1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

I took the plunge and deleted Kazaa

Discussion in 'Malware and Virus Removal Archive' started by Brinic, 2005/07/20.

Thread Status:
Not open for further replies.
  1. 2005/07/20
    Brinic

    Brinic Inactive Thread Starter

    Joined:
    2005/06/08
    Messages:
    71
    Likes Received:
    0
    I took the plunge and deleted Kazaa (Which I paid the $29.00). I downloaded Kazaa Resurrection in its place. I figure now is the best time to clean up the computer. Any help would be great!


    Logfile of HijackThis v1.99.1
    Scan saved at 11:34:40 PM, on 7/20/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Motive\Common\MOTIVE~1.EXE
    C:\Program Files\NetAssistant\bin\mad.exe
    C:\Program Files\NetAssistant\bin\mpbtn.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Kazaa Lite Resurrection\kazaalite.kpp
    C:\Program Files\NetAssistant\bin\MotiveBrowser.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca/homepage.html?blink=static
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.netscape.ca/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca/homepage.html?blink=static
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1120256448682
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FEDA78BB-6223-4901-AEAF-3F99397EC698}: NameServer = 207.236.176.10 206.47.244.89
    O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\gqmf32.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
     
    Brinic,
    #1
  2. 2005/07/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Good to hear you took out Kazaa! :D However, Kazaa Lite is a cracked Kazaa, and you're sending the makers of Kazaa a message that their software is worth using in any form, which does nothing toward getting them to clean it up. :( WinMX would be a much better choice!

    Fix the following entries with HJT.

    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\gqmf32.dll

    Reboot and delete the P2P Networking folder in C:\WINDOWS\System32.
    Do a file search for P2P Networking.* and delete anything found.
    Empty the recycle bin.

    Run an online virus scan with Panda ActiveScan, save the report and post it here along with a new HijackThis log.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2005/07/21
    Brinic

    Brinic Inactive Thread Starter

    Joined:
    2005/06/08
    Messages:
    71
    Likes Received:
    0
    Panda Scan Results

    Incident Status Location Spyware:spyware/cydoor No disinfected C:\WINDOWS\SYSTEM32\cd_clint.dll Adware:adware/look2me No disinfected C:\WINDOWS\SYSTEM32\guard.tmp Spyware:spyware/dluca No disinfected C:\DOCUMENTS AND SETTINGS\USER1\LOCAL SETTINGS\TEMP\delwbi.tmp Spyware:spyware/surfsidekick No disinfected C:\DOCUMENTS AND SETTINGS\USER1\LOCAL SETTINGS\TEMPORARY INTERNET FILES\Ssk.log
    Adware:adware/gator No disinfected C:\GatorPatch.log Adware:adware/delfinmedia No disinfected C:\keys.ini Adware:adware/twain-tech No disinfected C:\WINDOWS\smdat32m.sys Spyware:spyware/adclicker No disinfected C:\WINDOWS\usta33.ini Spyware:spyware/altnet No disinfected C:\PROGRAM FILES\Altnet Adware:adware/sidefind No disinfected C:\PROGRAM FILES\SideFind Adware:adware/wupd No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/DOWNLOADED PROGRAM FILES/MEDIAACCX.DLL
    Adware:adware/p2pnetworking No disinfected HKEY_CURRENT_USER\SOFTWARE\P2P NETWORKING
    Adware:adware/mywebsearch No disinfected HKEY_CLASSES_ROOT\CLSID\{147A976E-EEE1-4377-8EA7-4716E4CDD239}
    Adware:adware/funweb No disinfected HKEY_CLASSES_ROOT\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
    Spyware:spyware/dyfuca No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP MANAGEMENT\ARPCACHE\INTERNET OPTIMIZER
    Adware:adware/cws No disinfected HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\START PAGE_BAK
    Adware:adware/ncase No disinfected HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\SEARCH BAR_BAK
    Adware:adware/myway No disinfected HKEY_LOCAL_MACHINE\software\classes\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}
    Adware:Adware/Look2Me No disinfected C:\Documents and Settings\User1\Local Settings\Temporary Internet Files\Content.IE5\GZ012L4N\upd208[1].exe
    Adware:Adware/BrilliantDigitalNo disinfected C:\Program Files\KaZaA\bdcore.dll
    Adware:Adware/BrilliantDigitalNo disinfected C:\Program Files\KaZaA\bdcore.dll.updpnd
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cdrtcli.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\cirtcli.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\en2ql1f51.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\guard.tmp
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ierop.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\ipetmib1.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iqsmsnap.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\iyfgnt5.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\kt68l7ju1.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mavcrt20.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mkcshext.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mqcshext.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mscshext.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mv8ul9l91.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\mwdemui.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nmobjapi.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\nxtevent.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\r0r6la9s1d.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\u2rulc991f.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wnvadvd.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\system32\wudmtpdr.dll
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\Temp\bw2.com
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\Temp\upd204.exe
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\Temp\upd205.exe
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\Temp\upd206.exe
    Adware:Adware/Look2Me No disinfected C:\WINDOWS\Temp\upd208.exe
    Hijack log next post!
     
