[Solved]Adware.Look2Me infection?

Unknown
edited July 2006 in Spyware & Virus Removal
First I'd like to say this site is great. I've spent a lot of time browsing the very useful solutions but unfortunatly have become stuck on one of my own.

While my computer is running, just the explorer shell and standard memory resident programs, I get IE popup windows every couple of minutes directed to different ad sites.

I do run Norton Anti-Virus and Ad-Aware on a regular basis and have tried a few others including ewido to help resolve my problem. Ewido was able to locate Adware.Look2Me and always finds new random dll's, but is unable to quarantine them. (Even in safe mode and safe mode command prompt.) I have also tried to boot into a DOS mode with NTFS write support and remove the dll's manually, but more keep coming back.

I can't find any obvious running processes or registry enteries to kill so I imagine I have some strings that have embedded themselves into my explorer.exe or possibly something even worse.

I also have tried running a few Look2Me removal programs from different online sites, but all have come up blank (except ewido which is the only program that finds anything, but is unable to remove it.

I will post a hijackthis log and ewido log right below this post.

Thanks for the help!

Comments

  • JoeDShadow
    edited July 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 11:30:23 PM, on 7/24/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
    C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
    O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
    O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [smartpopupblocker] C:\Program Files\Smart Popup Blocker\SmartKillPopup.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135404442125
    O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://web.childrensmn.org/SNX/extender.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{30916FF5-9F19-4407-BF9C-5021CDA47013}: NameServer = 4.2.2.2
    O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\hrrq0595e.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  • JoeDShadow
    edited July 2006
    ewido anti-spyware - Scan Report

    + Created at: 10:26:33 PM 7/24/2006

    + Scan result:



    [3724] C:\WINDOWS\system32\guard.tmp -> Adware.Look2Me : Cleaned with backup (quarantined).
    [960] C:\WINDOWS\system32\lxkrn13n.dll -> Adware.Look2Me : Error during cleaning.


    ::Report end
  • TroganTrogan London, UK
    edited July 2006
    Hi JoeDShadow, welcome to Short-Media! :)

    Download L2mfix from one of these two locations:

    http://www.atribune.org/downloads/l2mfix.exe
    http://www.downloads.subratam.org/l2mfix.exe

    Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

    IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
  • JoeDShadow
    edited July 2006
    Here it is...

    L2MFIX find log 051206
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Paths]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\hrrq0595e.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    "Logon"="WLEventLogon"
    "Logoff"="WLEventLogoff"
    "Startup"="WLEventStartup"
    "Shutdown"="WLEventShutdown"
    "StartScreenSaver"="WLEventStartScreenSaver"
    "StopScreenSaver"="WLEventStopScreenSaver"
    "Lock"="WLEventLock"
    "Unlock"="WLEventUnlock"
    "StartShell"="WLEventStartShell"
    "PostShell"="WLEventPostShell"
    "Disconnect"="WLEventDisconnect"
    "Reconnect"="WLEventReconnect"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000000
    "SafeMode"=dword:00000001
    "MaxWait"=dword:ffffffff
    "DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Event"=dword:00000000

