Trojan - winlogonhook and pop-ups

Hello gimli and Welcome to TomCoyote,

Please do the following:

Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan:
• Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

======
WinPFind
Please Download the following tools to assist us in removing this infection! Download WinPFind from http://www.bleepingcomputer.com/files/winpfind.php

• Right Click the Zip Folder and Select Extract All
• Extract it somewhere you will remember like the Desktop
• Don’t do anything with it yet!

Reboot.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode

• Doubleclick WinPFind.exe
• Click on Configure Scan Options.
• Remove all the checkmarks under Folder Options on the left side by clicking the button Remove All, uncheck Run Addon's and click Apply.
• Click Start Scan
  It will scan the entire System, so please be patient! This scan may take awhile

Once the Scan is Complete

• Reboot your computer into normal mode.
• Go to the WinPFind folder
• Locate WinPFind.txt

Please reply with the results from Kapersky and the WinPFind.txt file and post the results in your reply.

Hello Susan, Thanks for a prompt help. Before my post I ran CounterSpy and it detected like 8 traces including winlogonhook. Right now it's monitor is going crazy with Shell Execute Hook Prompts. It gives Name: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}. I block it as I don't know what it is. Currently I'm running Kaspersky online scan and will post results when finished with both programs you suggested. Thanksa again for help, Gimli

