Options

HELP ME!!!!!!!!serious pop ups problem

Unknown
edited November 2005 in Spyware & Virus Removal
im beeing attacked by series of pop ups....can anyone help me fix it???
im beginning to be desperate.... :o


here is my hijackthis log:


Logfile of HijackThis v1.99.1
Scan saved at 19:17:44, on 01.11.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
C:\Progra~1\Launch Manager\LaunchAp.exe
C:\Progra~1\Launch Manager\PowerKey.exe
C:\Progra~1\Launch Manager\HotkeyApp.exe
C:\Progra~1\Launch Manager\CtrlVol.exe
C:\Progra~1\Launch Manager\Wbutton.exe
C:\Programfiler\Telenor\ecc\ecc.exe
C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\Messenger\msmsgs.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
C:\Programfiler\ewido\security suite\ewidoctrl.exe
C:\Programfiler\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\ntvdm.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WINPAT~1.EXE
C:\Programfiler\Internet Explorer\iexplore.exe
C:\PROGRAMFILER\INTERNET EXPLORER\IEXPLORE.EXE
C:\Documents and Settings\anette vågslid\Skrivebord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vg.no/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R3 - Default URLSearchHook is missing
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [ecc] C:\Programfiler\Telenor\ecc\ecc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ChkMail] è<9
O4 - HKCU\..\Run: [LineOfSightVietnamSetup.exe] C:\DOCUME~1\ANETTE~1\SKRIVE~1\instl\LINEOF~1.EXE /r
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programfiler\Spyware Doctor\swdoctor.exe" /Q
O8 - Extra context menu item: &Google Search - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\n66qlgj516o.dll (file missing)
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\m6lslg3716.dll (file missing)
O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\cgccu796.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programfiler\ewido\security suite\ewidoctrl.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programfiler\Spyware Doctor\sdhelp.exe

Comments

  • TroganTrogan London, UK
    edited November 2005
    Download L2mfix from one of these two locations:

    http://www.atribune.org/downloads/l2mfix.exe
    http://www.downloads.subratam.org/l2mfix.exe

    Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

    IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
  • j582
    edited November 2005
    thank you for helping me.

    her is the content of the log:

    L2MFIX find log 1.04a
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Group Policy]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\cgccu796.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ModuleUsage]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\n66qlgj516o.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellServiceObjectDelayLoad]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\m6lslg3716.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (NI) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (IO) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (ID-NI) ALLOW Read BUILTIN\Brukere
    (ID-IO) ALLOW Read BUILTIN\Brukere
    (ID-NI) ALLOW Read BUILTIN\Privilegerte brukere
    (ID-IO) ALLOW Read BUILTIN\Privilegerte brukere
    (ID-NI) ALLOW Full access BUILTIN\Administratorer
    (ID-IO) ALLOW Full access BUILTIN\Administratorer
    (ID-NI) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (ID-IO) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (ID-IO) ALLOW Full access OPPRETTER EIER


