IE 6.0 loading AD websites every 20 minuts <=> continuosly virus attacks

Unknown
edited May 2005 in Spyware & Virus Removal
I've been infected after visiting some websites for collecting cliparts. Soon after this IE began to laod differents websites with advertising content (f.ex.http://j.2004cms.com/HTM/406/1/JavaSiteRequest.asp?LV=6000&DC=619&NF=0&IW=720&IH=300&ORD=1114649537648 and http://www.9ringtone.com/dk/index.php etc. )

Soon after or maybee just before this IE behavior, has MCAfeel detected viruses:

26-04-2005 18:09:52 Deleted ALEXANDER\Administrator iexplore.exe C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\WL2ZS56N\wow[1].htm Exploit-MhtRedir.gen (Trojan)

This message is displayed 19 times to the last one:

26-04-2005 18:12:57 Script execution blocked ALEXANDER\Administrator iexplore.exe Script executed by iexplore.exe Exploit-MhtRedir.gen (Trojan)

Then new virus :

26-04-2005 19:15:29 Move failed (Clean failed) ALEXANDER\Administrator explorer.exe C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\AF2BAXEB\AppWrap[1].exe Vundo (Trojan)
......
26-04-2005 19:15:34 Deleted ALEXANDER\Administrator explorer.exe C:\Documents and Settings\Administrator\Lokale indstillinger\Temp\bw2.com Vundo (Trojan)
26-04-2005 19:27:39 Deleted ALEXANDER\Administrator explorer.exe C:\Documents and Settings\Administrator\Lokale indstillinger\Temp\bw2.com Vundo (Trojan)

And next:

Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\GHAFO9QZ\AppWrap[2].exe QUrl-3 (Trojan)
26-04-2005 19:39:35 Move failed (Clean failed) ALEXANDER\Administrator explorer.exe C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\GHAFO9QZ\AppWrap[2].exe QUrl-3 (Trojan)
26-04-2005 19:39:38 Deleted ALEXANDER\Administrator explorer.exe C:\Documents and Settings\Administrator\Lokale indstillinger\Temp\bw2.com QUrl-3 (Trojan)


On next day same story, but only one virus detected:

27-04-2005 15:45:20 Deleted ALEXANDER\Administrator iexplore.exe C:\WINDOWS\Temp\Temporary Internet Files\Content.IE5\4DS9QD0N\dia172[1].htm JS/Exploit-MhtRedir.gen (Trojan)

To day....
Just after log on

Error messsage: Error while trying to run "C:\Windows\system32\ww2_.dll" DllGetVersion

And new virus attacks, Detected as Vundo:
AppWrap(3).exe Status-Move failed
AppWrap(1).exe Status-Move failed
bw2.com Status-Deleted

I don't know what to do, This is first time in this year I have got viruses and IE still preloding Adsites.

Firewall just detected that
C:\WINDOWS\system32\MTE1Mzc6ODoxMg.exe is trying to broadcast to
Remote Name : www.ad-w-a-r-e.com
Remote Address : 213.61.6.3

I have denied access

I run Spybot and Ad Aware with no result

Here is my new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:04:01, on 28-04-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Network Associates\VirusScan\mcshield.exe
C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
C:\Programmer\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE
C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe
C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe
C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Babylon\Babylon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Yahoo!\Messenger\ypager.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\HijackThis\HijackThis.exe
C:\Programmer\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Programmer\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Programmer\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\MTE1Mzc6ODoxMg.exe
C:\Programmer\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my3.statcounter.com/project/standar...338ec425fddaa0e
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts: lsvarende værtsnavn.
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [FLMLABTECMOUSE] C:\Programmer\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Programmer\HijackThis\HijackThis.exe /startupscan
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://support.epson-europe.com/selftest/Prg/ESTPTest.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/...B/e-Safekey.cab
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/contr...ate/sdkinst.cab
O16 - DPF: {F9043C85-F6F2-101A-A3C9-08002B2F49FB} (Microsoft Common Dialog Control, version 5.0 (SP2)) - file://C:\Programmer\OpenCube\NavStudio\program\comdlg32.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = localdom.net
O17 - HKLM\Software\..\Telephony: DomainName = localdom.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = localdom.net
O20 - Winlogon Notify: policies - C:\WINDOWS\system32\k8800ilme8qa0.dll
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe


After installing of ie-spyad,
blocking from broadcastning rundll32.exe and winlogon.exe,
deleting BW2.COM-1F947601.pf and bw2.com
IE not showing new ADsites, but I am not sure if I did right things.