    Brinic,
    #3
  5. 2005/07/21
    Brinic

    Brinic Inactive Thread Starter

    Joined:
    2005/06/08
    Messages:
    71
    Likes Received:
    0
    Hijack log (post was too long!)

    Hijack Log

    Logfile of HijackThis v1.99.1
    Scan saved at 3:28:12 PM, on 7/21/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Kazaa Lite Resurrection\kazaalite.kpp
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca/homepage.html?blink=static
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.netscape.ca/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca/homepage.html?blink=static
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1120256448682
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FEDA78BB-6223-4901-AEAF-3F99397EC698}: NameServer = 207.236.176.10 206.47.244.89
    O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\n0p4la7q1d.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    Thanks for all the help!
     
    Brinic,
    #4
  6. 2005/07/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    OK, we have to get rid of that Look2me infection! Please download L2mfix

    http://www.downloads.subratam.org/l2mfix.exe

    Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

    IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!
     
    noahdfear,
    #5
  7. 2005/07/21
    Brinic

    Brinic Inactive Thread Starter

    Joined:
    2005/06/08
    Messages:
    71
    Likes Received:
    0
    Look2me Log

    L2MFIX find log 1.03
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous "=dword:00000000
    "Impersonate "=dword:00000000
    "DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff "= "ChainWlxLogoffEvent "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous "=dword:00000000
    "Impersonate "=dword:00000000
    "DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff "= "CryptnetWlxLogoffEvent "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName "= "cscdll.dll "
    "Logon "= "WinlogonLogonEvent "
    "Logoff "= "WinlogonLogoffEvent "
    "ScreenSaver "= "WinlogonScreenSaverEvent "
    "Startup "= "WinlogonStartupEvent "
    "Shutdown "= "WinlogonShutdownEvent "
    "StartShell "= "WinlogonStartShellEvent "
    "Impersonate "=dword:00000000
    "Asynchronous "=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reliability]
    "Asynchronous "=dword:00000000
    "DllName "= "C:\\WINDOWS\\system32\\imxpromn.dll "
    "Impersonate "=dword:00000000
    "Logon "= "WinLogon "
    "Logoff "= "WinLogoff "
    "Shutdown "= "WinShutdown "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName "= "wlnotify.dll "
    "Logon "= "SCardStartCertProp "
    "Logoff "= "SCardStopCertProp "
    "Lock "= "SCardSuspendCertProp "
    "Unlock "= "SCardResumeCertProp "
    "Enabled "=dword:00000001
    "Impersonate "=dword:00000001
    "Asynchronous "=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous "=dword:00000000
    "DllName "=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate "=dword:00000000
    "StartShell "= "SchedStartShell "
    "Logoff "= "SchedEventLogOff "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff "= "WLEventLogoff "
    "Impersonate "=dword:00000000
    "Asynchronous "=dword:00000001
    "DllName "=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName "= "WlNotify.dll "
    "Lock "= "SensLockEvent "
    "Logon "= "SensLogonEvent "
    "Logoff "= "SensLogoffEvent "
    "Safe "=dword:00000001
    "MaxWait "=dword:00000258
    "StartScreenSaver "= "SensStartScreenSaverEvent "
    "StopScreenSaver "= "SensStopScreenSaverEvent "
    "Startup "= "SensStartupEvent "
    "Shutdown "= "SensShutdownEvent "
    "StartShell "= "SensStartShellEvent "
    "PostShell "= "SensPostShellEvent "
    "Disconnect "= "SensDisconnectEvent "
    "Reconnect "= "SensReconnectEvent "
    "Unlock "= "SensUnlockEvent "
    "Impersonate "=dword:00000001
    "Asynchronous "=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous "=dword:00000000
    "DllName "=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate "=dword:00000000
    "Logoff "= "TSEventLogoff "
    "Logon "= "TSEventLogon "
    "PostShell "= "TSEventPostShell "
    "Shutdown "= "TSEventShutdown "
    "StartShell "= "TSEventStartShell "
    "Startup "= "TSEventStartup "
    "MaxWait "=dword:00000258
    "Reconnect "= "TSEventReconnect "
    "Disconnect "= "TSEventDisconnect "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName "= "wlnotify.dll "
    "Logon "= "RegisterTicketExpiredNotificationEvent "
    "Logoff "= "UnregisterTicketExpiredNotificationEvent "
    "Impersonate "=dword:00000001
    "Asynchronous "=dword:00000001

