri 16 Jun 2006 14:34:44 A…. 48,936 47.79 K
ssqpqoo.dll Fri 7 Jul 2006 20:00:42 ..SH. 39,437 38.51 K
tuvsqpo.dll Thu 6 Jul 2006 13:24:44 ..SH. 39,437 38.51 K
urqomlk.dll Thu 6 Jul 2006 20:21:04 ..SH. 39,437 38.51 K
urqooll.dll Fri 7 Jul 2006 19:04:30 ..SH. 39,437 38.51 K
vturonl.dll Wed 5 Jul 2006 13:25:00 ..SH. 39,437 38.51 K
vtuurst.dll Thu 6 Jul 2006 23:32:36 ..SH. 39,437 38.51 K
vtuuuro.dll Fri 7 Jul 2006 20:34:46 ..SH. 39,437 38.51 K
winipsec.dll Sun 14 May 2006 10:13:42 A…. 29,184 28.50 K
wvurrst.dll Thu 6 Jul 2006 23:57:36 ..SH. 39,437 38.51 K
xxyaabb.dll Fri 7 Jul 2006 19:25:36 ..SH. 39,437 38.51 K
xxyax.dll Wed 5 Jul 2006 12:57:28 ….. 569,396 556.05 K
xxyvssp.dll Wed 5 Jul 2006 0:28:02 ..SH. 39,437 38.51 K
xxyyyxw.dll Fri 7 Jul 2006 19:16:24 ..SH. 39,437 38.51 K
yayaaxx.dll Wed 5 Jul 2006 13:04:44 ..SH. 39,437 38.51 K
yayawxy.dll Thu 6 Jul 2006 19:42:08 ..SH. 39,437 38.51 K
yayayaw.dll Fri 7 Jul 2006 13:05:26 ..SH. 39,437 38.51 K
yayyvwx.dll Wed 5 Jul 2006 12:57:00 ..SH. 39,437 38.51 K
77 items found: 77 files (62 H/S), 0 directories.
Total of file sizes: 6,530,958 bytes 6.23 M
Locate .tmp files:
C:\WINDOWS\SYSTEM32\
mcrh.tmp Thu 6 Jul 2006 20:15:44 A…. 0 0.00 K
xayxx.tmp Thu 6 Jul 2006 0:06:44 A.SH. 593,247 579.34 K
xayxx~1.tmp Thu 6 Jul 2006 20:15:44 A…. 0 0.00 K
3 items found: 3 files (1 H/S), 0 directories.
Total of file sizes: 593,247 bytes 579.34 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is C866-B80B
Directory of C:\WINDOWS\System32
10/07/2006 22:14 580,186 ooppo.ini
10/07/2006 19:02 dllcache
10/07/2006 14:25 579,424 ooppo.bak2
08/07/2006 08:58 623,725 ooppo.bak1
08/07/2006 08:58 569,396 oppoo.dll
07/07/2006 22:13 39,437 ljjijjh.dll
07/07/2006 21:02 39,437 opnkkll.dll
07/07/2006 20:34 39,437 vtuuuro.dll
07/07/2006 20:00 39,437 ssqpqoo.dll
07/07/2006 19:49 39,437 qomnmki.dll
07/07/2006 19:41 39,437 opnnljg.dll
07/07/2006 19:31 39,437 iifcbyx.dll
07/07/2006 19:25 39,437 xxyaabb.dll
07/07/2006 19:21 39,437 awtrpon.dll
07/07/2006 19:16 39,437 xxyyyxw.dll
07/07/2006 19:04 39,437 urqooll.dll
07/07/2006 18:59 39,437 qommmjg.dll
07/07/2006 18:51 39,437 nnnlkjg.dll
07/07/2006 18:16 39,437 rqrspon.dll
07/07/2006 13:05 39,437 yayayaw.dll
06/07/2006 23:57 39,437 wvurrst.dll
06/07/2006 23:57 39,437 qomkllk.dll
06/07/2006 23:32 39,437 vtuurst.dll
06/07/2006 22:49 39,437 awtussq.dll
06/07/2006 21:21 39,437 iifdabc.dll
06/07/2006 20:30 39,437 opnklii.dll
06/07/2006 20:24 39,437 fcccccd.dll
06/07/2006 20:24 39,437 ddcbxxu.dll
06/07/2006 20:21 39,437 urqomlk.dll
06/07/2006 20:15 624 xayxx.ini2
06/07/2006 19:42 39,437 yayawxy.dll
06/07/2006 19:05 623,301 xayxx.bak2
06/07/2006 18:46 Microsoft
06/07/2006 18:45 39,437 ddcyxvu.dll
06/07/2006 18:17 39,437 efcbyay.dll
06/07/2006 18:16 39,437 opnnool.dll
06/07/2006 18:12 39,437 awtturs.dll
06/07/2006 18:12 39,437 gebxvtr.dll
06/07/2006 18:06 39,437 khfebab.dll
06/07/2006 18:06 39,437 qomjigf.dll
06/07/2006 17:57 39,437 hggffcd.dll
06/07/2006 17:57 39,437 hgggdaw.dll
06/07/2006 17:54 39,437 rqrpmnl.dll
06/07/2006 17:45 39,437 gebyaxx.dll
06/07/2006 13:24 39,437 tuvsqpo.dll
06/07/2006 12:53 39,437 hggghff.dll
06/07/2006 00:55 39,437 qomjggh.dll
06/07/2006 00:43 39,437 jkkkhed.dll
06/07/2006 00:33 39,437 opnljkh.dll
06/07/2006 00:21 39,437 rqrsqnl.dll
06/07/2006 00:18 462 xayxx.ini
06/07/2006 00:06 593,247 xayxx.tmp
05/07/2006 13:31 39,437 qomjkhi.dll
05/07/2006 13:27 39,437 fccayya.dll
05/07/2006 13:24 39,437 vturonl.dll
05/07/2006 13:22 39,437 khfeecb.dll
05/07/2006 13:20 39,437 opnlige.dll
05/07/2006 13:12 39,437 opnmnmm.dll
05/07/2006 13:11 39,437 cbxyvvt.dll
05/07/2006 13:06 39,437 nnnljgh.dll
05/07/2006 13:04 39,437 yayaaxx.dll
05/07/2006 13:02 39,437 qomjkjk.dll
05/07/2006 13:00 39,437 cbxvtrr.dll
05/07/2006 12:56 39,437 yayyvwx.dll
05/07/2006 00:36 39,437 ljjjged.dll
05/07/2006 00:35 39,437 jkkjigg.dll
05/07/2006 00:28 39,437 iifdefe.dll
05/07/2006 00:28 39,437 khfebby.dll
05/07/2006 00:28 39,437 xxyvssp.dll
05/07/2006 00:27 39,437 nnnmljh.dll
05/07/2006 00:26 39,437 qomlmml.dll
69 File(s) 5,976,022 bytes
