Here is the List

Hi Tle9713

You have the latest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option # 1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

Message Edited by Shaba_FIN on 07-21-200603:37 AM

Message Edited by Shaba_FIN on 07-21-200603:38 AM

Message Edited by Shaba_FIN on 07-21-200603:38 AM

Ok, we'll see if this work ok despite 16-bit problem:

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option # 2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!

Note : Once the pc has restarted if a log does not appear or the icons didn't dissappear, run the "second.bat" located inside the L2mfix folder.

I can't fit it all in one message, so I'll break it down.

L2MFIX find log 051206
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Group Policy]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINNT\\system32\\gp6ol3j31.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{E2FB775C-0658-8E15-09EE-418E9521C4F7}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network and Dial-up Connections"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{1A9BA3A0-143A-11CF-8350-444553540000}"="Shell Favorite Folder"
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"="My Computer"
"{86747AC0-42A0-1069-A2E6-08002B30309D}"="Briefcase Folder"
"{0AFACED1-E828-11D1-9187-B532F1E9575D}"="Folder Shortcut"
"{12518493-00B2-11d2-9FA5-9E3420524153}"="Mounted Volume"
"{21B22460-3AEA-1069-A2DC-08002B30309D}"="File Property Page Extension"
"{B091E540-83E3-11CF-A713-0020AFD79762}"="File Types Page"
"{FBF23B41-E3F0-101B-8488-00AA003E56F8}"="MIME File Types Hook"
"{C2FBB630-2971-11d1-A18C-00C04FD75D13}"="Microsoft CopyTo Service"
"{C2FBB631-2971-11d1-A18C-00C04FD75D13}"="Microsoft MoveTo Service"
"{13709620-C279-11CE-A49E-444553540000}"="Shell Automation Service"
"{62112AA1-EBE4-11cf-A5FB-0020AFE7292D}"="Shell Automation Folder View"
"{4622AD11-FF23-11d0-8D34-00A0C90F2719}"="Start Menu"
"{7BA4C740-9E81-11CF-99D3-00AA004AE837}"="Microsoft SendTo Service"
"{D969A300-E7FF-11d0-A93B-00A0C90F2719}"="Microsoft New Object Service"
"{09799AFB-AD67-11d1-ABCD-00C04FC30936}"="Open With Context Menu Handler"
"{3FC0B520-68A9-11D0-8D77-00C04FD70822}"="Display Control Panel HTML Extensions"
"{75048700-EF1F-11D0-9888-006097DEACF9}"="ActiveDesktop"
"{6D5313C0-8C62-11D1-B2CD-006097DF8C11}"="Folder Options Property Page Extension"
"{57651662-CE3E-11D0-8D77-00C04FC99D61}"="CmdFileIcon"
"{4657278A-411B-11d2-839A-00C04FD918D0}"="Shell Drag and Drop helper"
"{A470F8CF-A1E8-4f65-8335-227475AA5C46}"="Add encryption item to context menus in explorer"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{568804CA-CBD7-11d0-9816-00C04FD91972}"="Menu Shell Folder"
"{5b4dae26-b807-11d0-9815-00c04fd91972}"="Menu Band"
"{8278F931-2A3E-11d2-838F-00C04FD918D0}"="Tracking Shell Menu"
"{E13EF4E4-D2F2-11d0-9816-00C04FD91972}"="Menu Site"
"{ECD4FC4F-521C-11D0-B792-00A0C90312E1}"="Menu Desk Bar"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{D82BE2B0-5764-11D0-A96E-00C04FD705A2}"="IShellFolderBand"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{0E5CBF21-D15F-11d0-8301-00AA005B4383}"="&Links"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7487cd30-f71a-11d0-9ea7-00805f714772}"="Thumbnail Image"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{8BEBB290-52D0-11D0-B7F4-00C04FD706EC}"="Thumbnails"
"{EAB841A0-9550-11CF-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{1AEB1360-5AFC-11D0-B806-00C04FD706EC}"="Office Graphics Filters Thumbnail Extractor"
"{9DBD2C50-62AD-11D0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{500202A0-731E-11D0-B829-00C04FD706EC}"="LNK file thumbnail interface delegator"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8C-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{fe1290f0-cfbd-11cf-a330-00aa00c16e65}"="Directory Namespace"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{450D8FBA-AD25-11D0-98A8-0800361B1103}"="MyDocs Folder"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{5a61f7a0-cde1-11cf-9113-00aa00425c62}"="IIS Shell Extention"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{5E44E225-A408-11CF-B581-008029601108}"="Adaptec DirectCD Shell Extension"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{8BB622A0-4010-4A4C-92A2-B3EB1C52AA63}"=""
"{692094AC-B180-4681-82E6-01E51AA901F9}"=""
"{4A4A524A-357B-4E4D-AF70-CFD9010EA57A}"=""
"{35DBC321-DD8C-435C-AF4F-663AD258A298}"=""
"{7BB0A73C-9183-4F27-98E6-456F503BF5C6}"=""
"{15CD2D87-B7D1-420C-9559-4433499BE837}"=""
"{7EB97031-56F4-4E3A-B31F-AEB3D15DB68C}"=""
"{7E71CA88-89FC-4D42-A778-ED72D04CAED9}"=""
"{D3955DA7-51F7-4DE1-BA21-E5BD7809CD40}"=""
"{DDF8F585-BCF8-406F-88AC-9835C3752981}"=""
"{EA5AF106-AD69-46E0-AC41-FA5FF572AC97}"=""
"{9A9B03D4-10EA-4FA1-9265-B997722A9A11}"=""
"{F7237AA3-B0DE-415E-BC0A-ECBB6BC16459}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{35DBC321-DD8C-435C-AF4F-663AD258A298}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{35DBC321-DD8C-435C-AF4F-663AD258A298}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{35DBC321-DD8C-435C-AF4F-663AD258A298}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{35DBC321-DD8C-435C-AF4F-663AD258A298}\InprocServer32]
@="C:\\WINNT\\system32\\oeeng400.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{7E71CA88-89FC-4D42-A778-ED72D04CAED9}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E71CA88-89FC-4D42-A778-ED72D04CAED9}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E71CA88-89FC-4D42-A778-ED72D04CAED9}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{7E71CA88-89FC-4D42-A778-ED72D04CAED9}\InprocServer32]
@="C:\\WINNT\\system32\\PJIKey.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D3955DA7-51F7-4DE1-BA21-E5BD7809CD40}]
@=""
"IDEx"="AD"