Help needed asap ! Thanks in advance

Regards etcon.dk

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Please run at least two of these online scans.
    Make sure they are set to clean automatically:

    http://www.pandasoftware.com/activescan/com/activescan_principal.htm

    http://www.bitdefender.com/scan/licence.php

    http://housecall.trendmicro.com/housecall/start_corp.asp

    There will be files that these scans will not remove. Please include that information in your next post.


    Reboot and post a new hijackthis log.
  • etcon.dk
    edited April 2005
    Hi, and thank you for prompt response.

    Results from BitDefender Free Online Virus Scan

    C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\GHAFO9QZ\BM2[1].dll: infected with Trojan.Downloader.Agent.JT
    C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\GHAFO9QZ\BM2[1].dll: deleted
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eZulaHotText.zip=>eZinstall.exe: password protected
    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eZulaHotText.zip=>sbRecovery.ini: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>arrow1.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>arrow2.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bck1.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bck2.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt11.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt12.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt13.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt21.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt22.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt23.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt31.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt32.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt33.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt41.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt42.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt43.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt51.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt52.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt53.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt61.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt62.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox1.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox2.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox3.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox4.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>default.skn: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn1.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn2.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn3.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph1.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph2.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph3.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph4.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph5.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph6.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph7.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>main.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>preview.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>sprite1.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>tab1.bmp: password protected
    C:\Programmer\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>tab2.bmp: password protected
    C:\WINDOWS\Downloaded Program Files\BM2.dll: infected with Trojan.Downloader.Agent.JT
    C:\WINDOWS\Downloaded Program Files\BM2.dll: deleted
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\BM2.dll: infected with Trojan.Downloader.Agent.JT
    C:\WINDOWS\Downloaded Program Files\CONFLICT.1\BM2.dll: deleted

    Results from Panda ActiveScan :



    Incident Status Location

    Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\0DIRGHYB\AppWrap[1].exe
    Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\0DIRGHYB\Installer[1].exe
    Adware:Adware/nCase No disinfected C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\AF2BAXEB\AppWrap[2].exe
    Adware:Adware/Funcade No disinfected C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\WL2ZS56N\installer_MEDIAWHIZ5[1].cab
    Adware:Adware/Funcade No disinfected C:\Documents and Settings\Administrator\Lokale indstillinger\Temporary Internet Files\Content.IE5\WL2ZS56N\installer_MEDIAWHIZ5[1].cab[installer_MEDIAWHIZ5.exe]
    Adware:Adware/Look2Me No disinfected C:\Documents and Settings\Administrator\Skrivebord\Online Dating.url
    Spyware:Spyware/Spyblocs No disinfected C:\Documents and Settings\Administrator\Skrivebord\Remove Spyware.url
    Adware:Adware/Look2Me No disinfected C:\RECYCLER\S-1-5-21-839522115-1677128483-1060284298-500\Dc1692.dll
    Adware:Adware/Funcade No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MEDIAWHIZ5.exe
    Adware:Adware/Funcade No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.2\installer_MEDIAWHIZ5.exe
    Adware:Adware/Funcade No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.3\installer_MEDIAWHIZ5.exe
    Adware:Adware/Funcade No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.4\installer_MEDIAWHIZ5.exe
    Adware:Adware/Funcade No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.5\installer_MEDIAWHIZ5.exe
    Adware:Adware/Funcade No disinfected C:\WINDOWS\Downloaded Program Files\installer_MEDIAWHIZ5.exe
    Adware:Adware/WinAD No disinfected C:\WINDOWS\Downloaded Program Files\PrevAdX.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\iconu.exe
    Virus:Trj/Qhost.Y Disinfected C:\WINDOWS\system32\drivers\etc\hosts
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\g604lgdq160e.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\j4n20e5oeh.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\megina.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\rMcpldlg.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\vjipxspx.dll
    Virus:Trj/Citifraud.A Disinfected Private mapper\TradeMagazine\Net Tilbud\VS: Please update your e-Bay account information\MSG_RTF.TXT
    Virus:EICAR-AV-TEST-FILE Disinfected E:\Gendannede filer\GAMMEL C-DREV\Download\virus_test\eicarcom2.RB0