2 Dir(s) 36,427,972,608 bytes free
About 99% of those files listed at the end of the Look2MeFix log are bad files…
Let's try some "off the shelf" items to see if we can get rid of a few.
Download
VundoFix.exe to your desktop from here:
VundoFix.exe CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
1. Double-click
VundoFix.exe to run it.
2. Click the
Scan for Vundo button.
3. Once it's done scanning, click the
Remove Vundo button.
4. You will receive a prompt asking if you want to remove the files, click
YES .
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, it will prompt that it will shutdown your computer, click
OK .
7. Turn your computer back on.
Post a new HijackThis! log, along with the contents of this file:
into this thread .
As requested herewith contents of C:\vundofix.txt
VundoFix V4.2.84
Checking Java version…
Sun Java not detected
Scan started at 00:06:14 06/07/2006
Listing files found while scanning….
C:\WINDOWS\system32\byxvtrq.dll
C:\WINDOWS\system32\xayxx.bak1
C:\WINDOWS\system32\xayxx.ini
C:\WINDOWS\system32\xxyax.dll
Attempting to delete C:\WINDOWS\system32\byxvtrq.dll
C:\WINDOWS\system32\byxvtrq.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\xayxx.bak1
C:\WINDOWS\system32\xayxx.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\xayxx.ini
C:\WINDOWS\system32\xayxx.ini Could not be deleted.
Attempting to delete C:\WINDOWS\system32\xxyax.dll
C:\WINDOWS\system32\xxyax.dll Could not be deleted.
Performing Repairs to the registry.
Done!
VundoFix V5.1.1
Checking Java version…
Sun Java not detected
Scan started at 23:02:47 10/07/2006
Listing files found while scanning….
C:\windows\system32\awtrpon.dll
C:\windows\system32\awtturs.dll
C:\windows\system32\awtussq.dll
C:\windows\system32\byxvtrq.dll
C:\windows\system32\cbxvtrr.dll
C:\windows\system32\cbxyvvt.dll
C:\windows\system32\ddcbxxu.dll
C:\windows\system32\ddcyxvu.dll
C:\windows\system32\efcbyay.dll
C:\windows\system32\fccayya.dll
C:\windows\system32\fcccccd.dll
C:\windows\system32\gebxvtr.dll
C:\windows\system32\gebyaxx.dll
C:\windows\system32\hggffcd.dll
C:\windows\system32\hgggdaw.dll
C:\windows\system32\hggghff.dll
C:\windows\system32\iifcbyx.dll
C:\windows\system32\iifdabc.dll
C:\windows\system32\iifdefe.dll
C:\windows\system32\jkkjigg.dll
C:\windows\system32\jkkkhed.dll
C:\windows\system32\khfebab.dll
C:\windows\system32\khfebby.dll
C:\windows\system32\khfeecb.dll
C:\windows\system32\ljjijjh.dll
C:\windows\system32\ljjjged.dll
C:\windows\system32\nnnljgh.dll
C:\windows\system32\nnnlkjg.dll
C:\windows\system32\nnnmljh.dll
C:\windows\system32\opnkkll.dll
C:\windows\system32\opnklii.dll
C:\windows\system32\opnlige.dll
C:\windows\system32\opnljkh.dll
C:\windows\system32\opnmnmm.dll
C:\windows\system32\opnnljg.dll
C:\windows\system32\opnnool.dll
C:\windows\system32\oppoo.dll
C:\windows\system32\ooppo.ini
C:\windows\system32\ooppo.bak1
C:\windows\system32\ooppo.bak2
C:\windows\system32\qomjggh.dll
C:\windows\system32\qomjigf.dll
C:\windows\system32\qomjkhi.dll
C:\windows\system32\qomjkjk.dll
C:\windows\system32\qomkllk.dll
C:\windows\system32\qomlmml.dll
C:\windows\system32\qommmjg.dll
C:\windows\system32\qomnmki.dll
C:\windows\system32\rqrpmnl.dll
C:\windows\system32\rqrspon.dll
C:\windows\system32\rqrsqnl.dll
C:\windows\system32\ssqpqoo.dll
C:\windows\system32\tuvsqpo.dll
C:\windows\system32\urqomlk.dll
C:\windows\system32\urqooll.dll
C:\windows\system32\vturonl.dll
C:\windows\system32\vtuurst.dll
C:\windows\system32\vtuuuro.dll
C:\windows\system32\wvurrst.dll
C:\windows\system32\xxyaabb.dll
C:\windows\system32\xxyax.dll
C:\windows\system32\xayxx.ini
C:\windows\system32\xayxx.bak2
C:\windows\system32\xayxx.ini2
C:\windows\system32\xayxx.tmp
C:\windows\system32\xxyvssp.dll
C:\windows\system32\xxyyyxw.dll
C:\windows\system32\yayaaxx.dll
C:\windows\system32\yayawxy.dll
C:\windows\system32\yayayaw.dll
C:\windows\system32\yayyvwx.dll
VundoFix V5.1.1
Checking Java version…
Sun Java not detected
Scan started at 23:11:21 10/07/2006
Listing files found while scanning….