[HKEY_CLASSES_ROOT\CLSID\{D3955DA7-51F7-4DE1-BA21-E5BD7809CD40}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D3955DA7-51F7-4DE1-BA21-E5BD7809CD40}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D3955DA7-51F7-4DE1-BA21-E5BD7809CD40}\InprocServer32]
@="C:\\WINNT\\system32\\CpdLineExt.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{DDF8F585-BCF8-406F-88AC-9835C3752981}]
@=""
"IDEx"="AD"

[HKEY_CLASSES_ROOT\CLSID\{DDF8F585-BCF8-406F-88AC-9835C3752981}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDF8F585-BCF8-406F-88AC-9835C3752981}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{DDF8F585-BCF8-406F-88AC-9835C3752981}\InprocServer32]
@="C:\\WINNT\\system32\\czdial32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EA5AF106-AD69-46E0-AC41-FA5FF572AC97}]
@=""
"IDEx"="AD"

[HKEY_CLASSES_ROOT\CLSID\{EA5AF106-AD69-46E0-AC41-FA5FF572AC97}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EA5AF106-AD69-46E0-AC41-FA5FF572AC97}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EA5AF106-AD69-46E0-AC41-FA5FF572AC97}\InprocServer32]
@="C:\\WINNT\\system32\\siorprop.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9A9B03D4-10EA-4FA1-9265-B997722A9A11}]
@=""
"IDEx"="AD"

[HKEY_CLASSES_ROOT\CLSID\{9A9B03D4-10EA-4FA1-9265-B997722A9A11}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9A9B03D4-10EA-4FA1-9265-B997722A9A11}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9A9B03D4-10EA-4FA1-9265-B997722A9A11}\InprocServer32]
@="C:\\WINNT\\system32\\tiaffic.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{F7237AA3-B0DE-415E-BC0A-ECBB6BC16459}]
@=""
"IDEx"="AD"