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
    "Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
    00,00,9d,e9,af,0c,bf,33,be,4c,a4,eb,bd,64,e0,72,07,15,04,00,00,00,04,00,00,\
    00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,7f,82,0c,d4,d3,a5,61,66,\
    87,57,bc,12,cf,4a,31,6f,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,42,\
    d1,0c,be,e2,45,18,ca,20,4c,5c,68,3f,73,ed,56,b0,01,00,00,93,8d,fc,5e,f8,ac,\
    62,9a,71,9c,3a,33,2a,08,f6,e0,85,4c,48,7d,d2,30,67,d4,1c,d1,0c,75,f3,59,61,\
    55,81,50,f6,d2,fa,dd,43,05,c2,f0,12,d5,d9,64,ca,17,fb,0f,53,14,1b,f1,b6,c6,\
    3c,c8,4c,1f,7b,93,3b,34,2d,b7,c9,19,76,21,44,f5,19,f7,39,71,ba,59,82,ba,07,\
    0c,b8,c6,48,f4,4f,74,c2,ba,4b,8e,63,f0,36,9b,bc,53,a9,32,73,cf,0b,94,aa,04,\
    90,f6,5c,73,5c,0b,64,77,4a,1b,4c,71,47,5d,d7,23,1b,d6,55,ed,c5,8a,01,2f,3b,\
    07,fd,0b,34,5f,0a,45,69,78,5e,9e,e9,98,aa,80,6c,f3,75,24,c4,ab,93,c0,79,3f,\
    96,55,02,21,fb,7c,64,d0,8c,ef,f8,2e,ec,fc,69,03,d0,28,9e,44,00,75,dc,8e,0a,\
    2c,30,3c,66,36,5a,bb,be,d1,92,fe,6e,bd,6f,69,1f,6b,69,e8,a1,86,24,77,7e,5f,\
    2f,17,ef,d7,a8,21,50,6b,05,23,ca,d6,a5,02,dc,59,42,3a,58,90,a4,3b,4b,ee,e1,\
    aa,63,0b,6b,e1,5f,1e,0c,4e,bb,8a,87,11,06,a4,81,de,5f,8f,e0,1b,a0,42,50,00,\
    64,09,bc,e0,9d,99,08,17,39,57,82,c8,c7,d3,bc,f2,82,6b,b2,67,03,fd,fd,2d,5b,\
    60,08,00,4e,82,c4,82,11,11,0c,cd,85,14,9b,d0,a0,93,5f,09,b2,67,94,22,71,79,\
    19,8f,72,06,0a,84,89,1c,7a,e3,1a,dc,65,25,2e,0a,80,78,52,09,5a,31,f6,6f,15,\
    8d,73,a8,6a,5f,c3,be,ae,60,e8,34,98,c5,bc,e3,f3,11,a1,2c,d7,78,8c,bd,0c,45,\
    1f,08,df,31,fc,e2,dd,6f,ed,55,d8,bb,e8,e0,1c,2d,60,3a,58,3a,9e,9e,10,a3,0e,\
    7f,3c,03,78,7b,6e,b0,14,19,83,b6,39,b9,a5,3b,58,55,61,9f,55,1a,7f,16,30,f0,\
    a8,78,b1,e9,e2,3a,63,36,3c,26,f6,47,6e,76,a3,3e,13,35,dd,4a,72,f0,63,f6,8b,\
    96,14,00,00,00,ad,44,fb,91,23,38,19,4c,98,c3,6a,41,be,3a,5c,cb,14,66,92,0c

    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{A42B2A25-5F27-FA99-1CD0-0A1C5E6B3A24}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
    "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
    "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
    "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
    "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
    "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
    "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
    "{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
    "{acb4a560-3606-11d3-aef4-00104bd0f92d}"="KodakShellExtension"
    "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
    "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
    "{59850401-6664-101B-B21C-00AA004BA90B}"="Microsoft Office Binder Unbind"
    "{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
    "{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
    "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
    "{F4A72A26-4E17-4A59-99D5-DDFA81225C18}"="Batch File Rename"
    "{F9744085-8788-4088-A62B-25EE5E77B900}"=""
    "{D4D0F6B5-1CED-47A8-B663-D96BF792038E}"=""
    "{503747C2-CA2E-42CE-8363-0E321C2579EA}"=""
    "{290A4286-2029-4C2D-82C9-1AC77C0EDD35}"=""
    "{A37B6EF7-B7B7-4328-95F7-97820B152A34}"=""
    "{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}"=""