Susan, Just finished both scans. Sorry it took so long but I have a lot of storage (over 0.5 TB). Below are the log results. _________________________________________________________________________________________ Kaspersky: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Friday, July 28, 2006 4:43:00 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 28/07/2006 Kaspersky Anti-Virus database records: 197886 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ Z:\ Scan Statistics: Total number of scanned objects: 199277 Number of viruses found: 10 Number of infected objects: 22 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:25:03 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\HPPAppActivity.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS040C2439-0C10-48F9-B135-2543E0FBDB5E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS06A82FE9-0685-417B-8833-A34CF676D4F8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0B4F9D70-92AD-4A82-89E2-964C7CE803DE.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0CC6F345-A84B-48B3-8D04-98702B880E46.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1005846E-44C9-4859-9711-3F6080DF11E5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS10082096-C689-465C-A449-F194FC51658F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS121C3A01-417A-4CF7-88D7-E8BEA98323BF.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS184DCDAF-32A8-4C39-8FA2-4E843818B444.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS1F054FB7-2C7D-48F6-AEAD-4DC1043DC422.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS219CD86B-B056-442C-9FCB-95E080C60B12.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS22A6B05F-49F9-4402-8EA6-806E65857807.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS25355F40-0F3E-4F77-A18E-5D29EEEC55DA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS253B9192-6A47-4A0E-B6C6-C31873E11003.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2F65F2F6-5077-4A55-8500-AD1F4958FE19.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2F9401DF-BE6E-4109-A585-678DA1DD6541.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3A6CC6B1-BC9B-4085-83C3-329CB5ADBDB9.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3D471D41-07A1-46F4-861C-E2472260EDFE.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3D49A850-7456-44FF-A76E-90B6349FEA7C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS43084604-924F-48D0-B519-972399852194.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS459DC974-8DFF-40A4-A047-3893924DD0FE.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS49AD17D4-B99D-4D9C-8773-9A2693B0703C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4A0F9FF3-5318-48BB-B1F8-8C2E1BA48047.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS506FA668-9662-48BC-9074-D1B0F15F86DA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS51BE2D93-33ED-401B-BDCF-77E248AAAEC0.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5699EA19-21AF-41CF-9C6D-58B4C29235DD.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS56D65B37-9D7D-424A-9DEB-A78908096DA6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS59858EB2-0845-49E9-884E-8352D670CDA5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5E630B80-76C2-45E6-8CCC-A5DD0400C53A.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS65CB702B-B232-42C7-AFC8-F12B01C00C26.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS697F8D57-A470-414C-8BE2-21C8497A8013.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6B79294F-7157-4B97-B5A1-76BDAA1EE946.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS70D203E6-038C-45C6-8238-BD3C835D97B8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS70DEA7C9-03DE-459C-AE88-1CD7AB4C7FC6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7389DD68-E68B-44CD-8653-24482D5DD9C5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7D0C0777-30D2-4CD3-A710-B8CB3A32D2DF.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS84A35DE3-7A0C-4893-AAF8-B2C214EADAAA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS87F314D3-030E-4B5D-A8C8-AC4B97E4D9B1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9113D42F-8D5F-4B6C-8532-27881194826B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS91E059AD-CD82-495B-AF2A-116000FD7E73.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS92F232FA-DD28-43E9-89AF-8D1372DA7205.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS936AAF12-1106-4795-93B3-73B9A7461193.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS93EEA6FE-56C2-4C53-A57F-EC91CE29933A.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9D3192B5-61D6-4EEE-AD19-919C482A6C23.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9E04422C-DF0B-4297-9C05-953EEF645F05.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA985E0E6-BE9C-43B8-8D9A-2E82EF76A391.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAA99F52C-34B6-4233-A91E-4910A79565AA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSBAA42EAA-5D3D-407E-878C-FC8A32501B8C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSBAAA2E91-AEA6-41A0-B722-1F16CE41516C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSBB1DD2F6-60D1-4F98-9870-16B1019D5BF4.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSBF15E723-5E50-4894-8172-21825F1C2B75.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC22D839A-3CAA-4B11-BB9D-392019255D22.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC606A471-20C2-47AE-BE77-D4D84FB55B82.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCFC88A56-FB1B-4234-B8C9-810661B9F155.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD30E2D9B-643E-47E9-A5FA-FC9E340D1EEE.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD417F930-CBA0-4CAF-8BC5-D2BA1E834857.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD9A3D9FC-3F6C-434D-A009-FC0448B4770D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDAB73D60-BFCB-4B08-911A-F8CA55766F02.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDC058A2B-30F4-4BB3-92B9-DD78A311A323.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDFFAEEED-3075-4876-A7EC-230F3BD749AA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE084EC68-7660-4160-B4EE-48EDA5CD292E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE5E43380-D8A6-43F0-8EBC-49ECF4A17C53.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSEBD04E81-1F21-4490-A9D3-35EF38276F4E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSEF299E09-BFCB-4AB1-B8B1-1BC26217D1BF.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF1CC6D9C-AB05-4E7D-BD21-9086B6EC235E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF352E183-A352-40AD-9941-ACFDF7EEC8D3.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF7EE2F20-DC9C-4836-93AE-A3C3556F2155.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF8350E4C-1644-4D9D-9E6C-9C049FEBF935.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSFE7B4954-B9E3-4359-9F7B-C5ED23D130F1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSFFDD46CD-B6F5-4880-83C9-BEA8565AFE2B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Application Data\Identities\{099CA788-3F99-442B-B6F4-1C27746DCBBC}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Application Data\Identities\{099CA788-3F99-442B-B6F4-1C27746DCBBC}\Microsoft\Outlook Express\Hotmail - Inbox.dbx Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Application Data\Identities\{099CA788-3F99-442B-B6F4-1C27746DCBBC}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Application Data\Sunbelt Software\CounterSpy\Quarantine\99F607A9-DEFD-48DE-9C91-AA29A7\48856479-9DF5-4F8F-8147-1D28D8 Infected: Packed.Win32.Klone.g skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Application Data\Sunbelt Software\CounterSpy\SunEventsData.sdb Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\History\History.IE5\MSHist012006072720060728\index.dat Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Temp\~DF7142.tmp Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Temp\~DFB38C.tmp Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Temp\~DFD323.tmp Object is locked skipped C:\Documents and Settings\Szymon Dembowy\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Szymon Dembowy\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Szymon Dembowy\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Norton SystemWorks\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton SystemWorks\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton SystemWorks\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton SystemWorks\Norton AntiVirus\Savrt\0555NAV~.TMP Object is locked skipped C:\Program Files\Norton SystemWorks\Norton AntiVirus\Savrt\0613NAV~.TMP Object is locked skipped C:\Program Files\WS_FTP Pro\ssl.log Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0106063.exe Infected: Trojan-Downloader.Win32.Zlob.aat skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0106071.dll Infected: Trojan-Downloader.Win32.Zlob.aat skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0106136.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0106150.dll Infected: not-virus:Hoax.Win32.Renos.dw skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0106375.exe Infected: Trojan-Downloader.Win32.Zlob.aau skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0106376.exe Infected: Trojan-Downloader.Win32.Zlob.to skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107425.exe Infected: Trojan-Downloader.Win32.Zlob.aat skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107426.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107428.exe Infected: Trojan-Downloader.Win32.Zlob.aau skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107429.exe Infected: Trojan-Proxy.Win32.Ranky.bk skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107430.exe Infected: Trojan-Proxy.Win32.Ranky.bk skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107431.exe Infected: Trojan-Proxy.Win32.Ranky.bk skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107432.exe Infected: Trojan-Downloader.Win32.PurityScan.cq skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107434.dll Infected: not-virus:Hoax.Win32.Renos.dw skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0107435.exe Infected: Trojan-Downloader.Win32.Obfuscated.n skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP250\A0108468.dll Infected: not-virus:Hoax.Win32.Renos.dw skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP252\A0108506.dll Infected: Packed.Win32.Klone.g skipped C:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP252\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{59205E96-4646-42D8-BAE2-F2548852D674}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\win45A.tmp Object is locked skipped C:\WINDOWS\Temp\win463.tmp.exe Infected: Trojan-Downloader.Win32.Obfuscated.a skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\RECYCLER\NPROTECT\NPROTECT.LOG Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP252\change.log Object is locked skipped D:\Temp\My Downloads\Complete\Cdvd.exe/stream/data0011 Infected: Trojan-Downloader.Win32.Small.asf skipped D:\Temp\My Downloads\Complete\Cdvd.exe/stream Infected: Trojan-Downloader.Win32.Small.asf skipped D:\Temp\My Downloads\Complete\Cdvd.exe NSIS: infected - 2 skipped E:\RECYCLER\NPROTECT\NPROTECT.LOG Object is locked skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{3090E151-74EA-47B2-93B1-7A2497E1D1CB}\RP252\change.log Object is locked skipped Scan process completed. _________________________________________________________________________________________ WINPFind: WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600 Internet Explorer Version: 6.0.2900.2180 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] SV1 = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Adobe.Acrobat.ContextMenu {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido anti-spyware {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} = C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WS_FTP {797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Start Menu Pin = %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SpySweeper {7C9D5882-CB4A-4090-96C8-430BFE8B795B} = C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} = C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WS_FTP {797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido anti-spyware {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = %SystemRoot%\system32\SHELL32.