    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{633427CC-548C-3391-3271-CCBA959F7CC8}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Egenskapsside for multimediefil"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM skannerbehandling"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS-sikkerhetsside"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Egenskapsside for OLE DOC-fil"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Skallutvidelse for deling"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermkort"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermtype"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermpanorering"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS-sikkerhetsside"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Kompatibilitetsside"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Diskkopieringsutvidelse"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Skallutvidelser for Microsoft Windows-nettverksobjekter"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM skjermbehandling"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM skriverbehandling"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Skallutvidelser for filkomprimering"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Skallutvidelse for Web-skriver"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Hurtigmeny for kryptering"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Koffert"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Ikonutvidelse for HyperTerminal"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Skrifter"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profil"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Skriversikkerhetsside"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Skallutvidelse for deling"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-utvidelse"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign-utvidelse"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Nettverkstilkoblinger"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Nettverkstilkoblinger"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Skannere og kameraer"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Skannere og kameraer"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="Skannere og kameraer"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Skannere og kameraer"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Skannere og kameraer"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Skallutvidelser for Windows Script Host"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft-datakobling"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Planlagte oppgaver"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Oppgavelinje og Start-meny"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="S›k"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Hjelp og st›tte"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Hjelp og st›tte"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Kj›r..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internett"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-post"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative verkt›y"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internett-verkt›ylinje"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Nedlastingsstatus"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="B†ndproxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
    "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft-tjeneste for tidligere URL-adresser"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="Logg"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Midlertidige Internett-filer"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Midlertidige Internett-filer"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft-binding for URL-s›k"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Velkomstbilde for Internet Explorer 4.0"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internett"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-b†nd"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="Mappe for ActiveX-hurtigbuffer"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Abonnementsmappe"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Behandling av skallprogrammer"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Enumerator for installerte programmer"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin Programpubliserer"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Uttrekking av miniatyrbilder i GDI+-filer"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Behandling av informasjon om miniatyrbilder"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Uttrekking av HTML-miniatyrbilder"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Veiviser for Web-publisering"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Bestille utskrifter via Weben"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Veiviserobjekt for skallpublisering"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="F† en passport-veiviser"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Brukerkontoer"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanalfil"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Kanalsnarvei"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Kanalbehandlingsobjekt"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Mappe for Frakoblede filer"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Etter &personer..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