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}\InprocServer32]
    @="C:\\WINDOWS\\system32\\aiicap.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}\InprocServer32]
    @="C:\\WINDOWS\\system32\\vhrcodec.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}\InprocServer32]
    @="C:\\WINDOWS\\system32\\vwr.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}\InprocServer32]
    @="C:\\WINDOWS\\system32\\srlwoa.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}\InprocServer32]
    @="C:\\WINDOWS\\system32\\oEkley.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    browseui.dll Wed May 10 2006 12:23:00a A.... 1,022,976 999.00 K
    cdfview.dll Wed May 10 2006 12:23:00a A.... 151,040 147.50 K
    danim.dll Wed May 10 2006 12:23:00a A.... 1,054,208 1.00 M
    dhcpcsvc.dll Fri May 19 2006 7:59:42a A.... 111,616 109.00 K
    dnsapi.dll Fri May 19 2006 7:59:42a A.... 148,480 145.00 K
    dxtmsft.dll Wed May 10 2006 12:23:00a A.... 357,888 349.50 K
    dxtrans.dll Wed May 10 2006 12:23:00a A.... 205,312 200.50 K
    extmgr.dll Wed May 10 2006 12:23:00a ..... 55,808 54.50 K
    gppul3~1.dll Mon Jul 24 2006 11:22:26p ..S.R 234,613 229.11 K
    hrrq05~1.dll Mon Jul 24 2006 10:53:58p ..S.R 234,613 229.11 K
    iepeers.dll Wed May 10 2006 12:23:00a A.... 251,392 245.50 K
    inseng.dll Wed May 10 2006 12:23:00a A.... 96,256 94.00 K
    iphlpapi.dll Fri May 19 2006 7:59:42a A.... 94,720 92.50 K
    jgdw400.dll Thu Jun 1 2006 1:47:08p A.... 163,840 160.00 K
    jgpl400.dll Thu Jun 1 2006 1:47:08p A.... 27,648 27.00 K
    jscript.dll Thu May 18 2006 12:24:26a A.... 450,560 440.00 K
    jsproxy.dll Wed May 10 2006 12:23:00a A.... 16,384 16.00 K
    k008la~1.dll Mon Jul 24 2006 11:21:26p ..S.R 236,413 230.87 K
    kip.dll Sat Jul 22 2006 12:57:38p A.... 0 0.00 K
    legitc~1.dll Mon Jun 19 2006 4:19:42p A.... 571,184 557.80 K
    mshtml.dll Fri May 19 2006 10:08:32a A.... 3,052,544 2.91 M
    mshtmled.dll Wed May 10 2006 12:23:02a A.... 448,512 438.00 K
    msrating.dll Wed May 10 2006 12:23:02a A.... 146,432 143.00 K
    mstime.dll Wed May 10 2006 12:23:02a A.... 532,480 520.00 K
    pngfilt.dll Wed May 10 2006 12:23:02a A.... 39,424 38.50 K
    rasmans.dll Sun May 14 2006 3:44:08a A.... 181,248 177.00 K
    shdocvw.dll Mon May 29 2006 10:30:34a A.... 1,494,016 1.42 M
    shlwapi.dll Wed May 10 2006 12:23:02a A.... 474,112 463.00 K
    srlwoa.dll Tue Jul 25 2006 12:46:18a ..S.R 234,613 229.11 K
    urlmon.dll Wed May 10 2006 12:23:02a A.... 613,888 599.50 K
    wgalogon.dll Mon Jun 19 2006 4:20:42p A.... 702,768 686.30 K
    wininet.dll Wed May 10 2006 12:23:04a A.... 658,432 643.00 K
    wmp.dll Sat Apr 29 2006 6:07:48a A.... 5,533,696 5.28 M
    xpsp3res.dll Thu May 11 2006 3:23:24a A.... 24,576 24.00 K

    34 items found: 34 files (4 H/S), 0 directories.
    Total of file sizes: 19,621,692 bytes 18.71 M
    Locate .tmp files:

    C:\WINDOWS\SYSTEM32\
    guard.tmp Tue Jul 25 2006 8:27:20a ..S.R 234,613 229.11 K

    1 item found: 1 file (1 H/S), 0 directories.
    Total of file sizes: 234,613 bytes 229.11 K
    **********************************************************************************
    Directory Listing of system files:
    Volume in drive C has no label.
    Volume Serial Number is 2068-9EB4

    Directory of C:\WINDOWS\System32

    07/25/2006 08:27 AM 234,613 guard.tmp
    07/25/2006 12:46 AM 234,613 srlwoa.dll
    07/24/2006 11:22 PM 234,613 gppul3791.dll
    07/24/2006 11:21 PM 236,413 k008ladu1d08.dll
    07/24/2006 10:53 PM 234,613 hrrq0595e.dll
    07/24/2006 04:00 AM <DIR> dllcache
    12/24/2005 01:02 AM <DIR> Microsoft
    09/30/1999 08:21 PM 166,672 mstext35.dll
    09/28/1999 10:42 PM 1,050,896 msjet35.dll
    09/09/1999 11:06 PM 168,720 msltus35.dll
    09/09/1999 11:06 PM 252,688 msexcl35.dll
    08/25/1999 03:57 PM 415,504 msrepl35.dll
    06/10/1999 10:34 AM 123,664 msjint35.dll
    06/10/1999 10:34 AM 24,848 msjter35.dll
    06/07/1999 07:59 PM 250,128 mspdox35.dll
    04/25/1999 06:00 PM 287,504 Msxbse35.dll
    04/25/1999 06:00 PM 368,912 Vbar332.dll
    04/25/1999 06:00 PM 252,176 Msrd2x35.dll
    16 File(s) 4,536,577 bytes
    2 Dir(s) 14,517,571,584 bytes free
  • TroganTrogan London, UK
    edited July 2006
    Thanks for the log...