C:\windows\system32\awtrpon.dll
C:\windows\system32\awtturs.dll
C:\windows\system32\awtussq.dll
C:\windows\system32\byxvtrq.dll
C:\windows\system32\cbxvtrr.dll
C:\windows\system32\cbxyvvt.dll
C:\windows\system32\ddcbxxu.dll
C:\windows\system32\ddcyxvu.dll
C:\windows\system32\efcbyay.dll
C:\windows\system32\fccayya.dll
C:\windows\system32\fcccccd.dll
C:\windows\system32\gebxvtr.dll
C:\windows\system32\gebyaxx.dll
C:\windows\system32\hggffcd.dll
C:\windows\system32\hgggdaw.dll
C:\windows\system32\hggghff.dll
C:\windows\system32\iifcbyx.dll
C:\windows\system32\iifdabc.dll
C:\windows\system32\iifdefe.dll
C:\windows\system32\jkkjigg.dll
C:\windows\system32\jkkkhed.dll
C:\windows\system32\khfebab.dll
C:\windows\system32\khfebby.dll
C:\windows\system32\khfeecb.dll
C:\windows\system32\ljjijjh.dll
C:\windows\system32\ljjjged.dll
C:\windows\system32\nnnljgh.dll
C:\windows\system32\nnnlkjg.dll
C:\windows\system32\nnnmljh.dll
C:\windows\system32\opnkkll.dll
C:\windows\system32\opnklii.dll
C:\windows\system32\opnlige.dll
C:\windows\system32\opnljkh.dll
C:\windows\system32\opnmnmm.dll
C:\windows\system32\opnnljg.dll
C:\windows\system32\opnnool.dll
C:\windows\system32\oppoo.dll
C:\windows\system32\ooppo.ini
C:\windows\system32\ooppo.bak1
C:\windows\system32\ooppo.bak2
C:\windows\system32\qomjggh.dll
C:\windows\system32\qomjigf.dll
C:\windows\system32\qomjkhi.dll
C:\windows\system32\qomjkjk.dll
C:\windows\system32\qomkllk.dll
C:\windows\system32\qomlmml.dll
C:\windows\system32\qommmjg.dll
C:\windows\system32\qomnmki.dll
C:\windows\system32\rqrpmnl.dll
C:\windows\system32\rqrspon.dll
C:\windows\system32\rqrsqnl.dll
C:\windows\system32\ssqpqoo.dll
C:\windows\system32\tuvsqpo.dll
C:\windows\system32\urqomlk.dll
C:\windows\system32\urqooll.dll
C:\windows\system32\vturonl.dll
C:\windows\system32\vtuurst.dll
C:\windows\system32\vtuuuro.dll
C:\windows\system32\wvurrst.dll
C:\windows\system32\xxyaabb.dll
C:\windows\system32\xxyax.dll
C:\windows\system32\xayxx.ini
C:\windows\system32\xayxx.bak2
C:\windows\system32\xayxx.ini2
C:\windows\system32\xayxx.tmp
C:\windows\system32\xxyvssp.dll
C:\windows\system32\xxyyyxw.dll
C:\windows\system32\yayaaxx.dll
C:\windows\system32\yayawxy.dll
C:\windows\system32\yayayaw.dll
C:\windows\system32\yayyvwx.dll
VundoFix V5.1.1
Checking Java version…
Sun Java not detected
Scan started at 23:16:26 10/07/2006
Listing files found while scanning….