    "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
    "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
    "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
    "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
    "{72869F50-472A-43BB-BE91-D0294277AA2D}"=""
    "{0588B48D-FE08-4D0B-A155-F84FE9737130}"=""
    "{881C9897-1D4C-4FEA-940E-2EA653A0E46E}"=""
    "{CAAF7200-0F2C-419D-8D92-E67880240A73}"=""
    "{D3886080-B0D7-4114-9557-140872036D5C}"=""
    "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
    "{8E67C19E-AF86-4882-9799-346CD52F2AAC}"=""

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}]
    @=&quot;"
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\egent97.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\mrastmib.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\rmfsaps.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\ijfxhk.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\wwnipsec.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\cgccu796.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    wininet.dll Sat 3 Sep 2005 1:55:08 A.... 657 920 642,50 K
    urlmon.dll Sat 3 Sep 2005 1:55:08 A.... 603 648 589,50 K
    shlwapi.dll Sat 3 Sep 2005 1:55:06 A.... 473 600 462,50 K
    shdocvw.dll Sat 3 Sep 2005 1:55:06 A.... 1 484 288 1,41 M
    pngfilt.dll Sat 3 Sep 2005 1:55:04 A.... 39 424 38,50 K
    mstime.dll Sat 3 Sep 2005 1:55:04 A.... 530 432 518,00 K
    msrating.dll Sat 3 Sep 2005 1:55:04 A.... 146 432 143,00 K
    mshtmled.dll Sat 3 Sep 2005 1:55:02 A.... 448 512 438,00 K
    mshtml.dll Tue 4 Oct 2005 17:27:36 A.... 3 013 120 2,87 M
    inseng.dll Sat 3 Sep 2005 1:55:00 A.... 96 768 94,50 K
    iepeers.dll Sat 3 Sep 2005 1:54:58 A.... 251 392 245,50 K
    dxtrans.dll Sat 3 Sep 2005 1:54:58 A.... 205 312 200,50 K
    danim.dll Sat 3 Sep 2005 1:54:58 A.... 1 054 208 1,00 M
    cdfview.dll Sat 3 Sep 2005 1:54:56 A.... 151 552 148,00 K
    browseui.dll Sat 3 Sep 2005 1:54:56 A.... 1 019 904 996,00 K
    extmgr.dll Sat 3 Sep 2005 1:54:58 ..... 55 808 54,50 K
    cdosys.dll Sat 10 Sep 2005 3:55:36 A.... 2 067 968 1,97 M
    hr4605~1.dll Thu 27 Oct 2005 18:11:04 ..S.R 234 746 229,24 K
    wwnipsec.dll Wed 26 Oct 2005 18:08:00 ..S.R 236 052 230,52 K
    mxise.dll Sat 29 Oct 2005 13:31:28 ..S.R 236 750 231,20 K
    cjcui.dll Thu 27 Oct 2005 22:40:52 ..S.R 234 101 228,61 K
    uwer32.dll Sun 30 Oct 2005 12:06:24 ..S.R 236 750 231,20 K
    cgccu796.dll Tue 1 Nov 2005 17:58:02 ..S.R 236 750 231,20 K
    mpisam11.dll Tue 1 Nov 2005 18:42:22 ..... 236 750 231,20 K
    kedmlt47.dll Tue 1 Nov 2005 19:31:28 ..S.R 236 750 231,20 K
    dnru01~1.dll Sat 29 Oct 2005 13:27:34 ..S.R 236 041 230,51 K
    sirenacm.dll Mon 19 Sep 2005 7:00:34 A.... 119 856 117,05 K
    m6nqlg~1.dll Wed 26 Oct 2005 20:01:00 ..S.R 236 052 230,52 K
    dpu11.dll Tue 9 Aug 2005 23:12:28 A.... 245 760 240,00 K
    dpus11.dll Tue 9 Aug 2005 23:12:28 A.... 303 104 296,00 K
    k0pmla~1.dll Tue 1 Nov 2005 16:45:04 ..S.R 237 119 231,56 K
    dpugui11.dll Tue 9 Aug 2005 23:12:30 A.... 581 632 568,00 K
    dpv11.dll Tue 9 Aug 2005 23:12:28 A.... 57 344 56,00 K
    qt-dx331.dll Tue 9 Aug 2005 23:12:30 A.... 3 596 288 3,43 M
    libeay32.dll Tue 9 Aug 2005 23:13:32 A.... 831 488 812,00 K
    ssleay32.dll Tue 9 Aug 2005 23:13:32 A.... 159 744 156,00 K
    unicows.dll Tue 9 Aug 2005 23:13:32 A.... 245 408 239,66 K
    dpl100.dll Tue 9 Aug 2005 23:12:30 A.... 86 016 84,00 K
    dtu100.dll Tue 9 Aug 2005 23:12:30 A.... 200 704 196,00 K
    divx.dll Tue 9 Aug 2005 23:14:00 A.... 692 736 676,50 K
    divx_x~1.dll Tue 9 Aug 2005 23:13:52 A.... 688 128 672,00 K
    divx_x~2.dll Tue 9 Aug 2005 23:13:54 A.... 688 128 672,00 K
    divx_x~3.dll Tue 9 Aug 2005 23:13:52 A.... 671 744 656,00 K
    umpnpmgr.dll Tue 23 Aug 2005 5:40:32 A.... 123 904 121,00 K
    quartz.dll Tue 30 Aug 2005 5:56:40 A.... 1 290 240 1,23 M
    winsrv.dll Thu 1 Sep 2005 4:28:08 A.... 291 840 285,00 K
    shell32.dll Fri 23 Sep 2005 5:07:48 A.... 8 456 704 8,06 M
    linkinfo.dll Thu 1 Sep 2005 4:28:08 A.... 19 968 19,50 K
    netman.dll Mon 22 Aug 2005 20:36:20 A.... 197 632 193,00 K
    nwwks.dll Thu 11 Aug 2005 17:12:32 A.... 65 024 63,50 K

