Solved: Pop-ups/Ad-ware removall HELP!

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
Hi all! Just wondered if anyone has got any ideas how to get shot of the pop ups im getting. Ive run: Spy bot search and destroy, Microsoft anti-spyware, Spyware Doctor, Spyware blaster, Ad-aware 6, AVG Virus scan, Trend micro online scan, Registry Mechanic. These got rid of alot of spyware and a few viruses, but i cant get rid of all my problems. Which consist of pop ups, which try to connect to the internet if im offline and they can also put shortcuts on my desktop and of course pop up all the time when im browsing. None of the above programs show any problems so i am at a loss at the mo!

Cheers Azazel.
 
Joined
Sep 7, 2004
Messages
49,014
Adaware 6 is out of date

Get all of these and/or verify you have the current versions

SpywareBlaster 3.5 http://majorgeeks.com/download2859.html
SpyBot V1.4 http://www.majorgeeks.com/download2471.html
AdAware SE 1.06 http://www.majorgeeks.com/download506.html
MS AntiSpy - http://www.microsoft.com/downloads/...a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en (XP and W2K only)

DownLoad them (they are free), install them, check each for their
definition updates
and then run AdAware, MS AntiSpy (W2k/XP) and Spybot, fixing anything
they say.

In SpywareBlaster - Always enable all protection after updates
In SpyBot - After an update run immunize

Do these and reboot before the next step.



Get HiJack This V1.99.1 http://thespykiller.co.uk/files/hijackthis_sfx.exe - double click the DL file and click UNZIP letting it extract to its default folder C:\Program FIles\HiJackThis, run it from there, DO NOT fix anything, post the log here.
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
Ok heres the log file! Cheers!


Logfile of HijackThis v1.99.1
Scan saved at 23:42:32, on 16/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Program Files\New Folder\iTouch\iTouch.exe
C:\WINDOWS\system32\rundll32.exe
G:\Program Files\New Folder\MouseWare\system\em_exec.exe
C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
G:\Program Files\Microsoft Anti Spyware\gcasServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\Spyware Doctor\swdoctor.exe
G:\Program Files\Microsoft Anti Spyware\gcasDtServ.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.btopenworld.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.co.uk/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
F2 - REG:system.ini: Shell=
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] G:\Program Files\New Folder\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "G:\Program Files\Microsoft Anti Spyware\gcasServ.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [Spyware Doctor] "G:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\Realdownload.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - G:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.btopenworld.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{98FD5000-5E24-429C-8900-6855F4FDCA97}: NameServer = 194.72.0.98 194.72.9.38
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\gpn8l35u1.dll
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
 
Joined
Sep 7, 2004
Messages
49,014
Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

* Note: If you receive an error while running option #1 like: ''C:\windows\system32\cmd.exe
C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications, choose close to terminate the application.."...then do one of the following:

1: Click on the l2mfix.bat again and choose option # 5 for Fix Autoexec.nt/cmd.exe error.
2: Alternatively, you can click the fixautont.html link in the l2mfix folder and follow the directions there to fix it manually.
Do not run the fix portion without fixing the error first.
After you have performed the procedures to fix the error, repeat the steps above to run option #1 for Run Find Log.
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
Here it is! Cheers! Azazel.

L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RunOnce]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\jt6u07j9e.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Zboard]
"DllName"="Winlognotif.dll"
"Impersonate"=dword:00000000
"Logoff"="WLEventLogoff"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C365CA48-8D1A-9D42-D240-6BE65793F139}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
@=""
"{6af09ec9-b429-11d4-a1fb-0090960218cb}"="My Bluetooth Places"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}"=""
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{EC694DD9-E078-462A-921B-EDF562497B1A}"=""
"{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}"=""
"{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}"=""
"{526B5021-8910-4E6B-8298-015038A55F1E}"=""
"{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}"=""
"{FC69808F-CC76-4D6F-8EFF-AF9221352623}"=""
"{03BB691A-1011-4FA1-9E61-4213353C257D}"=""
"{8D4B107A-9EEA-4118-A264-25F2CA71D80E}"=""
"{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}"=""
"{8340DDA6-3446-478D-B5C5-99060A87AB68}"=""
"{9E71CE45-934A-4293-876F-438BDFB6837D}"=""
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}\InprocServer32]
@="C:\\WINDOWS\\system32\\ntobjapi.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}\InprocServer32]
@="C:\\WINDOWS\\system32\\kwdic.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}\InprocServer32]
@="C:\\WINDOWS\\system32\\dfound3d.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}\InprocServer32]
@="C:\\WINDOWS\\system32\\mtcpxl32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}\InprocServer32]
@="C:\\WINDOWS\\system32\\veoy.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}\InprocServer32]
@="C:\\WINDOWS\\system32\\dgdiagn.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}\InprocServer32]
@="blank"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}\InprocServer32]
@="C:\\WINDOWS\\system32\\whnhttp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}\InprocServer32]
@="C:\\WINDOWS\\system32\\bvowseui.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}\InprocServer32]
@="C:\\WINDOWS\\system32\\aicups.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}\InprocServer32]
@="C:\\WINDOWS\\system32\\lscwmi.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}\InprocServer32]
@="C:\\WINDOWS\\system32\\wispdmod.dll"
"ThreadingModel"="Apartment"

**********************************************************************************
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
And some more!

Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
acivvaxx.dll Sat 14 Jan 2006 16:59:02 ..S.R 235,849 230.32 K
aicups.dll Tue 17 Jan 2006 17:28:44 ..S.R 236,463 230.92 K
ati2cqag.dll Sat 29 Oct 2005 2:16:02 A.... 237,568 232.00 K
ati2dvag.dll Sat 29 Oct 2005 3:12:48 A.... 247,296 241.50 K
ati2edxx.dll Sat 29 Oct 2005 3:07:36 A.... 40,960 40.00 K
ati2evxx.dll Sat 29 Oct 2005 3:07:28 A.... 47,616 46.50 K
ati3duag.dll Sat 29 Oct 2005 2:58:48 A.... 2,491,808 2.38 M
atiddc.dll Sat 29 Oct 2005 3:06:00 A.... 53,248 52.00 K
atidemgr.dll Sat 29 Oct 2005 5:13:40 A.... 258,048 252.00 K
atiiiexx.dll Sat 29 Oct 2005 5:52:18 A.... 307,200 300.00 K
atikvmag.dll Sat 29 Oct 2005 2:40:32 A.... 151,552 148.00 K
atioglx1.dll Sat 29 Oct 2005 4:32:26 A.... 6,684,672 6.38 M
atioglxx.dll Sat 29 Oct 2005 3:27:22 A.... 4,866,048 4.64 M
atipdlxx.dll Sat 29 Oct 2005 3:08:00 A.... 110,592 108.00 K
atitvo32.dll Sat 29 Oct 2005 2:21:16 A.... 17,408 17.00 K
ativvaxx.dll Sat 29 Oct 2005 2:52:58 A.... 603,040 588.91 K
attapi.dll Sat 7 Jan 2006 17:17:16 ..S.R 236,696 231.15 K
bgdispl.dll Sun 8 Jan 2006 9:40:58 ..S.R 236,859 231.30 K
browseui.dll Thu 24 Nov 2005 1:06:34 A.... 1,022,464 998.50 K
bvowseui.dll Sat 14 Jan 2006 12:19:18 ..S.R 235,289 229.77 K
ccsetacl.dll Fri 6 Jan 2006 17:51:06 ..S.R 234,626 229.13 K
cdfview.dll Fri 21 Oct 2005 3:39:26 A.... 151,040 147.50 K
cptsrv.dll Fri 6 Jan 2006 23:25:32 ..S.R 236,343 230.80 K
cvedui.dll Sat 14 Jan 2006 17:20:04 ..S.R 235,534 230.01 K
danim.dll Sat 5 Nov 2005 3:16:24 A.... 1,054,208 1.00 M
dfmap.dll Sun 15 Jan 2006 22:09:24 ..S.R 233,643 228.16 K
dfound3d.dll Thu 12 Jan 2006 21:49:48 ..S.R 236,177 230.64 K
dgdiagn.dll Sat 14 Jan 2006 11:39:34 ..S.R 233,910 228.43 K
dmrgui.dll Mon 16 Jan 2006 10:49:58 ..S.R 235,685 230.16 K
dn4401~1.dll Sat 14 Jan 2006 9:28:54 ..S.R 234,351 228.86 K
dxtrans.dll Fri 21 Oct 2005 3:39:28 A.... 205,312 200.50 K
esent.dll Thu 20 Oct 2005 22:20:04 A.... 1,082,368 1.03 M
extmgr.dll Fri 21 Oct 2005 3:39:28 ..... 55,808 54.50 K
f6l02g~1.dll Sat 14 Jan 2006 9:57:38 ..S.R 235,946 230.41 K
f8l00i~1.dll Mon 16 Jan 2006 23:55:24 ..S.R 235,496 229.98 K
fpj803~1.dll Sat 14 Jan 2006 9:20:16 ..S.R 233,654 228.18 K
fpl003~1.dll Sat 14 Jan 2006 9:22:24 ..S.R 237,006 231.45 K
gccoll~1.dll Tue 15 Nov 2005 12:12:08 A.... 126,680 123.71 K
gcunco~1.dll Tue 15 Nov 2005 12:12:06 A.... 95,448 93.21 K
gdi32.dll Thu 29 Dec 2005 2:54:36 A.... 280,064 273.50 K
gvkcsp.dll Sat 14 Jan 2006 17:14:50 ..S.R 235,534 230.01 K
hashlib.dll Tue 15 Nov 2005 12:12:08 A.... 117,976 115.21 K
hr0o05~1.dll Sat 14 Jan 2006 18:11:34 ..S.R 234,283 228.79 K
iepeers.dll Fri 21 Oct 2005 3:39:28 A.... 251,392 245.50 K
inseng.dll Fri 21 Oct 2005 3:39:28 A.... 96,256 94.00 K
ir4sl5~1.dll Fri 13 Jan 2006 20:54:00 ..S.R 236,159 230.62 K
ir64l5~1.dll Fri 13 Jan 2006 21:41:20 ..S.R 237,275 231.71 K
ititpki.dll Sun 15 Jan 2006 16:42:36 ..S.R 234,283 228.79 K