[HKEY_CLASSES_ROOT\CLSID\{F7237AA3-B0DE-415E-BC0A-ECBB6BC16459}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F7237AA3-B0DE-415E-BC0A-ECBB6BC16459}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{F7237AA3-B0DE-415E-BC0A-ECBB6BC16459}\InprocServer32]
@="C:\\WINNT\\system32\\tXpiui.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 040E-6E4C

Directory of C:\WINNT\System32

07/21/2006 12:28p 234,592 guard.tmp
07/20/2006 09:09a 234,592 enj2l11o1.dll
07/19/2006 04:26p 234,592 dn4u01h9e.dll
07/19/2006 03:35p 235,968 m6polg7316.dll
07/19/2006 02:27p 234,592 gp6ol3j31.dll
07/19/2006 01:04p 235,116 meutil.dll
07/19/2006 11:42a 235,116 AQYCFILT.DLL
07/19/2006 08:45a 235,652 n08olal31dq.dll
07/14/2006 10:14adllcache
8 File(s) 1,880,220 bytes
1 Dir(s) 4,464,111,616 bytes free


I am running Windows 2000 Professional and it told me that there was a 16 bit problem or something.

Password should be blank. Try just pressing Enter.

I think that the 16 bit problem came up again.

It's been a half an hour since I ran L2MFix Tool and it says that it will automatically type the password, but when it says "Enter password for L2MFIX:", it doesn't type it in.

The computer restarted with no background and no icons. There was no log that popped up. I clicked on second.bat but it said that "Second.bat is Not intended to be run on its own"

Ok, we'll try some another tool here:

Please download Look2Me-Destroyer.exe to your desktop.

* Close all windows before continuing.
* Double-click Look2Me-Destroyer.exe to run it.
* Put a check next to Run this program as a task.
* You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OK
* When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
* Once it's done scanning, click the Remove L2M button.
* You will receive a Done Scanning message, click OK.
* When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
* Your computer will then shutdown.
* Turn your computer back on.
* Please post the contents of Look2Me-Destroyer.txt and a new HiJackThis log.

I ran it and it successfully ran. Here is the log.


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 7/22/2006 2:04:03 PM

Infected! C:\WINNT\system32\gp6ol3j31.dll
Infected! C:\WINNT\system32\CpdLineExt.dll
Infected! C:\WINNT\system32\czdial32.dll
Infected! C:\WINNT\system32\dn2801fue.dll
Infected! C:\WINNT\system32\dn4u01h9e.dll
Infected! C:\WINNT\system32\enj2l11o1.dll
Infected! C:\WINNT\system32\gp6ol3j31.dll
Infected! C:\WINNT\system32\k0nola531d.dll
Infected! C:\WINNT\system32\m6polg7316.dll
Infected! C:\WINNT\system32\meutil.dll
Infected! C:\WINNT\system32\n08olal31dq.dll
Infected! C:\WINNT\system32\siorprop.dll
Infected! C:\WINNT\system32\tiaffic.dll
Infected! C:\WINNT\system32\tXpiui.dll
Infected! C:\WINNT\system32\guard.tmp

Attempting to delete infected files...

Attempting to delete: C:\WINNT\system32\gp6ol3j31.dll
C:\WINNT\system32\gp6ol3j31.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\CpdLineExt.dll
C:\WINNT\system32\CpdLineExt.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\czdial32.dll
C:\WINNT\system32\czdial32.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\dn2801fue.dll
C:\WINNT\system32\dn2801fue.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\dn4u01h9e.dll
C:\WINNT\system32\dn4u01h9e.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\enj2l11o1.dll
C:\WINNT\system32\enj2l11o1.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\gp6ol3j31.dll
C:\WINNT\system32\gp6ol3j31.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\k0nola531d.dll
C:\WINNT\system32\k0nola531d.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\m6polg7316.dll
C:\WINNT\system32\m6polg7316.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\meutil.dll
C:\WINNT\system32\meutil.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\n08olal31dq.dll
C:\WINNT\system32\n08olal31dq.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\siorprop.dll
C:\WINNT\system32\siorprop.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\tiaffic.dll
C:\WINNT\system32\tiaffic.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\tXpiui.dll
C:\WINNT\system32\tXpiui.dll Deleted successfully!