    50 items found: 50 files (10 H/S), 0 directories.
    Total of file sizes: 34 511 541 bytes 32,91 M
    Locate .tmp files:

    C:\WINDOWS\SYSTEM32\
    guard.tmp Tue 1 Nov 2005 18:12:02 ..S.R 236 750 231,20 K

    1 item found: 1 file (1 H/S), 0 directories.
    Total of file sizes: 236 750 bytes 231,20 K
    **********************************************************************************
    Directory Listing of system files:
    Volumet i stasjon C er ACER
    Volumserienummeret er 2360-10D5

    Innhold i C:\WINDOWS\System32

    01.11.2005 19:31 236ÿ750 kedmlt47.dll
    01.11.2005 18:12 236ÿ750 guard.tmp
    01.11.2005 17:58 236ÿ750 cgccu796.dll
    01.11.2005 16:45 237ÿ119 k0pmla711d.dll
    30.10.2005 12:06 236ÿ750 uwer32.dll
    29.10.2005 13:31 236ÿ750 mxise.dll
    29.10.2005 13:27 236ÿ041 dnru0199e.dll
    27.10.2005 22:40 234ÿ101 cjcui.dll
    27.10.2005 18:11 234ÿ746 hr4605hse.dll
    26.10.2005 20:01 236ÿ052 m6nqlg5516.dll
    26.10.2005 18:08 236ÿ052 wwnipsec.dll
    18.09.2005 14:57 5 AuxDrv32ds_g.ods
    16.06.2003 09:13 <DIR> Microsoft
    16.06.2003 08:53 <DIR> dllcache
    12 fil(er) 2ÿ597ÿ866 byte
    2 mappe(r) 1ÿ797ÿ046ÿ272 byte ledig
  • TroganTrogan London, UK
    edited November 2005
    Close any programs you have open since this step requires a reboot.