    Close any browsers and programs you have open since this step requires a reboot.

    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot. After the reboot notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

    IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!
    If after the reboot the log does not open double click on it in the l2mfix folder.
  • JoeDShadow
    edited July 2006
    L2mfix 051206
    Creating Account.
    The command completed successfully.

    Adding Administrative privleges.
    The command completed successfully.
    Checking for L2MFix account(0=no 1=yes):
    1
    Granting SeDebugPrivilege to L2MFIX ... successful

    Running From:
    C:\WINDOWS\system32

    Killing Processes!
    Killing 'smss.exe'
    \SystemRoot\System32\smss.exe (1260)
    Killing 'winlogon.exe'
    winlogon.exe (1364)
    Killing 'explorer.exe'
    C:\WINDOWS\Explorer.EXE (1160)
    Killing 'rundll32.exe'
    rundll32.exe "C:\WINDOWS\system32\guard.tmp",DllGetVersion (3124)
    Restoring Sedebugprivilege:
    Granting SeDebugPrivilege to Administrators ... successful

    Scanning First Pass. Please Wait!

    First Pass Completed

    Second Pass Scanning

    Second pass Completed!
    1 file(s) copied.
    1 file(s) copied.
    1 file(s) copied.
    1 file(s) copied.
    1 file(s) copied.
    Deleting: C:\WINDOWS\system32\gppul3791.dll
    Successfully Deleted: C:\WINDOWS\system32\gppul3791.dll
    Deleting: C:\WINDOWS\system32\hrrq0595e.dll
    Successfully Deleted: C:\WINDOWS\system32\hrrq0595e.dll
    Deleting: C:\WINDOWS\system32\k008ladu1d08.dll
    Successfully Deleted: C:\WINDOWS\system32\k008ladu1d08.dll
    Deleting: C:\WINDOWS\system32\srlwoa.dll
    Successfully Deleted: C:\WINDOWS\system32\srlwoa.dll
    Deleting: C:\WINDOWS\system32\guard.tmp
    Successfully Deleted: C:\WINDOWS\system32\guard.tmp

    msg11?.dll
    0 file(s) copied.



    Restoring Windows Update Certificates.:

    The following Is the Current Export of the Winlogon notify key:
    ****************************************************************************
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Paths]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\hrrq0595e.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "PostShell"="SensPostShellEvent"
    "Disconnect"="SensDisconnectEvent"
    "Reconnect"="SensReconnectEvent"
    "Unlock"="SensUnlockEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "Logoff"="TSEventLogoff"
    "Logon"="TSEventLogon"
    "PostShell"="TSEventPostShell"
    "Shutdown"="TSEventShutdown"
    "StartShell"="TSEventStartShell"
    "Startup"="TSEventStartup"
    "MaxWait"=dword:00000258
    "Reconnect"="TSEventReconnect"
    "Disconnect"="TSEventDisconnect"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    "Logon"="WLEventLogon"
    "Logoff"="WLEventLogoff"
    "Startup"="WLEventStartup"
    "Shutdown"="WLEventShutdown"
    "StartScreenSaver"="WLEventStartScreenSaver"
    "StopScreenSaver"="WLEventStopScreenSaver"
    "Lock"="WLEventLock"
    "Unlock"="WLEventUnlock"
    "StartShell"="WLEventStartShell"
    "PostShell"="WLEventPostShell"
    "Disconnect"="WLEventDisconnect"
    "Reconnect"="WLEventReconnect"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000000
    "SafeMode"=dword:00000001
    "MaxWait"=dword:ffffffff
    "DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Event"=dword:00000000