Attempting to delete: C:\WINNT\system32\guard.tmp
C:\WINNT\system32\guard.tmp Deleted successfully!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Explorer

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{8BB622A0-4010-4A4C-92A2-B3EB1C52AA63}"
HKCR\Clsid\{8BB622A0-4010-4A4C-92A2-B3EB1C52AA63}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{692094AC-B180-4681-82E6-01E51AA901F9}"
HKCR\Clsid\{692094AC-B180-4681-82E6-01E51AA901F9}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{4A4A524A-357B-4E4D-AF70-CFD9010EA57A}"
HKCR\Clsid\{4A4A524A-357B-4E4D-AF70-CFD9010EA57A}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{35DBC321-DD8C-435C-AF4F-663AD258A298}"
HKCR\Clsid\{35DBC321-DD8C-435C-AF4F-663AD258A298}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7BB0A73C-9183-4F27-98E6-456F503BF5C6}"
HKCR\Clsid\{7BB0A73C-9183-4F27-98E6-456F503BF5C6}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{15CD2D87-B7D1-420C-9559-4433499BE837}"
HKCR\Clsid\{15CD2D87-B7D1-420C-9559-4433499BE837}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7EB97031-56F4-4E3A-B31F-AEB3D15DB68C}"
HKCR\Clsid\{7EB97031-56F4-4E3A-B31F-AEB3D15DB68C}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7E71CA88-89FC-4D42-A778-ED72D04CAED9}"
HKCR\Clsid\{7E71CA88-89FC-4D42-A778-ED72D04CAED9}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{D3955DA7-51F7-4DE1-BA21-E5BD7809CD40}"
HKCR\Clsid\{D3955DA7-51F7-4DE1-BA21-E5BD7809CD40}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{DDF8F585-BCF8-406F-88AC-9835C3752981}"
HKCR\Clsid\{DDF8F585-BCF8-406F-88AC-9835C3752981}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{EA5AF106-AD69-46E0-AC41-FA5FF572AC97}"
HKCR\Clsid\{EA5AF106-AD69-46E0-AC41-FA5FF572AC97}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{9A9B03D4-10EA-4FA1-9265-B997722A9A11}"
HKCR\Clsid\{9A9B03D4-10EA-4FA1-9265-B997722A9A11}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F7237AA3-B0DE-415E-BC0A-ECBB6BC16459}"
HKCR\Clsid\{F7237AA3-B0DE-415E-BC0A-ECBB6BC16459}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded

Great news :)

Send a fresh HijackThis log and we'll continue :)

Logfile of HijackThis v1.99.1
Scan saved at 12:55:15 PM, on 07/23/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgentSvc.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\taskib.exe
C:\WINNT\system32\UAService7.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\mqsvc.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\AOL\1132525521\ee\AOLSoftware.exe
C:\Program Files\Java\jre1.5.0_02\bin\jucheck.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\System32\svchost.exe
C:\nwnmed_7.exe
C:\kybrded_7.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\HITWAR~1\HITWAR~1.EXE
C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Le\LOCALS~1\Temp\Rar$EX00.954\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.maxifiles.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tray Temperature] C:\DOCUME~1\Le\LOCALS~1\Temp\MiniBug.exe 1
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINNT\system32\sfg.dll"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1132525521\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [ntdll.dll] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [newname] C:\\nwnmed_7.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrded_7.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINNT\system32\sfg.dll"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Registry Cleaner] C:\PROGRA~1\REGIST~1\regclean.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [HitwarePKLite] C:\PROGRA~1\HITWAR~1\HITWAR~1.EXE
O4 - Global Startup: KaBoom! Popup Blocker.lnk = C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.41optYplkOmji/SpySpotterCabInstall.cab
O16 - DPF: {FCEAE646-DCF9-4D59-B994-6BD30A315139} - http://www.mtv.com/overdrive/bin/setup.exe
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: Welcome - C:\WINNT\system32\c0000admed0a0.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IEAgentSvc - Binns and Company Software, Inc. - C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgentSvc.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Network Station Task Manager (TSKIB) - Unknown owner - C:\WINNT\taskib.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe

Move HijackThis to own folder, eg. C:\Hjt

Uninstall via add/remove program if present:

Toolbar888

Open HijackThis, click do a system scan only and checkmark these:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.maxifiles.com/
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [PCShield] regsvr32 /s "C:\WINNT\system32\sfg.dll"
O4 - HKLM\..\Run: [ntdll.dll] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [newname] C:\\nwnmed_7.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrded_7.exe
O4 - HKCU\..\Run: [PCShield] regsvr32 /s "C:\WINNT\system32\sfg.dll"
O16 - DPF: {FC67BB52-AAB6-4282-9D51-2DAFFE73AFD0} - http://download.spyspotter.com/spyspotter/SpSp29952.41optYplkOmji/SpySpotterCabInstall.cab
O23 - Service: Network Station Task Manager (TSKIB) - Unknown owner - C:\WINNT\taskib.exe










Close all windows, also browser, and press fix checked

Please click Start > Run and type in: services.msc
Click OK
In the Services window find: Network Station Task Manager (TSKIB)
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK

Please download ATF Cleaner by Atribune and save
it to desktop. Don't use it yet.

Download and unzip BFU.zip from here.
Run the program and click the Web button as shown by the blue arrow below:


Use this URL to copy into the address bar of the Download script window:
http://metallica.geekstogo.com/alcanshorty.bfu

Execute the script by clicking the Execute button.

If you have any questions about the use of BFU please read here:
http://metallica.geekstogo.com/BFUinstructions.html

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.


Please download Ewido to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install Ewido by double clicking the installer.
  
• Follow the prompts. Make sure that Launch Ewido is checked.
  
• On the main screen under Your Computer's security.
  
  • Click on Change state next to Resident shield. It should now change to inactive.
    
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    
  • Wait until you see the Update succesfull message.
    Note: If the Update now option is grayed out, follow the steps below.
    
    • Click on Update on the toolbar.
      
    • Under Manual update, click on the Start Update button.
      
    • Wait until you see the Update succesfull message.
      
    
    
    
  
  
• Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.
  

If you are having problems with the updater, you can use this link to manually update ewido.
Ewido manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that Ewido is closed before installing the update.

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
  
• Wait 30 seconds, and then turn the computer on.
  
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  
• Ensure that the Safe Mode option is selected.
  
• Press Enter. The computer then begins to start in Safe mode.
  
• Login on your usual account.
  

______________________________

Delete if found:

C:\Program Files\ ToolBar888
C:\WINNT\system32\ sfg.dll
C:\ nwnmed_7.exe
C:\ kybrded_7.exe
C:\WINNT\ taskib.exe

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit to close ATF-Cleaner.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start Ewido and run a full scan.

• Click on Scanner on the toolbar.
  
• Click on the Settings tab.
  
  • Under How to act?
    
    • Click on Recommended Action and choose Quarantine from the popup menu.
      
    
    
  • Under How to scan?
    
    • All checkboxes should be ticked.
      
    
    
  • Under Possibly unwanted software:
    
    • All checkboxes should be ticked.
      
    
    
  • Under Reports:
    
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
      
    
    
  • Under What to scan?
    
    • Select Scan every file.
      
    
    
  
  
• Click on the Scan tab.
  
• Click on Complete System Scan to start the scan process.
  
• Let the program scan the machine.
  
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    
  • At the bottom of the window click on the Apply all Actions button. (3)
    
    
    
  
  
  
• When done, click the Save Scan Report button.
  
  • Click the Save Report as button.
    
  • Save the report to your Desktop.
    
  
  
• Right-click the Ewido Tray Icon and select Exit. Confirm by clicking Yes.
  

Reboot in Normal Mode.

Please post:

• Ewido log
  
• A new HijackThis log
  

Your may need several replies to post the requested logs, otherwise they might get cut off.