j0n2la~1.dll Sat 14 Jan 2006 11:48:34 ..S.R 233,910 228.43 K
jibexec.dll Fri 13 Jan 2006 23:44:00 ..S.R 237,006 231.45 K
jt0o07~1.dll Sat 14 Jan 2006 15:58:54 ..S.R 233,772 228.29 K
jt6u07~1.dll Mon 16 Jan 2006 23:38:24 ..S.R 236,463 230.92 K
k026la~1.dll Sat 7 Jan 2006 10:13:56 ..S.R 236,371 230.83 K
kwdfi1.dll Sat 14 Jan 2006 18:03:00 ..S.R 233,993 228.51 K
kwdic.dll Sat 7 Jan 2006 17:39:16 ..S.R 236,859 231.30 K
kydsmsno.dll Sat 14 Jan 2006 17:43:30 ..S.R 235,105 229.59 K
lscwmi.dll Sat 14 Jan 2006 17:01:46 ..S.R 234,039 228.55 K
lvr009~1.dll Fri 13 Jan 2006 21:06:20 ..S.R 235,909 230.38 K
m8juli~1.dll Sat 14 Jan 2006 17:14:50 ..S.R 234,207 228.71 K
mfimon.dll Fri 13 Jan 2006 23:17:56 ..S.R 235,810 230.28 K
miaatext.dll Fri 13 Jan 2006 21:37:40 ..S.R 235,810 230.28 K
mpcpxl32.dll Mon 16 Jan 2006 21:00:00 ..S.R 233,643 228.16 K
mpoeacct.dll Sat 14 Jan 2006 17:10:00 ..S.R 234,039 228.55 K
msc71enu.dll Sat 14 Jan 2006 9:20:16 ..S.R 237,006 231.45 K
mshtml.dll Thu 24 Nov 2005 1:06:34 A.... 3,015,680 2.88 M
mshtmled.dll Fri 21 Oct 2005 3:39:30 A.... 448,512 438.00 K
msrating.dll Fri 21 Oct 2005 3:39:30 A.... 146,432 143.00 K
mstime.dll Fri 21 Oct 2005 3:39:30 A.... 530,944 518.50 K
mtcpxl32.dll Fri 13 Jan 2006 17:29:20 ..S.R 236,246 230.71 K
mv2sl9~1.dll Sun 8 Jan 2006 19:39:48 ..S.R 234,112 228.63 K
mzdtcprx.dll Thu 12 Jan 2006 17:44:56 ..S.R 233,798 228.32 K
n2r20c~1.dll Sat 14 Jan 2006 17:32:04 ..S.R 233,733 228.25 K
n82uli~1.dll Fri 13 Jan 2006 21:37:38 ..S.R 234,212 228.72 K
ntobjapi.dll Sat 14 Jan 2006 9:21:22 ..S.R 237,006 231.45 K
oemdspif.dll Sat 29 Oct 2005 3:07:50 A.... 77,824 76.00 K
p4r4le~1.dll Fri 13 Jan 2006 23:26:56 ..S.R 235,810 230.28 K
pcd.dll Sat 14 Jan 2006 9:28:54 ..S.R 233,910 228.43 K
pngfilt.dll Fri 21 Oct 2005 3:39:30 A.... 39,424 38.50 K
pvpnetsh.dll Fri 6 Jan 2006 18:37:08 ..S.R 234,626 229.13 K
qzvd.dll Sat 14 Jan 2006 16:56:52 ..S.R 234,039 228.55 K
s488le~1.dll Thu 12 Jan 2006 20:16:24 ..S.R 236,863 231.31 K
safolder.dll Sat 14 Jan 2006 16:10:30 ..S.R 233,465 227.99 K
sbrio600.dll Fri 6 Jan 2006 23:43:30 ..S.R 236,371 230.83 K
shdocvw.dll Thu 1 Dec 2005 3:59:30 A.... 1,492,480 1.42 M
shlwapi.dll Fri 21 Oct 2005 3:39:30 A.... 473,600 462.50 K
urlmon.dll Sat 5 Nov 2005 3:16:28 A.... 609,280 595.00 K
veoy.dll Fri 13 Jan 2006 19:45:52 ..S.R 235,810 230.28 K
visapi.dll Sat 14 Jan 2006 17:04:42 ..S.R 234,872 229.37 K
whnhttp.dll Sat 14 Jan 2006 11:51:04 ..S.R 235,289 229.77 K
wininet.dll Fri 21 Oct 2005 3:39:30 A.... 658,432 643.00 K
wispdmod.dll Sat 14 Jan 2006 17:25:48 ..S.R 236,530 230.98 K
wm2help.dll Sun 15 Jan 2006 17:51:22 ..S.R 236,636 231.09 K
wsvdmoe.dll Sat 14 Jan 2006 17:54:30 ..S.R 235,990 230.46 K
wswfaxui.dll Thu 12 Jan 2006 22:16:08 ..S.R 234,979 229.47 K
wzasf.dll Sat 14 Jan 2006 9:57:38 ..S.R 233,910 228.43 K
xwob2res.dll Sat 14 Jan 2006 9:24:04 ..S.R 233,910 228.43 K

96 items found: 96 files (60 H/S), 0 directories.
Total of file sizes: 42,265,800 bytes 40.30 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
atmtdd~1.tmp Sat 7 Jan 2006 15:35:08 A.... 0 0.00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 0 bytes 0.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 0CFA-7A5F

Directory of C:\WINDOWS\System32

17/01/2006 17:28 236,463 aicups.dll
16/01/2006 23:55 235,496 f8l00i3me8.dll
16/01/2006 23:38 236,463 jt6u07j9e.dll
16/01/2006 20:59 233,643 mpcpxl32.dll
16/01/2006 10:49 235,685 dmrgui.dll
15/01/2006 22:09 233,643 dfmap.dll
15/01/2006 17:51 236,636 wm2help.dll
15/01/2006 17:50 <DIR> dllcache
15/01/2006 16:42 234,283 ititpki.dll
14/01/2006 18:11 234,283 hr0o05d3e.dll
14/01/2006 18:02 233,993 kwdfi1.dll
14/01/2006 17:54 235,990 wsvdmoe.dll
14/01/2006 17:43 235,105 kydsmsno.dll
14/01/2006 17:32 233,733 n2r20c9oef.dll
14/01/2006 17:25 236,530 wispdmod.dll
14/01/2006 17:20 235,534 cvedui.dll
14/01/2006 17:14 235,534 gvkcsp.dll
14/01/2006 17:14 234,207 m8juli1918.dll
14/01/2006 17:09 234,039 mpoeacct.dll
14/01/2006 17:04 234,872 visapi.dll
14/01/2006 17:01 234,039 lscwmi.dll
14/01/2006 16:59 235,849 acivvaxx.dll
14/01/2006 16:56 234,039 qzvd.dll
14/01/2006 16:10 233,465 safolder.dll
14/01/2006 15:58 233,772 jt0o07d3e.dll
14/01/2006 12:19 235,289 bvowseui.dll
14/01/2006 11:51 235,289 whnhttp.dll
14/01/2006 11:48 233,910 j0n2la5o1d.dll
14/01/2006 11:39 233,910 dgdiagn.dll
14/01/2006 09:57 233,910 wzasf.dll
14/01/2006 09:57 235,946 f6l02g3mg6.dll
14/01/2006 09:28 233,910 pcd.dll
14/01/2006 09:28 234,351 dn4401hqe.dll
14/01/2006 09:24 233,910 xwob2res.dll
14/01/2006 09:22 237,006 fpl0033me.dll
14/01/2006 09:21 237,006 ntobjapi.dll
14/01/2006 09:20 237,006 MSC71ENU.DLL
14/01/2006 09:20 233,654 fpj8031ue.dll
13/01/2006 23:43 237,006 jibexec.dll
13/01/2006 23:26 235,810 p4r4le9q1h.dll
13/01/2006 23:17 235,810 mfimon.dll
13/01/2006 21:41 237,275 ir64l5jq1.dll
13/01/2006 21:37 235,810 miaatext.dll
13/01/2006 21:37 234,212 n82ulif9182.dll
13/01/2006 21:06 235,909 lvr0099me.dll
13/01/2006 20:53 236,159 ir4sl5h71.dll
13/01/2006 19:45 235,810 veoy.dll
13/01/2006 17:29 236,246 mtcpxl32.dll
12/01/2006 22:16 234,979 wswfaxui.dll
12/01/2006 21:49 236,177 dfound3d.dll
12/01/2006 20:16 236,863 s488lelu1hq8.dll
12/01/2006 17:44 233,798 mzdtcprx.dll
08/01/2006 19:39 234,112 mv2sl9f71.dll
08/01/2006 09:40 236,859 bgdispl.dll
07/01/2006 17:39 236,859 kwdic.dll
07/01/2006 17:17 236,696 attapi.dll
07/01/2006 10:13 236,371 k026lafs1d26.dll
06/01/2006 23:43 236,371 sbrio600.dll
06/01/2006 23:25 236,343 cPtsrv.dll
06/01/2006 18:37 234,626 pVpnetsh.dll
06/01/2006 17:51 234,626 ccsetacl.dll
24/09/2004 23:01 <DIR> Microsoft
60 File(s) 14,117,120 bytes
2 Dir(s) 1,961,529,344 bytes free
 
Joined
Sep 7, 2004
Messages
49,014
Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.


If after the reboot the desktop icons don’t disappear or the log does not pop up then in the l2mfix folder double click the second.bat file to continue with the fix.

IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
=========================
I suggest that after doing the above go back and run Opt 1 and then Opt 2 again to ensure we get them all

Then post a new HiJack log
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
L2mfix 010406
Creating Account.
The command completed successfully.

Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 508 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'
Killing PID 624 'winlogon.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1612 'explorer.exe'
Killing PID 1612 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 [email protected]
Killing PID 1364 'rundll32.exe'
Killing PID 236 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
1 file(s) copied.
Deleting: C:\WINDOWS\system32\acivvaxx.dll
Successfully Deleted: C:\WINDOWS\system32\acivvaxx.dll
Deleting: C:\WINDOWS\system32\attapi.dll
Successfully Deleted: C:\WINDOWS\system32\attapi.dll
Deleting: C:\WINDOWS\system32\bgdispl.dll
Successfully Deleted: C:\WINDOWS\system32\bgdispl.dll
Deleting: C:\WINDOWS\system32\bvowseui.dll
Successfully Deleted: C:\WINDOWS\system32\bvowseui.dll
Deleting: C:\WINDOWS\system32\ccsetacl.dll
Successfully Deleted: C:\WINDOWS\system32\ccsetacl.dll
Deleting: C:\WINDOWS\system32\cPtsrv.dll
Successfully Deleted: C:\WINDOWS\system32\cPtsrv.dll
Deleting: C:\WINDOWS\system32\cvedui.dll
Successfully Deleted: C:\WINDOWS\system32\cvedui.dll
Deleting: C:\WINDOWS\system32\dfmap.dll
Successfully Deleted: C:\WINDOWS\system32\dfmap.dll
Deleting: C:\WINDOWS\system32\dfound3d.dll
Successfully Deleted: C:\WINDOWS\system32\dfound3d.dll
Deleting: C:\WINDOWS\system32\dgdiagn.dll
Successfully Deleted: C:\WINDOWS\system32\dgdiagn.dll
Deleting: C:\WINDOWS\system32\dmrgui.dll
Successfully Deleted: C:\WINDOWS\system32\dmrgui.dll
Deleting: C:\WINDOWS\system32\dn4401hqe.dll
Successfully Deleted: C:\WINDOWS\system32\dn4401hqe.dll
Deleting: C:\WINDOWS\system32\en0ul1d91.dll
Successfully Deleted: C:\WINDOWS\system32\en0ul1d91.dll
Deleting: C:\WINDOWS\system32\f6l02g3mg6.dll
Successfully Deleted: C:\WINDOWS\system32\f6l02g3mg6.dll
Deleting: C:\WINDOWS\system32\f8l00i3me8.dll
Successfully Deleted: C:\WINDOWS\system32\f8l00i3me8.dll
Deleting: C:\WINDOWS\system32\fpj8031ue.dll
Successfully Deleted: C:\WINDOWS\system32\fpj8031ue.dll
Deleting: C:\WINDOWS\system32\fpl0033me.dll
Successfully Deleted: C:\WINDOWS\system32\fpl0033me.dll
Deleting: C:\WINDOWS\system32\gfmf32.dll
Successfully Deleted: C:\WINDOWS\system32\gfmf32.dll
Deleting: C:\WINDOWS\system32\gvkcsp.dll
Successfully Deleted: C:\WINDOWS\system32\gvkcsp.dll
Deleting: C:\WINDOWS\system32\hr0o05d3e.dll
Successfully Deleted: C:\WINDOWS\system32\hr0o05d3e.dll
Deleting: C:\WINDOWS\system32\ir4sl5h71.dll
Successfully Deleted: C:\WINDOWS\system32\ir4sl5h71.dll
Deleting: C:\WINDOWS\system32\ir64l5jq1.dll
Successfully Deleted: C:\WINDOWS\system32\ir64l5jq1.dll
Deleting: C:\WINDOWS\system32\ititpki.dll
Successfully Deleted: C:\WINDOWS\system32\ititpki.dll
Deleting: C:\WINDOWS\system32\j0n2la5o1d.dll
Successfully Deleted: C:\WINDOWS\system32\j0n2la5o1d.dll
Deleting: C:\WINDOWS\system32\jibexec.dll
Successfully Deleted: C:\WINDOWS\system32\jibexec.dll
Deleting: C:\WINDOWS\system32\jt0o07d3e.dll
Successfully Deleted: C:\WINDOWS\system32\jt0o07d3e.dll
Deleting: C:\WINDOWS\system32\jt6u07j9e.dll
Successfully Deleted: C:\WINDOWS\system32\jt6u07j9e.dll
Deleting: C:\WINDOWS\system32\k026lafs1d26.dll
Successfully Deleted: C:\WINDOWS\system32\k026lafs1d26.dll
Deleting: C:\WINDOWS\system32\kwdfi1.dll
Successfully Deleted: C:\WINDOWS\system32\kwdfi1.dll
Deleting: C:\WINDOWS\system32\kwdic.dll
Successfully Deleted: C:\WINDOWS\system32\kwdic.dll
Deleting: C:\WINDOWS\system32\kydsmsno.dll
Successfully Deleted: C:\WINDOWS\system32\kydsmsno.dll
Deleting: C:\WINDOWS\system32\lscwmi.dll
Successfully Deleted: C:\WINDOWS\system32\lscwmi.dll
Deleting: C:\WINDOWS\system32\lvr0099me.dll
Successfully Deleted: C:\WINDOWS\system32\lvr0099me.dll
Deleting: C:\WINDOWS\system32\m8juli1918.dll
Successfully Deleted: C:\WINDOWS\system32\m8juli1918.dll
Deleting: C:\WINDOWS\system32\mfimon.dll
Successfully Deleted: C:\WINDOWS\system32\mfimon.dll
Deleting: C:\WINDOWS\system32\miaatext.dll
Successfully Deleted: C:\WINDOWS\system32\miaatext.dll
Deleting: C:\WINDOWS\system32\mpcpxl32.dll
Successfully Deleted: C:\WINDOWS\system32\mpcpxl32.dll
Deleting: C:\WINDOWS\system32\mpoeacct.dll
Successfully Deleted: C:\WINDOWS\system32\mpoeacct.dll
Deleting: C:\WINDOWS\system32\MSC71ENU.DLL
Successfully Deleted: C:\WINDOWS\system32\MSC71ENU.DLL
Deleting: C:\WINDOWS\system32\mtcpxl32.dll
Successfully Deleted: C:\WINDOWS\system32\mtcpxl32.dll
Deleting: C:\WINDOWS\system32\mv2sl9f71.dll
Successfully Deleted: C:\WINDOWS\system32\mv2sl9f71.dll
Deleting: C:\WINDOWS\system32\mzdtcprx.dll
Successfully Deleted: C:\WINDOWS\system32\mzdtcprx.dll
Deleting: C:\WINDOWS\system32\n2r20c9oef.dll
Successfully Deleted: C:\WINDOWS\system32\n2r20c9oef.dll
Deleting: C:\WINDOWS\system32\n82ulif9182.dll
Successfully Deleted: C:\WINDOWS\system32\n82ulif9182.dll
Deleting: C:\WINDOWS\system32\ntobjapi.dll
Successfully Deleted: C:\WINDOWS\system32\ntobjapi.dll
Deleting: C:\WINDOWS\system32\p2n8lc5u1f.dll
Successfully Deleted: C:\WINDOWS\system32\p2n8lc5u1f.dll
Deleting: C:\WINDOWS\system32\p4r4le9q1h.dll
Successfully Deleted: C:\WINDOWS\system32\p4r4le9q1h.dll
Deleting: C:\WINDOWS\system32\pcd.dll
Successfully Deleted: C:\WINDOWS\system32\pcd.dll
Deleting: C:\WINDOWS\system32\pVpnetsh.dll
Successfully Deleted: C:\WINDOWS\system32\pVpnetsh.dll
Deleting: C:\WINDOWS\system32\qzvd.dll
Successfully Deleted: C:\WINDOWS\system32\qzvd.dll
Deleting: C:\WINDOWS\system32\s488lelu1hq8.dll
Successfully Deleted: C:\WINDOWS\system32\s488lelu1hq8.dll
Deleting: C:\WINDOWS\system32\safolder.dll
Successfully Deleted: C:\WINDOWS\system32\safolder.dll
Deleting: C:\WINDOWS\system32\sbrio600.dll
Successfully Deleted: C:\WINDOWS\system32\sbrio600.dll
Deleting: C:\WINDOWS\system32\veoy.dll
Successfully Deleted: C:\WINDOWS\system32\veoy.dll
Deleting: C:\WINDOWS\system32\visapi.dll
Successfully Deleted: C:\WINDOWS\system32\visapi.dll
Deleting: C:\WINDOWS\system32\whnhttp.dll
Successfully Deleted: C:\WINDOWS\system32\whnhttp.dll
Deleting: C:\WINDOWS\system32\wispdmod.dll
Successfully Deleted: C:\WINDOWS\system32\wispdmod.dll
Deleting: C:\WINDOWS\system32\wm2help.dll
Successfully Deleted: C:\WINDOWS\system32\wm2help.dll
Deleting: C:\WINDOWS\system32\wsvdmoe.dll
Successfully Deleted: C:\WINDOWS\system32\wsvdmoe.dll
Deleting: C:\WINDOWS\system32\wswfaxui.dll
Successfully Deleted: C:\WINDOWS\system32\wswfaxui.dll
Deleting: C:\WINDOWS\system32\wzasf.dll
Successfully Deleted: C:\WINDOWS\system32\wzasf.dll
Deleting: C:\WINDOWS\system32\xwob2res.dll
Successfully Deleted: C:\WINDOWS\system32\xwob2res.dll

msg11?.dll
0 file(s) copied.



Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reliability]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\jt6u07j9e.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Zboard]
"DllName"="Winlognotif.dll"
"Impersonate"=dword:00000000
"Logoff"="WLEventLogoff"


The following are the files found:
****************************************************************************
C:\WINDOWS\system32\acivvaxx.dll
C:\WINDOWS\system32\attapi.dll
C:\WINDOWS\system32\bgdispl.dll
C:\WINDOWS\system32\bvowseui.dll
C:\WINDOWS\system32\ccsetacl.dll
C:\WINDOWS\system32\cPtsrv.dll
C:\WINDOWS\system32\cvedui.dll
C:\WINDOWS\system32\dfmap.dll
C:\WINDOWS\system32\dfound3d.dll
C:\WINDOWS\system32\dgdiagn.dll
C:\WINDOWS\system32\dmrgui.dll
C:\WINDOWS\system32\dn4401hqe.dll
C:\WINDOWS\system32\en0ul1d91.dll
C:\WINDOWS\system32\f6l02g3mg6.dll
C:\WINDOWS\system32\f8l00i3me8.dll
C:\WINDOWS\system32\fpj8031ue.dll
C:\WINDOWS\system32\fpl0033me.dll
C:\WINDOWS\system32\gfmf32.dll
C:\WINDOWS\system32\gvkcsp.dll
C:\WINDOWS\system32\hr0o05d3e.dll
C:\WINDOWS\system32\ir4sl5h71.dll
C:\WINDOWS\system32\ir64l5jq1.dll
C:\WINDOWS\system32\ititpki.dll
C:\WINDOWS\system32\j0n2la5o1d.dll
C:\WINDOWS\system32\jibexec.dll
C:\WINDOWS\system32\jt0o07d3e.dll
C:\WINDOWS\system32\jt6u07j9e.dll
C:\WINDOWS\system32\k026lafs1d26.dll
C:\WINDOWS\system32\kwdfi1.dll
C:\WINDOWS\system32\kwdic.dll
C:\WINDOWS\system32\kydsmsno.dll
C:\WINDOWS\system32\lscwmi.dll
C:\WINDOWS\system32\lvr0099me.dll
C:\WINDOWS\system32\m8juli1918.dll
C:\WINDOWS\system32\mfimon.dll
C:\WINDOWS\system32\miaatext.dll
C:\WINDOWS\system32\mpcpxl32.dll
C:\WINDOWS\system32\mpoeacct.dll
C:\WINDOWS\system32\MSC71ENU.DLL
C:\WINDOWS\system32\mtcpxl32.dll
C:\WINDOWS\system32\mv2sl9f71.dll
C:\WINDOWS\system32\mzdtcprx.dll
C:\WINDOWS\system32\n2r20c9oef.dll
C:\WINDOWS\system32\n82ulif9182.dll
C:\WINDOWS\system32\ntobjapi.dll
C:\WINDOWS\system32\p2n8lc5u1f.dll
C:\WINDOWS\system32\p4r4le9q1h.dll
C:\WINDOWS\system32\pcd.dll
C:\WINDOWS\system32\pVpnetsh.dll
C:\WINDOWS\system32\qzvd.dll
C:\WINDOWS\system32\s488lelu1hq8.dll
C:\WINDOWS\system32\safolder.dll
C:\WINDOWS\system32\sbrio600.dll
C:\WINDOWS\system32\veoy.dll
C:\WINDOWS\system32\visapi.dll
C:\WINDOWS\system32\whnhttp.dll
C:\WINDOWS\system32\wispdmod.dll
C:\WINDOWS\system32\wm2help.dll
C:\WINDOWS\system32\wsvdmoe.dll
C:\WINDOWS\system32\wswfaxui.dll
C:\WINDOWS\system32\wzasf.dll
C:\WINDOWS\system32\xwob2res.dll

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}\InprocServer32]
@="C:\\WINDOWS\\system32\\ntobjapi.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}\InprocServer32]
@="C:\\WINDOWS\\system32\\kwdic.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}\InprocServer32]
@="C:\\WINDOWS\\system32\\dfound3d.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}\InprocServer32]
@="C:\\WINDOWS\\system32\\mtcpxl32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}\InprocServer32]
@="C:\\WINDOWS\\system32\\veoy.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}\InprocServer32]
@="C:\\WINDOWS\\system32\\dgdiagn.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}\InprocServer32]
@="blank"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}\InprocServer32]
@="C:\\WINDOWS\\system32\\whnhttp.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}\InprocServer32]
@="C:\\WINDOWS\\system32\\bvowseui.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}\InprocServer32]
@="C:\\WINDOWS\\system32\\gfmf32.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}\InprocServer32]
@="C:\\WINDOWS\\system32\\lscwmi.dll"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}\InprocServer32]
@="C:\\WINDOWS\\system32\\wispdmod.dll"
"ThreadingModel"="Apartment"

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}"=-
"{EC694DD9-E078-462A-921B-EDF562497B1A}"=-
"{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}"=-
"{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}"=-
"{526B5021-8910-4E6B-8298-015038A55F1E}"=-
"{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}"=-
"{FC69808F-CC76-4D6F-8EFF-AF9221352623}"=-
"{03BB691A-1011-4FA1-9E61-4213353C257D}"=-
"{8D4B107A-9EEA-4118-A264-25F2CA71D80E}"=-
"{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}"=-
"{8340DDA6-3446-478D-B5C5-99060A87AB68}"=-
"{9E71CE45-934A-4293-876F-438BDFB6837D}"=-
[-HKEY_CLASSES_ROOT\CLSID\{A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2}]
[-HKEY_CLASSES_ROOT\CLSID\{EC694DD9-E078-462A-921B-EDF562497B1A}]
[-HKEY_CLASSES_ROOT\CLSID\{B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C}]
[-HKEY_CLASSES_ROOT\CLSID\{290E0CC8-396D-4D25-AAEC-BDF46E75D29D}]
[-HKEY_CLASSES_ROOT\CLSID\{526B5021-8910-4E6B-8298-015038A55F1E}]
[-HKEY_CLASSES_ROOT\CLSID\{BEA0A227-97D6-4D41-90AA-2AAB4BF1656F}]
[-HKEY_CLASSES_ROOT\CLSID\{FC69808F-CC76-4D6F-8EFF-AF9221352623}]
[-HKEY_CLASSES_ROOT\CLSID\{03BB691A-1011-4FA1-9E61-4213353C257D}]
[-HKEY_CLASSES_ROOT\CLSID\{8D4B107A-9EEA-4118-A264-25F2CA71D80E}]
[-HKEY_CLASSES_ROOT\CLSID\{D4D75A52-0C38-42AB-9F6D-357F9ACC11EE}]
[-HKEY_CLASSES_ROOT\CLSID\{8340DDA6-3446-478D-B5C5-99060A87AB68}]
[-HKEY_CLASSES_ROOT\CLSID\{9E71CE45-934A-4293-876F-438BDFB6837D}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/acivvaxx.dll (164 bytes security) (deflated 5%)
adding: dlls/attapi.dll (164 bytes security) (deflated 5%)
adding: dlls/bgdispl.dll (164 bytes security) (deflated 5%)
adding: dlls/bvowseui.dll (164 bytes security) (deflated 5%)
adding: dlls/ccsetacl.dll (164 bytes security) (deflated 4%)
adding: dlls/cPtsrv.dll (164 bytes security) (deflated 5%)
adding: dlls/cvedui.dll (164 bytes security) (deflated 5%)
adding: dlls/dfmap.dll (164 bytes security) (deflated 4%)
adding: dlls/dfound3d.dll (164 bytes security) (deflated 5%)
adding: dlls/dgdiagn.dll (164 bytes security) (deflated 4%)
adding: dlls/dmrgui.dll (164 bytes security) (deflated 5%)
adding: dlls/dn4401hqe.dll (164 bytes security) (deflated 5%)
adding: dlls/en0ul1d91.dll (164 bytes security) (deflated 4%)
adding: dlls/f6l02g3mg6.dll (164 bytes security) (deflated 5%)
adding: dlls/f8l00i3me8.dll (164 bytes security) (deflated 5%)
adding: dlls/fpj8031ue.dll (164 bytes security) (deflated 4%)
adding: dlls/fpl0033me.dll (164 bytes security) (deflated 6%)
adding: dlls/gfmf32.dll (164 bytes security) (deflated 5%)
adding: dlls/gvkcsp.dll (164 bytes security) (deflated 5%)
adding: dlls/hr0o05d3e.dll (164 bytes security) (deflated 5%)
adding: dlls/ir4sl5h71.dll (164 bytes security) (deflated 5%)
adding: dlls/ir64l5jq1.dll (164 bytes security) (deflated 6%)
adding: dlls/ititpki.dll (164 bytes security) (deflated 5%)
adding: dlls/j0n2la5o1d.dll (164 bytes security) (deflated 4%)
adding: dlls/jibexec.dll (164 bytes security) (deflated 6%)
adding: dlls/jt0o07d3e.dll (164 bytes security) (deflated 4%)
adding: dlls/jt6u07j9e.dll (164 bytes security) (deflated 5%)
adding: dlls/k026lafs1d26.dll (164 bytes security) (deflated 5%)
adding: dlls/kwdfi1.dll (164 bytes security) (deflated 4%)
adding: dlls/kwdic.dll (164 bytes security) (deflated 5%)
adding: dlls/kydsmsno.dll (164 bytes security) (deflated 5%)
adding: dlls/lscwmi.dll (164 bytes security) (deflated 5%)
adding: dlls/lvr0099me.dll (164 bytes security) (deflated 5%)
adding: dlls/m8juli1918.dll (164 bytes security) (deflated 5%)
adding: dlls/mfimon.dll (164 bytes security) (deflated 5%)
adding: dlls/miaatext.dll (164 bytes security) (deflated 5%)
adding: dlls/mpcpxl32.dll (164 bytes security) (deflated 4%)
adding: dlls/mpoeacct.dll (164 bytes security) (deflated 5%)
adding: dlls/MSC71ENU.DLL (164 bytes security) (deflated 6%)
adding: dlls/mtcpxl32.dll (164 bytes security) (deflated 5%)
adding: dlls/mv2sl9f71.dll (164 bytes security) (deflated 4%)
adding: dlls/mzdtcprx.dll (164 bytes security) (deflated 4%)
adding: dlls/n2r20c9oef.dll (164 bytes security) (deflated 4%)
adding: dlls/n82ulif9182.dll (164 bytes security) (deflated 4%)
adding: dlls/ntobjapi.dll (164 bytes security) (deflated 6%)
adding: dlls/p2n8lc5u1f.dll (164 bytes security) (deflated 4%)
adding: dlls/p4r4le9q1h.dll (164 bytes security) (deflated 5%)
adding: dlls/pcd.dll (164 bytes security) (deflated 4%)
adding: dlls/pVpnetsh.dll (164 bytes security) (deflated 4%)
adding: dlls/qzvd.dll (164 bytes security) (deflated 5%)
adding: dlls/s488lelu1hq8.dll (164 bytes security) (deflated 6%)
adding: dlls/safolder.dll (164 bytes security) (deflated 4%)
adding: dlls/sbrio600.dll (164 bytes security) (deflated 5%)
adding: dlls/veoy.dll (164 bytes security) (deflated 5%)
adding: dlls/visapi.dll (164 bytes security) (deflated 5%)
adding: dlls/whnhttp.dll (164 bytes security) (deflated 5%)
adding: dlls/wispdmod.dll (164 bytes security) (deflated 5%)
adding: dlls/wm2help.dll (164 bytes security) (deflated 5%)
adding: dlls/wsvdmoe.dll (164 bytes security) (deflated 5%)
adding: dlls/wswfaxui.dll (164 bytes security) (deflated 5%)
adding: dlls/wzasf.dll (164 bytes security) (deflated 4%)
adding: dlls/xwob2res.dll (164 bytes security) (deflated 4%)
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
adding: backregs/03BB691A-1011-4FA1-9E61-4213353C257D.reg (212 bytes security) (deflated 70%)
adding: backregs/290E0CC8-396D-4D25-AAEC-BDF46E75D29D.reg (212 bytes security) (deflated 70%)
adding: backregs/526B5021-8910-4E6B-8298-015038A55F1E.reg (212 bytes security) (deflated 70%)
adding: backregs/8340DDA6-3446-478D-B5C5-99060A87AB68.reg (212 bytes security) (deflated 70%)
adding: backregs/8D4B107A-9EEA-4118-A264-25F2CA71D80E.reg (212 bytes security) (deflated 70%)
adding: backregs/9E71CE45-934A-4293-876F-438BDFB6837D.reg (212 bytes security) (deflated 70%)
adding: backregs/A417D6AF-AFFB-44E3-8C31-C5AF11C03EC2.reg (212 bytes security) (deflated 70%)
adding: backregs/B21EC2D3-7E6D-4DBA-9F8A-83777B5E812C.reg (212 bytes security) (deflated 70%)
adding: backregs/BEA0A227-97D6-4D41-90AA-2AAB4BF1656F.reg (212 bytes security) (deflated 70%)
adding: backregs/D4D75A52-0C38-42AB-9F6D-357F9ACC11EE.reg (212 bytes security) (deflated 70%)
adding: backregs/EC694DD9-E078-462A-921B-EDF562497B1A.reg (212 bytes security) (deflated 70%)
adding: backregs/FC69808F-CC76-4D6F-8EFF-AF9221352623.reg (212 bytes security) (deflated 71%)
adding: backregs/notibac.reg (164 bytes security) (deflated 88%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
Logfile of HijackThis v1.99.1
Scan saved at 18:29:08, on 17/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Program Files\New Folder\iTouch\iTouch.exe
C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
G:\Program Files\New Folder\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
G:\Program Files\Microsoft Anti Spyware\gcasServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\Spyware Doctor\swdoctor.exe
G:\Program Files\Microsoft Anti Spyware\gcasDtServ.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.btopenworld.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.co.uk/keyword/%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
F2 - REG:system.ini: Shell=
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - G:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - G:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] G:\Program Files\New Folder\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "G:\Program Files\Microsoft Anti Spyware\gcasServ.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [Spyware Doctor] "G:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\Realdownload.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - G:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.btopenworld.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\jt6u07j9e.dll (file missing)
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
 
Joined
Sep 7, 2004
Messages
49,014
Fix these with HJT – mark them, close IE, click fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank

F2 - REG:system.ini: Shell=

O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\jt6u07j9e.dll (file missing)


START – RUN – type in %temp% OK - Edit – Select all – File – Delete

Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

Empty the recycle bin
Boot and post a new log from normal NOT safe mode

How are things now???

Please give feedback on what worked/didn’t work and the current status of your system
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
Heres latest log flie! Much better now cheers! Appears to be no pop ups anymore! But i have had a couple of blue screen error reports! And then it reboots and says my graphics card is not connected properly, and wont boot! Never had this before!

Logfile of HijackThis v1.99.1
Scan saved at 17:03:00, on 18/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Ideazon\Zboard Software\Driver\ZboardTray.exe
C:\WINDOWS\SOUNDMAN.EXE
G:\Program Files\New Folder\iTouch\iTouch.exe
C:\Program Files\Ideazon\Zboard Software\Driver\Zboard.exe
C:\WINDOWS\system32\rundll32.exe
G:\Program Files\New Folder\MouseWare\system\em_exec.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
G:\Program Files\Microsoft Anti Spyware\gcasServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
G:\Program Files\Spyware Doctor\swdoctor.exe
G:\Program Files\Microsoft Anti Spyware\gcasDtServ.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.btopenworld.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.co.uk/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.co.uk/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BTopenworld
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - G:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - G:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [zBrowser Launcher] G:\Program Files\New Folder\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [gcasServ] "G:\Program Files\Microsoft Anti Spyware\gcasServ.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [Spyware Doctor] "G:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\Realdownload.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - G:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\System32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.btopenworld.com/
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{98FD5000-5E24-429C-8900-6855F4FDCA97}: NameServer = 194.72.0.98 194.72.9.38
O20 - Winlogon Notify: Zboard - C:\WINDOWS\SYSTEM32\Winlognotif.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
 

Azazel.co

Thread Starter
Joined
Jan 16, 2006
Messages
16
The error report that windows gives when i boot up again after a few minutes is a hard drive read error. Could this be caused by the spyware progs i am running?
 
Joined
Sep 7, 2004
Messages
49,014
Make sure you critical data is backed up the run a chkdsk - not releated to malware
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top