    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

    IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
  • j582
    edited November 2005
    i did what u said... but a new log did not appear after rebooting..
  • j582
    edited November 2005
    L2MFIX find log 1.04a
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ModuleUsage]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\n66qlgj516o.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "PostShell"="SensPostShellEvent"
    "Disconnect"="SensDisconnectEvent"
    "Reconnect"="SensReconnectEvent"
    "Unlock"="SensUnlockEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ShellServiceObjectDelayLoad]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\m6lslg3716.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "Logoff"="TSEventLogoff"
    "Logon"="TSEventLogon"
    "PostShell"="TSEventPostShell"
    "Shutdown"="TSEventShutdown"
    "StartShell"="TSEventStartShell"
    "Startup"="TSEventStartup"
    "MaxWait"=dword:00000258
    "Reconnect"="TSEventReconnect"
    "Disconnect"="TSEventDisconnect"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName"="wlnotify.dll"
    "Logon"="RegisterTicketExpiredNotificationEvent"
    "Logoff"="UnregisterTicketExpiredNotificationEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
    "DLLName"="wzcdlg.dll"
    "Logon"="WZCEventLogon"
    "Logoff"="WZCEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000000


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (CI) DENY --C
    BUILTIN\Administratorer
    (NI) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (IO) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (ID-NI) ALLOW Read BUILTIN\Brukere
    (ID-IO) ALLOW Read BUILTIN\Brukere
    (ID-NI) ALLOW Read BUILTIN\Privilegerte brukere
    (ID-IO) ALLOW Read BUILTIN\Privilegerte brukere
    (ID-NI) ALLOW Full access BUILTIN\Administratorer
    (ID-IO) ALLOW Full access BUILTIN\Administratorer
    (ID-NI) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (ID-IO) ALLOW Full access NT-MYNDIGHET\SYSTEM
    (ID-IO) ALLOW Full access OPPRETTER EIER


    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{C09318B6-5275-909B-A4D3-9F12B4D3EE41}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Egenskapsside for multimediefil"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM skannerbehandling"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS-sikkerhetsside"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Egenskapsside for OLE DOC-fil"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Skallutvidelse for deling"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermkort"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermtype"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Kontrollpanelsutvidelse for skjermpanorering"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS-sikkerhetsside"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Kompatibilitetsside"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Diskkopieringsutvidelse"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Skallutvidelser for Microsoft Windows-nettverksobjekter"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM skjermbehandling"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM skriverbehandling"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Skallutvidelser for filkomprimering"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Skallutvidelse for Web-skriver"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Hurtigmeny for kryptering"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Koffert"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Ikonutvidelse for HyperTerminal"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Skrifter"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC-profil"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Skriversikkerhetsside"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Skallutvidelse for deling"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO-utvidelse"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign-utvidelse"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Nettverkstilkoblinger"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Nettverkstilkoblinger"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Skannere og kameraer"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Skannere og kameraer"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="Skannere og kameraer"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Skannere og kameraer"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Skannere og kameraer"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Skallutvidelser for Windows Script Host"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft-datakobling"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Planlagte oppgaver"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Oppgavelinje og Start-meny"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="S›k"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Hjelp og st›tte"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Hjelp og st›tte"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Kj›r..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internett"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-post"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative verkt›y"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internett-verkt›ylinje"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Nedlastingsstatus"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="B†ndproxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
    "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft-tjeneste for tidligere URL-adresser"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="Logg"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Midlertidige Internett-filer"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Midlertidige Internett-filer"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft-binding for URL-s›k"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Velkomstbilde for Internet Explorer 4.0"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internett"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer-b†nd"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="Mappe for ActiveX-hurtigbuffer"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Abonnementsmappe"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Behandling av skallprogrammer"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Enumerator for installerte programmer"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin Programpubliserer"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Uttrekking av miniatyrbilder i GDI+-filer"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Behandling av informasjon om miniatyrbilder"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Uttrekking av HTML-miniatyrbilder"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Veiviser for Web-publisering"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Bestille utskrifter via Weben"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Veiviserobjekt for skallpublisering"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="F† en passport-veiviser"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Brukerkontoer"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Kanalfil"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Kanalsnarvei"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Kanalbehandlingsobjekt"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Mappe for Frakoblede filer"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Etter &personer..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
    "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
    "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
    "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
    "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
    "{72869F50-472A-43BB-BE91-D0294277AA2D}"=""
    "{0588B48D-FE08-4D0B-A155-F84FE9737130}"=""
    "{881C9897-1D4C-4FEA-940E-2EA653A0E46E}"=""
    "{CAAF7200-0F2C-419D-8D92-E67880240A73}"=""
    "{D3886080-B0D7-4114-9557-140872036D5C}"=""
    "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
    "{8E67C19E-AF86-4882-9799-346CD52F2AAC}"=""