    And after rebooting:

    Logfile of HijackThis v1.99.1
    Scan saved at 03:21:01, on 30-04-2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programmer\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
    C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
    C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
    C:\Programmer\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
    C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE
    C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe
    C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe
    C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
    C:\Programmer\Messenger\msmsgs.exe
    C:\Programmer\Babylon\Babylon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmer\Skype\Phone\Skype.exe
    C:\Programmer\Network Associates\VirusScan\mcshield.exe
    C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Programmer\HijackThis\HijackThis.exe
    C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
    C:\Programmer\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
    C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Programmer\Google\Google Desktop Search\GoogleDesktopIndex.exe
    C:\Programmer\Google\Google Desktop Search\GoogleDesktopCrawl.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my3.statcounter.com/project/standard/stats.php?project_id=665863&PHPSESSID=4be4622e653086816338ec425fddaa0e
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
    O4 - HKLM\..\Run: [FLMLABTECMOUSE] C:\Programmer\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKCU\..\Run: [HijackThis startup scan] C:\Programmer\HijackThis\HijackThis.exe /startupscan
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
    O4 - Global Startup: VPN Client.lnk = ?
    O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
    O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://support.epson-europe.com/selftest/Prg/ESTPTest.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
    O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
    O16 - DPF: {F9043C85-F6F2-101A-A3C9-08002B2F49FB} (Microsoft Common Dialog Control, version 5.0 (SP2)) - file://C:\Programmer\OpenCube\NavStudio\program\comdlg32.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = localdom.net
    O17 - HKLM\Software\..\Telephony: DomainName = localdom.net
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = localdom.net
    O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\p4p6le7s1h.dll
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe


    Regards etcon.dk
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Please download and install Cleanup 4.0
    http://cleanup.stevengould.org/


    Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows



    Reboot your computer into Safe Mode


    Run CleanUp.


    Reboot back to normal mode.



    Download L2mfix from one of these two locations:

    http://www.atribune.org/downloads/l2mfix.exe
    http://www.downloads.subratam.org/l2mfix.exe

    Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

    IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
  • etcon.dk
    edited April 2005
    CleanUp done

    Here is l2mfix log:

    L2MFIX find log 1.03
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
    "Asynchronous"=dword:00000000
    "DllName"=""
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{7C7370B6-483D-15FB-E59F-2FCF59350182}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Egenskabsark for multimediefiler"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM-scannerstyring"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Sikkerhedsside"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Egenskabsside for OLE-dokumentfil"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Gr‘nsefladeudvidelse til deling"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rmkort"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rm"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Kontrolpanel-udvidelse til sk‘rmpanorering"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security-side"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Kompatibilitetsside"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Udvidelsen Diskcopy"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Gr‘nsefladeudvidelser til Microsoft Windows-netv‘rksobjekter"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM-sk‘rmstyring"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM-printerstyring"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Gr‘nsefladeudvidelser til filkomprimering"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Gr‘nsefladeudvidelse til webudskrift"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Kontekstmenu til kryptering"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Rejsetaske"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal-ikon"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profil"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Sikkerhedsside"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Gr‘nsefladeudvidelse til deling"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-filtype"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto signeringsfiltype"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Netv‘rksforbindelser"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Netv‘rksforbindelser"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scannere og kameraer"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scannere og kameraer"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scannere og kameraer"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scannere og kameraer"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scannere og kameraer"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell-udvidelser til Windows Script Host"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft-dataforbindelse"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Planlagte opgaver"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Proceslinje og menuen Start"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="S›g"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Hj‘lp og support"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Hj‘lp og support"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="K›r..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internettet"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administration"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="V‘rkt›jslinje til Microsoft Internet"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
    "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Webs›gning"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Redigeringsboks til adresse"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft URL-oversigtstjeneste"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="Oversigt"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Velkomstbillede til Internet Explorer 4-suiten"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internettet"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX-cachemappe"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Programstyring"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Opt‘lling af installerede programmer"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Udpakning af miniaturer til GDI+-filer"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Dokumentinfo om miniaturehandler (DOCFILES)"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Udpakning af HTML-miniaturer"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Guiden Webudgivelse"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Bestil billedudskrift over World Wide Web"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objekt til guiden Webudgivelse"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Guiden F† et Passport"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Brugerkonti"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanalfil"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Genvej til kanal"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Mappen Offlinefiler"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Efter &personer..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Webmapper"
    "{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
    "{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
    "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
    "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
    "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
    "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
    "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
    "{B23E1714-8CE4-414A-85CC-8DE71731F284}"=""
    "{B237FD5F-5E4D-4436-91B5-5DB05CBE4508}"=""