C:\windows\system32\awtrpon.dll
C:\windows\system32\awtturs.dll
C:\windows\system32\awtussq.dll
C:\windows\system32\byxvtrq.dll
C:\windows\system32\cbxvtrr.dll
C:\windows\system32\cbxyvvt.dll
C:\windows\system32\ddcbxxu.dll
C:\windows\system32\ddcyxvu.dll
C:\windows\system32\efcbyay.dll
C:\windows\system32\fccayya.dll
C:\windows\system32\fcccccd.dll
C:\windows\system32\gebxvtr.dll
C:\windows\system32\gebyaxx.dll
C:\windows\system32\hggffcd.dll
C:\windows\system32\hgggdaw.dll
C:\windows\system32\hggghff.dll
C:\windows\system32\iifcbyx.dll
C:\windows\system32\iifdabc.dll
C:\windows\system32\iifdefe.dll
C:\windows\system32\jkkjigg.dll
C:\windows\system32\jkkkhed.dll
C:\windows\system32\khfebab.dll
C:\windows\system32\khfebby.dll
C:\windows\system32\khfeecb.dll
C:\windows\system32\ljjijjh.dll
C:\windows\system32\ljjjged.dll
C:\windows\system32\nnnljgh.dll
C:\windows\system32\nnnlkjg.dll
C:\windows\system32\nnnmljh.dll
C:\windows\system32\opnkkll.dll
C:\windows\system32\opnklii.dll
C:\windows\system32\opnlige.dll
C:\windows\system32\opnljkh.dll
C:\windows\system32\opnmnmm.dll
C:\windows\system32\opnnljg.dll
C:\windows\system32\opnnool.dll
C:\windows\system32\oppoo.dll
C:\windows\system32\ooppo.ini
C:\windows\system32\ooppo.bak1
C:\windows\system32\ooppo.bak2
C:\windows\system32\qomjggh.dll
C:\windows\system32\qomjigf.dll
C:\windows\system32\qomjkhi.dll
C:\windows\system32\qomjkjk.dll
C:\windows\system32\qomkllk.dll
C:\windows\system32\qomlmml.dll
C:\windows\system32\qommmjg.dll
C:\windows\system32\qomnmki.dll
C:\windows\system32\rqrpmnl.dll
C:\windows\system32\rqrspon.dll
C:\windows\system32\rqrsqnl.dll
C:\windows\system32\ssqpqoo.dll
C:\windows\system32\tuvsqpo.dll
C:\windows\system32\urqomlk.dll
C:\windows\system32\urqooll.dll
C:\windows\system32\vturonl.dll
C:\windows\system32\vtuurst.dll
C:\windows\system32\vtuuuro.dll
C:\windows\system32\wvurrst.dll
C:\windows\system32\xxyaabb.dll
C:\windows\system32\xxyax.dll
C:\windows\system32\xayxx.ini
C:\windows\system32\xayxx.bak2
C:\windows\system32\xayxx.ini2
C:\windows\system32\xayxx.tmp
C:\windows\system32\xxyvssp.dll
C:\windows\system32\xxyyyxw.dll
C:\windows\system32\yayaaxx.dll
C:\windows\system32\yayawxy.dll
C:\windows\system32\yayayaw.dll
C:\windows\system32\yayyvwx.dll
Beginning removal…
The process smss.exe could not be stopped
Vundofix may not be able to delete some files that were found.
The process winlogon.exe could not be stopped
Vundofix may not be able to delete some files that were found.
The process explorer.exe was successfully stopped
The process iexplore.exe was successfully stopped
The process rundll32.exe was successfully stopped
Attempting to delete C:\windows\system32\awtrpon.dll
C:\windows\system32\awtrpon.dll Has been deleted!
Attempting to delete C:\windows\system32\awtturs.dll
C:\windows\system32\awtturs.dll Has been deleted!
Attempting to delete C:\windows\system32\awtussq.dll
C:\windows\system32\awtussq.dll Has been deleted!
Attempting to delete C:\windows\system32\byxvtrq.dll
C:\windows\system32\byxvtrq.dll Has been deleted!
Attempting to delete C:\windows\system32\cbxvtrr.dll
C:\windows\system32\cbxvtrr.dll Has been deleted!
Attempting to delete C:\windows\system32\cbxyvvt.dll
C:\windows\system32\cbxyvvt.dll Has been deleted!
Attempting to delete C:\windows\system32\ddcbxxu.dll
C:\windows\system32\ddcbxxu.dll Has been deleted!
Attempting to delete C:\windows\system32\ddcyxvu.dll
C:\windows\system32\ddcyxvu.dll Has been deleted!
Attempting to delete C:\windows\system32\efcbyay.dll
C:\windows\system32\efcbyay.dll Has been deleted!
Attempting to delete C:\windows\system32\fccayya.dll
C:\windows\system32\fccayya.dll Has been deleted!
Attempting to delete C:\windows\system32\fcccccd.dll
C:\windows\system32\fcccccd.dll Has been deleted!
Attempting to delete C:\windows\system32\gebxvtr.dll
C:\windows\system32\gebxvtr.dll Has been deleted!
Attempting to delete C:\windows\system32\gebyaxx.dll
C:\windows\system32\gebyaxx.dll Has been deleted!
Attempting to delete C:\windows\system32\hggffcd.dll
C:\windows\system32\hggffcd.dll Has been deleted!
Attempting to delete C:\windows\system32\hgggdaw.dll
C:\windows\system32\hgggdaw.dll Has been deleted!
Attempting to delete C:\windows\system32\hggghff.dll
C:\windows\system32\hggghff.dll Has been deleted!
Attempting to delete C:\windows\system32\iifcbyx.dll
C:\windows\system32\iifcbyx.dll Has been deleted!
Attempting to delete C:\windows\system32\iifdabc.dll
C:\windows\system32\iifdabc.dll Has been deleted!
Attempting to delete C:\windows\system32\iifdefe.dll
C:\windows\system32\iifdefe.dll Has been deleted!
Attempting to delete C:\windows\system32\jkkjigg.dll
C:\windows\system32\jkkjigg.dll Has been deleted!
Attempting to delete C:\windows\system32\jkkkhed.dll
C:\windows\system32\jkkkhed.dll Has been deleted!