    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{D8881DE4-0123-E051-0B22-A5EC10CD7DCF} "=" "

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046} "= "Multimedia File Property Sheet "
    "{176d6597-26d3-11d1-b350-080036a75b03} "= "ICM Scanner Management "
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C} "= "NTFS Security Page "
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32} "= "OLE Docfile Property Page "
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6} "= "Shell extensions for sharing "
    "{41E300E0-78B6-11ce-849B-444553540000} "= "PlusPack CPL Extension "
    "{42071712-76d4-11d1-8b24-00a0c9068ff3} "= "Display Adapter CPL Extension "
    "{42071713-76d4-11d1-8b24-00a0c9068ff3} "= "Display Monitor CPL Extension "
    "{42071714-76d4-11d1-8b24-00a0c9068ff3} "= "Display Panning CPL Extension "
    "{4E40F770-369C-11d0-8922-00A024AB2DBB} "= "DS Security Page "
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} "= "Compatibility Page "
    "{56117100-C0CD-101B-81E2-00AA004AE837} "= "Shell Scrap DataHandler "
    "{59099400-57FF-11CE-BD94-0020AF85B590} "= "Disk Copy Extension "
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6} "= "Shell extensions for Microsoft Windows Network objects "
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605} "= "ICM Monitor Management "
    "{675F097E-4C4D-11D0-B6C1-0800091AA605} "= "ICM Printer Management "
    "{764BF0E1-F219-11ce-972D-00AA00A14F56} "= "Shell extensions for file compression "
    "{77597368-7b15-11d0-a0c2-080036af3f03} "= "Web Printer Shell Extension "
    "{7988B573-EC89-11cf-9C00-00AA00A14F56} "= "Disk Quota UI "
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "= "Encryption Context Menu "
    "{85BBD920-42A0-1069-A2E4-08002B30309D} "= "Briefcase "
    "{88895560-9AA2-1069-930E-00AA0030EBC8} "= "HyperTerminal Icon Ext "
    "{BD84B380-8CA2-1069-AB1D-08000948F534} "= "Fonts "
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27} "= "ICC Profile "
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723} "= "Printers Security Page "
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} "= "Shell extensions for sharing "
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03} "= "Display TroubleShoot CPL Extension "
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45} "= "Crypto PKO Extension "
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45} "= "Crypto Sign Extension "
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E} "= "Network Connections "
    "{992CFFA0-F557-101A-88EC-00DD010CCC48} "= "Network Connections "
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD} "= "Scanners & Cameras "
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} "= "Scanners & Cameras "
    "{905667aa-acd6-11d2-8080-00805f6596d2} "= "Scanners & Cameras "
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1} "= "Scanners & Cameras "
    "{83bbcbf3-b28a-4919-a5aa-73027445d672} "= "Scanners & Cameras "
    "{F0152790-D56E-4445-850E-4F3117DB740C} "= "Remote Sessions CPL Extension "
    "{60254CA5-953B-11CF-8C96-00AA00B8708C} "= "Shell extensions for Windows Script Host "
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829} "= "Microsoft Data Link "
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} "= "Tasks Folder Icon Handler "
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} "= "Tasks Folder Shell Extension "
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF} "= "Scheduled Tasks "
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1} "= "Taskbar and Start Menu "
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} "= "Search "
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} "= "Help and Support "
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} "= "Help and Support "
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} "= "Run... "
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} "= "Internet "
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} "= "E-mail "
    "{D20EA4E1-3957-11d2-A40B-0C5020524152} "= "Fonts "
    "{D20EA4E1-3957-11d2-A40B-0C5020524153} "= "Administrative Tools "
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78} "= "Audio Media Properties Handler "
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817} "= "Video Media Properties Handler "
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71} "= "Wav Properties Handler "
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E} "= "Avi Properties Handler "
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9} "= "Midi Properties Handler "
    "{c5a40261-cd64-4ccf-84cb-c394da41d590} "= "Video Thumbnail Extractor "
    "{5E6AB780-7743-11CF-A12B-00AA004AE837} "= "Microsoft Internet Toolbar "
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938} "= "Download Status "
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972} "= "Augmented Shell Folder "
    "{6413BA2C-B461-11d1-A18A-080036B11A03} "= "Augmented Shell Folder 2 "