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{601ED020-FB6C-11D3-87D8-0050DA59922B} WsftpBrowserHelper Class = C:\Program Files\WS_FTP Pro\wsbho2k0.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} = C:\WINDOWS\system32\jkkllji.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} SSVHelper Class = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98241F66-737B-47F5-A12E-480C71287688} = C:\WINDOWS\system32\ddcyv.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD} CNavExtBho Class = C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910} AcroIEToolbarHelper Class = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{182EC0BE-5110-49C8-A062-BEB1D02A220B} Adobe PDF = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\System32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] {47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll {C4069E3A-68F1-403E-B40E-20066696354B} = Norton AntiVirus : C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5E638779-1818-4754-A595-EF1C63B87A56} ButtonText = Express Cleanup : C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263} ButtonText = Research : [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} = [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll {C4069E3A-68F1-403E-B40E-20066696354B} = Norton AntiVirus : C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll {47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} = : {F2CF5485-4E02-4F68-819C-B92DE9277049} = : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] NvCplDaemon RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup nwiz nwiz.exe /install PRONoMgr.exe C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe CTSysVol C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r SBDrvDet C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r UpdReg C:\WINDOWS\UpdReg.EXE CTHelper CTHELPER.EXE QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe" Ptipbmf rundll32.exe ptipbmf.dll,SetWriteCacheMode TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot NvMediaCenter RunDLL32.exe NvMCTray.dll,NvTaskbarInit SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" CaISSDT "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe" MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto SunServer C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = 1 MAPI Installed = 1 MSFS Installed = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] CTFMON.EXE C:\WINDOWS\system32\ctfmon.exe SetDefaultMIDI MIDIDef.exe Lrco "C:\WINDOWS\FNTS~1\chkntfs.exe" -vt yazb Ufgztfuk C:\Program Files\?dobe\w?auclt.exe [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] CounterSpyCleaner C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunASCleaner.exe [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup location Common Startup command C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe item Acrobat Assistant path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup location Common Startup command C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe item Acrobat Assistant HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup location Common Startup command C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE item Adobe Gamma Loader path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup location Common Startup command C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE item Adobe Gamma Loader HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup location Common Startup command C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE item InterVideo WinCinema Manager path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup location Common Startup command C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE item InterVideo WinCinema Manager HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup location Common Startup command C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe /start item Logitech Desktop Messenger path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup location Common Startup command C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe /start item Logitech Desktop Messenger HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~2\Office10\OSA.EXE -b -l item Microsoft Office path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~2\Office10\OSA.EXE -b -l item Microsoft Office HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ASUS Probe key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item AsusProb hkey HKLM command C:\Program Files\ASUS\Asus Probe\AsusProb.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item AsusProb hkey HKLM command C:\Program Files\ASUS\Asus Probe\AsusProb.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ccApp key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ccApp hkey HKLM command "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ccApp hkey HKLM command "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item iTunesHelper hkey HKLM command "C:\Program Files\iTunes\iTunesHelper.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item iTunesHelper hkey HKLM command "C:\Program Files\iTunes\iTunesHelper.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Launch Ai Booster key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item OverClk hkey HKLM command C:\Program Files\ASUS\Ai Booster\OverClk.exe 1 inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item OverClk hkey HKLM command C:\Program Files\ASUS\Ai Booster\OverClk.exe 1 inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LDM key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item BackWeb-8876480 hkey HKCU command C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item BackWeb-8876480 hkey HKCU command C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechGalleryRepair key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechSoftwareUpdate key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ManifestEngine hkey HKCU command "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ManifestEngine hkey HKCU command "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechVideoRepair key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechVideoTray key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LogiTray hkey HKLM command C:\Program Files\Logitech\Video\LogiTray.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LogiTray hkey HKLM command C:\Program Files\Logitech\Video\LogiTray.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LVCOMSX key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LVCOMSX hkey HKLM command C:\WINDOWS\System32\LVCOMSX.EXE inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LVCOMSX hkey HKLM command C:\WINDOWS\System32\LVCOMSX.EXE inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item msmsgs hkey HKCU command "C:\Program Files\Messenger\msmsgs.exe" /background inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item msmsgs hkey HKCU command "C:\Program Files\Messenger\msmsgs.exe" /background inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NeroFilterCheck key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NeroCheck hkey HKLM command C:\WINDOWS\system32\NeroCheck.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NeroCheck hkey HKLM command C:\WINDOWS\system32\NeroCheck.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NvMediaCenter key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NvMcTray hkey HKLM command RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NvMcTray hkey HKLM command RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item qttask hkey HKLM command "C:\Program Files\QuickTime\qttask.exe" -atboottime inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item qttask hkey HKLM command "C:\Program Files\QuickTime\qttask.exe" -atboottime inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RemoteControl key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item PDVDServ hkey HKLM command "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item PDVDServ hkey HKLM command "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skype key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item Skype hkey HKCU command "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item Skype hkey HKCU command "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunServer key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item sunserver hkey HKLM command C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item sunserver hkey HKLM command C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item realsched hkey HKLM command "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item realsched hkey HKLM command "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state system.ini 0 win.ini 0 bootini 2 services 0 startup 2 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID {17492023-C23A-453E-A040-C7C580BBF700} 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = {0DF44EAA-FF21-4412-828E-260A8728E7F1} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 undockwithoutlogon 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 145 NoDrives 0 NoViewOnDrive 0 NoRecentDocsMenu 0 ClearRecentDocsOnExit 1 NoRecentDocsHistory 1 NoDriveAutoRun ÿÿÿ HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System DisableRegistryTools 0 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll WPDShServiceObj {AAA288BA-9A4C-45B0-95D7-94D524869DB5} = C:\WINDOWS\system32\WPDShServiceObj.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, Shell = Explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT&