Attempting to delete C:\windows\system32\khfebab.dll
C:\windows\system32\khfebab.dll Has been deleted!
Attempting to delete C:\windows\system32\khfebby.dll
C:\windows\system32\khfebby.dll Has been deleted!
Attempting to delete C:\windows\system32\khfeecb.dll
C:\windows\system32\khfeecb.dll Has been deleted!
Attempting to delete C:\windows\system32\ljjijjh.dll
C:\windows\system32\ljjijjh.dll Has been deleted!
Attempting to delete C:\windows\system32\ljjjged.dll
C:\windows\system32\ljjjged.dll Has been deleted!
Attempting to delete C:\windows\system32\nnnljgh.dll
C:\windows\system32\nnnljgh.dll Has been deleted!
Attempting to delete C:\windows\system32\nnnlkjg.dll
C:\windows\system32\nnnlkjg.dll Has been deleted!
Attempting to delete C:\windows\system32\nnnmljh.dll
C:\windows\system32\nnnmljh.dll Has been deleted!
Attempting to delete C:\windows\system32\opnkkll.dll
C:\windows\system32\opnkkll.dll Has been deleted!
Attempting to delete C:\windows\system32\opnklii.dll
C:\windows\system32\opnklii.dll Has been deleted!
Attempting to delete C:\windows\system32\opnlige.dll
C:\windows\system32\opnlige.dll Has been deleted!
Attempting to delete C:\windows\system32\opnljkh.dll
C:\windows\system32\opnljkh.dll Has been deleted!
Attempting to delete C:\windows\system32\opnmnmm.dll
C:\windows\system32\opnmnmm.dll Has been deleted!
Attempting to delete C:\windows\system32\opnnljg.dll
C:\windows\system32\opnnljg.dll Has been deleted!
Attempting to delete C:\windows\system32\opnnool.dll
C:\windows\system32\opnnool.dll Has been deleted!
Attempting to delete C:\windows\system32\oppoo.dll
C:\windows\system32\oppoo.dll Could not be deleted.
Attempting to delete C:\windows\system32\ooppo.ini
C:\windows\system32\ooppo.ini Has been deleted!
Attempting to delete C:\windows\system32\ooppo.bak1
C:\windows\system32\ooppo.bak1 Has been deleted!
Attempting to delete C:\windows\system32\ooppo.bak2
C:\windows\system32\ooppo.bak2 Has been deleted!
Attempting to delete C:\windows\system32\qomjggh.dll
C:\windows\system32\qomjggh.dll Has been deleted!
Attempting to delete C:\windows\system32\qomjigf.dll
C:\windows\system32\qomjigf.dll Has been deleted!
Attempting to delete C:\windows\system32\qomjkhi.dll
C:\windows\system32\qomjkhi.dll Has been deleted!
Attempting to delete C:\windows\system32\qomjkjk.dll
C:\windows\system32\qomjkjk.dll Has been deleted!
Attempting to delete C:\windows\system32\qomkllk.dll
C:\windows\system32\qomkllk.dll Has been deleted!
Attempting to delete C:\windows\system32\qomlmml.dll
C:\windows\system32\qomlmml.dll Has been deleted!
Attempting to delete C:\windows\system32\qommmjg.dll
C:\windows\system32\qommmjg.dll Has been deleted!
Attempting to delete C:\windows\system32\qomnmki.dll
C:\windows\system32\qomnmki.dll Has been deleted!
Attempting to delete C:\windows\system32\rqrpmnl.dll
C:\windows\system32\rqrpmnl.dll Has been deleted!
Attempting to delete C:\windows\system32\rqrspon.dll
C:\windows\system32\rqrspon.dll Has been deleted!
Attempting to delete C:\windows\system32\rqrsqnl.dll
C:\windows\system32\rqrsqnl.dll Has been deleted!
Attempting to delete C:\windows\system32\ssqpqoo.dll
C:\windows\system32\ssqpqoo.dll Has been deleted!
Attempting to delete C:\windows\system32\tuvsqpo.dll
C:\windows\system32\tuvsqpo.dll Has been deleted!
Attempting to delete C:\windows\system32\urqomlk.dll
C:\windows\system32\urqomlk.dll Has been deleted!
Attempting to delete C:\windows\system32\urqooll.dll
C:\windows\system32\urqooll.dll Has been deleted!
Attempting to delete C:\windows\system32\vturonl.dll
C:\windows\system32\vturonl.dll Has been deleted!
Attempting to delete C:\windows\system32\vtuurst.dll
C:\windows\system32\vtuurst.dll Has been deleted!
Attempting to delete C:\windows\system32\vtuuuro.dll
C:\windows\system32\vtuuuro.dll Has been deleted!
Attempting to delete C:\windows\system32\wvurrst.dll
C:\windows\system32\wvurrst.dll Has been deleted!
Attempting to delete C:\windows\system32\xxyaabb.dll
C:\windows\system32\xxyaabb.dll Has been deleted!
Attempting to delete C:\windows\system32\xxyax.dll
C:\windows\system32\xxyax.dll Has been deleted!
Attempting to delete C:\windows\system32\xayxx.ini
C:\windows\system32\xayxx.ini Has been deleted!
Attempting to delete C:\windows\system32\xayxx.bak2
C:\windows\system32\xayxx.bak2 Has been deleted!
Attempting to delete C:\windows\system32\xayxx.ini2
C:\windows\system32\xayxx.ini2 Has been deleted!