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}]
    @=&quot;"
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{72869F50-472A-43BB-BE91-D0294277AA2D}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\egent97.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{0588B48D-FE08-4D0B-A155-F84FE9737130}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\mrastmib.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{881C9897-1D4C-4FEA-940E-2EA653A0E46E}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\rmfsaps.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{CAAF7200-0F2C-419D-8D92-E67880240A73}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\ijfxhk.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D3886080-B0D7-4114-9557-140872036D5C}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\wwnipsec.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{8E67C19E-AF86-4882-9799-346CD52F2AAC}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\cgccu796.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    wininet.dll Sat 3 Sep 2005 1:55:08 A.... 657 920 642,50 K
    urlmon.dll Sat 3 Sep 2005 1:55:08 A.... 603 648 589,50 K
    shlwapi.dll Sat 3 Sep 2005 1:55:06 A.... 473 600 462,50 K
    shdocvw.dll Sat 3 Sep 2005 1:55:06 A.... 1 484 288 1,41 M
    pngfilt.dll Sat 3 Sep 2005 1:55:04 A.... 39 424 38,50 K
    mstime.dll Sat 3 Sep 2005 1:55:04 A.... 530 432 518,00 K
    msrating.dll Sat 3 Sep 2005 1:55:04 A.... 146 432 143,00 K
    mshtmled.dll Sat 3 Sep 2005 1:55:02 A.... 448 512 438,00 K
    mshtml.dll Tue 4 Oct 2005 17:27:36 A.... 3 013 120 2,87 M
    inseng.dll Sat 3 Sep 2005 1:55:00 A.... 96 768 94,50 K
    iepeers.dll Sat 3 Sep 2005 1:54:58 A.... 251 392 245,50 K
    dxtrans.dll Sat 3 Sep 2005 1:54:58 A.... 205 312 200,50 K
    danim.dll Sat 3 Sep 2005 1:54:58 A.... 1 054 208 1,00 M
    cdfview.dll Sat 3 Sep 2005 1:54:56 A.... 151 552 148,00 K
    browseui.dll Sat 3 Sep 2005 1:54:56 A.... 1 019 904 996,00 K
    extmgr.dll Sat 3 Sep 2005 1:54:58 ..... 55 808 54,50 K
    cdosys.dll Sat 10 Sep 2005 3:55:36 A.... 2 067 968 1,97 M
    hr4605~1.dll Thu 27 Oct 2005 18:11:04 ..S.R 234 746 229,24 K
    wwnipsec.dll Wed 26 Oct 2005 18:08:00 ..S.R 236 052 230,52 K
    mxise.dll Sat 29 Oct 2005 13:31:28 ..S.R 236 750 231,20 K
    cjcui.dll Thu 27 Oct 2005 22:40:52 ..S.R 234 101 228,61 K
    uwer32.dll Sun 30 Oct 2005 12:06:24 ..S.R 236 750 231,20 K
    cgccu796.dll Tue 1 Nov 2005 17:58:02 ..S.R 236 750 231,20 K
    mpisam11.dll Tue 1 Nov 2005 18:42:22 ..... 236 750 231,20 K
    kedmlt47.dll Tue 1 Nov 2005 19:31:28 ..S.R 236 750 231,20 K
    dnru01~1.dll Sat 29 Oct 2005 13:27:34 ..S.R 236 041 230,51 K
    kidlt.dll Tue 1 Nov 2005 19:49:18 ..S.R 236 750 231,20 K
    izfxexps.dll Tue 1 Nov 2005 19:56:18 ..S.R 236 750 231,20 K
    sirenacm.dll Mon 19 Sep 2005 7:00:34 A.... 119 856 117,05 K
    m6nqlg~1.dll Wed 26 Oct 2005 20:01:00 ..S.R 236 052 230,52 K
    dpu11.dll Tue 9 Aug 2005 23:12:28 A.... 245 760 240,00 K
    dpus11.dll Tue 9 Aug 2005 23:12:28 A.... 303 104 296,00 K
    k0pmla~1.dll Tue 1 Nov 2005 16:45:04 ..S.R 237 119 231,56 K
    dpugui11.dll Tue 9 Aug 2005 23:12:30 A.... 581 632 568,00 K
    dpv11.dll Tue 9 Aug 2005 23:12:28 A.... 57 344 56,00 K
    qt-dx331.dll Tue 9 Aug 2005 23:12:30 A.... 3 596 288 3,43 M
    libeay32.dll Tue 9 Aug 2005 23:13:32 A.... 831 488 812,00 K
    ssleay32.dll Tue 9 Aug 2005 23:13:32 A.... 159 744 156,00 K
    unicows.dll Tue 9 Aug 2005 23:13:32 A.... 245 408 239,66 K
    dpl100.dll Tue 9 Aug 2005 23:12:30 A.... 86 016 84,00 K
    dtu100.dll Tue 9 Aug 2005 23:12:30 A.... 200 704 196,00 K
    divx.dll Tue 9 Aug 2005 23:14:00 A.... 692 736 676,50 K
    divx_x~1.dll Tue 9 Aug 2005 23:13:52 A.... 688 128 672,00 K
    divx_x~2.dll Tue 9 Aug 2005 23:13:54 A.... 688 128 672,00 K
    divx_x~3.dll Tue 9 Aug 2005 23:13:52 A.... 671 744 656,00 K
    umpnpmgr.dll Tue 23 Aug 2005 5:40:32 A.... 123 904 121,00 K
    quartz.dll Tue 30 Aug 2005 5:56:40 A.... 1 290 240 1,23 M
    winsrv.dll Thu 1 Sep 2005 4:28:08 A.... 291 840 285,00 K
    shell32.dll Fri 23 Sep 2005 5:07:48 A.... 8 456 704 8,06 M
    linkinfo.dll Thu 1 Sep 2005 4:28:08 A.... 19 968 19,50 K
    netman.dll Mon 22 Aug 2005 20:36:20 A.... 197 632 193,00 K
    nwwks.dll Thu 11 Aug 2005 17:12:32 A.... 65 024 63,50 K