Hi gimli, It looks like the WINPFind was cut off at the bottom. Could you reply and with it again please?

Susan, Here's entire WINPFind log: WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding. If you see a message in the titlebar saying "Not responding…" you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly. »»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600 Internet Explorer Version: 6.0.2900.2180 »»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»» [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] SV1 = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Adobe.Acrobat.ContextMenu {D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido anti-spyware {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With {09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} = C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WS_FTP {797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} Start Menu Pin = %SystemRoot%\system32\SHELL32.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\SpySweeper {7C9D5882-CB4A-4090-96C8-430BFE8B795B} = C:\PROGRA~1\Webroot\SPYSWE~1\SSCtxMnu.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} = C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WS_FTP {797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu {A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido anti-spyware {8934FCEF-F5B8-468f-951F-78A921CD3920} = C:\Program Files\ewido anti-spyware 4.0\context.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files {750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR {B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinZip {E0D79304-84BE-11CE-9641-444553540000} = C:\PROGRA~1\WINZIP\WZSHLSTB.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF} = %SystemRoot%\system32\SHELL32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE} = %SystemRoot%\system32\SHELL32.dll [HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} AcroIEHlprObj Class = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{601ED020-FB6C-11D3-87D8-0050DA59922B} WsftpBrowserHelper Class = C:\Program Files\WS_FTP Pro\wsbho2k0.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} = C:\WINDOWS\system32\jkkllji.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} SSVHelper Class = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{98241F66-737B-47F5-A12E-480C71287688} = C:\WINDOWS\system32\ddcyv.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD} CNavExtBho Class = C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910} AcroIEToolbarHelper Class = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{182EC0BE-5110-49C8-A062-BEB1D02A220B} Adobe PDF = C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} &Tip of the Day = %SystemRoot%\System32\shdocvw.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar] {47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll {C4069E3A-68F1-403E-B40E-20066696354B} = Norton AntiVirus : C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} MenuText = Sun Java Console : C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{5E638779-1818-4754-A595-EF1C63B87A56} ButtonText = Express Cleanup : C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263} ButtonText = Research : [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} = [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser {01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll {0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll {C4069E3A-68F1-403E-B40E-20066696354B} = Norton AntiVirus : C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll {47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} = : {F2CF5485-4E02-4F68-819C-B92DE9277049} = : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] NvCplDaemon RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup nwiz nwiz.exe /install PRONoMgr.exe C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe CTSysVol C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r SBDrvDet C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r UpdReg C:\WINDOWS\UpdReg.EXE CTHelper CTHELPER.EXE QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper "C:\Program Files\iTunes\iTunesHelper.exe" Ptipbmf rundll32.exe ptipbmf.dll,SetWriteCacheMode TkBellExe "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot NvMediaCenter RunDLL32.exe NvMCTray.dll,NvTaskbarInit SunJavaUpdateSched C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe ccApp "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" CaISSDT "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe" MSConfig C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto SunServer C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] IMAIL Installed = 1 MAPI Installed = 1 MSFS Installed = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] CTFMON.EXE C:\WINDOWS\system32\ctfmon.exe SetDefaultMIDI MIDIDef.exe Lrco "C:\WINDOWS\FNTS~1\chkntfs.exe" -vt yazb Ufgztfuk C:\Program Files\?dobe\w?auclt.exe [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] CounterSpyCleaner C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunASCleaner.exe [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Acrobat Assistant.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup location Common Startup command C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe item Acrobat Assistant path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Acrobat Assistant.lnk backup C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup location Common Startup command C:\PROGRA~1\Adobe\ACROBA~1.0\Distillr\acrotray.exe item Acrobat Assistant HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup location Common Startup command C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE item Adobe Gamma Loader path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup location Common Startup command C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE item Adobe Gamma Loader HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup location Common Startup command C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE item InterVideo WinCinema Manager path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk backup C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup location Common Startup command C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE item InterVideo WinCinema Manager HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup location Common Startup command C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe /start item Logitech Desktop Messenger path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk backup C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup location Common Startup command C:\PROGRA~1\Logitech\DESKTO~1\8876480\Program\LDMConf.exe /start item Logitech Desktop Messenger HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office.lnk path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~2\Office10\OSA.EXE -b -l item Microsoft Office path C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Microsoft Office.lnk backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup location Common Startup command C:\PROGRA~1\MICROS~2\Office10\OSA.EXE -b -l item Microsoft Office HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ASUS Probe key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item AsusProb hkey HKLM command C:\Program Files\ASUS\Asus Probe\AsusProb.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item AsusProb hkey HKLM command C:\Program Files\ASUS\Asus Probe\AsusProb.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ccApp key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ccApp hkey HKLM command "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ccApp hkey HKLM command "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item iTunesHelper hkey HKLM command "C:\Program Files\iTunes\iTunesHelper.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item iTunesHelper hkey HKLM command "C:\Program Files\iTunes\iTunesHelper.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Launch Ai Booster key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item OverClk hkey HKLM command C:\Program Files\ASUS\Ai Booster\OverClk.exe 1 inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item OverClk hkey HKLM command C:\Program Files\ASUS\Ai Booster\OverClk.exe 1 inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LDM key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item BackWeb-8876480 hkey HKCU command C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item BackWeb-8876480 hkey HKCU command C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechGalleryRepair key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechSoftwareUpdate key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ManifestEngine hkey HKCU command "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ManifestEngine hkey HKCU command "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechVideoRepair key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item ISStart hkey HKLM command C:\Program Files\Logitech\Video\ISStart.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LogitechVideoTray key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LogiTray hkey HKLM command C:\Program Files\Logitech\Video\LogiTray.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LogiTray hkey HKLM command C:\Program Files\Logitech\Video\LogiTray.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\LVCOMSX key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LVCOMSX hkey HKLM command C:\WINDOWS\System32\LVCOMSX.EXE inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item LVCOMSX hkey HKLM command C:\WINDOWS\System32\LVCOMSX.EXE inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item msmsgs hkey HKCU command "C:\Program Files\Messenger\msmsgs.exe" /background inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item msmsgs hkey HKCU command "C:\Program Files\Messenger\msmsgs.exe" /background inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NeroFilterCheck key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NeroCheck hkey HKLM command C:\WINDOWS\system32\NeroCheck.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NeroCheck hkey HKLM command C:\WINDOWS\system32\NeroCheck.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NvMediaCenter key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NvMcTray hkey HKLM command RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item NvMcTray hkey HKLM command RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item qttask hkey HKLM command "C:\Program Files\QuickTime\qttask.exe" -atboottime inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item qttask hkey HKLM command "C:\Program Files\QuickTime\qttask.exe" -atboottime inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RemoteControl key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item PDVDServ hkey HKLM command "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item PDVDServ hkey HKLM command "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Skype key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item Skype hkey HKCU command "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item Skype hkey HKCU command "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunServer key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item sunserver hkey HKLM command C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item sunserver hkey HKLM command C:\Program Files\Sunbelt Software\CounterSpy\Consumer\sunserver.exe inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TkBellExe key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item realsched hkey HKLM command "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot inimapping 0 key SOFTWARE\Microsoft\Windows\CurrentVersion\Run item realsched hkey HKLM command "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot inimapping 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state system.ini 0 win.ini 0 bootini 2 services 0 startup 2 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ext\CLSID {17492023-C23A-453E-A040-C7C580BBF700} 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum {BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} = {0DF44EAA-FF21-4412-828E-260A8728E7F1} = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system dontdisplaylastusername 0 legalnoticecaption legalnoticetext shutdownwithoutlogon 1 undockwithoutlogon 1 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies] HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer NoDriveTypeAutoRun 145 NoDrives 0 NoViewOnDrive 0 NoRecentDocsMenu 0 ClearRecentDocsOnExit 1 NoRecentDocsHistory 1 NoDriveAutoRun ÿÿÿ HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System DisableRegistryTools 0 HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] PostBootReminder {7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll CDBurn {fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll WPDShServiceObj {AAA288BA-9A4C-45B0-95D7-94D524869DB5} = C:\WINDOWS\system32\WPDShServiceObj.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, Shell = Explorer.exe System = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain = crypt32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet = cryptnet.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll = cscdll.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcyv = C:\WINDOWS\system32\ddcyv.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkllji = jkkllji.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy = sclgntfy.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn = WlNotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon = WgaLogon.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winzlo32 = winzlo32.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon = wlnotify.dll HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier = WRLogonNTF.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path Debugger = ntsd -d [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] AppInit_DLLs »»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder. Scan completed on 7/28/2006 5:00:58 AM

This should not take as long to do as the first reply.

Please download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose:Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click
• No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
• NOTE:If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

STEP 1.
======
FileFind

Please downloadFileFind from Atribune.
Unzip the file and save it to your desktop.

To run FileFind, please do the following:

• Click on FileFind.exe
• In the box labeled "Enter the directory to search"
• Enter Drive eg.. C:\
• In the box labeled "Enter the file to search"
• Enter the file winzlo32.dll
• Now click on the "Find" button
• Once the utility has found the files click on "Export"
• This will save a text file to your C:\ drive as /Export.txt

Double click on Export.txt, copy and paste, this information in your next post.


Please download VundoFix.exe to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.

Please post (reply) with the export.txt, the vundofix.txt and a new HiJackThis log.

Disable SpySweeper:
You have SpySweeper installed. While this is a great program, we need to temporarily disable (not uninstall) the program because it might stop our fix.

