Save the file to your desktop and
double clickl2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.
Double clickl2mfix.bat and select
option #1 for Run
Find Log by
typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log.
Copy the contents of that log and paste it into this thread.
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're '
in use', try deleting them from "
Safe Mode".
Post back a new log, and let me know how everything goes.
L2MFIX find log 1.03
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
azicap32.dll Tue Mar 15 2005 3:11:08p ..S.R 235,288 229.77 K
browseui.dll Thu Jan 27 2005 12:13:16p A.... 1,016,832 993.00 K
cdfview.dll Thu Jan 27 2005 12:13:16p A.... 151,040 147.50 K
gp8ol3~1.dll Wed Mar 16 2005 3:36:30p ..S.R 233,439 227.96 K
gpjml3~1.dll Thu Mar 17 2005 8:58:16p ..S.R 233,807 228.32 K
gwfspi~1.dll Fri Jan 28 2005 3:37:58p A.... 23,304 22.76 K
hr8q05~1.dll Mon Mar 14 2005 8:17:38p ..S.R 232,834 227.38 K
hrr605~1.dll Thu Mar 17 2005 9:06:26p ..S.R 234,502 229.00 K
hxpertrm.dll Tue Mar 15 2005 1:39:22p ..S.R 234,068 228.58 K
iepeers.dll Thu Jan 27 2005 12:13:16p A.... 249,856 244.00 K
inseng.dll Thu Jan 27 2005 12:13:16p A.... 96,256 94.00 K
irlql5~1.dll Tue Mar 15 2005 4:09:50a ..S.R 235,278 229.76 K
j06m0a~1.dll Mon Mar 14 2005 2:55:06p ..S.R 232,896 227.44 K
jtjm07~1.dll Tue Mar 15 2005 3:25:18a ..S.R 234,068 228.58 K
jtn207~1.dll Thu Mar 17 2005 8:06:38p ..S.R 232,440 226.99 K
k0js0a~1.dll Thu Mar 17 2005 8:32:16p ..S.R 233,404 227.93 K
ktp4l7~1.dll Tue Mar 15 2005 9:04:22p ..S.R 234,674 229.17 K
l08mla~1.dll Mon Mar 14 2005 2:27:56p ..S.R 233,916 228.43 K
legitc~1.dll Fri Jan 28 2005 3:38:00p A.... 421,128 411.26 K
lv2m09~1.dll Wed Mar 16 2005 9:17:42p ..S.R 233,502 228.03 K
mdrd3x40.dll Mon Mar 14 2005 11:07:36p ..S.R 234,068 228.58 K
mec42.dll Thu Mar 17 2005 9:06:26p ..S.R 233,807 228.32 K
mshtml.dll Thu Jan 27 2005 12:13:18p A.... 3,006,976 2.87 M
ole32.dll Fri Jan 14 2005 3:55:50a A.... 1,285,120 1.22 M
olecli32.dll Fri Jan 14 2005 3:55:50a A.... 74,752 73.00 K
olecnv32.dll Fri Jan 14 2005 3:55:50a A.... 37,888 37.00 K
p2n8lc~1.dll Tue Mar 15 2005 2:56:28p ..S.R 233,248 227.78 K
r6r6lg~1.dll Thu Mar 17 2005 2:16:14a ..S.R 233,072 227.61 K
rpcss.dll Fri Jan 14 2005 3:55:50a A.... 395,776 386.50 K
shdocvw.dll Thu Jan 27 2005 12:13:18p A.... 1,483,264 1.41 M
shell32.dll Tue Dec 21 2004 3:49:36p A.... 8,450,048 8.06 M
shlwapi.dll Thu Jan 27 2005 12:13:18p A.... 473,600 462.50 K
sintf16.dll Sat Mar 12 2005 5:22:56p A.... 12,067 11.78 K
sintf32.dll Sat Mar 12 2005 5:22:56p A.... 17,212 16.81 K
sintfnt.dll Sat Mar 12 2005 5:22:56p A.... 21,840 21.33 K
tyrmmgr.dll Wed Mar 16 2005 12:07:52p ..S.R 233,373 227.90 K
urlmon.dll Thu Jan 27 2005 12:13:18p A.... 607,744 593.50 K
uxtheme.dll Wed Mar 16 2005 1:59:40a A.... 218,624 213.50 K
wininet.dll Thu Jan 27 2005 12:13:18p A.... 656,896 641.50 K
39 items found: 39 files (19 H/S), 0 directories.