    52 items found: 52 files (12 H/S), 0 directories.
    Total of file sizes: 34 985 041 bytes 33,36 M
    Locate .tmp files:

    C:\WINDOWS\SYSTEM32\
    guard.tmp Tue 1 Nov 2005 18:12:02 ..S.R 236 750 231,20 K

    1 item found: 1 file (1 H/S), 0 directories.
    Total of file sizes: 236 750 bytes 231,20 K
    **********************************************************************************
    Directory Listing of system files:
    Volumet i stasjon C er ACER
    Volumserienummeret er 2360-10D5

    Innhold i C:\WINDOWS\System32

    01.11.2005 19:56 236ÿ750 izfxexps.dll
    01.11.2005 19:49 236ÿ750 kidlt.dll
    01.11.2005 19:31 236ÿ750 kedmlt47.dll
    01.11.2005 18:12 236ÿ750 guard.tmp
    01.11.2005 17:58 236ÿ750 cgccu796.dll
    01.11.2005 16:45 237ÿ119 k0pmla711d.dll
    30.10.2005 12:06 236ÿ750 uwer32.dll
    29.10.2005 13:31 236ÿ750 mxise.dll
    29.10.2005 13:27 236ÿ041 dnru0199e.dll
    27.10.2005 22:40 234ÿ101 cjcui.dll
    27.10.2005 18:11 234ÿ746 hr4605hse.dll
    26.10.2005 20:01 236ÿ052 m6nqlg5516.dll
    26.10.2005 18:08 236ÿ052 wwnipsec.dll
    18.09.2005 14:57 5 AuxDrv32ds_g.ods
    16.06.2003 09:13 <DIR> Microsoft
    16.06.2003 08:53 <DIR> dllcache
    14 fil(er) 3ÿ071ÿ366 byte
    2 mappe(r) 1ÿ795ÿ981ÿ312 byte ledig
  • TroganTrogan London, UK
    edited November 2005
    Post a new HJT log.
  • j582
    edited November 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 20:00:27, on 01.11.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\CTSvcCDA.EXE
    C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
    C:\Programfiler\ewido\security suite\ewidoctrl.exe
    C:\Programfiler\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    C:\Progra~1\Launch Manager\LaunchAp.exe
    C:\Progra~1\Launch Manager\PowerKey.exe
    C:\Progra~1\Launch Manager\HotkeyApp.exe
    C:\Progra~1\Launch Manager\CtrlVol.exe
    C:\Progra~1\Launch Manager\Wbutton.exe
    C:\Programfiler\Telenor\ecc\ecc.exe
    C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
    C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programfiler\Messenger\msmsgs.exe
    C:\Programfiler\MSN Messenger\MsnMsgr.Exe
    C:\Programfiler\Spyware Doctor\swdoctor.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Programfiler\Internet Explorer\iexplore.exe
    C:\Documents and Settings\anette vågslid\Skrivebord\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vg.no/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R3 - Default URLSearchHook is missing
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exe
    O4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"
    O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exe
    O4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exe
    O4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"
    O4 - HKLM\..\Run: [ecc] C:\Programfiler\Telenor\ecc\ecc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ChkMail] è<9
    O4 - HKCU\..\Run: [LineOfSightVietnamSetup.exe] C:\DOCUME~1\ANETTE~1\SKRIVE~1\instl\LINEOF~1.EXE /r
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programfiler\Spyware Doctor\swdoctor.exe" /Q
    O8 - Extra context menu item: &Google Search - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\n66qlgj516o.dll (file missing)
    O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\m6lslg3716.dll (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Programfiler\ewido\security suite\ewidoctrl.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programfiler\Spyware Doctor\sdhelp.exe
  • TroganTrogan London, UK
    edited November 2005
    Please move HJT to its own folder on your C: so backups can be created. Do this before continuing.
    ===

    Check the following in HJT and click 'Fix Checked'

    R3 - Default URLSearchHook is missing

    O4 - HKCU\..\Run: [ChkMail] è<9
    O4 - HKCU\..\Run: [LineOfSightVietnamSetup.exe] C:\DOCUME~1\ANETTE~1\SKRIVE~1\instl\LINEOF~1.EXE /r
    ===

    Download Ewido Security Suite
    • Install ewido security suite
    • When installing, under "Additional Options" uncheck..
      • Install background guard
      • Install scan via context menu
    • Launch ewido, there should be an icon on your desktop, double-click it.
    • You will need to update ewido to the latest definition files.
      • On the left hand side of the main screen click update.
      • Then click on Start Update.
    • The update will start and a progress bar will show the updates being installed.
      (the status bar at the bottom will display "Update successful")
    • Now, scan with it by clicking 'Scanner' on the left and choosing 'Complete System Scan'
    ===

    Post a new HJT log :)
  • j582
    edited November 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 20:36:29, on 01.11.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\CTSvcCDA.EXE
    C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
    C:\Programfiler\Spyware Doctor\sdhelp.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    C:\Progra~1\Launch Manager\LaunchAp.exe
    C:\Progra~1\Launch Manager\PowerKey.exe
    C:\Progra~1\Launch Manager\HotkeyApp.exe
    C:\Progra~1\Launch Manager\CtrlVol.exe
    C:\Progra~1\Launch Manager\Wbutton.exe
    C:\Programfiler\Telenor\ecc\ecc.exe
    C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
    C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programfiler\Messenger\msmsgs.exe
    C:\Programfiler\MSN Messenger\MsnMsgr.Exe
    C:\Programfiler\Spyware Doctor\swdoctor.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Programfiler\Internet Explorer\iexplore.exe
    C:\Programfiler\ewido\security suite\ewidoctrl.exe
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vg.no/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R3 - Default URLSearchHook is missing
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exe
    O4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"
    O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exe
    O4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exe
    O4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"
    O4 - HKLM\..\Run: [ecc] C:\Programfiler\Telenor\ecc\ecc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programfiler\Spyware Doctor\swdoctor.exe" /Q
    O8 - Extra context menu item: &Google Search - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\n66qlgj516o.dll (file missing)
    O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\m6lslg3716.dll (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Programfiler\ewido\security suite\ewidoctrl.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programfiler\Spyware Doctor\sdhelp.exe
  • j582
    edited November 2005
    ok... i did what u said...my new log is above
  • TroganTrogan London, UK
    edited November 2005
    Remove this with HJT:

    R3 - Default URLSearchHook is missing
    ===

    Scan your PC with the following:

    Panda Activescan

    There maybe files that cannot be removed. Post them here.
    ===

    You need to get yourself an Anti-Virus. There are some FREE good ones available, just let me know.

