L2mfix 032106
Creating Account.
The command completed successfully.
Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX … successful
Running From:
C:\WINDOWS\system32
Killing Processes!
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 648 'smss.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Killing PID 1292 'winlogon.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Killing PID 1520 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [removed]
Error, Cannot find a process with an image name of rundll32.exe
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators … successful
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Restoring Windows Update Certificates.:
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
"Logon"="WLEventLogon"
"Logoff"="WLEventLogoff"
"Startup"="WLEventStartup"
"Shutdown"="WLEventShutdown"
"StartScreenSaver"="WLEventStartScreenSaver"
"StopScreenSaver"="WLEventStopScreenSaver"
"Lock"="WLEventLock"
"Unlock"="WLEventUnlock"
"StartShell"="WLEventStartShell"
"PostShell"="WLEventPostShell"
"Disconnect"="WLEventDisconnect"
"Reconnect"="WLEventReconnect"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000000
"SafeMode"=dword:00000001
"MaxWait"=dword:ffffffff
"DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Event"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
"Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
00,00,fe,87,ec,83,8a,01,95,4b,b5,7a,86,58,2a,ae,2e,5e,04,00,00,00,04,00,00,\
00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,82,2b,b3,c0,32,dc,6a,5f,\
66,9a,a5,77,91,5b,87,7b,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,b9,\
0f,48,cc,40,53,55,52,6a,b8,55,8f,2f,6a,66,33,08,06,00,00,7b,fe,0d,9f,38,26,\
72,6d,fa,91,93,3e,78,d5,51,87,88,1f,0b,cb,6e,1d,d7,f1,e4,d6,17,0c,84,3d,ba,\
4b,2f,4c,aa,a6,7f,0b,27,6c,74,6c,eb,7a,7e,60,fe,56,f9,73,62,d1,b7,af,2a,de,\
46,cd,2a,45,a6,50,3b,71,29,c1,61,7c,ff,31,68,3c,6a,f0,c2,c9,06,3c,0e,36,23,\
82,bc,da,0b,0c,b8,5d,d8,29,65,61,fd,ca,b5,eb,a3,23,99,17,24,56,85,c0,4a,4b,\
b7,06,36,e6,ef,d3,8f,75,b6,82,6a,f1,10,f0,70,6f,f4,6c,13,da,8d,53,b4,0e,d1,\
f1,2b,0b,9e,19,e2,28,49,66,64,1a,33,bf,0e,36,71,04,c9,d2,ac,db,7f,f8,e8,0d,\
94,0d,98,e7,06,ea,e5,f5,f7,cb,35,e7,0a,bf,f3,2e,e9,5c,59,a9,0f,32,b8,e5,6d,\
6f,44,09,ef,b7,c3,be,7c,65,76,28,81,e5,96,18,d8,eb,11,fb,a9,ec,cf,1c,75,44,\
03,d8,7e,b6,36,f4,1f,f4,39,67,15,da,29,cf,21,c0,ff,e4,c5,e1,f2,e7,14,7c,04,\
2c,84,25,b6,44,3a,5b,0a,1a,a9,61,da,22,64,53,ee,2a,f4,73,f3,38,b7,ba,db,86,\
a7,3b,a0,35,83,53,18,57,86,2c,26,e3,ad,ab,6b,4a,13,5d,f7,28,ee,af,17,65,47,\