Total of file sizes: 23,141,907 bytes 22.07 M
Locate .tmp files:
No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 6CA9-DAC8
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
deleting local copy: azicap32.dll
deleting local copy: en44l1hq1.dll
deleting local copy: gp8ol3l31.dll
deleting local copy: hr8q05l5e.dll
deleting local copy: hxpertrm.dll
deleting local copy: irlql5351.dll
deleting local copy: j06m0aj1edo.dll
deleting local copy: jtjm0711e.dll
deleting local copy: jtn2075oe.dll
deleting local copy: k0js0a17ed.dll
deleting local copy: ktp4l77q1.dll
deleting local copy: l08mlal11dq.dll
deleting local copy: lv2m09f1e.dll
deleting local copy: mdrd3x40.dll
deleting local copy: p2n8lc5u1f.dll
deleting local copy: r26ulcj91fo.dll
deleting local copy: r6r6lg9s16.dll
deleting local copy: szclient.dll
deleting local copy: tyrmmgr.dll
deleting local copy: wahisn.dll
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
The following are the files found:
****************************************************************************
C:\WINDOWS\system32\azicap32.dll
C:\WINDOWS\system32\en44l1hq1.dll
C:\WINDOWS\system32\gp8ol3l31.dll
C:\WINDOWS\system32\hr8q05l5e.dll
C:\WINDOWS\system32\hxpertrm.dll
C:\WINDOWS\system32\irlql5351.dll
C:\WINDOWS\system32\j06m0aj1edo.dll
C:\WINDOWS\system32\jtjm0711e.dll
C:\WINDOWS\system32\jtn2075oe.dll
C:\WINDOWS\system32\k0js0a17ed.dll
C:\WINDOWS\system32\ktp4l77q1.dll
C:\WINDOWS\system32\l08mlal11dq.dll
C:\WINDOWS\system32\lv2m09f1e.dll
C:\WINDOWS\system32\mdrd3x40.dll
C:\WINDOWS\system32\p2n8lc5u1f.dll
C:\WINDOWS\system32\r26ulcj91fo.dll
C:\WINDOWS\system32\r6r6lg9s16.dll
C:\WINDOWS\system32\szclient.dll
C:\WINDOWS\system32\tyrmmgr.dll
C:\WINDOWS\system32\wahisn.dll
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
Running From:
C:\Documents and Settings\Brad Hoskinson\Desktop\deleat when done with\l2mfix
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (
http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\Brad Hoskinson\Desktop\deleat when done with\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Brad Hoskinson\Desktop\deleat when done with\l2mfix
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003
Craig.Peacock@beyondlogic.org Killing PID 1492 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003
Craig.Peacock@beyondlogic.org Killing PID 1596 'rundll32.exe'
Close any programs you have open since this step requires a reboot.
-
From the
l2mfix folder on your desktop, double click
l2mfix.bat and select option #
2 for
Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
Run
HiJackThis and click "
Scan", then check(tick) the following, if present:
Logfile of HijackThis v1.99.1
Scan saved at 7:00:24 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Let's delete these files, then post back just one more HiJackThis log; if we're still in the 'green', we'll just need to do the final cleanup, and you should be good to go.
Locate and
delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
files...
C:\WINDOWS\icont.exe C:\WINDOWS\woinstall.exe
-
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're '
in use', try deleting them from "
Safe Mode".
Logfile of HijackThis v1.99.1
Scan saved at 7:49:51 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
1. Double-click the
mwav.exe icon to run it (
it'll self extract).
2. Click "
Scan".
3. When it completes, post back the results from the 'Virus log information' pane.
Now, with all windows closed except
HiJackThis, click "
Fix checked".
================================
Here's how to restore it back...
================================
Run
HiJackThis, then:
1. Click "
Config..."
2. Click "
Backups"
3. Check(
tick) the entry(s) your wanting to restore.
4. Click "
Restore".
It's a good idea to idea to reboot your system and check to see if the problem has been resolved. If not, post back with any new problems or concerns you may be having.
Reboot your computer, and try using different programs and make sure everything is running ok. If your still experiencing problems, post back any concerns or problems you may be having and wait for any advice before continuing with the cleanup.
Download, install and run
Cleanup! from
Steven Gould, then:
1. Click "
Cleanup!"
(
wait for the program to finish scanning your system, and selecting files to be removed.)
2. Exit the program and reboot the computer, if necessary.
-
For more information about using
Cleanup! see
here.
If everything is running ok, let's do the final cleanup...
1. Run "
Disk Cleanup" and allow it to remove everything it finds.
2. If you've downloaded
MicroWorld AV (
MWAV), run it again - but don't scan, just click "
Clear Log" and exit the program.
3. Go to
www.trendmicro.com and click "
Free Online Scan", then "
Scan now, it's free!". When it's downloaded, select all available drives, then check(tick) "
Auto clean", then click "
Scan".
4. Run
AdAware SE Personal and "
perform a full system scan", then
Spybot S&D, and "
Check for Problems". Let them both remove the residual 'problems' left that
HiJackThis couldn't fix.
Midnight Star
4.8K Posts
0
March 18th, 2005 05:00
Hello! and welcome to the Dell forums.
Download L2mfix from one of these two locations:
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
Go to www.trendmicro.com, and then:
1. Click " Free Online Scan".
2. Click " Scan now, it's free".
It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:
1. Select all available drives.
2. Check(tick) " Auto Clean".
3. Click " Scan".
When it completes, post back the full filename of any files that cannot be cleaned or deleted.
Run HiJackThis and click " Scan", then check(tick) the following, if present:
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O4 - HKLM\..\Run: [nsvcin] C:\WINDOWS\system32\n20050308.exe
O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\gpjml3111.dll
Now, with all windows closed except HiJackThis, click " Fix checked".
Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
files...
C:\WINDOWS\system32\n20050308.exe
C:\WINDOWS\system32\gpjml3111.dll
-
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".
Post back a new log, and let me know how everything goes.
-
Mike.
Brad1981
17 Posts
0
March 18th, 2005 06:00
Midnight Star
4.8K Posts
0
March 18th, 2005 12:00
That's ok, just break it down into multiple posts if you can.
-
Mike.
Brad1981
17 Posts
0
March 18th, 2005 16:00
Brad1981
17 Posts
0
March 18th, 2005 16:00
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\gpjml3111.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
useragent:
Windows Registry Editor Version 5.00
"{1A44FB55-CCD7-7115-3839-37F2CFFB6701}"=""
Shell Extension key:
Windows Registry Editor Version 5.00
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
Brad1981
17 Posts
0
March 18th, 2005 16:00
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}"="RecordNow! SendToExt"
"{5CA3D70E-1895-11CF-8E15-001234567890}"="DriveLetterAccess"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{615D2D5E-D7CF-45F4-9273-6C91A6D856CA}"=""
"{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension"
"{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
"{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension"
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
@=""
@=""
@=""
@="C:\\WINDOWS\\system32\\mec42.dll"
"ThreadingModel"="Apartment"
Files Found are not all bad files:
azicap32.dll Tue Mar 15 2005 3:11:08p ..S.R 235,288 229.77 K
browseui.dll Thu Jan 27 2005 12:13:16p A.... 1,016,832 993.00 K
cdfview.dll Thu Jan 27 2005 12:13:16p A.... 151,040 147.50 K
gp8ol3~1.dll Wed Mar 16 2005 3:36:30p ..S.R 233,439 227.96 K
gpjml3~1.dll Thu Mar 17 2005 8:58:16p ..S.R 233,807 228.32 K
gwfspi~1.dll Fri Jan 28 2005 3:37:58p A.... 23,304 22.76 K
hr8q05~1.dll Mon Mar 14 2005 8:17:38p ..S.R 232,834 227.38 K
hrr605~1.dll Thu Mar 17 2005 9:06:26p ..S.R 234,502 229.00 K
hxpertrm.dll Tue Mar 15 2005 1:39:22p ..S.R 234,068 228.58 K
iepeers.dll Thu Jan 27 2005 12:13:16p A.... 249,856 244.00 K
inseng.dll Thu Jan 27 2005 12:13:16p A.... 96,256 94.00 K
irlql5~1.dll Tue Mar 15 2005 4:09:50a ..S.R 235,278 229.76 K
j06m0a~1.dll Mon Mar 14 2005 2:55:06p ..S.R 232,896 227.44 K
jtjm07~1.dll Tue Mar 15 2005 3:25:18a ..S.R 234,068 228.58 K
jtn207~1.dll Thu Mar 17 2005 8:06:38p ..S.R 232,440 226.99 K
k0js0a~1.dll Thu Mar 17 2005 8:32:16p ..S.R 233,404 227.93 K
ktp4l7~1.dll Tue Mar 15 2005 9:04:22p ..S.R 234,674 229.17 K
l08mla~1.dll Mon Mar 14 2005 2:27:56p ..S.R 233,916 228.43 K
legitc~1.dll Fri Jan 28 2005 3:38:00p A.... 421,128 411.26 K
lv2m09~1.dll Wed Mar 16 2005 9:17:42p ..S.R 233,502 228.03 K
mdrd3x40.dll Mon Mar 14 2005 11:07:36p ..S.R 234,068 228.58 K
mec42.dll Thu Mar 17 2005 9:06:26p ..S.R 233,807 228.32 K
mshtml.dll Thu Jan 27 2005 12:13:18p A.... 3,006,976 2.87 M
ole32.dll Fri Jan 14 2005 3:55:50a A.... 1,285,120 1.22 M
olecli32.dll Fri Jan 14 2005 3:55:50a A.... 74,752 73.00 K
olecnv32.dll Fri Jan 14 2005 3:55:50a A.... 37,888 37.00 K
p2n8lc~1.dll Tue Mar 15 2005 2:56:28p ..S.R 233,248 227.78 K
r6r6lg~1.dll Thu Mar 17 2005 2:16:14a ..S.R 233,072 227.61 K
rpcss.dll Fri Jan 14 2005 3:55:50a A.... 395,776 386.50 K
shdocvw.dll Thu Jan 27 2005 12:13:18p A.... 1,483,264 1.41 M
shell32.dll Tue Dec 21 2004 3:49:36p A.... 8,450,048 8.06 M
shlwapi.dll Thu Jan 27 2005 12:13:18p A.... 473,600 462.50 K
sintf16.dll Sat Mar 12 2005 5:22:56p A.... 12,067 11.78 K
sintf32.dll Sat Mar 12 2005 5:22:56p A.... 17,212 16.81 K
sintfnt.dll Sat Mar 12 2005 5:22:56p A.... 21,840 21.33 K
tyrmmgr.dll Wed Mar 16 2005 12:07:52p ..S.R 233,373 227.90 K
urlmon.dll Thu Jan 27 2005 12:13:18p A.... 607,744 593.50 K
uxtheme.dll Wed Mar 16 2005 1:59:40a A.... 218,624 213.50 K
wininet.dll Thu Jan 27 2005 12:13:18p A.... 656,896 641.50 K
Total of file sizes: 23,141,907 bytes 22.07 M
Locate .tmp files:
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 6CA9-DAC8
03/17/2005 09:06 PM 234,502 hrr6059se.dll
03/17/2005 08:58 PM 233,807 gpjml3111.dll
03/17/2005 08:32 PM 233,404 k0js0a17ed.dll
03/17/2005 08:06 PM 232,440 jtn2075oe.dll
03/17/2005 02:16 AM 233,072 r6r6lg9s16.dll
03/16/2005 09:17 PM 233,502 lv2m09f1e.dll
03/16/2005 03:36 PM 233,439 gp8ol3l31.dll
03/16/2005 12:07 PM 233,373 tyrmmgr.dll
03/16/2005 01:59 AM dllcache
03/15/2005 09:04 PM 234,674 ktp4l77q1.dll
03/15/2005 03:11 PM 235,288 azicap32.dll
03/15/2005 02:56 PM 233,248 p2n8lc5u1f.dll
03/15/2005 01:39 PM 234,068 hxpertrm.dll
03/15/2005 04:09 AM 235,278 irlql5351.dll
03/15/2005 03:25 AM 234,068 jtjm0711e.dll
03/14/2005 11:07 PM 234,068 mdrd3x40.dll
03/14/2005 08:17 PM 232,834 hr8q05l5e.dll
03/14/2005 02:55 PM 232,896 j06m0aj1edo.dll
03/14/2005 02:27 PM 233,916 l08mlal11dq.dll
08/10/2004 02:08 PM Microsoft
19 File(s) 4,441,684 bytes
2 Dir(s) 26,685,599,744 bytes free
Brad1981
17 Posts
0
March 18th, 2005 21:00
Copyright (c) 1999-2001 Frank Heyne Software ( http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!
Registry permissions set too:
Copyright (c) 1999-2001 Frank Heyne Software ( http://www.heysoft.de)
This program is Freeware, use it on your own risk!
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
deleting local copy: azicap32.dll
deleting local copy: en44l1hq1.dll
deleting local copy: gp8ol3l31.dll
deleting local copy: hr8q05l5e.dll
deleting local copy: hxpertrm.dll
deleting local copy: irlql5351.dll
deleting local copy: j06m0aj1edo.dll
deleting local copy: jtjm0711e.dll
deleting local copy: jtn2075oe.dll
deleting local copy: k0js0a17ed.dll
deleting local copy: ktp4l77q1.dll
deleting local copy: l08mlal11dq.dll
deleting local copy: lv2m09f1e.dll
deleting local copy: mdrd3x40.dll
deleting local copy: p2n8lc5u1f.dll
deleting local copy: r26ulcj91fo.dll
deleting local copy: r6r6lg9s16.dll
deleting local copy: szclient.dll
deleting local copy: tyrmmgr.dll
deleting local copy: wahisn.dll
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
@=""
"DLLName"="igfxsrvc.dll"
"Asynchronous"=dword:00000001
"Impersonate"=dword:00000001
"Unlock"="WinlogonUnlockEvent"
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
The following are the files found:
****************************************************************************
C:\WINDOWS\system32\azicap32.dll
C:\WINDOWS\system32\en44l1hq1.dll
C:\WINDOWS\system32\gp8ol3l31.dll
C:\WINDOWS\system32\hr8q05l5e.dll
C:\WINDOWS\system32\hxpertrm.dll
C:\WINDOWS\system32\irlql5351.dll
C:\WINDOWS\system32\j06m0aj1edo.dll
C:\WINDOWS\system32\jtjm0711e.dll
C:\WINDOWS\system32\jtn2075oe.dll
C:\WINDOWS\system32\k0js0a17ed.dll
C:\WINDOWS\system32\ktp4l77q1.dll
C:\WINDOWS\system32\l08mlal11dq.dll
C:\WINDOWS\system32\lv2m09f1e.dll
C:\WINDOWS\system32\mdrd3x40.dll
C:\WINDOWS\system32\p2n8lc5u1f.dll
C:\WINDOWS\system32\r26ulcj91fo.dll
C:\WINDOWS\system32\r6r6lg9s16.dll
C:\WINDOWS\system32\szclient.dll
C:\WINDOWS\system32\tyrmmgr.dll
C:\WINDOWS\system32\wahisn.dll
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
"{615D2D5E-D7CF-45F4-9273-6C91A6D856CA}"=-
[-HKEY_CLASSES_ROOT\CLSID\{615D2D5E-D7CF-45F4-9273-6C91A6D856CA}]
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Brad1981
17 Posts
0
March 18th, 2005 21:00
Running From:
C:\Documents and Settings\Brad Hoskinson\Desktop\deleat when done with\l2mfix
Copyright (c) 1999-2001 Frank Heyne Software ( http://www.heysoft.de)
This program is Freeware, use it on your own risk!
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting registry permissions:
Copyright (c) 1999-2001 Frank Heyne Software ( http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry
Registry Permissions set too:
Copyright (c) 1999-2001 Frank Heyne Software ( http://www.heysoft.de)
This program is Freeware, use it on your own risk!
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\Brad Hoskinson\Desktop\deleat when done with\l2mfix
System Rebooted!
Running From:
C:\Documents and Settings\Brad Hoskinson\Desktop\deleat when done with\l2mfix
killing explorer and rundll32.exe
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1492 'explorer.exe'
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1596 'rundll32.exe'
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Backing Up: C:\WINDOWS\system32\azicap32.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\en44l1hq1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\gp8ol3l31.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hr8q05l5e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\hxpertrm.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\irlql5351.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\j06m0aj1edo.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jtjm0711e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\jtn2075oe.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\k0js0a17ed.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ktp4l77q1.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\l08mlal11dq.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\lv2m09f1e.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\mdrd3x40.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\p2n8lc5u1f.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\r26ulcj91fo.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\r6r6lg9s16.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\szclient.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\tyrmmgr.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\wahisn.dll
1 file(s) copied.
deleting: C:\WINDOWS\system32\azicap32.dll
Successfully Deleted: C:\WINDOWS\system32\azicap32.dll
deleting: C:\WINDOWS\system32\en44l1hq1.dll
Successfully Deleted: C:\WINDOWS\system32\en44l1hq1.dll
deleting: C:\WINDOWS\system32\gp8ol3l31.dll
Successfully Deleted: C:\WINDOWS\system32\gp8ol3l31.dll
deleting: C:\WINDOWS\system32\hr8q05l5e.dll
Successfully Deleted: C:\WINDOWS\system32\hr8q05l5e.dll
deleting: C:\WINDOWS\system32\hxpertrm.dll
Successfully Deleted: C:\WINDOWS\system32\hxpertrm.dll
deleting: C:\WINDOWS\system32\irlql5351.dll
Successfully Deleted: C:\WINDOWS\system32\irlql5351.dll
deleting: C:\WINDOWS\system32\j06m0aj1edo.dll
Successfully Deleted: C:\WINDOWS\system32\j06m0aj1edo.dll
deleting: C:\WINDOWS\system32\jtjm0711e.dll
Successfully Deleted: C:\WINDOWS\system32\jtjm0711e.dll
deleting: C:\WINDOWS\system32\jtn2075oe.dll
Successfully Deleted: C:\WINDOWS\system32\jtn2075oe.dll
deleting: C:\WINDOWS\system32\k0js0a17ed.dll
Successfully Deleted: C:\WINDOWS\system32\k0js0a17ed.dll
deleting: C:\WINDOWS\system32\ktp4l77q1.dll
Successfully Deleted: C:\WINDOWS\system32\ktp4l77q1.dll
deleting: C:\WINDOWS\system32\l08mlal11dq.dll
Successfully Deleted: C:\WINDOWS\system32\l08mlal11dq.dll
deleting: C:\WINDOWS\system32\lv2m09f1e.dll