    Post a new HJT log :)
  • j582
    edited November 2005
    the scan is workings its way through the pc now.. which free vrus protection programs do you recommend???

    im really happy for all help you been giving me..
    thanx,

    j582
  • TroganTrogan London, UK
    edited November 2005
    I'l give you a list of instructions you can follow to stay more secure once your comp is clean.

    For an Anti-Virus, get AVG Free Edition. Its a good Anti-Virus that won't slow your computer plus its FREE. :D
  • j582
    edited November 2005
    Logfile of HijackThis v1.99.1
    Scan saved at 23:52:59, on 01.11.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe
    C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
    C:\WINDOWS\Explorer.EXE
    C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\AVENGINE.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\apvxdwin.exe
    c:\programfiler\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\CTSvcCDA.EXE
    C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
    C:\Programfiler\ewido\security suite\ewidoctrl.exe
    C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
    C:\Programfiler\Fellesfiler\Panda Software\PavShld\pavprsrv.exe
    C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
    C:\Programfiler\Spyware Doctor\sdhelp.exe
    C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\WebProxy.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    C:\Progra~1\Launch Manager\LaunchAp.exe
    C:\Progra~1\Launch Manager\PowerKey.exe
    C:\Progra~1\Launch Manager\HotkeyApp.exe
    C:\Progra~1\Launch Manager\CtrlVol.exe
    C:\Progra~1\Launch Manager\Wbutton.exe
    C:\Programfiler\Telenor\ecc\ecc.exe
    C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
    C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programfiler\Messenger\msmsgs.exe
    C:\Programfiler\MSN Messenger\MsnMsgr.Exe
    C:\Programfiler\Spyware Doctor\swdoctor.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.vg.no/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R3 - Default URLSearchHook is missing
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LaunchAp] C:\Progra~1\Launch Manager\LaunchAp.exe
    O4 - HKLM\..\Run: [PowerKey] "C:\Progra~1\Launch Manager\PowerKey.exe"
    O4 - HKLM\..\Run: [LManager] C:\Progra~1\Launch Manager\HotkeyApp.exe
    O4 - HKLM\..\Run: [CtrlVol] C:\Progra~1\Launch Manager\CtrlVol.exe
    O4 - HKLM\..\Run: [Wbutton] "C:\Progra~1\Launch Manager\Wbutton.exe"
    O4 - HKLM\..\Run: [ecc] C:\Programfiler\Telenor\ecc\ecc.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\APVXDWIN.EXE" /s
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Programfiler\Spyware Doctor\swdoctor.exe" /Q
    O8 - Extra context menu item: &Google Search - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://C:\Programfiler\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
    O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: ModuleUsage - C:\WINDOWS\system32\n66qlgj516o.dll (file missing)
    O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\m6lslg3716.dll (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Programfiler\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Programfiler\ewido\security suite\ewidoctrl.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PavFnSvr.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Programfiler\Fellesfiler\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\pavsrv51.exe
    O23 - Service: Panda Network Manager (PNMSRV) - Panda Software - c:\programfiler\panda software\panda titanium 2006 antivirus + antispyware\firewall\PNMSRV.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\PsImSvc.exe
    O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Programfiler\Spyware Doctor\sdhelp.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Programfiler\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe

    actually it seems like the pop ups has stopped :)
  • TroganTrogan London, UK
    edited November 2005
    OK, thats good!

    Hmm, that line in your HJT log keeps reappearing.
    ===

    Go into Safe Mode - explained here
    ===

    Check the following in HJT and click 'Fix Checked'. Close all WINDOWS first

    R3 - Default URLSearchHook is missing
    ===

    Reboot into Normal Mode and post a new HJT log :)
Sign In or Register to comment.