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{B23E1714-8CE4-414A-85CC-8DE71731F284}]
    @=&quot;"
    "IDEx"="BM2"

    [HKEY_CLASSES_ROOT\CLSID\{B23E1714-8CE4-414A-85CC-8DE71731F284}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{B23E1714-8CE4-414A-85CC-8DE71731F284}\Implemented

    Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{B23E1714-8CE4-414A-85CC-8DE71731F284}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\mfvbvm60.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{B237FD5F-5E4D-4436-91B5-5DB05CBE4508}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{B237FD5F-5E4D-4436-91B5-5DB05CBE4508}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{B237FD5F-5E4D-4436-91B5-5DB05CBE4508}\Implemented

    Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{B237FD5F-5E4D-4436-91B5-5DB05CBE4508}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\kfdhu.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    authz.dll Wed 2 Mar 2005 20.18.12 A.... 56.832 55,50 K
    browseui.dll Thu 10 Mar 2005 10.04.12 A.... 1.016.832 993,00 K
    cdfview.dll Thu 10 Mar 2005 10.04.12 A.... 151.552 148,00 K
    dnj001~1.dll Sat 30 Apr 2005 17.01.54 ..S.R 235.041 229,53 K
    g604lg~1.dll Tue 26 Apr 2005 22.14.08 ..... 234.654 229,15 K
    iepeers.dll Thu 10 Mar 2005 10.04.12 A.... 250.880 245,00 K
    inseng.dll Thu 10 Mar 2005 10.04.12 A.... 96.768 94,50 K
    j4n20e~1.dll Tue 26 Apr 2005 22.14.12 ..... 233.502 228,03 K
    megina.dll Fri 29 Apr 2005 10.36.28 ..S.R 233.248 227,78 K
    mfvbvm60.dll Sat 30 Apr 2005 20.04.10 ..S.R 233.336 227,87 K
    mshtml.dll Thu 10 Mar 2005 10.04.12 A.... 3.010.560 2,87 M
    msi.dll Mon 21 Mar 2005 15.00.20 A.... 2.890.240 2,75 M
    msihnd.dll Mon 21 Mar 2005 15.00.22 A.... 271.360 265,00 K
    msimsg.dll Mon 21 Mar 2005 15.00.22 A.... 884.736 864,00 K
    msisip.dll Mon 21 Mar 2005 15.00.22 A.... 15.360 15,00 K
    msrating.dll Thu 10 Mar 2005 10.04.12 A.... 146.432 143,00 K
    shdocvw.dll Thu 10 Mar 2005 10.04.14 A.... 1.483.264 1,41 M
    shell32.dll Tue 1 Mar 2005 1.12.34 A.... 8.461.824 8,07 M
    shlwapi.dll Thu 10 Mar 2005 10.04.14 A.... 473.600 462,50 K
    spmsg.dll Thu 24 Feb 2005 19.34.50 ..... 14.560 14,22 K
    srell32.dll Sat 30 Apr 2005 17.00.54 ..S.R 235.041 229,53 K
    urlmon.dll Thu 10 Mar 2005 10.04.14 A.... 605.696 591,50 K
    user32.dll Wed 2 Mar 2005 20.18.14 A.... 577.024 563,50 K
    vjipxspx.dll Thu 28 Apr 2005 21.01.20 ..S.R 233.336 227,87 K
    wininet.dll Thu 10 Mar 2005 10.04.14 A.... 658.432 643,00 K
    winsrv.dll Wed 2 Mar 2005 20.18.14 A.... 291.328 284,50 K