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
    "Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
    00,00,9d,e9,af,0c,bf,33,be,4c,a4,eb,bd,64,e0,72,07,15,04,00,00,00,04,00,00,\
    00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,7f,82,0c,d4,d3,a5,61,66,\
    87,57,bc,12,cf,4a,31,6f,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,42,\
    d1,0c,be,e2,45,18,ca,20,4c,5c,68,3f,73,ed,56,b0,01,00,00,93,8d,fc,5e,f8,ac,\
    62,9a,71,9c,3a,33,2a,08,f6,e0,85,4c,48,7d,d2,30,67,d4,1c,d1,0c,75,f3,59,61,\
    55,81,50,f6,d2,fa,dd,43,05,c2,f0,12,d5,d9,64,ca,17,fb,0f,53,14,1b,f1,b6,c6,\
    3c,c8,4c,1f,7b,93,3b,34,2d,b7,c9,19,76,21,44,f5,19,f7,39,71,ba,59,82,ba,07,\
    0c,b8,c6,48,f4,4f,74,c2,ba,4b,8e,63,f0,36,9b,bc,53,a9,32,73,cf,0b,94,aa,04,\
    90,f6,5c,73,5c,0b,64,77,4a,1b,4c,71,47,5d,d7,23,1b,d6,55,ed,c5,8a,01,2f,3b,\
    07,fd,0b,34,5f,0a,45,69,78,5e,9e,e9,98,aa,80,6c,f3,75,24,c4,ab,93,c0,79,3f,\
    96,55,02,21,fb,7c,64,d0,8c,ef,f8,2e,ec,fc,69,03,d0,28,9e,44,00,75,dc,8e,0a,\
    2c,30,3c,66,36,5a,bb,be,d1,92,fe,6e,bd,6f,69,1f,6b,69,e8,a1,86,24,77,7e,5f,\
    2f,17,ef,d7,a8,21,50,6b,05,23,ca,d6,a5,02,dc,59,42,3a,58,90,a4,3b,4b,ee,e1,\
    aa,63,0b,6b,e1,5f,1e,0c,4e,bb,8a,87,11,06,a4,81,de,5f,8f,e0,1b,a0,42,50,00,\
    64,09,bc,e0,9d,99,08,17,39,57,82,c8,c7,d3,bc,f2,82,6b,b2,67,03,fd,fd,2d,5b,\
    60,08,00,4e,82,c4,82,11,11,0c,cd,85,14,9b,d0,a0,93,5f,09,b2,67,94,22,71,79,\
    19,8f,72,06,0a,84,89,1c,7a,e3,1a,dc,65,25,2e,0a,80,78,52,09,5a,31,f6,6f,15,\
    8d,73,a8,6a,5f,c3,be,ae,60,e8,34,98,c5,bc,e3,f3,11,a1,2c,d7,78,8c,bd,0c,45,\
    1f,08,df,31,fc,e2,dd,6f,ed,55,d8,bb,e8,e0,1c,2d,60,3a,58,3a,9e,9e,10,a3,0e,\
    7f,3c,03,78,7b,6e,b0,14,19,83,b6,39,b9,a5,3b,58,55,61,9f,55,1a,7f,16,30,f0,\
    a8,78,b1,e9,e2,3a,63,36,3c,26,f6,47,6e,76,a3,3e,13,35,dd,4a,72,f0,63,f6,8b,\
    96,14,00,00,00,ad,44,fb,91,23,38,19,4c,98,c3,6a,41,be,3a,5c,cb,14,66,92,0c

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName"="wlnotify.dll"
    "Logon"="RegisterTicketExpiredNotificationEvent"
    "Logoff"="UnregisterTicketExpiredNotificationEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001


    The following are the files found:
    ****************************************************************************
    C:\WINDOWS\system32\gppul3791.dll
    C:\WINDOWS\system32\hrrq0595e.dll
    C:\WINDOWS\system32\k008ladu1d08.dll
    C:\WINDOWS\system32\srlwoa.dll
    C:\WINDOWS\system32\guard.tmp

    Registry Entries that were Deleted:
    Please verify that the listing looks ok.
    If there was something deleted wrongly there are backups in the backreg folder.
    ****************************************************************************
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\aiicap.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\vhrcodec.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\vwr.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\srlwoa.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}\Implemented Categories]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=&quot;"