• Open it click >Options over to the left then >program options>Uncheck "load at windows startup"
• Over to the left click "shields" and uncheck all there.
• Uncheck" home page shield".
• Uncheck ''automatically restore default without notification".

After all of the fixes are complete it is very important that you enable SpySweeper again.

Scan with HijackThis. Place a check against each of the following:
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\jkkllji.dll
O2 - BHO: (no name) - {E730F7A0-6FAF-4DA4-9A6E-D12DF10A0AFB} - C:\WINDOWS\system32\ddcyv.dll (file missing)
O4 - HKCU\..\Run: [Ufgztfuk] C:\Program Files\?dobe\w?auclt.exe
O20 - Winlogon Notify: jkkllji - C:\WINDOWS\SYSTEM32\jkkllji.dll
O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

======
Delete Files with Killbox

Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard
C:\WINDOWS\system32\jkkllji.dll
C:\Program Files\?dobe
D:\Temp\My Downloads\Complete\Cdvd.exe


In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed
(Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)
Click the option to Delete on Reboot
- If not greyed out click the checkbox for Unregister .dll Before Deleting
- click End Explorer Shell while Killing File
- Now click on the red button with a white 'X' in the middle to delete the files
- Click Yes when it says all files will be deleted on the next reboot
- Click Yes when it asks if you want to reboot now
(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)

Note: Killbox will let you know if a file does not exist. If that happens, just continue on.

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.

Post back a fresh HijackThis log and we will take another look.

Susan, After I restarted SpySweeper I discovered I still have mljjk.dll. I checked and the file physically is still in windows\system32 directory. So it looks like I still have WinFixer virus. Hijackthis does not show it (at least I don't see it). VundoFix does not detect it either. Please advise what to do. I'm considering deleting this file manually and having SpySweeper remove the registry entry. Your help is greatly appreciated. Gimli

Go ahead and delete mljjk.dll manually then. Then please do the following:

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

You may receive pop-up asking if you will allow script to run when you perform the following instructions. Please allow the script to run.

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

If you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."…then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.

