HijackThis log included

Checking your log I will be back with you as soon as I can.

Welcome to the Forums.

The fixes we will use are specific to your problems and should only be used for this issue on this machine.

Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!
Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!




You are running HJT directly from the desktop.
Create a folder called HJT either in C: or My documents and place the hijackthis.exe in there.
This will ensure we have back ups made and it doesn't get deleted .


___________________

I see no signs of an anti virus program.. I suggest you get one in asap.
I will list 2 free anti virus programs just choose 1.

AVG FREE

Avast

Download and install one of these and run a full scan.



________________

Please download LQfix.exe from one of the following locations:
http://www.downloads.subratam.org/LQfix.exe
http://miekiemoes.geekstogo.com/tools/LQfix.exe

Save it to your desktop and Double-Click LQfix.exe and click Next > Next > Install.
Leave the default settings, if you change them, the fix will Fail!
You need an active Internet Connection, so make sure your you're not blocking any connection now.
Now make sure the "Launch LQfix" box is checked.
Click the Finish button, after clicking the Finish button the fix will start.
Follow the on-screen prompts and Your system will reboot afterwards
Please be patient after the reboot, there is a script running in the background that needs to complete.



In your next reply I would like to see:

• A new HJT log

Didn't realize your were on dial up.

HJT
Run hijackthis and choose scan only and place a check by the following lines if present.
Close all other windows and browsers except HJT before clicking on Fix Checked



O2 - BHO: (no name) - {1E33120B-0518-B3DD-6EDF-0AA358C58F9F} - C:\WINDOWS\System32\lcsilx.dll
O2 - BHO: (no name) - {69C52FBF-228C-C2FB-FDCF-0858B28307D8} - C:\WINDOWS\System32\vyqfwzg.dll
O2 - BHO: (no name) - {75CAD05A-D6CF-A048-FF10-015C28A5D9AB} - C:\WINDOWS\System32\qwvmrgk.dll


O4 - HKLM\..\Run: [urnncvua] C:\WINDOWS\System32\urnncvua.exe
O4 - HKLM\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKLM\..\Run: [hfvqlug.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\hfvqlug.dll,lxfaoe
O4 - HKLM\..\Run: [lbitnjb.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\lbitnjb.dll,xkmjtr
O4 - HKLM\..\Run: [amqdajn.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\amqdajn.dll,pvtbded
O4 - HKLM\..\RunServices: [stonedrv] c:\windows\system32\stonedrv.exe
O4 - HKCU\..\Run: [stonedrv] c:\windows\system32\stonedrv.exe
O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll (file missing)
O21 - SSODL: jQvPPRUelxB - {2F9AA011-8530-0ABB-E50D-6FF2616352DA} - C:\WINDOWS\System32\bcz.dll (file missing)




Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

• In Safe Mode, right click the SDFix.zip folder and choose Extract All,
• Open the extracted folder and double click RunThis.bat to start the script.
• Type Y to begin the script.
• It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• Your system will take longer that normal to restart as the fixtool will be running and removing files.
• When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
• Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log

____________________________
Please download the Killbox by Option^Explicit

Note: In the event you already have Killbox, this is a new version that I need you to download.
Save it to your desktop.
Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
C:\WINDOWS\System32\bcz.dll
C:\WINDOWS\System32\amqdajn.dll
C:\WINDOWS\System32\lbitnjb.dll
C:\WINDOWS\System32\urnncvua.exe
C:\WINDOWS\System32\qwvmrgk.dll
C:\WINDOWS\System32\vyqfwzg.dll
C:\WINDOWS\System32\lcsilx.dll


Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).


If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.



In your next reply I would like to see:

• A new HJT log
• The report from S&D fix ( Report.txt )

Looking much better.



1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall



Post that and 1 more HJT log.

recently got a rectangular error message saying lsass.exe had terminated unexpectedly and the machine had to shut down… it had a countdown and an red and white x icon.

I see you have AVG installed. Lets update it and set it up the way I ask and do a scan.

• You will need to update AVG to the latest definition files.
• At the top of the main screen click Update.
• Then in the Manual Update section, click on Start Update.

[*]The update will start and a progress bar will show the updates being installed.

[*]When updates are completed, close AVG.

If you are having problems with the updater, you can use this link to manually update AVG.
AVG manual updates
Do not use it yet.


________________________________________
Safe mode:
Please reboot to safe mode:
After the very first black screen start tapping the
F8 key untill prompted with a list choose safe
mode.




_________________________________________
AVG Part 2
AVG
Close all open windows/programs/folders. Have nothing else open while ewido performs its scan!
Click on scanner
Click on Settings
Under How to act
Choose quarintine

Under Reports check automatically create report after every scan.
Now back to the scan tab andClick on Complete system scan

Let the program scan the machine .
When finished click apply all actions.