Attempting to delete C:\windows\system32\xayxx.tmp
C:\windows\system32\xayxx.tmp Has been deleted!
Attempting to delete C:\windows\system32\xxyvssp.dll
C:\windows\system32\xxyvssp.dll Has been deleted!
Attempting to delete C:\windows\system32\xxyyyxw.dll
C:\windows\system32\xxyyyxw.dll Has been deleted!
Attempting to delete C:\windows\system32\yayaaxx.dll
C:\windows\system32\yayaaxx.dll Has been deleted!
Attempting to delete C:\windows\system32\yayawxy.dll
C:\windows\system32\yayawxy.dll Has been deleted!
Attempting to delete C:\windows\system32\yayayaw.dll
C:\windows\system32\yayayaw.dll Has been deleted!
Attempting to delete C:\windows\system32\yayyvwx.dll
C:\windows\system32\yayyvwx.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V5.1.1
Checking Java version…
Sun Java not detected
Scan started at 23:21:16 10/07/2006
Listing files found while scanning….
C:\windows\system32\oppoo.dll
C:\windows\system32\ooppo.ini
Beginning removal…
The process smss.exe could not be stopped
Vundofix may not be able to delete some files that were found.
The process winlogon.exe could not be stopped
Vundofix may not be able to delete some files that were found.
The process explorer.exe was successfully stopped
The process iexplore.exe was successfully stopped
The process rundll32.exe was successfully stopped
Attempting to delete C:\windows\system32\oppoo.dll
C:\windows\system32\oppoo.dll Could not be deleted.
Attempting to delete C:\windows\system32\ooppo.ini
C:\windows\system32\ooppo.ini Has been deleted!
Performing Repairs to the registry.
Done!
And a new HijackThis! log, please.
As requested herewith latest HJT log :-
Please post a new Look2Me fix log.
Then give me 10 minutes or so to compose a "fix" for you.
Herewith new Look2me fix log :-
L2MFIX find log 051206
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\oppoo]
"Asynchronous"=dword:00000001
"DllName"="C:\\WINDOWS\\System32\\oppoo.dll"
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{2303D3FB-D94F-6408-E359-7C1A6928EA6E}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…"
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{E28B1EAD-FB19-4C75-846F-8B6F68586857}"=""
"{008E97C5-DD35-4D63-9825-2639AB37A304}"=""
"{CA967362-23C1-467E-B993-8874D9F95894}"=""
"{B9254DF6-73F2-4E30-802A-DAF614D53E18}"=""
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders"
"{698315E0-9BDD-4CCE-B493-5D90CFAFC084}"=""
"{D63C0426-84BB-4952-BAB8-E21788C4E6FC}"=""
"{132EDC98-E1DE-4B72-B513-C74E121F7D87}"=""
"{3F44D27C-B298-4929-B0D5-738DF2A82146}"=""
"{4A97235D-3D5B-4B86-BFAC-6D58A57F9AAD}"=""
"{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}"=""
"{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}"=""
"{785827EA-6E8D-4843-A13E-7E79D2CD5111}"=""
"{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}"=""
"{F3E5EEA7-CEF7-4408-9FDF-6189920FDA0F}"=""
"{27C54D1A-BAA0-4E99-8DD7-7317317796D4}"=""
"{D2E9CB9E-778E-4774-9CDF-679A88C8040B}"=""
"{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}"=""
"{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}"=""
"{C544DAF1-26A9-4EBB-BCEE-C74252DD3615}"=""
"{9E0963FC-40A8-48A3-BFD6-CFC519169889}"=""
"{2979FFFC-8E76-48C5-80E6-C85AC4AA283D}"=""
"{C725566A-3680-48C9-9F9A-38C353073030}"=""
"{55A6E709-15A0-4799-A5C6-E24E01A34927}"=""
"{6B6B8939-F8B3-41C9-B8BD-BD77A0A3F8FE}"=""
"{5AF80F73-0F14-4D71-B208-94B3B404501F}"=""
"{BF552F57-81D9-497D-ACA5-96B26CFD99FE}"=""
"{1D05CD86-929C-4369-B774-AC91510BFC6D}"=""
"{F6B2D57C-49DA-422A-81E8-E043EECFA009}"=""
"{9B3468FF-A0EA-4BCA-BE46-B03B36F4AADF}"=""
"{D571F431-F7EA-4426-9101-7C4C027CCE7B}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\InprocServer32]
@="C:\\WINDOWS\\system32\\khdda.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\InprocServer32]
@="C:\\WINDOWS\\system32\\dacompos.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\InprocServer32]
@="C:\\WINDOWS\\system32\\mrvbvm60.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\InprocServer32]
@="C:\\WINDOWS\\system32\\ribdyctl.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\InprocServer32]
@="C:\\WINDOWS\\system32\\uqnphost.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\InprocServer32]
@="C:\\WINDOWS\\system32\\uep10.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\InprocServer32]
@="C:\\WINDOWS\\system32\\ugat.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\InprocServer32]
@="C:\\WINDOWS\\system32\\kndes.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
hqghumea.dll Sat 8 Jul 2006 0:11:50 A…. 28,116 27.46 K
ipsecsnp.dll Sun 14 May 2006 10:13:42 A…. 334,848 327.00 K
ipsecsvc.dll Sun 14 May 2006 10:13:42 A…. 159,744 156.00 K
ipsmsnap.dll Sun 14 May 2006 10:13:42 A…. 364,544 356.00 K
legitc~1.dll Wed 17 May 2006 11:23:38 A…. 579,888 566.30 K
msvcp71.dll Wed 5 Jul 2006 0:16:24 A…. 499,712 488.00 K
msvcr71.dll Wed 5 Jul 2006 0:16:24 A…. 348,160 340.00 K
oakley.dll Sun 14 May 2006 10:13:42 A…. 257,536 251.50 K
oppoo.dll Sat 8 Jul 2006 8:58:26 ….. 569,396 556.05 K
polstore.dll Sun 14 May 2006 10:13:42 A…. 98,304 96.00 K
qghumeay.dll Fri 7 Jul 2006 23:31:00 A…. 28,116 27.46 K
rasmans.dll Thu 22 Jun 2006 11:59:18 A…. 169,984 166.00 K
sirenacm.dll Fri 16 Jun 2006 14:34:44 A…. 48,936 47.79 K
winipsec.dll Sun 14 May 2006 10:13:42 A…. 29,184 28.50 K
14 items found: 14 files, 0 directories.
Total of file sizes: 3,516,468 bytes 3.35 M
Locate .tmp files:
C:\WINDOWS\SYSTEM32\
mcrh.tmp Thu 6 Jul 2006 20:15:44 A…. 0 0.00 K
xayxx~1.tmp Thu 6 Jul 2006 20:15:44 A…. 0 0.00 K
2 items found: 2 files, 0 directories.
Total of file sizes: 0 bytes 0.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is C866-B80B
Directory of C:\WINDOWS\System32
11/07/2006 00:03 339 ooppo.ini
10/07/2006 19:02 dllcache
06/07/2006 18:46 Microsoft
1 File(s) 339 bytes
2 Dir(s) 36,457,283,584 bytes free
Step 1:
Please download Process Explorer by Systernals from:
Process Explorer
Also download/unzip KillBox by Option^Explicit from:
Killbox.zip
Download this file and save it where you can find it:
FixVundo Registry File
Copy/paste the text in the Quote box below into Notepad, and save it (where you can find it) as "
killme.txt "
C:\WINDOWS\SYSTEM32\oppoo.dll
Print out the following instructions as you will not have Internet Access for the rest of this fix.
Reboot in
"safe" mode .
Unzip Process Explorer and double click on
procexp.exe
In the top section of the Process Exlporer screen double-click on
winlogon.exe to bring up the winlogon.exe properties screen. Click on the
Threads tab at the top.
Once you see this screen click on each instance of:
once and then click the kill button.
After you have killed all of:
under winlogon click
OK .
If you see any of the files listed below, kill them as well.
Files to look for:
————————–
ooppo.ini
BE SURE TO KILL ONLY THESE FILES!!!
Probably not all of them will be present. That is OK.
Next double-click on
explorer.exe , select the
Threads tab, and again click once on each instance of:
then click the kill button.
If you see any of the files listed below kill them as well.
Files to look for:
————————–
ooppo.ini
BE SURE TO KILL ONLY THESE FILES!!!
Probably not all of them will be present. That is OK
Once you have done that click
OK again.
Next run Hijack This! and place a check beside each of the following.
Now click
Fix checked and close HijackThis.
Now double-click on the
vundo.reg file that you saved earlier and allow it to merge with the registry.
Find and open the "
killme.txt " file with Notepad.
Then copy the all file names in the "
killme.txt " to the clipboard by highlighting them and pressing
C (hold the
key down, then press
C ):
Close "
killme.txt ".
Double click on
Killbox.exe and then check the
Delete on reboot button.
In Killbox, click
File (in the upper left of Killbox), and choose "
Paste from Clipboard ".
Click the
red dot with the white X in it, in the upper right of Killbox, then click "
Yes ", and "
Yes " again.
After the reboot, "copy/paste" a new Hijack This! log file
into this thread .
In Process Explorer oppoo.dll only showed in explorer.exe - nothing in winlogon.exe. Still in safe mode i ran Hijack This and 02 and 020 were not showing !