Successfully Deleted: C:\WINDOWS\system32\lv2m09f1e.dll
deleting: C:\WINDOWS\system32\mdrd3x40.dll
Successfully Deleted: C:\WINDOWS\system32\mdrd3x40.dll
deleting: C:\WINDOWS\system32\p2n8lc5u1f.dll
Successfully Deleted: C:\WINDOWS\system32\p2n8lc5u1f.dll
deleting: C:\WINDOWS\system32\r26ulcj91fo.dll
Successfully Deleted: C:\WINDOWS\system32\r26ulcj91fo.dll
deleting: C:\WINDOWS\system32\r6r6lg9s16.dll
Successfully Deleted: C:\WINDOWS\system32\r6r6lg9s16.dll
deleting: C:\WINDOWS\system32\szclient.dll
Successfully Deleted: C:\WINDOWS\system32\szclient.dll
deleting: C:\WINDOWS\system32\tyrmmgr.dll
Successfully Deleted: C:\WINDOWS\system32\tyrmmgr.dll
deleting: C:\WINDOWS\system32\wahisn.dll
Successfully Deleted: C:\WINDOWS\system32\wahisn.dll
Zipping up files for submission:
adding: azicap32.dll (164 bytes security) (deflated 5%)
adding: en44l1hq1.dll (164 bytes security) (deflated 6%)
adding: gp8ol3l31.dll (164 bytes security) (deflated 4%)
adding: hr8q05l5e.dll (164 bytes security) (deflated 4%)
adding: hxpertrm.dll (164 bytes security) (deflated 5%)
adding: irlql5351.dll (164 bytes security) (deflated 5%)
adding: j06m0aj1edo.dll (164 bytes security) (deflated 4%)
adding: jtjm0711e.dll (164 bytes security) (deflated 5%)
adding: jtn2075oe.dll (164 bytes security) (deflated 4%)
adding: k0js0a17ed.dll (164 bytes security) (deflated 5%)
adding: ktp4l77q1.dll (164 bytes security) (deflated 5%)
adding: l08mlal11dq.dll (164 bytes security) (deflated 5%)
adding: lv2m09f1e.dll (164 bytes security) (deflated 4%)
adding: mdrd3x40.dll (164 bytes security) (deflated 5%)
adding: p2n8lc5u1f.dll (164 bytes security) (deflated 4%)
adding: r26ulcj91fo.dll (164 bytes security) (deflated 5%)
adding: r6r6lg9s16.dll (164 bytes security) (deflated 4%)
adding: szclient.dll (164 bytes security) (deflated 5%)
adding: tyrmmgr.dll (164 bytes security) (deflated 4%)
adding: wahisn.dll (164 bytes security) (deflated 5%)
adding: clear.reg (164 bytes security) (deflated 22%)
adding: echo.reg (164 bytes security) (deflated 13%)
adding: direct.txt (164 bytes security) (deflated 3%)
adding: lo2.txt (164 bytes security) (deflated 83%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: report.txt (164 bytes security) (deflated 66%)
adding: test.txt (164 bytes security) (deflated 77%)
adding: test2.txt (164 bytes security) (stored 0%)
adding: test3.txt (164 bytes security) (stored 0%)
adding: test5.txt (164 bytes security) (stored 0%)
adding: xfind.txt (164 bytes security) (deflated 71%)
adding: backregs/615D2D5E-D7CF-45F4-9273-6C91A6D856CA.reg (164 bytes security) (deflated 70%)
adding: backregs/shell.reg (164 bytes security) (deflated 74%)
Restoring Registry Permissions:
Midnight Star
4.8K Posts
0
March 18th, 2005 21:00
It does it to me all the time too ... ;)
-
Let's take the next step...
Close any programs you have open since this step requires a reboot.
-
From the l2mfix folder on your desktop, double click l2mfix.bat and select option # 2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
Run HiJackThis and click " Scan", then check(tick) the following, if present:
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
Now, with all windows closed except HiJackThis, click " Fix checked".
Post back a new log, and let me know how everything goes.
-
Mike.