Susan, Manual simple delete was not possible of mljjk.dll. I have gone into registry and removed 3 separate entries involving this dll. I'm going to reboot and try to delete the file then. SpySweeper still detected winlogonhook, purityscan and spyware quake. Sorry about the trouble - it seems like my computer is really messed up. I hope you can guide me until it's clean. I'm really happy I found this forum and I think it's great you sped your own time to help others. If it bothers you that I do stuff on my own please let me know and I will only do what you recommend. I ran the l2mfix and below is a copy of the log. L2MFIX find log 051206 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mljjk] "Asynchronous"=dword:00000001 "DllName"="C:\\WINDOWS\\system32\\mljjk.dll" "Impersonate"=dword:00000000 "Startup"="SysLogon" "Logoff"="SysLogoff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] "Logon"="WLEventLogon" "Logoff"="WLEventLogoff" "Startup"="WLEventStartup" "Shutdown"="WLEventShutdown" "StartScreenSaver"="WLEventStartScreenSaver" "StopScreenSaver"="WLEventStopScreenSaver" "Lock"="WLEventLock" "Unlock"="WLEventUnlock" "StartShell"="WLEventStartShell" "PostShell"="WLEventPostShell" "Disconnect"="WLEventDisconnect" "Reconnect"="WLEventReconnect" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000000 "SafeMode"=dword:00000001 "MaxWait"=dword:ffffffff "DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Event"=dword:00000000 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings] "Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\ 00,00,37,69,26,65,d5,a7,e6,49,ba,0b,ac,53,f3,60,27,11,04,00,00,00,04,00,00,\ 00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,52,aa,ef,ce,45,1e,7c,01,\ eb,49,a9,d8,76,84,3f,b4,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,d4,\ 07,f7,bc,3d,02,0d,62,9e,a4,7b,1b,d7,77,6c,55,b0,01,00,00,df,bc,04,77,58,23,\ 8f,03,ee,85,96,82,f0,96,9f,0b,7e,0b,0a,9e,24,44,87,54,c6,9b,f9,40,fd,b8,6b,\ b5,90,be,74,e4,91,95,e4,55,2d,5d,a3,16,9d,bd,52,ca,b3,c3,63,1d,8e,72,1a,7c,\ 99,7b,fc,4b,15,af,fb,bb,cb,d7,51,0b,d3,89,9f,ef,a5,1f,83,2c,16,5b,09,e9,03,\ 11,cb,ac,b1,ff,43,6f,06,83,0c,d6,55,e6,a2,a2,88,11,02,52,ce,e6,4f,4e,81,ed,\ f9,2a,24,6f,4c,cb,ca,31,4f,dd,f4,25,58,76,b8,02,4a,e9,67,6e,3c,5b,8b,09,3c,\ 42,b4,17,40,bd,e7,f1,33,61,e9,61,6e,63,5f,46,8b,e5,0f,34,7b,bb,87,b9,25,71,\ 85,8c,cd,1b,ac,03,68,92,34,0c,b4,b0,22,23,98,ec,f0,ea,27,fe,bf,95,45,69,61,\ ae,e2,17,08,8a,bd,92,54,27,98,06,3d,52,a5,45,7d,27,ad,92,73,6d,8d,9b,27,a5,\ a6,16,98,43,f8,79,fc,4c,7c,23,27,af,b9,ee,a2,dd,de,43,b5,fe,d7,f1,d0,fa,c3,\ 4f,60,80,3c,18,d3,ba,7c,cb,92,d1,4a,8b,94,02,a9,2b,3f,a1,2f,34,f0,87,64,0d,\ ee,a9,38,84,d8,2a,fd,d6,83,00,c2,16,ae,aa,6e,28,15,e2,fe,8c,c0,14,89,30,34,\ db,77,4e,f9,51,35,7c,67,ad,8c,04,e5,85,e9,9b,0b,37,7e,1f,0d,d8,21,08,a1,f6,\ be,d3,96,59,11,eb,cc,49,49,5d,35,63,75,09,87,86,8b,cc,92,f4,02,b9,5e,7b,6b,\ 3e,ce,52,6c,d8,44,49,7a,6a,0f,26,1e,2e,82,0e,2a,bd,94,fa,b0,91,9f,2a,c3,3b,\ 83,59,4c,e5,c9,68,06,46,30,10,51,b5,c0,1a,06,a5,d6,93,b3,a6,72,73,9d,e2,46,\ 03,6a,10,34,53,5c,9a,8e,d5,4a,66,8c,c4,f8,c6,65,09,f0,ec,81,e6,12,6d,cf,53,\ 1a,59,dd,65,f5,de,a3,81,a1,0d,41,84,a6,ac,9b,b6,29,14,7e,02,e0,48,a5,95,81,\ 41,14,00,00,00,82,26,4b,ff,25,ad,74,65,f7,22,86,c8,01,7e,f8,3c,70,cb,74,39 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier] "Asynchronous"=dword:00000000 "DllName"="WRLogonNTF.dll" "Impersonate"=dword:00000001 "Lock"="WRLock" "StartScreenSaver"="WRStartScreenSaver" "StartShell"="WRStartShell" "Startup"="WRStartup" "StopScreenSaver"="WRStopScreenSaver" "Unlock"="WRUnlock" "Shutdown"="WRShutdown" "Logoff"="WRLogoff" "Logon"="WRLogon" ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet" "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management" "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page" "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page" "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing" "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension" "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension" "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension" "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension" "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page" "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page" "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler" "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension" "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects" "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management" "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management" "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression" "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension" "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI" "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu" "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase" "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext" "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts" "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile" "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page" "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing" "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension" "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension" "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension" "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections" "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections" "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras" "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras" "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras" "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras" "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras" "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host" "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link" "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler" "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension" "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks" "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu" "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search" "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support" "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run…" "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet" "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail" "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts" "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools" "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler" "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler" "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler" "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler" "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler" "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor" "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar" "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status" "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder" "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2" "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy" "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand" "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band" "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band" "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search" "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search" "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility" "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address" "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox" "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete" "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor" "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List" "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List" "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible" "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar" "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser" "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List" "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List" "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container" "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu" "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp" "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar" "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite" "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist" "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings" "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band" "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service" "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer" "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture" "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut" "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service" "{FF393560-C2A7-11CF-BFF4-444553540000}"="History" "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files" "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook" "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen" "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook" "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC" "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC" "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet" "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space" "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band" "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service" "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder" "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck" "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr" "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder" "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler" "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent" "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent" "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent" "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent" "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent" "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler" "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager" "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator" "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher" "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs" "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory" "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor" "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)" "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor" "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler" "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard" "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web" "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object" "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard" "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts" "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler" "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target" "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview" "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext" "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control" "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control" "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control" "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control" "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control" "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI" "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object" "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find" "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find" "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI" "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs" "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook" "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target" "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties" "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu" "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options" "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder" "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler" "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell" "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%" "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler" "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer" "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People…" "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class" "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer" "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu" "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu" "{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}"="My Logitech Pictures" "{E0D79304-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79305-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79306-84BE-11CE-9641-444553540000}"="WinZip" "{E0D79307-84BE-11CE-9641-444553540000}"="WinZip" "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band" "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu" "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes" "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler" "{32A9D769-5B55-4a25-9A62-86B5683FE50A}"="NikonView Drop Extension" "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}"="Messenger Sharing Folders" "{35786D3C-B075-49b9-88DD-029876E11C01}"="Portable Devices" "{D6791A63-E7E2-4fee-BF52-5DED8E86E9B8}"="Portable Devices Menu" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper" "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File" "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut" "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object" "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu" "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties" "{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration" ********************************************************************************** HKEY ROOT CLASSIDS: ********************************************************************************** Files Found are not all bad files: C:\WINDOWS\SYSTEM32\ asferror.dll Tue May 9 2006 10:26:32p A…. 7,168 7.00 K audiodev.dll Tue May 9 2006 10:26:34p A…. 267,776 261.50 K blackbox.dll Tue May 9 2006 8:59:14p A…. 585,216 571.50 K browseui.dll Wed May 10 2006 1:25:20a A…. 1,022,976 999.00 K cdfview.dll Wed May 10 2006 1:25:20a A…. 151,040 147.50 K cewmdm.dll Tue May 9 2006 10:26:34p A…. 219,648 214.50 K danim.dll Wed May 10 2006 1:25:20a A…. 1,054,208 1.00 M dhcpcsvc.dll Fri May 19 2006 8:59:42a A…. 111,616 109.00 K dnsapi.dll Fri May 19 2006 8:59:42a A…. 148,480 145.00 K drmv2clt.dll Tue May 9 2006 9:00:02p A…. 1,350,656 1.29 M dxtmsft.dll Wed May 10 2006 1:25:22a A…. 357,888 349.50 K dxtrans.dll Wed May 10 2006 1:25:22a A…. 205,312 200.50 K ehetw.dll Tue May 9 2006 8:57:06p ….. 11,264 11.00 K extmgr.dll Wed May 10 2006 1:25:22a A…. 55,808 54.50 K iepeers.dll Wed May 10 2006 1:25:22a A…. 251,904 246.00 K inseng.dll Wed May 10 2006 1:25:22a A…. 96,256 94.00 K iphlpapi.dll Fri May 19 2006 8:59:42a A…. 94,720 92.50 K jgdw400.dll Thu Jun 1 2006 2:47:08p A…. 163,840 160.00 K jgpl400.dll Thu Jun 1 2006 2:47:08p A…. 27,648 27.00 K jscript.dll Thu May 18 2006 1:24:26a A…. 450,560 440.00 K jsproxy.dll Wed May 10 2006 1:25:22a A…. 15,872 15.50 K laprxy.dll Tue May 9 2006 10:26:32p A…. 9,728 9.50 K legitc~1.dll Mon Jun 19 2006 4:19:42p A…. 571,184 557.80 K mfplat.dll Tue May 9 2006 9:00:08p ….. 382,976 374.00 K mljjk.dll Fri Jul 28 2006 11:18:30p ….. 573,492 560.05 K mp43decd.dll Tue May 9 2006 9:00:56p ….. 241,152 235.50 K mp43dmod.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K mp4sdecd.dll Tue May 9 2006 9:00:58p ….. 299,520 292.50 K mp4sdmod.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K mpg4decd.dll Tue May 9 2006 9:00:58p ….. 241,152 235.50 K mpg4dmod.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K msdelta.dll Tue May 9 2006 8:45:20p ….. 304,640 297.50 K mshtml.dll Fri May 19 2006 11:06:04a A…. 3,055,104 2.91 M mshtmled.dll Wed May 10 2006 1:25:22a A…. 448,512 438.00 K msnetobj.dll Tue May 9 2006 10:26:34p A…. 212,480 207.50 K mspmsnsv.dll Tue May 9 2006 10:26:34p A…. 26,112 25.50 K mspmsp.dll Tue May 9 2006 10:26:34p A…. 165,376 161.50 K msrating.dll Wed May 10 2006 1:25:22a A…. 146,432 143.00 K msscp.dll Tue May 9 2006 8:59:20p A…. 417,280 407.50 K mstime.dll Wed May 10 2006 1:25:22a A…. 532,480 520.00 K mswmdm.dll Tue May 9 2006 10:26:34p A…. 306,688 299.50 K nv4_disp.dll Thu Jun 1 2006 5:22:00p A…. 4,529,408 4.32 M nvapi.dll Thu Jun 1 2006 5:22:00p A…. 