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 3:50:15 PM 07/24/2006

+ Scan result:



C:\WINNT\system32\fcs.exe -> Adware.Adlog : Cleaned with backup (quarantined).
C:\WINNT\system32\zbzis.dll -> Adware.Adstart : Cleaned with backup (quarantined).
C:\WINNT\icont.exe -> Adware.AdURL : Cleaned with backup (quarantined).
C:\WINNT\TGU\asappsrv.dll -> Adware.CommAd : Cleaned with backup (quarantined).
C:\WINNT\TGU\command.exe -> Adware.CommAd : Cleaned with backup (quarantined).
C:\WINNT\system32\AQYCFILT.DLL -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\LEASRV.DLL -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\MYMTAPI.DLL -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\enjml1111.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\kxd103.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\mixex.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\mkutilse.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\mnutilse.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\moc40u.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\mzhcp.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
C:\WINNT\system32\rem.dll -> Adware.Look2Me : Cleaned with backup (quarantined).
[448] C:\WINNT\system32\LIASRV.DLL -> Adware.Look2Me : Error during cleaning.
[512] C:\WINNT\system32\LIASRV.DLL -> Adware.Look2Me : Error during cleaning.
C:\Program Files\SearchRelevant\SearchRelevant.dll -> Adware.Relevance : Cleaned with backup (quarantined).
C:\LemonadeTycoonSetup-dm.exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\Program Files\Mozilla Firefox\plugins\npzango.dll -> Adware.WinAD : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\CONFLICT.1\AdStatServX.dll -> Adware.WinAD : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\ALNV5CBN\kybrded_7[1].exe -> Downloader.Adload.cu : Cleaned with backup (quarantined).
C:\bintheredunthat\kybrded_7.exe -> Downloader.Adload.cu : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\nwnmed_7[1].exe -> Downloader.Adload.cy : Cleaned with backup (quarantined).
C:\bintheredunthat\nwnmed_7.exe -> Downloader.Adload.cy : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\ALNV5CBN\tahoma[1].tar -> Downloader.Adload.db : Cleaned with backup (quarantined).
C:\ipod32.exe -> Downloader.Adload.db : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\loader[1].exe -> Downloader.Adload.de : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\0E55F2FD-ABE2-43CC-A5D5-13BCE9\E932714C-CE3E-412A-879D-602B7E -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\4487ACBF-018B-4C84-99C8-C11671\4D0D68B2-FDA7-49D9-ADEF-CCACF7 -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\6D19D988-A85A-44DA-B6A4-67F8F0\517C6329-80CE-4546-A252-1D92AF -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\74AAD711-E7C0-4B01-B34E-28C029\8AFDEA17-DE20-476B-A2E8-354D4C -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\7E4CA93A-1EF3-4FDE-89B9-C3F30A\31B43AA3-25E9-444B-A9D3-720109 -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\A6B7B630-F7CD-44F4-AECA-525B07\C95061EF-13F1-409E-A89C-6569EC -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\BEC67B99-491A-4EA8-8625-7F7902\4A90631B-8FF9-44D4-BD5F-D3C4C8 -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Program Files\Microsoft AntiSpyware\Quarantine\E587B6D7-C8B8-4C22-9D46-F68718\B54CF6FC-7D7B-4A12-9C1B-E4C5BD -> Downloader.Qoologic.p : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\nwnmac_6[1].exe -> Downloader.VB.ada : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\kybrdaca_6[1].exe -> Downloader.VB.agi : Cleaned with backup (quarantined).
C:\WINNT\system32\See04152005.exe -> Dropper.Agent.hl : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\0XARWTIF\drsmartload45a[1].exe -> Hijacker.VB.fg : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\0XARWTIF\drsmartload849a[1].exe -> Hijacker.VB.fg : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\ALNV5CBN\drsmartload46a[1].exe -> Hijacker.VB.fg : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\ALNV5CBN\dfndred_7[1].exe -> Hijacker.VB.nh : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\OYRA1QLC\dfndrac_6[1].exe -> Hijacker.VB.nh : Cleaned with backup (quarantined).
C:\WINNT\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : Cleaned with backup (quarantined).
:mozilla.11:C:\Documents and Settings\Le\Application Data\Mozilla\Firefox\Profiles\yd8k4rsm.default\cookies-1.txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
:mozilla.8:C:\Documents and Settings\Le\Application Data\Mozilla\Firefox\Profiles\yd8k4rsm.default\cookies-1.txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
:mozilla.10:C:\Documents and Settings\Le\Application Data\Mozilla\Firefox\Profiles\yd8k4rsm.default\cookies-1.txt -> TrackingCookie.Atdmt : Cleaned with backup (quarantined).
:mozilla.20:C:\Documents and Settings\Le\Application Data\Mozilla\Firefox\Profiles\yd8k4rsm.default\cookies-1.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
:mozilla.21:C:\Documents and Settings\Le\Application Data\Mozilla\Firefox\Profiles\yd8k4rsm.default\cookies-1.txt -> TrackingCookie.Com : Cleaned with backup (quarantined).
:mozilla.9:C:\Documents and Settings\Le\Application Data\Mozilla\Firefox\Profiles\yd8k4rsm.default\cookies-1.txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Cookies\system@c.enhance[1].txt -> TrackingCookie.Enhance : Cleaned with backup (quarantined).
C:\found.000\file0002.chk -> TrackingCookie.Fastclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Default User\Cookies\system@c.goclick[2].txt -> TrackingCookie.Goclick : Cleaned with backup (quarantined).
:mozilla.12:C:\Documents and Settings\Le\Application Data\Mozilla\Firefox\Profiles\yd8k4rsm.default\cookies-1.txt -> TrackingCookie.Mediaplex : Cleaned with backup (quarantined).
C:\WINNT\system32\hhaeyfg.vxd -> Trojan.Painwin.a : Cleaned with backup (quarantined).
C:\WINNT\system32\nqarona.exe -> Trojan.Pakes : Cleaned with backup (quarantined).
C:\Program Files\Common Files\{040E6E4C-05D7-1033-0827-010105290001}\Update.exe -> Trojan.Starter.65 : Cleaned with backup (quarantined).


::Report end

Logfile of HijackThis v1.99.1
Scan saved at 3:59:35 PM, on 07/24/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgentSvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\UAService7.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\mqsvc.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Common Files\AOL\1132525521\ee\AOLSoftware.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\PROGRA~1\HITWAR~1\HITWAR~1.EXE
C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgent.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.maxifiles.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tray Temperature] C:\DOCUME~1\Le\LOCALS~1\Temp\MiniBug.exe 1
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1132525521\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [Registry Cleaner] C:\PROGRA~1\REGIST~1\regclean.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [HitwarePKLite] C:\PROGRA~1\HITWAR~1\HITWAR~1.EXE
O4 - Global Startup: KaBoom! Popup Blocker.lnk = C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: RaptisoftGameLoader - http://miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://www.truedoc.com/activex/tdserver.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O16 - DPF: {FCEAE646-DCF9-4D59-B994-6BD30A315139} - http://www.mtv.com/overdrive/bin/setup.exe
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: Shell Extensions - C:\WINNT\system32\c800lidm180a.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IEAgentSvc - Binns and Company Software, Inc. - C:\Program Files\Binnsware, Inc\KaBoom! Popup Blocker\IEAgentSvc.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe

That was the hicjack this

Hi

Looking much better :)

We need to temporarily disable microsoft antispyware that it won't prevent fixes:

1. Right-click on the Microsoft Anti-Spyware icon in the system tray [it's the one with the red and yellow bulls-eye].
2. Click on "Security Agents Status".
3. Click on "Disable real-time protection".

After that:

Open HijackThis, click do a system scan only and checkmark these:


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.maxifiles.com/
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Tray Temperature] C:\DOCUME~1\Le\LOCALS~1\Temp\MiniBug.exe 1

Close all windows including browser and press fix checked.

Re-run look2medestroyer (you still have look2me even though I thought it was gone :( )

Send C:\ Look2Me-Destroyer.txt and a fresh HijackThis log.