Exit AVG.
It will save a log in C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

Reboot normaly.

Post the log from AVG and a new Hijackthis log.

Reboot Normaly

______________________


Please go HERE and do a online scan.
Let me know what is found.

______________________

In your next reply I would like to see:

• A new HJT log
• The report from the online scan
• The report from AVG.
• Let me know if the lsass.exe error continuesThe

Download this tool and run it. Let me know if it finds anything.

Sasser removal



_____________________

Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\SYSTEM32\hfvqlug.dll
C:\Documents and Settings\work\loaded.exe


Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).


If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.



____________________


Please download WinPFind2.

• Extract the files to a folder(eg: C:\WinPFind2).
• Double click WinPFind2.exe to start the program.
• Click the Select All button in the File Options box of the Configuration tab(this is the tab the program opens up to by default).
• Click the Run all Scans button.
• When its finished scanning you will see Scans Complete! at the bottom left of the program.
• Click the Export to Text button.
• Notepad will open with the results of the scan and the log will be saved to the folder that you extracted the program to(C:\WinPFind2\WinPFind2.txt)
• Post the log in your next reply please. You may need to split the log over a couple posts so that it doesn't get cut off. If so please use the [Start Post #1] and [Start Post #2] deliminators in the log to split the log up.

In your next reply I would like to see:

• A new HJT log
• The report from winp2 log
• If sasser removal tool found anything
• Let me know if the lsass error continues