196,608 192.00 K nvcod.dll Thu Jun 1 2006 5:22:00p A…. 35,840 35.00 K nvcodins.dll Thu Jun 1 2006 5:22:00p A…. 35,840 35.00 K nvcpl.dll Thu Jun 1 2006 5:22:00p A…. 7,618,560 7.27 M nvcpluir.dll Thu Jun 1 2006 5:22:00p A…. 1,011,712 988.00 K nvdisps.dll Thu Jun 1 2006 5:22:00p A…. 5,652,480 5.39 M nvdispsr.dll Thu Jun 1 2006 5:22:00p A…. 5,246,976 5.00 M nvexpbar.dll Thu Jun 1 2006 5:22:00p A…. 311,296 304.00 K nvgames.dll Thu Jun 1 2006 5:22:00p A…. 3,100,672 2.96 M nvgamesr.dll Thu Jun 1 2006 5:22:00p A…. 2,916,352 2.78 M nvhwvid.dll Thu Jun 1 2006 5:22:00p A…. 581,632 568.00 K nview.dll Thu Jun 1 2006 5:22:00p A…. 1,466,368 1.40 M nvmccs.dll Thu Jun 1 2006 5:22:00p A…. 229,376 224.00 K nvmccsrs.dll Thu Jun 1 2006 5:22:00p A…. 45,056 44.00 K nvmccss.dll Thu Jun 1 2006 5:22:00p A…. 188,416 184.00 K nvmccssr.dll Thu Jun 1 2006 5:22:00p A…. 462,848 452.00 K nvmctray.dll Thu Jun 1 2006 5:22:00p A…. 86,016 84.00 K nvmobls.dll Thu Jun 1 2006 5:22:00p A…. 888,832 868.00 K nvmoblsr.dll Thu Jun 1 2006 5:22:00p A…. 2,859,008 2.73 M nvnt4cpl.dll Thu Jun 1 2006 5:22:00p A…. 286,720 280.00 K nvoglnt.dll Thu Jun 1 2006 5:22:00p A…. 5,632,000 5.37 M nvshell.dll Thu Jun 1 2006 5:22:00p A…. 466,944 456.00 K nvvitvs.dll Thu Jun 1 2006 5:22:00p A…. 2,924,544 2.79 M nvvitvsr.dll Thu Jun 1 2006 5:22:00p A…. 2,977,792 2.84 M nvwddi.dll Thu Jun 1 2006 5:22:00p A…. 81,920 80.00 K nvwdmcpl.dll Thu Jun 1 2006 5:22:00p A…. 1,662,976 1.59 M nvwimg.dll Thu Jun 1 2006 5:22:00p A…. 1,019,904 996.00 K nvwss.dll Thu Jun 1 2006 5:22:00p A…. 1,257,472 1.20 M nvwssr.dll Thu Jun 1 2006 5:22:00p A…. 1,740,800 1.66 M pncrt.dll Fri Jul 21 2006 10:46:02p A…. 278,528 272.00 K pndx5016.dll Fri Jul 21 2006 10:46:06p A…. 6,656 6.50 K pndx5032.dll Fri Jul 21 2006 10:46:06p A…. 5,632 5.50 K pngfilt.dll Wed May 10 2006 1:25:22a A…. 39,424 38.50 K po1676~1.dll Tue May 9 2006 8:58:48p ….. 188,928 184.50 K portab~1.dll Tue May 9 2006 8:58:48p ….. 345,600 337.50 K portab~2.dll Tue May 9 2006 8:58:48p ….. 101,376 99.00 K portab~3.dll Tue May 9 2006 8:58:38p ….. 168,960 165.00 K portab~4.dll Tue May 9 2006 8:58:50p ….. 103,424 101.00 K px.dll Tue May 16 2006 4:23:54p ….. 430,080 420.00 K pxdrv.dll Tue May 16 2006 4:23:54p ….. 450,560 440.00 K pxmas.dll Tue May 16 2006 4:23:54p ….. 176,128 172.00 K pxsfs.dll Tue May 16 2006 4:23:54p ….. 1,257,472 1.20 M pxwave.dll Tue May 16 2006 4:23:56p ….. 339,968 332.00 K qasf.dll Tue May 9 2006 10:26:34p A…. 201,728 197.00 K rasmans.dll Sun May 14 2006 4:44:08a A…. 181,248 177.00 K rmoc3260.dll Fri Jul 21 2006 10:46:14p A…. 176,167 172.04 K s32evnt1.dll Tue May 16 2006 2:34:38p A…. 87,808 85.75 K shdocvw.dll Mon May 29 2006 11:32:10a A…. 1,496,576 1.43 M shlwapi.dll Wed May 10 2006 1:25:22a A…. 474,112 463.00 K sirenacm.dll Fri Jun 16 2006 2:34:44p A…. 48,936 47.79 K spmsg.dll Mon Jun 19 2006 3:18:34p ….. 14,048 13.72 K symneti.dll Thu Jun 8 2006 12:08:36p A…. 534,208 521.69 K symredir.dll Thu Jun 8 2006 12:08:36p A…. 161,472 157.69 K urlmon.dll Wed May 10 2006 1:25:22a A…. 615,424 601.00 K vxblock.dll Tue May 16 2006 4:23:56p ….. 28,672 28.00 K wdfapi.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K wgalogon.dll Mon Jun 19 2006 4:20:42p ….. 702,768 686.30 K wininet.dll Wed May 10 2006 1:25:22a A…. 663,552 648.00 K wmadmod.dll Tue May 9 2006 10:26:34p A…. 705,024 688.50 K wmadmoe.dll Tue May 9 2006 10:26:34p A…. 1,063,424 1.01 M wmasf.dll Tue May 9 2006 10:26:34p A…. 221,696 216.50 K wmdmlog.dll Tue May 9 2006 10:26:34p A…. 31,744 31.00 K wmdmps.dll Tue May 9 2006 10:26:34p A…. 36,864 36.00 K wmdrmdev.dll Tue May 9 2006 10:26:34p A…. 417,280 407.50 K wmdrmnet.dll Tue May 9 2006 10:26:34p A…. 337,408 329.50 K wmdrmsdk.dll Tue May 9 2006 8:59:34p ….. 513,536 501.50 K wmerror.dll Tue May 9 2006 10:26:32p A…. 218,112 213.00 K wmidx.dll Tue May 9 2006 10:26:34p A…. 155,136 151.50 K wmnetmgr.dll Tue May 9 2006 10:26:34p A…. 992,256 969.00 K wmp.dll Tue May 9 2006 10:26:34p A…. 10,394,624 9.91 M wmpasf.dll Tue May 9 2006 10:26:34p A…. 237,056 231.50 K wmpdxm.dll Tue May 9 2006 10:26:34p A…. 301,056 294.00 K wmpeff~1.dll Tue May 9 2006 10:26:34p ….. 433,152 423.00 K wmpencen.dll Tue May 9 2006 10:26:34p A…. 1,641,472 1.56 M wmploc.dll Tue May 9 2006 10:26:34p A…. 7,706,112 7.35 M wmpmde.dll Tue May 9 2006 9:00:22p ….. 546,816 534.00 K wmpps.dll Tue May 9 2006 10:26:34p ….. 135,680 132.50 K wmpshell.dll Tue May 9 2006 10:26:34p A…. 97,792 95.50 K wmpsrcwp.dll Tue May 9 2006 10:26:34p A…. 203,776 199.00 K wmsdmod.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K wmsdmoe2.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K wmspdmod.dll Tue May 9 2006 10:26:34p A…. 564,736 551.50 K wmspdmoe.dll Tue May 9 2006 10:26:34p A…. 1,280,000 1.22 M wmvadvd.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K wmvadve.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K wmvcore.dll Tue May 9 2006 10:22:32p A…. 2,463,744 2.35 M wmvdecod.dll Tue May 9 2006 9:01:06p ….. 1,463,808 1.39 M wmvdmod.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K wmvdmoe2.dll Tue May 9 2006 10:26:34p A…. 4,096 4.00 K wmvencod.dll Tue May 9 2006 9:00:58p ….. 1,455,616 1.39 M wmvsdecd.dll Tue May 9 2006 9:01:06p ….. 1,359,360 1.29 M wmvsencd.dll Tue May 9 2006 9:00:58p ….. 770,560 752.50 K wmvxencd.dll Tue May 9 2006 9:00:56p ….. 636,928 622.00 K wpdconns.dll Tue May 9 2006 8:58:40p A…. 35,840 35.00 K wpdmtp.dll Tue May 9 2006 8:58:40p A…. 144,896 141.50 K wpdmtpus.dll Tue May 9 2006 8:58:40p A…. 55,808 54.50 K wpdshext.dll Tue May 9 2006 8:58:54p ….. 3,745,280 3.57 M wpdshs~1.dll Tue May 9 2006 8:58:54p ….. 52,224 51.00 K wpdsp.dll Tue May 9 2006 8:58:46p A…. 343,552 335.50 K wpdtrace.dll Tue May 9 2006 8:58:38p A…. 13,312 13.00 K wpd_ci.dll Tue May 9 2006 8:58:50p A…. 670,208 654.50 K wrlogo~1.dll Fri Jul 7 2006 5:16:12p A…. 208,896 204.00 K xpsp3res.dll Thu May 11 2006 4:37:26a A…. 90,112 88.00 K 145 items found: 145 files, 0 directories. Total of file sizes: 121,163,843 bytes 115.55 M Locate .tmp files: C:\WINDOWS\SYSTEM32\ kjjlm.tmp Sat Jul 29 2006 12:10:20a ..SH. 210,154 205.23 K 1 item found: 1 file (1 H/S), 0 directories. Total of file sizes: 210,154 bytes 205.23 K ********************************************************************************** Directory Listing of system files: Volume in drive C is SYSTEM Volume Serial Number is 5CAB-5DE2 Directory of C:\WINDOWS\System32 07/29/2006 10:30 AM 207,568 kjjlm.ini2 07/29/2006 12:10 AM 210,154 kjjlm.tmp 07/28/2006 11:18 PM 205,918 kjjlm.ini 07/28/2006 11:18 PM 205,918 kjjlm.bak1 07/25/2006 06:51 PM Microsoft 09/30/1999 06:21 PM 166,672 mstext35.dll 09/28/1999 08:42 PM 1,050,896 msjet35.dll 09/09/1999 09:06 PM 252,688 msexcl35.dll 09/09/1999 09:06 PM 168,720 msltus35.dll 08/25/1999 01:57 PM 415,504 msrepl35.dll 06/10/1999 08:34 AM 24,848 msjter35.dll 06/10/1999 08:34 AM 123,664 msjint35.dll 06/07/1999 05:59 PM 250,128 mspdox35.dll 04/25/1999 04:00 PM 287,504 Msxbse35.dll 04/25/1999 04:00 PM 368,912 Vbar332.dll 04/25/1999 04:00 PM 252,176 Msrd2x35.dll 15 File(s) 4,191,270 bytes 1 Dir(s) 29,851,037,696 bytes free

We will use Killbox again.

Please download ATF Cleaner by Atribune.

This program is for XP and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose:Select All
• Click the Empty Selected button.
• NOTE: If you would like to keep your saved passwords, please click
• No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
• NOTE:If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

======
Delete Files with Killbox

Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the ]red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard
C:\WINDOWS\SYSTEM32\mljjk.dll
C:\WINDOWS\SYSTEM32\kjjlm.tmp
C:\WINDOWS\SYSTEM32\kjjlm.ini2
C:\WINDOWS\SYSTEM32\kjjlm.ini
C:\WINDOWS\SYSTEM32\kjjlm.bak1


In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed
(Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)
Click the option to Delete on Reboot
- If not greyed out click the checkbox for Unregister .dll Before Deleting
- click End Explorer Shell while Killing File
- Now click on the red button with a white 'X' in the middle to delete the files
- Click Yes when it says all files will be deleted on the next reboot
- Click Yes when it asks if you want to reboot now
(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)

Note: Killbox will let you know if a file does not exist. If that happens, just continue on.

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.