Open this file on your machine with Notepad:kb.log
As requested herewith killbox log :-
Pocket Killbox version 2.0.0.648
Running on Windows XP as Chris Brownhill(Administrator)
was started @ Tuesday, July 11, 2006, 7:18 PM
# 1 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\oppoo.dll
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 7:19:50 PM
Killbox Closed(Exit) @ 7:20:07 PM
__________________________________________________
Pocket Killbox version 2.0.0.648
Running on Windows XP as Chris Brownhill(Administrator)
was started @ Tuesday, July 11, 2006, 8:46 PM
# 1 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\oppoo.dll
Also latest Look2me log :-
L2MFIX find log 051206
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\oppoo]
"Asynchronous"=dword:00000001
"DllName"="C:\\WINDOWS\\System32\\oppoo.dll"
"Impersonate"=dword:00000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{2303D3FB-D94F-6408-E359-7C1A6928EA6E}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…"
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…"
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{E28B1EAD-FB19-4C75-846F-8B6F68586857}"=""
"{008E97C5-DD35-4D63-9825-2639AB37A304}"=""
"{CA967362-23C1-467E-B993-8874D9F95894}"=""
"{B9254DF6-73F2-4E30-802A-DAF614D53E18}"=""
"{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders"
"{698315E0-9BDD-4CCE-B493-5D90CFAFC084}"=""
"{D63C0426-84BB-4952-BAB8-E21788C4E6FC}"=""
"{132EDC98-E1DE-4B72-B513-C74E121F7D87}"=""
"{3F44D27C-B298-4929-B0D5-738DF2A82146}"=""
"{4A97235D-3D5B-4B86-BFAC-6D58A57F9AAD}"=""
"{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}"=""
"{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}"=""
"{785827EA-6E8D-4843-A13E-7E79D2CD5111}"=""
"{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}"=""
"{F3E5EEA7-CEF7-4408-9FDF-6189920FDA0F}"=""
"{27C54D1A-BAA0-4E99-8DD7-7317317796D4}"=""
"{D2E9CB9E-778E-4774-9CDF-679A88C8040B}"=""
"{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}"=""
"{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}"=""
"{C544DAF1-26A9-4EBB-BCEE-C74252DD3615}"=""
"{9E0963FC-40A8-48A3-BFD6-CFC519169889}"=""
"{2979FFFC-8E76-48C5-80E6-C85AC4AA283D}"=""
"{C725566A-3680-48C9-9F9A-38C353073030}"=""
"{55A6E709-15A0-4799-A5C6-E24E01A34927}"=""
"{6B6B8939-F8B3-41C9-B8BD-BD77A0A3F8FE}"=""
"{5AF80F73-0F14-4D71-B208-94B3B404501F}"=""
"{BF552F57-81D9-497D-ACA5-96B26CFD99FE}"=""
"{1D05CD86-929C-4369-B774-AC91510BFC6D}"=""
"{F6B2D57C-49DA-422A-81E8-E043EECFA009}"=""
"{9B3468FF-A0EA-4BCA-BE46-B03B36F4AADF}"=""
"{D571F431-F7EA-4426-9101-7C4C027CCE7B}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{132EDC98-E1DE-4B72-B513-C74E121F7D87}\InprocServer32]
@="C:\\WINDOWS\\system32\\khdda.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{D1D10E27-4CC6-4B83-A719-9AF80CA9CCB5}\InprocServer32]
@="C:\\WINDOWS\\system32\\dacompos.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0A609CAA-D53B-4268-ACB5-8A8C09C2692C}\InprocServer32]
@="C:\\WINDOWS\\system32\\mrvbvm60.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{1D042240-1CAD-46A8-BDDF-9CBD69D2343C}\InprocServer32]
@="C:\\WINDOWS\\system32\\ribdyctl.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{27C54D1A-BAA0-4E99-8DD7-7317317796D4}\InprocServer32]
@="C:\\WINDOWS\\system32\\uqnphost.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{6A7F9CD9-55CF-4841-852C-D8CF06A0A48A}\InprocServer32]
@="C:\\WINDOWS\\system32\\uep10.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}]
@=""
"IDEx"="ADDR"
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{0E0791FA-A2E6-48E4-8CFB-528EC4D48F21}\InprocServer32]
@="C:\\WINDOWS\\system32\\ugat.dll"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}]
@=""
"IDEx"="AD"
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{9E0963FC-40A8-48A3-BFD6-CFC519169889}\InprocServer32]
@="C:\\WINDOWS\\system32\\kndes.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
hqghumea.dll Sat 8 Jul 2006 0:11:50 A…. 28,116 27.46 K
ipsecsnp.dll Sun 14 May 2006 10:13:42 A…. 334,848 327.00 K
ipsecsvc.dll Sun 14 May 2006 10:13:42 A…. 159,744 156.00 K
ipsmsnap.dll Sun 14 May 2006 10:13:42 A…. 364,544 356.00 K
legitc~1.dll Wed 17 May 2006 11:23:38 A…. 579,888 566.30 K
msvcp71.dll Wed 5 Jul 2006 0:16:24 A…. 499,712 488.00 K
msvcr71.dll Wed 5 Jul 2006 0:16:24 A…. 348,160 340.00 K
oakley.dll Sun 14 May 2006 10:13:42 A…. 257,536 251.50 K
oppoo.dll Sat 8 Jul 2006 8:58:26 ….. 569,396 556.05 K
polstore.dll Sun 14 May 2006 10:13:42 A…. 98,304 96.00 K
qghumeay.dll Fri 7 Jul 2006 23:31:00 A…. 28,116 27.46 K
rasmans.dll Thu 22 Jun 2006 11:59:18 A…. 169,984 166.00 K
sirenacm.dll Fri 16 Jun 2006 14:34:44 A…. 48,936 47.79 K
winipsec.dll Sun 14 May 2006 10:13:42 A…. 29,184 28.50 K
14 items found: 14 files, 0 directories.
Total of file sizes: 3,516,468 bytes 3.35 M
Locate .tmp files:
C:\WINDOWS\SYSTEM32\
mcrh.tmp Thu 6 Jul 2006 20:15:44 A…. 0 0.00 K
xayxx~1.tmp Thu 6 Jul 2006 20:15:44 A…. 0 0.00 K
2 items found: 2 files, 0 directories.
Total of file sizes: 0 bytes 0.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is C866-B80B
Directory of C:\WINDOWS\System32
12/07/2006 12:50 530,631 ooppo.ini
12/07/2006 07:28 580,174 ooppo.bak2
10/07/2006 19:02 dllcache
06/07/2006 18:46 Microsoft
2 File(s) 1,110,805 bytes
2 Dir(s) 36,236,173,312 bytes free
Please do not reboot.
I will post a "fix" shortly.
If you reboot before attempting the fix, we'll have to start over.