b9,78,b7,a4,4e,23,b2,00,e7,26,a1,7c,82,93,40,22,47,d4,5f,e5,0d,90,95,9e,86,\
3f,00,8c,a8,80,87,2a,19,d5,a5,48,98,57,e1,ca,31,39,26,a6,7a,99,d0,39,4a,c2,\
48,35,08,e9,e8,be,59,60,43,67,42,e0,b6,43,5f,f0,05,7e,87,8f,21,b7,4a,5f,9a,\
bb,5c,03,35,f4,19,08,38,92,b3,05,8f,95,3c,b7,52,be,3a,2e,9d,9d,d8,72,de,b7,\
e0,81,8a,44,49,fc,70,c2,6d,bc,21,84,3a,05,40,22,56,08,b4,c1,d3,92,81,99,31,\
78,f3,14,77,7e,29,f8,ef,95,bc,62,4d,7c,d6,a4,b4,9c,30,8e,28,e8,7f,01,08,cc,\
af,61,9d,da,6a,4d,d8,28,28,c8,01,9b,84,52,9d,55,f1,7d,1e,90,0b,4d,14,42,d3,\
40,20,f6,41,13,2b,26,4c,5d,36,2d,18,c3,ec,4c,c9,1b,25,2f,76,ea,cb,19,3f,e7,\
29,38,29,a8,7a,02,04,e4,47,97,b5,8a,f3,ce,91,2b,7f,e6,4e,05,f1,84,57,a0,33,\
b7,ee,2b,20,bb,17,8a,0c,77,04,61,65,8a,71,9f,48,88,24,ea,08,59,37,80,f5,1e,\
6d,31,6a,42,7b,2b,03,86,7f,76,ff,bb,e9,2d,c2,18,e5,de,e9,d7,ec,21,a3,5a,fb,\
ec,b8,c7,4b,ab,44,80,23,4b,24,b2,2a,6f,a9,26,54,d9,f8,22,69,19,e1,e4,72,c6,\
16,d6,87,90,99,07,2a,80,30,c6,1b,95,59,c4,d3,01,97,68,de,ac,00,78,7e,0d,ab,\
28,fc,68,e7,b2,80,90,ba,b4,22,09,e5,bc,54,84,9a,67,60,6e,71,7f,6a,c7,ad,d2,\
e0,5c,30,a2,8d,f4,85,98,67,6d,18,a3,7a,e8,60,3d,6c,10,43,a7,57,67,71,f6,11,\
58,9a,f6,36,d5,dd,5b,10,24,83,b4,90,d9,9e,f6,79,fa,65,41,14,3d,6c,8e,0c,f8,\
62,a6,a1,5d,38,61,0b,80,ff,65,73,6b,2e,66,82,e0,d4,f2,38,02,35,b6,30,21,fe,\
c9,d7,84,0e,4d,de,0c,d5,cd,4a,18,6a,d6,05,49,02,7a,8f,9e,ec,59,4a,d8,c6,73,\
e1,bf,b8,d2,b2,85,e9,c8,b3,fa,92,3a,e0,a1,74,df,8a,fa,75,b9,af,18,ef,ab,bd,\
38,60,1f,1a,39,e2,40,8a,f4,69,49,6c,a8,a4,12,86,b5,ae,53,82,cb,0f,f1,2f,9a,\
c8,c8,d1,06,7c,0e,49,ca,cd,f2,7f,c5,c5,d2,0a,02,72,84,38,bf,c2,d0,25,a5,d9,\
c0,23,b7,fc,0c,bf,bc,21,48,7b,cd,9d,1a,3e,1c,53,51,22,53,ac,f0,dd,9a,b7,78,\
ab,90,64,a7,ff,5a,c3,30,32,c7,6b,0e,bb,1b,02,16,59,35,d7,2c,08,2f,02,6c,8a,\
5d,24,5f,94,8b,1d,51,1f,cb,91,09,d0,29,63,04,bf,72,9b,71,eb,d7,73,4e,b7,35,\
55,95,51,70,a3,2d,ec,6a,84,29,72,8d,e5,70,20,45,08,3e,cb,50,a0,00,e0,54,f1,\
df,b0,c9,15,b5,6b,df,e4,dd,6e,3e,67,eb,ac,1b,ee,cc,e9,d5,df,da,fa,e5,1d,5c,\
89,c0,f5,82,16,90,4c,98,9e,d2,6f,1a,df,09,dc,a3,a3,1d,ea,19,08,4b,c7,f4,59,\
76,74,79,e8,0c,95,70,4d,0c,8a,09,11,ad,27,ac,b3,a9,ca,71,aa,e8,dd,cb,1b,6d,\
85,13,65,27,cc,af,f5,a6,70,72,e2,83,1e,e1,ed,4e,25,f7,01,76,0f,dc,d0,04,9b,\
18,94,82,96,43,26,35,4b,b9,af,b5,2f,2c,02,4f,2a,a0,2b,7e,51,75,cd,cc,61,52,\
ca,75,3b,6a,10,ef,5a,9c,e0,16,6f,e2,a9,79,e8,e0,be,81,0b,53,9a,b0,e7,b2,3d,\
9f,c3,d6,2c,b2,3e,03,e8,7b,2d,7c,e7,47,da,86,d9,a1,50,08,f7,75,9d,66,7d,51,\
9e,7b,ce,3b,51,22,80,6d,7b,f5,52,19,87,a4,d7,f9,d6,47,af,c4,92,d3,57,c4,df,\