    26 items found: 26 files (5 H/S), 0 directories.
    Total of file sizes: 22.995.438 bytes 21,93 M
    Locate .tmp files:

    No matches found.
    **********************************************************************************
    Directory Listing of system files:
    Disken i drev C har ikke noget navn.
    Diskens serienummer er 6434-EA12

    Indhold af C:\WINDOWS\System32

    30-04-2005 20:04 233.336 mfvbvm60.dll
    30-04-2005 17:01 235.041 dnj0011me.dll
    30-04-2005 17:00 235.041 srell32.dll
    29-04-2005 10:36 233.248 megina.dll
    28-04-2005 21:01 233.336 vjipxspx.dll
    27-04-2005 15:59 <DIR> dllcache
    25-12-2004 19:44 <DIR> Microsoft
    5 fil(er) 1.170.002 byte
    2 mappe(r) 29.212.065.792 byte ledig
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Close any programs you have open since this step requires a reboot.

    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

    IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
  • etcon.dk
    edited April 2005
    L2mfix log:

    L2Mfix 1.03

    Running From:
    C:\Documents and Settings\Administrator\Skrivebord\l2mfix



    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (ID-NI) ALLOW Read BUILTIN\Brugere
    (ID-IO) ALLOW Read BUILTIN\Brugere
    (ID-NI) ALLOW Read BUILTIN\Superbrugere
    (ID-IO) ALLOW Read BUILTIN\Superbrugere
    (ID-NI) ALLOW Full access BUILTIN\Administratorer
    (ID-IO) ALLOW Full access BUILTIN\Administratorer
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER



    Setting registry permissions:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!


    Denying C(CI) access for predefined group "Administrators"
    - adding new ACCESS DENY entry


    Registry Permissions set too:

    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (CI) DENY --C
    BUILTIN\Administratorer
    (ID-NI) ALLOW Read BUILTIN\Brugere
    (ID-IO) ALLOW Read BUILTIN\Brugere
    (ID-NI) ALLOW Read BUILTIN\Superbrugere
    (ID-IO) ALLOW Read BUILTIN\Superbrugere
    (ID-NI) ALLOW Full access BUILTIN\Administratorer
    (ID-IO) ALLOW Full access BUILTIN\Administratorer
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER



    Setting up for Reboot


    Starting Reboot!

    C:\Documents and Settings\Administrator\Skrivebord\l2mfix
    System Rebooted!

    Running From:
    C:\Documents and Settings\Administrator\Skrivebord\l2mfix

    killing explorer and rundll32.exe

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Killing PID 1732 'explorer.exe'
    Killing PID 1732 'explorer.exe'

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Error, Cannot find a process with an image name of rundll32.exe

    Scanning First Pass. Please Wait!