Brad1981
17 Posts
0
March 18th, 2005 22:00
File C:\WINDOWS\icont.exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\woinstall.exe infected by "not-a-virus:AdWare.EZula.ak" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\Temp\bw2.com infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\4TQBKTI7\AppWrap[1].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\4TQBKTI7\AppWrap[2].exe infected by "not-a-virus:AdWare.Zestyfind" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\I3WDUV87\AppWrap[1].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OT6FW96F\AppWrap[1].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OT6FW96F\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OT6FW96F\AppWrap[3].exe infected by "not-a-virus:AdWare.AdURL.c" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OT6FW96F\upd202[1].exe infected by "not-a-virus:AdWare.Look2Me.ab" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OTAJGXAF\AppWrap[1].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OTAJGXAF\AppWrap[2].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OTAJGXAF\AppWrap[3].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OTAJGXAF\AppWrap[4].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
File C:\DOCUME~1\BRADHO~1\LOCALS~1\TEMPOR~1\Content.IE5\OTAJGXAF\AppWrap[5].exe infected by "Trojan-Downloader.Win32.Small.ru" Virus. Action Taken: No Action Taken.
Brad1981
17 Posts
0
March 18th, 2005 22:00
Scan saved at 7:00:24 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Avant Browser\avant.exe
C:\Documents and Settings\Brad Hoskinson\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4443/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
Midnight Star
4.8K Posts
0
March 18th, 2005 22:00
Let's delete these files, then post back just one more HiJackThis log; if we're still in the 'green', we'll just need to do the final cleanup, and you should be good to go.
Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
files...
C:\WINDOWS\icont.exe
C:\WINDOWS\woinstall.exe
-
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're ' in use', try deleting them from " Safe Mode".
Mike.
Brad1981
17 Posts
0
March 18th, 2005 22:00
Scan saved at 7:49:51 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Avant Browser\avant.exe
C:\DOCUME~1\BRADHO~1\LOCALS~1\Temp\mwavscan.com
C:\DOCUME~1\BRADHO~1\LOCALS~1\Temp\kavss.exe
C:\Documents and Settings\Brad Hoskinson\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4443/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
Midnight Star
4.8K Posts
0
March 18th, 2005 22:00
That log is looking just fine - great job!.
-
Let's see the results from just one more scan to see if there anything else on your system that we need to remove:
Download mwav.exe from MicroWorld, then:
1. Double-click the mwav.exe icon to run it ( it'll self extract).
2. Click " Scan".
3. When it completes, post back the results from the 'Virus log information' pane.
Mike.
Midnight Star
4.8K Posts
0
March 18th, 2005 23:00
Let's delete this one item; If it causes a problem, just restore it back. Other than that, everything is looking ok to me ... :)
Run HiJackThis and click " Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
Now, with all windows closed except HiJackThis, click " Fix checked".
================================
Here's how to restore it back...
================================
Run HiJackThis, then:
1. Click " Config..."
2. Click " Backups"
3. Check( tick) the entry(s) your wanting to restore.
4. Click " Restore".
It's a good idea to idea to reboot your system and check to see if the problem has been resolved. If not, post back with any new problems or concerns you may be having.
Reboot your computer, and try using different programs and make sure everything is running ok. If your still experiencing problems, post back any concerns or problems you may be having and wait for any advice before continuing with the cleanup.
Download, install and run Cleanup! from Steven Gould, then:
1. Click " Cleanup!"
( wait for the program to finish scanning your system, and selecting files to be removed.)
2. Exit the program and reboot the computer, if necessary.
-
For more information about using Cleanup! see here.
If everything is running ok, let's do the final cleanup...
1. Run " Disk Cleanup" and allow it to remove everything it finds.
2. If you've downloaded MicroWorld AV ( MWAV), run it again - but don't scan, just click " Clear Log" and exit the program.
3. Go to www.trendmicro.com and click " Free Online Scan", then " Scan now, it's free!". When it's downloaded, select all available drives, then check(tick) " Auto clean", then click " Scan".
4. Run AdAware SE Personal and " perform a full system scan", then Spybot S&D, and " Check for Problems". Let them both remove the residual 'problems' left that HiJackThis couldn't fix.
5. Disable, then re-enable system restore; with a reboot in-between. Then immediately create a new system point manually.
If your having any more problems, post back.
-
Happy surfing,
Mike.