[Start Post #1] Processes Image Name—————ProcessID–Thread Count–Parent ID–Base Priority– #Full Path ##(Version Info) avgamsvr.exe————-001140—–0007———-000472—–Normal——— #c:\progra~1\grisoft\avgfre~1\avgamsvr.exe ##(GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 343552 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) avgcc.exe—————-001356—–0008———-001024—–Normal——— #c:\progra~1\grisoft\avgfre~1\avgcc.exe ##(GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) avgemc.exe—————001228—–0008———-000472—–Normal——— #c:\progra~1\grisoft\avgfre~1\avgemc.exe ##(GRISOFT, s.r.o. [Ver = 7.5.0.432 | Size = 323072 bytes | Date = 12/5/2006 10:35:02 AM | Attr = ]) avgupsvc.exe————-001180—–0003———-000472—–Normal——— #c:\progra~1\grisoft\avgfre~1\avgupsvc.exe ##(GRISOFT, s.r.o. [Ver = 7.5.0.420 | Size = 49664 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) ipodservice.exe———-001584—–0008———-000472—–Normal——— #c:\program files\ipod\bin\ipodservice.exe ##(Apple Computer, Inc. [Ver = 4.7.0.42 | Size = 327680 bytes | Date = 10/13/2004 4:03:54 PM | Attr = ]) ituneshelper.exe———001208—–0006———-001024—–Normal——— #c:\program files\itunes\ituneshelper.exe ##(Apple Computer, Inc. [Ver = 4.7.0.42 | Size = 278528 bytes | Date = 10/13/2004 4:04:14 PM | Attr = ]) jusched.exe————–001304—–0001———-001024—–Normal——— #c:\program files\java\jre1.5.0_06\bin\jusched.exe ##(Sun Microsystems, Inc. [Ver = 5.0.60.5 | Size = 36975 bytes | Date = 11/10/2005 1:03:52 PM | Attr = ]) winpfind2.exe————000216—–0002———-001024—–Normal——— #c:\winpfind2\winpfind2\winpfind2.exe ##(OldTimer Tools [Ver = 1.0.15.0 | Size = 397312 bytes | Date = 11/16/2006 6:07:22 AM | Attr = ]) Registry Entries #Value ##(Version Info) <<< >> Internet Explorer Settings << >>> HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page #http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page #http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL #http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Search_URL #http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page #%SystemRoot%\system32\blank.htm ## HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page #http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome ## HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page #http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ## HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page #C:\WINDOWS\System32\blank.htm ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\CustomizeSearch #http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ## HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant #http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ## HKCU\Software\Microsoft\Internet Explorer\urlSearchHooks\\{CFBFAE00-17A6-11D0-99CB-00C04FD64497} #Microsoft Url Search Hook = %SystemRoot%\System32\shdocvw.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1341440 bytes | Date = 7/16/2003 3:44:36 PM | Attr = ]) HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable #0 ## <<< >> BHO's << >>> HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F} #Reg Data - Value does not exist = C:\Program Files\Spybot - Search & Destroy\SDHelper.dll ##(Safer Networking Limited [Ver = 1, 4, 0, 0 | Size = 853672 bytes | Date = 5/31/2005 1:04:00 AM | Attr = ]) <<< >> Internet Explorer Bars, Toolbars and Extensions << >>> <<< HKLM-> Internet Explorer Bars >>> HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376} #&Tip of the Day = %SystemRoot%\System32\shdocvw.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1341440 bytes | Date = 7/16/2003 3:44:36 PM | Attr = ]) <<< HKCU-> Internet Explorer Bars >>> HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478} #Media Band = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 7/16/2003 3:24:56 PM | Attr = ]) <<< HKLM-> Internet Explorer ToolBars >>> HKLM\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\{8E718888-423F-11D2-876E-00A0C9082467} #&Radio = C:\WINDOWS\System32\msdxm.ocx ##( [Ver = | Size = 842268 bytes | Date = 7/16/2003 3:35:34 PM | Attr = ]) <<< HKCU-> Internet Explorer ToolBars >>> HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{01E04581-4EEE-11D0-BFE9-00AA005B4383} #&Address = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 7/16/2003 3:24:56 PM | Attr = ]) HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0E5CBF21-D15F-11D0-8301-00AA005B4383} #&Links = %SystemRoot%\system32\SHELL32.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 7/16/2003 3:44:38 PM | Attr = ]) HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4982D40A-C53B-4615-B15B-B5B5E98D167C} #AOL Toolbar = C:\Program Files\AOL Toolbar\toolbar.dll ##(File not found) <<< HKCU-> Internet Explorer CmdMapping >>> HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} #8196 - Sun Java Console ## HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{4982D40A-C53B-4615-B15B-B5B5E98D167C} #8195 - Reg Data - Key not found ## HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} #8192 - Reg Data - Value does not exist ## HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} #8194 - Reg Data - Key not found ## HKCU\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\NextId #8197 ## <<< HKLM-> Internet Explorer Extensions >>> HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} #MenuText: Sun Java Console = C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll ##(Sun Microsystems, Inc. [Ver = 5.0.60.5 | Size = 69746 bytes | Date = 11/10/2005 1:22:12 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} #ButtonText: AIM = C:\PROGRA~1\AIM\aim.exe ##(America Online, Inc. [Ver = 5.9.3702 | Size = 67160 bytes | Date = 12/8/2004 3:50:04 PM | Attr = ]) <<< HKCU-> Internet Explorer Menu Extensions >>> HKCU\Software\Microsoft\Internet Explorer\MenuExt\&AOL Toolbar search #res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML ##(File not found) <<< HKLM-> Internet Explorer Plugins >>> HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\.pdf #Adobe Acrobat = C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll ##(Adobe Systems Inc. [Ver = 6.0.0.2003051500 | Size = 133376 bytes | Date = 5/15/2003 12:01:48 AM | Attr = ]) <<< >> Approved Shell Extensions (Non-Microsoft only) << >>> <<< HKLM-> Approved Shell Extensions >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} #Taskbar and Start Menu = Reg Data - Key not found ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{42071714-76d4-11d1-8b24-00a0c9068ff3} #Display Panning CPL Extension = deskpan.dll ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{764BF0E1-F219-11ce-972D-00AA00A14F56} #Shell extensions for file compression = Reg Data - Key not found ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{7A9D77BD-5403-11d2-8785-2E0420524153} #User Accounts = Reg Data - Key not found ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} #Encryption Context Menu = Reg Data - Key not found ##(File not found) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{88895560-9AA2-1069-930E-00AA0030EBC8} #HyperTerminal Icon Ext = C:\WINDOWS\System32\hticons.dll ##(Hilgraeve, Inc. [Ver = 5.1.2600.0 | Size = 44544 bytes | Date = 7/16/2003 3:29:42 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} #AVG7 Shell Extension = C:\Program Files\Grisoft\AVG Free\avgse.dll ##(GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} #AVG7 Find Extension = C:\Program Files\Grisoft\AVG Free\avgse.dll ##(GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\\{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} #iTunes = C:\Program Files\iTunes\iTunesMiniPlayer.dll ##(Apple Computer, Inc. [Ver = 4.7.0.42 | Size = 102400 bytes | Date = 10/13/2004 4:03:06 PM | Attr = ]) <<< >> ContextMenuHandlers (Non-Microsoft only) << >>> <<< HKLM-> ContextMenuHandlers >>> HKLM\Software\Classes\*\shellex\ContextMenuHandlers\AVG7 Shell Extension #{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll ##(GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG7 Shell Extension #{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll ##(GRISOFT, s.r.o. [Ver = 7.5.0.409 | Size = 50688 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) <<< >> ColumnHandlers (Non-Microsoft only) << >>> <<< HKLM-> ColumnHandlers >>> <<< >> File Associations Keys << >>> HKLM\SOFTWARE\Classes\.bat\\'' #batfile ## HKLM\SOFTWARE\Classes\batfile\shell\open\command\\'' #"%1" %* ## HKLM\SOFTWARE\Classes\.cmd\\'' #cmdfile ## HKLM\SOFTWARE\Classes\cmdfile\shell\open\command\\'' #"%1" %* ## HKLM\SOFTWARE\Classes\.com\\'' #comfile ## HKLM\SOFTWARE\Classes\comfile\shell\open\command\\'' #"%1" %* ## HKLM\SOFTWARE\Classes\.exe\\'' #exefile ## HKLM\SOFTWARE\Classes\exefile\shell\open\command\\'' #"%1" %* ## HKLM\SOFTWARE\Classes\.hta\\'' #htafile ## HKLM\SOFTWARE\Classes\htafile\shell\open\command\\'' #C:\WINDOWS\System32\mshta.exe "%1" %* ## HKLM\SOFTWARE\Classes\.js\\'' #JSFile ## HKLM\SOFTWARE\Classes\jsfile\shell\open\command\\'' #%SystemRoot%\System32\WScript.exe "%1" %* ## HKLM\SOFTWARE\Classes\.jse\\'' #JSEFile ## HKLM\SOFTWARE\Classes\jsefile\shell\open\command\\'' #%SystemRoot%\System32\WScript.exe "%1" %* ## HKLM\SOFTWARE\Classes\.scr\\'' #scrfile ## HKLM\SOFTWARE\Classes\scrfile\shell\open\command\\'' #"%1" /S ## HKLM\SOFTWARE\Classes\.vbe\\'' #VBEFile ## HKLM\SOFTWARE\Classes\vbefile\shell\open\command\\'' #%SystemRoot%\System32\WScript.exe "%1" %* ## HKLM\SOFTWARE\Classes\.vbs\\'' #VBSFile ## HKLM\SOFTWARE\Classes\vbsfile\shell\open\command\\'' #%SystemRoot%\System32\WScript.exe "%1" %* ## HKLM\SOFTWARE\Classes\.wsf\\'' #WSFFile ## HKLM\SOFTWARE\Classes\wsffile\shell\open\command\\'' #%SystemRoot%\System32\WScript.exe "%1" %* ## HKLM\SOFTWARE\Classes\.wsh\\'' #WSHFile ## HKLM\SOFTWARE\Classes\wshfile\shell\open\command\\'' #%SystemRoot%\System32\WScript.exe "%1" %* ## HKLM\SOFTWARE\Classes\.txt\\'' #txtfile ## HKLM\SOFTWARE\Classes\txtfile\shell\open\command\\'' #%SystemRoot%\system32\NOTEPAD.EXE %1 ## <<< >> Registry Run Keys << >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\AVG7_CC #C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP ##(GRISOFT, s.r.o. [Ver = 7.5.0.418 | Size = 406016 bytes | Date = 12/3/2006 4:53:58 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\iTunesHelper #C:\Program Files\iTunes\iTunesHelper.exe ##(Apple Computer, Inc. [Ver = 4.7.0.42 | Size = 278528 bytes | Date = 10/13/2004 4:04:14 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\QuickTime Task #"C:\Program Files\QuickTime\qttask.exe" -atboottime ##(Apple Computer, Inc. [Ver = 6.5.1 | Size = 98304 bytes | Date = 5/13/2005 6:51:32 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched #C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe ##(Sun Microsystems, Inc. [Ver = 5.0.60.5 | Size = 36975 bytes | Date = 11/10/2005 1:03:52 PM | Attr = ]) HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\AOL Fast Start #"C:\Program Files\America Online 9.0\AOL.EXE" -b ##(File not found) <<< >> Miscellaneous Startup Keys << >>> <<< AppInit DLLs >>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs # ##(File not found) <<< Image File Execution Options >>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path #Debugger = ntsd -d ## <<< Shell Service Object Delay Load >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\CDBurn #{fbeb8a05-beee-4442-804e-409d6c4515e9} = %SystemRoot%\system32\SHELL32.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 7/16/2003 3:44:38 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\PostBootReminder #{7849596a-48ea-486e-8937-a2a3009f31a9} = %SystemRoot%\system32\SHELL32.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 7/16/2003 3:44:38 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\SysTray #{35CEC8A3-2BE6-11D2-8773-92E220524153} = C:\WINDOWS\System32\stobject.dll ##(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 117760 bytes | Date = 7/16/2003 3:46:54 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck #{E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\System32\webcheck.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 258048 bytes | Date = 7/16/2003 3:51:06 PM | Attr = ]) <<< Shell Execute Hooks >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} #URL Exec Hook = shell32.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 8336384 bytes | Date = 7/16/2003 3:44:38 PM | Attr = ]) <<< Shared Task Scheduler >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{438755C2-A8BA-11D1-B96B-00A0C90312E1} #Browseui preloader = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 7/16/2003 3:24:56 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{8C7461EF-2B13-11d2-BE35-3078302C2030} #Component Categories cache daemon = %SystemRoot%\System32\browseui.dll ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1021952 bytes | Date = 7/16/2003 3:24:56 PM | Attr = ]) <<< SafeBoot Option >>> <<< HKLM Command Processor AutoRun >>> HKLM\SOFTWARE\Microsoft\Command Processor\\AutoRun # ## <<< HKCU Command Processor AutoRun >>> <<< Security Providers >>> HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders #msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll ## <<< BootExecute >>> HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\\BootExecute #autocheck autochk *; ## <<< PendingFileRenameOperations >>> <<< FileRenameOperations >>> <<< ExcludeFromKnownDlls >>> HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\\ExcludeFromKnownDlls # ## <<< >> Disabled MSConfig Items << >>> <<< >> User Agent Post Platform << >>> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\() # ## HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\(none) # ## HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\\acc=none # ## <<< >> Winlogon << >>> HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\AltDefaultDomainName #USER-DN1AO2BERU ## HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\AltDefaultUserName #work ## HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\AutoAdminLogon #Reg Data - Value does not exist ## HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\DefaultDomainName #USER-DN1AO2BERU ## HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\DefaultUserName #work ## HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell #Explorer.exe ##(Microsoft Corporation [Ver = 6.00.2800.1106 (xpsp1.020828-1920) | Size = 1004032 bytes | Date = 7/16/2003 3:28:10 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\System # ##(File not found) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit #C:\WINDOWS\system32\userinit.exe, ##(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 22016 bytes | Date = 7/16/2003 3:49:24 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet #rundll32 shell32,Control_RunDLL "sysdm.cpl" ## HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain #crypt32.dll ##(Microsoft Corporation [Ver = 5.131.2600.1106 (xpsp1.020828-1920) | Size = 557568 bytes | Date = 7/16/2003 3:25:58 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet #cryptnet.dll ##(Microsoft Corporation [Ver = 5.131.2600.0 (xpclient.010817-1148) | Size = 53248 bytes | Date = 7/16/2003 3:26:00 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll #cscdll.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 89600 bytes | Date = 7/16/2003 3:26:00 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 7/16/2003 3:52:02 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 7/16/2003 3:52:02 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy #sclgntfy.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 18432 bytes | Date = 7/16/2003 3:43:58 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn #WlNotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 7/16/2003 3:52:02 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 7/16/2003 3:52:02 PM | Attr = ]) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon #wlnotify.dll ##(Microsoft Corporation [Ver = 5.1.2600.1106 (xpsp1.020828-1920) | Size = 86528 bytes | Date = 7/16/2003 3:52:02 PM | Attr = ]) <<< >> DNS Name Servers << >>> HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1F36D2BB-1079-4861-BBFE-4503A3F37246} # (D-Link DFE-530TX PCI Fast Ethernet Adapter (rev.A)) ## <<< >> All Winsock2 Catalogs << >>> HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 #%SystemRoot%\System32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 #%SystemRoot%\System32\winrnr.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 14848 bytes | Date = 7/16/2003 3:51:50 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 #%SystemRoot%\System32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004 #%SystemRoot%\system32\rsvpsp.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 90112 bytes | Date = 7/16/2003 3:43:32 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005 #%SystemRoot%\system32\rsvpsp.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 90112 bytes | Date = 7/16/2003 3:43:32 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015 #%SystemRoot%\system32\mswsock.dll ##(Microsoft Corporation [Ver = 5.1.2600.0 (xpclient.010817-1148) | Size = 228352 bytes | Date = 7/16/2003 3:37:00 PM | Attr = ]) <<< >> Protocol Handlers (Non-Microsoft only) << >>> HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\ipp # ##(File not found) HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp # ##(File not found) HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vnd.ms.radio #C:\WINDOWS\System32\msdxm.ocx ##( [Ver = | Size = 842268 bytes | Date = 7/16/2003 3:35:34 PM | Attr = ]) <<< >> Protocol Filters (Non-Microsoft only) << >>>