    First Pass Completed

    Second Pass Scanning

    Second pass Completed!
    Backing Up: C:\WINDOWS\system32\dnj0011me.dll
    1 fil(er) kopieret.
    Backing Up: C:\WINDOWS\system32\g604lgdq160e.dll
    1 fil(er) kopieret.
    Backing Up: C:\WINDOWS\system32\j4n20e5oeh.dll
    1 fil(er) kopieret.
    Backing Up: C:\WINDOWS\system32\megina.dll
    1 fil(er) kopieret.
    Backing Up: C:\WINDOWS\system32\mfvbvm60.dll
    1 fil(er) kopieret.
    Backing Up: C:\WINDOWS\system32\srell32.dll
    1 fil(er) kopieret.
    Backing Up: C:\WINDOWS\system32\vjipxspx.dll
    1 fil(er) kopieret.
    deleting: C:\WINDOWS\system32\dnj0011me.dll
    Successfully Deleted: C:\WINDOWS\system32\dnj0011me.dll
    deleting: C:\WINDOWS\system32\g604lgdq160e.dll
    Successfully Deleted: C:\WINDOWS\system32\g604lgdq160e.dll
    deleting: C:\WINDOWS\system32\j4n20e5oeh.dll
    Successfully Deleted: C:\WINDOWS\system32\j4n20e5oeh.dll
    deleting: C:\WINDOWS\system32\megina.dll
    Successfully Deleted: C:\WINDOWS\system32\megina.dll
    deleting: C:\WINDOWS\system32\mfvbvm60.dll
    Successfully Deleted: C:\WINDOWS\system32\mfvbvm60.dll
    deleting: C:\WINDOWS\system32\srell32.dll
    Successfully Deleted: C:\WINDOWS\system32\srell32.dll
    deleting: C:\WINDOWS\system32\vjipxspx.dll
    Successfully Deleted: C:\WINDOWS\system32\vjipxspx.dll


    Zipping up files for submission:
    adding: dnj0011me.dll (164 bytes security) (deflated 5%)
    adding: g604lgdq160e.dll (164 bytes security) (deflated 5%)
    adding: j4n20e5oeh.dll (164 bytes security) (deflated 4%)
    adding: megina.dll (164 bytes security) (deflated 4%)
    adding: mfvbvm60.dll (164 bytes security) (deflated 4%)
    adding: srell32.dll (164 bytes security) (deflated 5%)
    adding: vjipxspx.dll (164 bytes security) (deflated 4%)
    adding: clear.reg (164 bytes security) (deflated 37%)
    adding: echo.reg (164 bytes security) (deflated 11%)
    adding: direct.txt (164 bytes security) (stored 0%)
    adding: lo2.txt (164 bytes security) (deflated 77%)
    adding: readme.txt (164 bytes security) (deflated 49%)
    adding: report.txt (164 bytes security) (deflated 61%)
    adding: report_1.txt (164 bytes security) (deflated 61%)
    adding: test.txt (164 bytes security) (deflated 65%)
    adding: test2.txt (164 bytes security) (deflated 17%)
    adding: test3.txt (164 bytes security) (deflated 17%)
    adding: test5.txt (164 bytes security) (deflated 17%)
    adding: xfind.txt (164 bytes security) (deflated 59%)
    adding: backregs/B237FD5F-5E4D-4436-91B5-5DB05CBE4508.reg (164 bytes security) (deflated 70%)
    adding: backregs/B23E1714-8CE4-414A-85CC-8DE71731F284.reg (164 bytes security) (deflated 69%)
    adding: backregs/shell.reg (164 bytes security) (deflated 73%)

    Restoring Registry Permissions:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!


    Revoking access for predefined group "Administrators"
    Inherited ACE can not be revoked here!
    Inherited ACE can not be revoked here!


    Registry permissions set too:

    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (ID-NI) ALLOW Read BUILTIN\Brugere
    (ID-IO) ALLOW Read BUILTIN\Brugere
    (ID-NI) ALLOW Read BUILTIN\Superbrugere
    (ID-IO) ALLOW Read BUILTIN\Superbrugere
    (ID-NI) ALLOW Full access BUILTIN\Administratorer
    (ID-IO) ALLOW Full access BUILTIN\Administratorer
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER


    Restoring Sedebugprivilege:

    Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1789

    deleting local copy: dnj0011me.dll
    deleting local copy: g604lgdq160e.dll
    deleting local copy: j4n20e5oeh.dll
    deleting local copy: megina.dll
    deleting local copy: mfvbvm60.dll
    deleting local copy: srell32.dll
    deleting local copy: vjipxspx.dll

    The following Is the Current Export of the Winlogon notify key:
    ****************************************************************************
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
    "Asynchronous"=dword:00000000
    "DllName"=""
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"


    The following are the files found:
    ****************************************************************************
    C:\WINDOWS\system32\dnj0011me.dll
    C:\WINDOWS\system32\g604lgdq160e.dll
    C:\WINDOWS\system32\j4n20e5oeh.dll
    C:\WINDOWS\system32\megina.dll
    C:\WINDOWS\system32\mfvbvm60.dll
    C:\WINDOWS\system32\srell32.dll
    C:\WINDOWS\system32\vjipxspx.dll

    Registry Entries that were Deleted:
    Please verify that the listing looks ok.
    If there was something deleted wrongly there are backups in the backreg folder.
    ****************************************************************************
    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{B23E1714-8CE4-414A-85CC-8DE71731F284}"=-
    "{B237FD5F-5E4D-4436-91B5-5DB05CBE4508}"=-
    [-HKEY_CLASSES_ROOT\CLSID\{B23E1714-8CE4-414A-85CC-8DE71731F284}]
    [-HKEY_CLASSES_ROOT\CLSID\{B237FD5F-5E4D-4436-91B5-5DB05CBE4508}]
    REGEDIT4

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "SV1"=""
    ****************************************************************************
    Desktop.ini Contents:
    ****************************************************************************
    ****************************************************************************





    HJT log:

    Logfile of HijackThis v1.99.1
    Scan saved at 01:32:05, on 01-05-2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programmer\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
    C:\Programmer\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
    C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE
    C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe
    C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe
    C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
    C:\Programmer\Messenger\msmsgs.exe
    C:\Programmer\Babylon\Babylon.exe
    C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programmer\Skype\Phone\Skype.exe
    C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Programmer\Network Associates\VirusScan\mcshield.exe
    C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
    C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Programmer\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Programmer\Google\Google Desktop Search\GoogleDesktopIndex.exe
    C:\Programmer\Google\Google Desktop Search\GoogleDesktopCrawl.exe
    C:\Programmer\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my3.statcounter.com/project/standard/stats.php?project_id=665863&PHPSESSID=4be4622e653086816338ec425fddaa0e
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
    O4 - HKLM\..\Run: [FLMLABTECMOUSE] C:\Programmer\Labtec\Labtec Mouse Software\2.0\mouse32a.exe
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Programmer\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programmer\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programmer\Fælles filer\Network Associates\TalkBack\tbmon.exe"
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programmer\Creative\Shared Files\CAMTRAY.EXE
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Babylon Translator] C:\Programmer\Babylon\Babylon.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [Skype] "C:\Programmer\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Google Desktop Search] "C:\Programmer\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKCU\..\Run: [HijackThis startup scan] C:\Programmer\HijackThis\HijackThis.exe /startupscan
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
    O4 - Global Startup: VPN Client.lnk = ?
    O8 - Extra context menu item: &Google Search - res://c:\programmer\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\programmer\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\programmer\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\programmer\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\programmer\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
    O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {79E0C1C0-316D-11D5-A72A-006097BFA1AC} (EPSON Web Printer-SelfTest Control Class) - http://support.epson-europe.com/selftest/Prg/ESTPTest.cab
    O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
    O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
    O16 - DPF: {F9043C85-F6F2-101A-A3C9-08002B2F49FB} (Microsoft Common Dialog Control, version 5.0 (SP2)) - file://C:\Programmer\OpenCube\NavStudio\program\comdlg32.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = localdom.net
    O17 - HKLM\Software\..\Telephony: DomainName = localdom.net
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = localdom.net
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programmer\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programmer\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programmer\Network Associates\VirusScan\vstskmgr.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programmer\Sygate\SPF\smc.exe

    Thanks for quick responce
    Regards etcon.dk
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited April 2005
    Your log is clean. Are you having any more problems?
  • etcon.dk
    edited May 2005
    Dear Buckeye_Sam,

    Thank your for your professional and efficient help. It was great!

    If you can tell me how I can protect my PC from future attacks I will be very obliged to follow your advice.

    Can you tell me how much of windows services and / or broadcast traffic I shall allow or block?

    Thank a lot for your help.

    etcon.dk
  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited May 2005
    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
  • etcon.dk
    edited May 2005
    Hi,

    Thanks a lot for helping me to resolve my problems

    Good luck

    etcon.dk
This discussion has been closed.