    [HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}\InprocServer32]
    @=&quot;C:\\WINDOWS\\system32\\oEkley.dll"
    "ThreadingModel"="Apartment"

    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{F9744085-8788-4088-A62B-25EE5E77B900}"=-
    "{D4D0F6B5-1CED-47A8-B663-D96BF792038E}"=-
    "{503747C2-CA2E-42CE-8363-0E321C2579EA}"=-
    "{290A4286-2029-4C2D-82C9-1AC77C0EDD35}"=-
    "{A37B6EF7-B7B7-4328-95F7-97820B152A34}"=-
    "{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}"=-
    [-HKEY_CLASSES_ROOT\CLSID\{F9744085-8788-4088-A62B-25EE5E77B900}]
    [-HKEY_CLASSES_ROOT\CLSID\{D4D0F6B5-1CED-47A8-B663-D96BF792038E}]
    [-HKEY_CLASSES_ROOT\CLSID\{503747C2-CA2E-42CE-8363-0E321C2579EA}]
    [-HKEY_CLASSES_ROOT\CLSID\{290A4286-2029-4C2D-82C9-1AC77C0EDD35}]
    [-HKEY_CLASSES_ROOT\CLSID\{A37B6EF7-B7B7-4328-95F7-97820B152A34}]
    [-HKEY_CLASSES_ROOT\CLSID\{4A32E752-E7A0-49D8-BCC4-A5873F9D0902}]
    REGEDIT4

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "SV1"=""
    ****************************************************************************
    Desktop.ini Contents:
    ****************************************************************************

    ****************************************************************************
    Checking for L2MFix account(0=no 1=yes):
    0
    Zipping up files for submission:
    adding: dlls/gppul3791.dll (164 bytes security) (deflated 5%)
    adding: dlls/guard.tmp (164 bytes security) (deflated 5%)
    adding: dlls/hrrq0595e.dll (164 bytes security) (deflated 5%)
    adding: dlls/k008ladu1d08.dll (164 bytes security) (deflated 5%)
    adding: dlls/srlwoa.dll (164 bytes security) (deflated 5%)
    adding: backregs/290A4286-2029-4C2D-82C9-1AC77C0EDD35.reg (212 bytes security) (deflated 70%)
    adding: backregs/4A32E752-E7A0-49D8-BCC4-A5873F9D0902.reg (212 bytes security) (deflated 70%)
    adding: backregs/503747C2-CA2E-42CE-8363-0E321C2579EA.reg (212 bytes security) (deflated 70%)
    adding: backregs/A37B6EF7-B7B7-4328-95F7-97820B152A34.reg (212 bytes security) (deflated 70%)
    adding: backregs/D4D0F6B5-1CED-47A8-B663-D96BF792038E.reg (212 bytes security) (deflated 70%)
    adding: backregs/F9744085-8788-4088-A62B-25EE5E77B900.reg (212 bytes security) (deflated 70%)
    adding: backregs/notibac.reg (164 bytes security) (deflated 73%)
    adding: backregs/shell.reg (164 bytes security) (deflated 73%)
  • JoeDShadow
    edited July 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 8:04:00 PM, on 7/25/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
    C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\svchost.exe
    C:\hijackthis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exe
    O4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exe
    O4 - HKLM\..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx\Anti-Blaxx.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [smartpopupblocker] C:\Program Files\Smart Popup Blocker\SmartKillPopup.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135404442125
    O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://web.childrensmn.org/SNX/extender.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{30916FF5-9F19-4407-BF9C-5021CDA47013}: NameServer = 4.2.2.2
    O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\hrrq0595e.dll (file missing)
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  • JoeDShadow
    edited July 2006
    Textbook fix! :thumbsup:

    The popups are completely gone and things are back to normal. Not sure if there is anything else you want me to fix with Hijackthis, but otherwise I'd say we're resolved.

    Thanks a ton!
  • TroganTrogan London, UK
    edited July 2006
    Glad it worked...just a little left to do.