3e,a8,bc,9c,aa,ed,0a,56,14,c3,d8,10,14,50,ed,12,fd,2e,fa,9b,ef,c4,d4,0e,a7,\
5d,94,51,60,6a,c9,2b,36,c8,3c,bd,0d,eb,5c,18,5e,34,36,c5,d2,23,d7,05,bf,3e,\
d6,22,e2,34,78,e5,6c,de,36,a5,92,37,57,57,97,04,8b,67,b6,d8,8d,22,8a,e9,4e,\
e3,d4,58,e4,7b,12,5f,41,e1,5c,a9,72,68,35,1b,1c,10,66,bb,db,fa,2e,8f,cf,f5,\
db,4d,85,2b,a0,12,96,cd,ee,6d,1e,1b,bc,0d,be,cf,98,97,3f,06,73,c6,b3,80,19,\
57,3e,a8,72,5b,e4,42,b9,d8,ce,27,c7,45,48,cb,f6,66,40,4c,e1,dc,7e,27,18,77,\
a9,92,fb,0d,cb,42,a0,60,8e,07,94,df,bd,c2,6f,60,88,3a,df,16,6b,50,75,25,3b,\
7f,40,6b,ed,a3,b7,ab,50,cd,6c,15,00,0f,f5,1b,9e,c2,05,1e,20,17,7c,ee,2b,2d,\
ec,bf,b8,fa,16,b6,f2,8b,1a,b7,af,43,a8,3b,54,d1,a9,42,82,8b,43,83,d3,a2,73,\
ee,f6,52,74,4f,75,89,3b,78,85,c9,0c,ad,f3,5d,4a,23,ff,2a,6e,14,14,9f,e5,b5,\
b2,04,1c,75,38,0b,11,da,55,89,c4,f7,f3,ff,92,4b,2f,05,8b,15,0c,98,70,b0,ca,\
17,d3,12,ce,70,c3,3b,df,09,1a,cc,b0,5d,68,63,cb,3f,10,e2,76,6c,cc,47,3e,f4,\
94,00,a2,27,26,f5,a7,ea,5a,ce,f8,44,19,dc,48,a7,3d,d5,8d,60,c3,74,22,8e,47,\
47,ba,1d,3f,dd,1b,81,a8,2f,e0,f7,2c,8a,21,b9,28,1f,5d,4f,45,02,1a,f3,1b,0d,\
e0,40,97,05,b9,fc,f8,67,0a,a7,ba,f1,cf,b7,68,34,93,0c,66,29,98,9f,88,84,26,\
74,cc,42,ef,73,4c,11,bb,bf,75,53,6a,0e,7d,df,72,2a,e2,a6,fc,84,d5,3a,3b,06,\
ca,86,54,14,b5,f5,f5,05,df,57,e6,c8,23,fb,6f,65,24,9b,ed,bd,ed,6c,e4,89,91,\
22,9e,5f,8c,fb,97,da,5d,03,44,9d,f9,54,14,00,00,00,d9,66,15,a7,52,6e,e0,02,\
80,02,47,bf,8f,94,d7,68,ae,d1,36,5b
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winsfg32]
"Asynchronous"=dword:00000001
"DllName"="winsfg32.dll"
"Impersonate"=dword:00000000
"Startup"="EvtStartup"
"Shutdown"="EvtShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
The following are the files found:
****************************************************************************
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
zip warning: name not matched: dlls\*.*
zip error: Nothing to do! (backup.zip)
adding: backregs/notibac.reg (164 bytes security) (deflated 79%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)
Logfile of HijackThis v1.99.1
Scan saved at 2:47:12 PM, on 2/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Ernie\My Documents\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/?rs=1
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/?rs=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdat…b?1151356478299
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winsfg32 - C:\WINDOWS\SYSTEM32\winsfg32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe