Odd Website Pop-Ups...Please Help

Comments

• Trogan London, UK

  December 2005 edited December 2005

  Hi,
  
  
  Run HiJackThis then:
  
  1. Click "Open the Misc Tools Section"
  2. Click "Open Process manager"
  
  -
  
  Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:
  
  D:\WINDOWS\system32\svhost.exe
  C:\Program Files\AutoUpdate\AutoUpdate.exe
  
  Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.
  ==
  
  
  Check the following in HJT and click 'Fix Checked'
  
  O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
  O4 - HKLM\..\Run: [Windows Login] svhost.exe
  O4 - HKLM\..\RunServices: [Windows Login] svhost.exe
  
  O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusear...US_ZNxdm117BCUS
  
  O20 - Winlogon Notify: Applets - D:\WINDOWS\system32\lv4409hqe.dll (file missing)==
  ==
  
  Find and Delete:
  
  C:\Program Files\AutoUpdate << this folder
  ==
  
  
  Please visit at least two of the following sites for an online virus scan:
  
  BitDefender Free Online Virus Scan
  http://www.bitdefender.com/scan/licence.php
  Make sure you tick AutoClean under Scan Options.
  
  Panda ActiveScan
  http://www.pandasoftware.com/activescan/com/activescan_principal.htm
  Make sure you tick Disinfect automatically under Scan Options.
  
  Housecall at TrendMicro
  http://housecall.trendmicro.com/housecall/start_corp.asp
  Make sure you tick Auto Clean.
  When it completes, post back the full filename of any files that cannot be cleaned or deleted.
  
  eTrust Antivirus Web Scanner
  http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
  ==
  
  
  Reboot and post a new HJT log

  0
• IH8Spyware

  December 2005 edited December 2005

  Thanks for the help so far but still getting the pop-ups.
  
  Trend Micro didn't find anything but eTrust found this file: pacninsh.dll with Win32.Prop infection in the path of D:\Windows\system32\
  
  It found another one but deleted it but couldn't delete that one. Here is my second HJT Log after doing all that and rebooting:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 5:52:47 AM, on 12/3/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  D:\WINDOWS\System32\smss.exe
  D:\WINDOWS\system32\winlogon.exe
  D:\WINDOWS\system32\services.exe
  D:\WINDOWS\system32\lsass.exe
  D:\WINDOWS\system32\svchost.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  D:\Program Files\Norton Internet Security\ISSVC.exe
  D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  D:\WINDOWS\system32\LEXBCES.EXE
  D:\WINDOWS\system32\spoolsv.exe
  D:\WINDOWS\system32\LEXPPS.EXE
  D:\WINDOWS\system32\rundll32.exe
  D:\WINDOWS\Explorer.EXE
  D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  D:\WINDOWS\System32\nvsvc32.exe
  D:\WINDOWS\system32\RUNDLL32.EXE
  D:\Program Files\Common Files\Symantec Shared\ccApp.exe
  D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
  D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  D:\WINDOWS\SM1BG.EXE
  D:\WINDOWS\system32\LXSUPMON.EXE
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  D:\WINDOWS\system32\svhost.exe
  C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  D:\WINDOWS\System32\svchost.exe
  D:\WINDOWS\system32\msiexec.exe
  D:\WINDOWS\system32\wuauclt.exe
  D:\Program Files\Messenger\msmsgs.exe
  C:\HJT\HijackThis.exe
  
  O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [ViewMgr] D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SM1BG] D:\WINDOWS\SM1BG.EXE
  O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
  O4 - HKLM\..\Run: [Windows Login] svhost.exe
  O4 - HKLM\..\RunServices: [Windows Login] svhost.exe
  O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
  O8 - Extra context menu item: &AIM Search - res://D:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1108707065788
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: ShellScrap - D:\WINDOWS\system32\l2j80c1uef.dll
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: ISSvc (ISSVC) - Symantec Corporation - D:\Program Files\Norton Internet Security\ISSVC.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: SAVScan - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  
  Is it getting better or no?

  0
• Trogan London, UK

  December 2005 edited December 2005

  Nothing has changed in your log. Did you do the steps I provided in my first post?
  
  If you did and nothing has changed that is probably because of SpyBots TeaTimer.
  
  Do this to disable SpyBots TeaTimer
  
  We'll need to unload Spybot's Teatimer before we begin. To do this can you start Spybot and go to Tools > Resident and uncheck the box next to Tea-Timer. Make sure that the icon in the system tray is no longer there. If it is, just right click on it and select "Exit". Do not forget to re-enable it when we are done .

  0
• IH8Spyware

  December 2005 edited December 2005

  I don't feel like I'm getting anywhere, I can't find the folder C:\Program Files\AutoUpdate...its like it doesn't exist. I have all the hidden files showing and all that, already looked into it. I scanned with eTrust again and it found this: File pacninst.dll with the infection of Win32.Propo in the directory of D:\Windows\system32.
  
  Also I randomly have this error bother me at least once and I have no idea what it means:
  
  
  
  Also when I scan with Spybot it found this stuff and did this:
  
  
  
  And here is my new HJT Log. Looks like I'm not getting anywhere:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 11:59:24 PM, on 12/3/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  D:\WINDOWS\System32\smss.exe
  D:\WINDOWS\system32\winlogon.exe
  D:\WINDOWS\system32\services.exe
  D:\WINDOWS\system32\lsass.exe
  D:\WINDOWS\system32\svchost.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  D:\Program Files\Norton Internet Security\ISSVC.exe
  D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  D:\WINDOWS\system32\LEXBCES.EXE
  D:\WINDOWS\system32\spoolsv.exe
  D:\WINDOWS\system32\LEXPPS.EXE
  D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  D:\WINDOWS\System32\nvsvc32.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  D:\WINDOWS\system32\rundll32.exe
  D:\WINDOWS\Explorer.EXE
  D:\WINDOWS\system32\RUNDLL32.EXE
  D:\Program Files\Common Files\Symantec Shared\ccApp.exe
  D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
  D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  D:\WINDOWS\SM1BG.EXE
  D:\WINDOWS\system32\LXSUPMON.EXE
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  D:\WINDOWS\System32\svchost.exe
  D:\WINDOWS\system32\msiexec.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  D:\Program Files\Messenger\msmsgs.exe
  C:\HJT\HijackThis.exe
  
  O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [ViewMgr] D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SM1BG] D:\WINDOWS\SM1BG.EXE
  O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
  O4 - HKLM\..\Run: [Windows Login] svhost.exe
  O4 - HKLM\..\RunServices: [Windows Login] svhost.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1108707065788
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: App Management - D:\WINDOWS\system32\n84s0ih7e84.dll
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: ISSvc (ISSVC) - Symantec Corporation - D:\Program Files\Norton Internet Security\ISSVC.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: SAVScan - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  0
• IH8Spyware

  December 2005 edited December 2005

  I don't know if it will help but here are some of the sites that pop-up:
  
  http://www.great-coupon.com/normal/yyy65.html
  http://z1.adserver.com/w/cp.x;rid=679;tid=5;ev=1;dt=3;ac=60;c=230;
  http://www.deal-pro.com/normal/yyy65.html
  http://www.free-savings.com/normal/yyy65.html
  http://www.cash-coupon.com/normal/yyy65.html
  http://net-offers.net/popups/ashtm/Hotbar-600x400-Nov30A/Hotbar-Pop-600x400-Nov30A.htm?ClickURL=%26targetUrl%3Dhttp%253A%252F%252Fadopt%252Ehotbar%252Ecom%252Flink%252Ejsp%253Flocation%255Fid%253D6002%2526acamp%255Fid%253D22203%2526pcamp%255Fid%253D6002%2526creative%255Fid%253D21325%2526dem%253D35898%252Ef%252E9%252Efh%252Enl%252E383%252540%252540xzyov%252540%252540pzmhzh%2Bxrgb%252540%252540%252D3%255F9%252540%252540f%26targetIDs%3D25191%252C25192%252C25193%252C25194%252C25195%252C25196%252C25197%252C25198%252C25199%252C25200%252C25201%252C0
  http://www.cool-discount.com/normal/yyy65.html
  http://net-offers.net/popups/popOpener.asp?creative=http%3A//net-offers.net/popups/asimages/hotbar_errorguard_international.gif&h=300&w=720&t=0&d=0&pu=1&purl=&fs=false&targetUrl=http%3A//adopt.hotbar.com/link.jsp%3Flocation_id%3D6002%26acamp_id%3D22581%26pcamp_id%3D6002%26creative_id%3D20737%26dem%3Df.f.9.f.f.f&targetIDs=24364,0&sb=0&popVer=2
  http://www.your-deal.com/normal/yyy65.html
  http://www.super-stock.com/normal/yyy65.html
  http://ad.jamster.com/landingpages/html/dyn/rwp_red/?tduid=b543e1874e0e577f33b0224eef57a592
  http://www.virtual-free.com/normal/yyy65.html

  0
• IH8Spyware

  December 2005 edited December 2005

  I did another HJT log and I got this
  
  Logfile of HijackThis v1.99.1
  Scan saved at 3:13:29 AM, on 12/4/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  D:\WINDOWS\System32\smss.exe
  D:\WINDOWS\system32\winlogon.exe
  D:\WINDOWS\system32\services.exe
  D:\WINDOWS\system32\lsass.exe
  D:\WINDOWS\system32\svchost.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  D:\Program Files\Norton Internet Security\ISSVC.exe
  D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  D:\WINDOWS\system32\LEXBCES.EXE
  D:\WINDOWS\system32\spoolsv.exe
  D:\WINDOWS\system32\LEXPPS.EXE
  D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  D:\WINDOWS\System32\nvsvc32.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  D:\WINDOWS\system32\rundll32.exe
  D:\WINDOWS\Explorer.EXE
  D:\WINDOWS\system32\RUNDLL32.EXE
  D:\Program Files\Common Files\Symantec Shared\ccApp.exe
  D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
  D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  D:\WINDOWS\SM1BG.EXE
  D:\WINDOWS\system32\LXSUPMON.EXE
  D:\WINDOWS\System32\svchost.exe
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  D:\Program Files\MSN Messenger\msnmsgr.exe
  C:\HJT\HijackThis.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  D:\Program Files\Messenger\msmsgs.exe
  
  O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [ViewMgr] D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SM1BG] D:\WINDOWS\SM1BG.EXE
  O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1108707065788
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: Reinstall - D:\WINDOWS\system32\k608lgdu1608.dll
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: ISSvc (ISSVC) - Symantec Corporation - D:\Program Files\Norton Internet Security\ISSVC.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: SAVScan - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  
  I was looking through it and seen these:
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [SM1BG] D:\WINDOWS\SM1BG.EXE
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O20 - Winlogon Notify: Reinstall - D:\WINDOWS\system32\k608lgdu1608.dll
  I have no idea what they are...can I delete them or no? I have no idea...

  0
• Trogan London, UK

  December 2005 edited December 2005

  Download L2mfix from one of these two locations:
  
  http://www.atribune.org/downloads/l2mfix.exe
  http://www.downloads.subratam.org/l2mfix.exe
  
  Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
  
  IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
  
  if you receive, while running option #1, an error similar like: ''C:\windows\system32\cmd.exe
  C:\windows\system32\autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application.."...then please use option 5 or the web page link in the l2mfix folder to solve this error condition. do not run the fix portion without fixing this first.

  0
• IH8Spyware

  December 2005 edited December 2005

  I couldn't tell if I got an error or not. After the scan was done all the text disappeared before I could read it. Here is what I came up with though.
  
  L2MFIX find log 120305
  These are the registry keys present
  **********************************************************************************
  Winlogon/notify:
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex]
  "Asynchronous"=dword:00000000
  "DllName"="D:\\WINDOWS\\system32\\ir0sl5d71.dll"
  "Impersonate"=dword:00000000
  "Logon"="WinLogon"
  "Logoff"="WinLogoff"
  "Shutdown"="WinShutdown"
  
  **********************************************************************************
  useragent:
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
  "{0D2AA35E-4D83-4D2C-8149-256A16DF9962}"=""
  
  **********************************************************************************
  Shell Extension key:
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
  "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
  "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
  "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
  "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
  "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
  "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
  "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
  "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
  "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
  "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
  "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
  "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
  "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
  "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
  "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
  "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
  "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
  "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
  "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
  "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
  "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
  "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
  "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
  "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
  "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
  "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
  "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
  "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
  "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
  "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
  "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
  "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
  "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
  "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
  "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
  "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
  "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
  "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
  "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
  "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
  "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
  "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
  "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
  "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
  "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
  "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
  "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
  "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
  "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
  "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
  "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
  "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
  "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
  "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
  "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
  "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
  "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
  "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
  "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
  "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
  "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
  "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
  "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
  "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
  "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
  "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
  "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
  "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
  "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
  "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
  "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
  "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
  "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
  "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
  "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
  "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
  "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
  "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
  "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
  "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
  "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
  "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
  "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
  "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
  "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
  "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
  "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
  "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
  "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
  "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
  "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
  "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
  "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
  "{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
  "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
  "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
  "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
  "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
  "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
  "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
  "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
  "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
  "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
  "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
  "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
  "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
  "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
  "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
  "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
  "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
  "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
  "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
  "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
  "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
  "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
  "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
  "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
  "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
  "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
  "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
  "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
  "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
  "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
  "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
  "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
  "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
  "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
  "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
  "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
  "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
  "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
  "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
  "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
  "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
  "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
  "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
  "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
  "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
  "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
  "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
  "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
  "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
  "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
  "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
  "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
  "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
  "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
  "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
  "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
  "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
  "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
  "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
  "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
  "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
  "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
  "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
  "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
  "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
  "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
  "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
  "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
  "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
  "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
  "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
  "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
  "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
  "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
  "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
  "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
  "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
  "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
  "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
  "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
  "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
  "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
  "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
  "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
  "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
  "{5E44E225-A408-11CF-B581-008029601108}"="Roxio DragToDisc Shell Extension"
  "{0873D142-79EF-49fa-81B5-211AAC0B0A7F}"="Target Finder Shell Extension"
  "{8FF88D21-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
  "{8FF88D25-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) DragDrop Shell Extension"
  "{8FF88D27-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Context Menu Shell Extension"
  "{8FF88D23-7BD0-11D1-BFB7-00AA00262A11}"="WinAce Archiver 2.6b5 (beta test) Property Sheet Shell Extension"
  "{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
  "{45994ec6-2fe3-11d4-aace-00c04f9908b8}"="Compaq 1400P Inkjet Printer"
  "{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
  "{11C1D741-A95B-11d2-8A80-0080ADB32FF4}"="FTP Surfer Shell Extension"
  "{e82a2d71-5b2f-43a0-97b8-81be15854de8}"="ShellLink for Application References"
  "{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75}"="Shell Icon Handler for Application References"
  "{997BB76F-981C-4849-9F68-96A1A16CA04B}"=""
  "{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}"=""
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5E44E225-A408-11CF-B581-008029601108}]
  @=&quot;"
  
  **********************************************************************************
  HKEY ROOT CLASSIDS:
  Windows Registry Editor Version 5.00
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}]
  @=&quot;"
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}\Implemented Categories]
  @=&quot;"
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
  @=&quot;"
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}\InprocServer32]
  @=&quot:\\WINDOWS\\system32\\matext40.dll"
  "ThreadingModel"="Apartment"
  
  **********************************************************************************
  Files Found are not all bad files:
  
  D:\WINDOWS\SYSTEM32\
  cdosys.dll Fri Sep 9 2005 7:53:42p A.... 2,067,968 1.97 M
  cmdlin~1.dll Thu Oct 20 2005 1:12:58a A.... 98,304 96.00 K
  dfshim.dll Fri Sep 23 2005 7:28:38a A.... 83,456 81.50 K
  gccoll~1.dll Tue Nov 15 2005 12:12:08p A.... 126,680 123.71 K
  gcunco~1.dll Tue Nov 15 2005 12:12:06p A.... 95,448 93.21 K
  gdi32.dll Wed Oct 5 2005 9:09:36p A.... 280,064 273.50 K
  hashlib.dll Tue Nov 15 2005 12:12:08p A.... 117,976 115.21 K
  ir0sl5~1.dll Sun Dec 4 2005 3:32:52a ..S.R 234,100 228.61 K
  ivssam.dll Sun Dec 4 2005 12:37:06a ..S.R 236,216 230.68 K
  matext40.dll Sun Dec 4 2005 3:39:54a ..... 234,100 228.61 K
  mscoree.dll Fri Sep 23 2005 7:28:52a A.... 270,848 264.50 K
  mscorier.dll Fri Sep 23 2005 7:28:52a A.... 150,016 146.50 K
  mscories.dll Fri Sep 23 2005 7:28:52a A.... 74,240 72.50 K
  mshtml.dll Tue Oct 4 2005 4:26:00p A.... 3,015,168 2.88 M
  o084la~1.dll Sun Dec 4 2005 3:37:54a ..S.R 236,306 230.77 K
  pacninst.dll Wed Nov 30 2005 11:54:46a A.... 45,056 44.00 K
  shell32.dll Thu Sep 22 2005 9:05:30p A.... 8,450,560 8.06 M
  sirenacm.dll Wed Oct 12 2005 5:11:06p A.... 118,784 116.00 K
  
  18 items found: 18 files (3 H/S), 0 directories.
  Total of file sizes: 15,935,290 bytes 15.20 M
  Locate .tmp files:
  
  D:\WINDOWS\SYSTEM32\
  guard.tmp Sun Dec 4 2005 4:57:54a ..S.R 234,100 228.61 K
  
  1 item found: 1 file (1 H/S), 0 directories.
  Total of file sizes: 234,100 bytes 228.61 K
  **********************************************************************************
  Directory Listing of system files:
  Volume in drive D has no label.
  Volume Serial Number is 70EF-606A
  
  Directory of D:\WINDOWS\System32
  
  12/04/2005 04:57 AM 234,100 guard.tmp
  12/04/2005 03:37 AM 236,306 o084lalq1dqe.dll
  12/04/2005 03:32 AM 234,100 ir0sl5d71.dll
  12/04/2005 12:37 AM 236,216 iVssam.dll
  12/02/2005 01:50 AM <DIR> dllcache
  02/18/2005 03:23 AM <DIR> Microsoft
  4 File(s) 940,722 bytes
  2 Dir(s) 14,647,910,400 bytes free

  0
• Trogan London, UK

  December 2005 edited December 2005

  Close any browsers and programs you have open since this step requires a reboot.
  
  From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot. After the reboot notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
  
  IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
  If after the reboot the log does not open double click on it in the l2mfix folder.

  0
• IH8Spyware

  December 2005 edited December 2005

  Heres the log.txt file from l2mfix:
  
  L2mfix Beta 120305
  Creating Account.
  The command completed successfully.
  
  Adding Administrative privleges.
  The command completed successfully.
  
  Checking for L2MFix account(0=no 1=yes):
  1
  Granting SeDebugPrivilege to L2MFIX ... successful
  
  Running From:
  D:\WINDOWS\system32
  
  Killing Processes!
  
  Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
  Killing PID 472 'smss.exe'
  
  Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
  Killing PID 556 'winlogon.exe'
  Killing PID 556 'winlogon.exe'
  Killing PID 556 'winlogon.exe'
  
  Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
  Killing PID 2088 'explorer.exe'
  Killing PID 2088 'explorer.exe'
  
  Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
  Killing PID 5164 'rundll32.exe'
  
  Scanning First Pass. Please Wait!
  
  First Pass Completed
  
  Second Pass Scanning
  
  Second pass Completed!
  Backing Up: D:\WINDOWS\system32\ir0sl5d71.dll
  1 file(s) copied.
  Backing Up: D:\WINDOWS\system32\iVssam.dll
  1 file(s) copied.
  Backing Up: D:\WINDOWS\system32\o084lalq1dqe.dll
  1 file(s) copied.
  Backing Up: D:\WINDOWS\system32\guard.tmp
  1 file(s) copied.
  deleting: D:\WINDOWS\system32\ir0sl5d71.dll
  Successfully Deleted: D:\WINDOWS\system32\ir0sl5d71.dll
  deleting: D:\WINDOWS\system32\iVssam.dll
  Successfully Deleted: D:\WINDOWS\system32\iVssam.dll
  deleting: D:\WINDOWS\system32\o084lalq1dqe.dll
  Successfully Deleted: D:\WINDOWS\system32\o084lalq1dqe.dll
  deleting: D:\WINDOWS\system32\guard.tmp
  Successfully Deleted: D:\WINDOWS\system32\guard.tmp
  
  
  Zipping up files for submission:
  zip warning: name not matched: guard.tmp
  
  zip error: Nothing to do! (backup.zip)
  adding: Documents and Settings/Justin Fuller/Desktop/l2mfix/backregs/notibac.reg (164 bytes security) (deflated 87%)
  adding: Documents and Settings/Justin Fuller/Desktop/l2mfix/backregs/shell.reg (164 bytes security) (deflated 74%)
  
  Restoring Sedebugprivilege:
  
  Granting SeDebugPrivilege to Administrators ... successful
  
  Restoring Windows Update Certificates.:
  
  deleting local copy: ir0sl5d71.dll
  deleting local copy: iVssam.dll
  deleting local copy: o084lalq1dqe.dll
  deleting local copy: guard.tmp
  
  The following Is the Current Export of the Winlogon notify key:
  ****************************************************************************
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
  "Asynchronous"=dword:00000000
  "Impersonate"=dword:00000000
  "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
  "Logoff"="ChainWlxLogoffEvent"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
  "Asynchronous"=dword:00000000
  "Impersonate"=dword:00000000
  "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
  "Logoff"="CryptnetWlxLogoffEvent"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
  "DLLName"="cscdll.dll"
  "Logon"="WinlogonLogonEvent"
  "Logoff"="WinlogonLogoffEvent"
  "ScreenSaver"="WinlogonScreenSaverEvent"
  "Startup"="WinlogonStartupEvent"
  "Shutdown"="WinlogonShutdownEvent"
  "StartShell"="WinlogonStartShellEvent"
  "Impersonate"=dword:00000000
  "Asynchronous"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MediaContentIndex]
  "Asynchronous"=dword:00000000
  "DllName"="D:\\WINDOWS\\system32\\ir0sl5d71.dll"
  "Impersonate"=dword:00000000
  "Logon"="WinLogon"
  "Logoff"="WinLogoff"
  "Shutdown"="WinShutdown"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
  "DLLName"="wlnotify.dll"
  "Logon"="SCardStartCertProp"
  "Logoff"="SCardStopCertProp"
  "Lock"="SCardSuspendCertProp"
  "Unlock"="SCardResumeCertProp"
  "Enabled"=dword:00000001
  "Impersonate"=dword:00000001
  "Asynchronous"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
  "Asynchronous"=dword:00000000
  "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
  "Impersonate"=dword:00000000
  "StartShell"="SchedStartShell"
  "Logoff"="SchedEventLogOff"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
  "Logoff"="WLEventLogoff"
  "Impersonate"=dword:00000000
  "Asynchronous"=dword:00000001
  "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
  "DLLName"="WlNotify.dll"
  "Lock"="SensLockEvent"
  "Logon"="SensLogonEvent"
  "Logoff"="SensLogoffEvent"
  "Safe"=dword:00000001
  "MaxWait"=dword:00000258
  "StartScreenSaver"="SensStartScreenSaverEvent"
  "StopScreenSaver"="SensStopScreenSaverEvent"
  "Startup"="SensStartupEvent"
  "Shutdown"="SensShutdownEvent"
  "StartShell"="SensStartShellEvent"
  "PostShell"="SensPostShellEvent"
  "Disconnect"="SensDisconnectEvent"
  "Reconnect"="SensReconnectEvent"
  "Unlock"="SensUnlockEvent"
  "Impersonate"=dword:00000001
  "Asynchronous"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
  "Asynchronous"=dword:00000000
  "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
  "Impersonate"=dword:00000000
  "Logoff"="TSEventLogoff"
  "Logon"="TSEventLogon"
  "PostShell"="TSEventPostShell"
  "Shutdown"="TSEventShutdown"
  "StartShell"="TSEventStartShell"
  "Startup"="TSEventStartup"
  "MaxWait"=dword:00000258
  "Reconnect"="TSEventReconnect"
  "Disconnect"="TSEventDisconnect"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
  "DLLName"="wlnotify.dll"
  "Logon"="RegisterTicketExpiredNotificationEvent"
  "Logoff"="UnregisterTicketExpiredNotificationEvent"
  "Impersonate"=dword:00000001
  "Asynchronous"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
  "DLLName"="wzcdlg.dll"
  "Logon"="WZCEventLogon"
  "Logoff"="WZCEventLogoff"
  "Impersonate"=dword:00000000
  "Asynchronous"=dword:00000000
  
  
  The following are the files found:
  ****************************************************************************
  D:\WINDOWS\system32\ir0sl5d71.dll
  D:\WINDOWS\system32\iVssam.dll
  D:\WINDOWS\system32\o084lalq1dqe.dll
  D:\WINDOWS\system32\guard.tmp
  
  Registry Entries that were Deleted:
  Please verify that the listing looks ok.
  If there was something deleted wrongly there are backups in the backreg folder.
  ****************************************************************************
  Windows Registry Editor Version 5.00
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}]
  @=&quot;"
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}\Implemented Categories]
  @=&quot;"
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
  @=&quot;"
  
  [HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}\InprocServer32]
  @=&quot:\\WINDOWS\\system32\\matext40.dll"
  "ThreadingModel"="Apartment"
  
  REGEDIT4
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
  "{997BB76F-981C-4849-9F68-96A1A16CA04B}"=-
  "{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}"=-
  [-HKEY_CLASSES_ROOT\CLSID\{997BB76F-981C-4849-9F68-96A1A16CA04B}]
  [-HKEY_CLASSES_ROOT\CLSID\{7EA9D4A6-D8D0-49FD-8067-67384D68AF92}]
  REGEDIT4
  
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
  "SV1"=""
  ****************************************************************************
  Desktop.ini Contents:
  ****************************************************************************
  
  ****************************************************************************
  D:\WINDOWS\System32\7EA9D4A6-D8D0-49FD-8067-67384D68AF92.reg
  Checking for L2MFix account(0=no 1=yes):
  0
  adding: dlls/ir0sl5d71.dll (164 bytes security) (deflated 4%)
  adding: dlls/iVssam.dll (164 bytes security) (deflated 5%)
  adding: dlls/o084lalq1dqe.dll (164 bytes security) (deflated 5%)
  
  
  Heres the HJT log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 4:54:26 PM, on 12/4/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  D:\WINDOWS\System32\smss.exe
  D:\WINDOWS\system32\winlogon.exe
  D:\WINDOWS\system32\services.exe
  D:\WINDOWS\system32\lsass.exe
  D:\WINDOWS\system32\svchost.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  D:\Program Files\Norton Internet Security\ISSVC.exe
  D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  D:\WINDOWS\Explorer.EXE
  D:\WINDOWS\system32\LEXBCES.EXE
  D:\WINDOWS\system32\spoolsv.exe
  D:\WINDOWS\system32\LEXPPS.EXE
  D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  D:\WINDOWS\System32\nvsvc32.exe
  D:\WINDOWS\System32\svchost.exe
  D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  D:\WINDOWS\system32\RUNDLL32.EXE
  D:\Program Files\Common Files\Symantec Shared\ccApp.exe
  D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
  D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  D:\WINDOWS\SM1BG.EXE
  D:\WINDOWS\system32\LXSUPMON.EXE
  C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  D:\WINDOWS\System32\svchost.exe
  D:\WINDOWS\system32\wuauclt.exe
  D:\WINDOWS\system32\msiexec.exe
  D:\Program Files\Messenger\msmsgs.exe
  C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
  C:\HJT\HijackThis.exe
  
  O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [RoxioDragToDisc] "D:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [ViewMgr] D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SM1BG] D:\WINDOWS\SM1BG.EXE
  O4 - HKLM\..\Run: [LXSUPMON] D:\WINDOWS\system32\LXSUPMON.EXE RUN
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker\PartyPoker.exe
  O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - D:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1108707065788
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
  O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {C852B12E-3F08-4099-AF8E-32FD327B88EA} (msnloader Class) - http://rockstar.messenger.msn.com/rockstar.cab
  O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: MediaContentIndex - D:\WINDOWS\system32\ir0sl5d71.dll (file missing)
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: ISSvc (ISSVC) - Symantec Corporation - D:\Program Files\Norton Internet Security\ISSVC.exe
  O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
  O23 - Service: SAVScan - Symantec Corporation - D:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  0
• Trogan London, UK

  December 2005 edited December 2005

  Good Job
  -
  
  OK, check the following in HJT and click 'Fix Checked'
  
  O20 - Winlogon Notify: MediaContentIndex - D:\WINDOWS\system32\ir0sl5d71.dll (file missing)
  -
  
  
  Your log is clean. How are things?

  0
• IH8Spyware

  December 2005 edited December 2005

  Excellent so far. Thank you very very much. I'll refer you to anyone that has a problem from now on. SOOOOO glad I found this place, was about to go nuts

  0
• Trogan London, UK

  December 2005 edited December 2005

  No problem
  Let me know when I can mark this resolved
  
  
  Please consider joining the Folding@Home Project

  Join our Folding@Home team! Alzheimer's, Parkinson's, cancer... we're trying to cure them with our computers! You've at least read a little about it in the greeting I sent you when you signed up for the site. We're always really pleased to greet new members to the team, and it's a quick way to become an appreciated member of the community.
  MORE INFO: READ THIS

  
  Follow this guide by Crunchie to stay more secure
  
  Now that your PC is clean you need to follow these easy steps to keeping it this way:
  
  Secure your Internet Explorer by going here and following the instructions there.
  
  Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.
  
  Use a firewall to help prevent your PC's control being usurped by undesireables.
  
  Install and keep updated, Ad-Aware SE, and Spybot S&D.
  Run them both on a regular basis, following the manufacturer's recommendations.
  
  Install and keep updated, SpywareBlaster 3.4
  
  Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.
  
  Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.
  
  
  Clear your Temp folders.
  Clear out your Temporary internet files and other temp files.
  Go to Start > Settings > Control Panel >Internet Options.
  Under the General tab click the Delete temporary internet files,
  delete all Offline content as well. Clear out Cookies.
  
  Also, go to Start > Find/search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.
  
  Empty/delete the entire contents of the C:\Windows\temp folder and C:\temp folder, if you have one. (Contents but not the folder itself.)
  
  C:\Documents and Settings\username\Local Settings\Temp\
  
  In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.
  
  Empty the Recycle Bin.
  
  For XP users.
  After something like this it is a good idea to Flush the Restore Points and start fresh.
  To flush the XP system Restore Points.
  
  Go to Start>Run and type msconfig. Press enter.
  
  When msconfig opens, click the Launch System Restore Button.
  On the next page, click the System Restore Settings link on the left.
  
  Check the box labelled 'Turn off System restore'.
  
  Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.
  
  Note that all previous restore points will be lost.
  
  ===============
  
  If you have any more problems, post back.

  0
• IH8Spyware

  December 2005 edited December 2005

  Thx alot, you can mark it as resolved.

  0
• Trogan London, UK

  December 2005 edited December 2005

  Done!!!

  0