    Open HijackThis
    - Click the Do a system scan only button
    - Check the following entries (below)

    O20 - Winlogon Notify: App Paths - C:\WINDOWS\system32\hrrq0595e.dll (file missing)

    - Close ALL open windows (especially Internet Explorer!)
    Click Fix Checked


    I would like to have a quick look at another log from HijackThis.
    • Run Hijackthis.
    • Click on Open the Misc Tools section.
    • Next click on Open uninstall manager.
    • Press the Save list button. It will open a Notepad file.
    • Copy & Paste the entire contents of that file in your in your next post.
  • JoeDShadow
    edited July 2006
    Sent PM
  • TroganTrogan London, UK
    edited July 2006
    PM recieved!

    You have too many Peer2Peer programs. I strongly advise that you uninstall most or all of them.

    Your Java needs updating.
    Older versions have vulnerabilities that malware can use to infect your system.
    Please follow these steps to remove older version Java components.
    • Close any programmes you may have running, ESPECIALLY your web browser
    • Click Start > Control Panel.
    • Click Add/Remove Programs.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove all versions of Java.
    • Reboot your computer once all Java components are removed.
    Then download the latest version of Java Runtime Environment, and install it to your computer.

    Now:
    1) Let me know how the computer is.
    2) Is there anything else I can help with
    3) Can we mark this resolved?
  • JoeDShadow
    edited July 2006
    We are all set. I just uninstalled a ton of stuff and updated my Java. It was some much needed maintenance. That's for all your help, I don't need anything else! You can mark it as resolved.
  • TroganTrogan London, UK
    edited July 2006
    Your welcome! I'l mark this resolved.

    Here are some measures you can take to stay more secure online:

    Secure your Internet Explorer by going here and following the instructions there.

    Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera.

    Use a firewall to help prevent your PC(s) from being usurped by undesireables. If you don't have a Firewall, then choose one from the list here

    Install an Anti-Virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often. If you don't have an Anti-Virus program, choose one from the list here

    Install and keep updated, Ad-Aware SE and Spybot Search & Destroy.
    Run them both on a regular basis, following the manufacturer's recommendations.

    Install and keep updated, SpywareBlaster and SpywareGuard

    Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.

    Clear your Temp folders.
    Go to Start > Control Panel > Internet Options.
    Under the General tab click the Delete Files... button; check the Delete all offline content box and press OK. Next, click the Delete Cookies... button and press OK

    Go to "Start" -> "Run" and type in the box: "cleanmgr" press OK. Select the drive where your Operating System is installed (Default is C:) and press OK. Let Disk Cleanup scan your system for files to remove (it takes a few minutes!). On the next screen make sure these 3 options are checked
    • Temporary Files
    • Temporary Internet Files
    • Recycle Bin
    and then press "OK" to remove:

    Go to Start > Find/Search > Files or folders > in the named box, type: *.tmp and choose Edit > select all -> File > delete.

    Empty/delete the entire contents from the following folders:
    C:\Windows\temp
    C:\temp <-- if you have one.
    Note: Empty contents but don't delete the folder(s) itself.

    Clear out temp files from the following location. Change "username" to whatever you have on your computer.
    C:\Documents and Settings\username\Local Settings\Temp\
    In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

    Empty the Recycle Bin!

    Hide system files
    It is very important that system files and folders are hidden again, so that they DO NOT get deleted by mistake. To hide system files and folders, do the following for your operating system...

    Windows XP
    * Click Start.
    * Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading, uncheck Do not show hidden files and folders
    * Check the Hide protected operating system files (recommended) option.
    * Click Yes to confirm.
    * Click OK.


    For XP users.
    It's a good idea to Flush your System Restore points after ridding yourself of malware: You can clean this by doing the following:
    • Click Start | Help and Support | Undo changes to your computer with System Restore.
    • Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
    • Close the Help and Support Center box.
    • Click Start | Run and type Cleanmgr
    • Select (C :) then click OK.
    • Click the More Options tab.
    • Click Clean Up in the System Restore Section.
    This will remove all previous restore points except the newly created one.

    ===============

    If you have any more problems, post back.


    Please consider joining the Folding@Home Project :)
    Join our Folding@Home team! Alzheimer's, Parkinson's, cancer... we're trying to cure them with our computers! You've at least read a little about it in the greeting I sent you when you signed up for the site. We're always really pleased to greet new members to the team, and it's a quick way to become an appreciated member of the community.
    MORE INFO: READ THIS
This discussion has been closed.