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383} "= "BandProxy "
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837} "= "Microsoft BrowserBand "
    "{30D02401-6A81-11d0-8274-00C04FD5AE38} "= "Search Band "
    "{32683183-48a0-441b-a342-7c2a440a9478} "= "Media Band "
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13} "= "In-pane search "
    "{07798131-AF23-11d1-9111-00A0C98BA67D} "= "Web Search "
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8} "= "Registry Tree Options Utility "
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383} "= "&Address "
    "{A08C11D2-A228-11d0-825B-00AA005B4383} "= "Address EditBox "
    "{00BB2763-6A77-11D0-A535-00C04FD7D062} "= "Microsoft AutoComplete "
    "{7376D660-C583-11d0-A3A5-00C04FD706EC} "= "TridentImageExtractor "
    "{6756A641-DE71-11d0-831B-00AA005B4383} "= "MRU AutoComplete List "
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} "= "Custom MRU AutoCompleted List "
    "{7e653215-fa25-46bd-a339-34a2790f3cb7} "= "Accessible "
    "{acf35015-526e-4230-9596-becbe19f0ac9} "= "Track Popup Bar "
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2} "= "Address Bar Parser "
    "{00BB2764-6A77-11D0-A535-00C04FD7D062} "= "Microsoft History AutoComplete List "
    "{03C036F1-A186-11D0-824A-00AA005B4383} "= "Microsoft Shell Folder AutoComplete List "
    "{00BB2765-6A77-11D0-A535-00C04FD7D062} "= "Microsoft Multiple AutoComplete List Container "
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1} "= "Shell Band Site Menu "
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF} "= "Shell DeskBarApp "
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1} "= "Shell DeskBar "
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1} "= "Shell Rebar BandSite "
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C} "= "User Assist "
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} "= "Global Folder Settings "
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E} "= "Favorites Band "
    "{0A89A860-D7B1-11CE-8350-444553540000} "= "Shell Automation Inproc Service "
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} "= "Shell DocObject Viewer "
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61} "= "Microsoft Browser Architecture "
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8} "= "InternetShortcut "
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE} "= "Microsoft Url History Service "
    "{FF393560-C2A7-11CF-BFF4-444553540000} "= "History "
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933} "= "Temporary Internet Files "
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933} "= "Temporary Internet Files "
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497} "= "Microsoft Url Search Hook "
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} "= "IE4 Suite Splash Screen "
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13} "= "CDF Extension Copy Hook "
    "{131A6951-7F78-11D0-A979-00C04FD705A2} "= "ISFBand OC "
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661} "= "Search Assistant OC "
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837} "= "The Internet "
    "{871C5380-42A0-1069-A2EA-08002B30309D} "= "Internet Name Space "
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E} "= "Explorer Band "
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} "= "Sendmail service "
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} "= "Sendmail service "
    "{88C6C381-2E85-11D0-94DE-444553540000} "= "ActiveX Cache Folder "
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "= "WebCheck "
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} "= "Subscription Mgr "
    "{F5175861-2688-11d0-9C5E-00AA00A45957} "= "Subscription Folder "
    "{08165EA0-E946-11CF-9C87-00AA005127ED} "= "WebCheckWebCrawler "
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} "= "WebCheckChannelAgent "
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} "= "TrayAgent "
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02} "= "Code Download Agent "
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE} "= "ConnectionAgent "
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9} "= "PostAgent "
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} "= "WebCheck SyncMgr Handler "
    "{352EC2B7-8B9A-11D1-B8AE-006008059382} "= "Shell Application Manager "
    "{0B124F8F-91F0-11D1-B8B5-006008059382} "= "Installed Apps Enumerator "
    "{CFCCC7A0-A282-11D1-9082-006008059382} "= "Darwin App Publisher "
    "{e84fda7c-1d6a-45f6-b725-cb260c236066} "= "Shell Image Verbs "
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} "= "Shell Image Data Factory "
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B} "= "GDI+ file thumbnail extractor "
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC} "= "Summary Info Thumbnail handler (DOCFILES) "
    "{EAB841A0-9550-11cf-8C16-00805F1408F3} "= "HTML Thumbnail Extractor "
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe} "= "Shell Image Property Handler "
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D} "= "Web Publishing Wizard "
    "{add36aa8-751a-4579-a266-d66f5202ccbb} "= "Print Ordering via the Web "
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1} "= "Shell Publishing Wizard Object "
    "{58f1f272-9240-4f51-b6d4-fd63d1618591} "= "Get a Passport Wizard "
    "{7A9D77BD-5403-11d2-8785-2E0420524153} "= "User Accounts "
    "{BD472F60-27FA-11cf-B8B4-444553540000} "= "Compressed (zipped) Folder Right Drag Handler "
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} "= "Compressed (zipped) Folder SendTo Target "
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433} "= "Channel File "
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434} "= "Channel Shortcut "
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435} "= "Channel Handler Object "
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437} "= "Channel Menu "
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438} "= "Channel Properties "
    "{63da6ec0-2e98-11cf-8d82-444553540000} "= "FTP Folders Webview "
    "{883373C3-BF89-11D1-BE35-080036B11A03} "= "Microsoft DocProp Shell Ext "
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D} "= "Microsoft DocProp Inplace Edit Box Control "
    "{8EE97210-FD1F-4B19-91DA-67914005F020} "= "Microsoft DocProp Inplace ML Edit Box Control "
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB} "= "Microsoft DocProp Inplace Droplist Combo Control "
    "{6A205B57-2567-4A2C-B881-F787FAB579A3} "= "Microsoft DocProp Inplace Calendar Control "
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} "= "Microsoft DocProp Inplace Time Control "
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB} "= "Directory Query UI "
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86} "= "Shell properties for a DS object "
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB} "= "Directory Object Find "
    "{F020E586-5264-11d1-A532-0000F8757D7E} "= "Directory Start/Search Find "
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65} "= "Directory Property UI "
    "{62AE1F9A-126A-11D0-A14B-0800361B1103} "= "Directory Context Menu Verbs "
    "{ECF03A33-103D-11d2-854D-006008059367} "= "MyDocs Copy Hook "
    "{ECF03A32-103D-11d2-854D-006008059367} "= "MyDocs Drop Target "
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103} "= "MyDocs Properties "
    "{750fdf0e-2a26-11d1-a3ea-080036587f03} "= "Offline Files Menu "
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66} "= "Offline Files Folder Options "
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} "= "Offline Files Folder "
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14} "= "Microsoft Agent Character Property Sheet Handler "
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} "= "DfsShell "
    "{60fd46de-f830-4894-a628-6fa81bc0190d} "= "%DESC_PublishDropTarget% "
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717} "= "MMC Icon Handler "
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262} "= ".CAB file viewer "
    "{32714800-2E5F-11d0-8B85-00AA0044F941} "= "For &People... "
    "{8DD448E6-C188-4aed-AF92-44956194EB1F} "= "Windows Media Player Play as Playlist Context Menu Handler "
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} "= "Windows Media Player Burn Audio CD Context Menu Handler "
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} "= "Windows Media Player Add to Playlist Context Menu Handler "
    "{5E44E225-A408-11CF-B581-008029601108} "= "Adaptec DirectCD Shell Extension "
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED} "= "Auto Update Property Sheet Extension "
    "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} "= "Set Program Access and Defaults "
    "{596AB062-B4D2-4215-9F74-E9109B0A8153} "= "Previous Versions Property Page "
    "{9DB7A13C-F208-4981-8353-73CC61AE2783} "= "Previous Versions "
    "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "= "Shell Extensions for RealOne Player "
    "{B7A80A86-BCE5-417D-A5AF-94D759823AE2} "=" "
    "{640167b4-59b0-47a6-b335-a6b3c0695aea} "= "Portable Media Devices "
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e} "= "Portable Media Devices Menu "
    "{692F0339-CBAA-47e6-B5B5-3B84DB604E87} "= "Extensions Manager Folder "

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{B7A80A86-BCE5-417D-A5AF-94D759823AE2}]
    @=" "

    [HKEY_CLASSES_ROOT\CLSID\{B7A80A86-BCE5-417D-A5AF-94D759823AE2}\Implemented Categories]
    @=" "

    [HKEY_CLASSES_ROOT\CLSID\{B7A80A86-BCE5-417D-A5AF-94D759823AE2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=" "

    [HKEY_CLASSES_ROOT\CLSID\{B7A80A86-BCE5-417D-A5AF-94D759823AE2}\InprocServer32]
    @= "C:\\WINDOWS\\system32\\hjetcfg.dll "
    "ThreadingModel "= "Apartment "

    **********************************************************************************
    Files Found are not all bad files:
    **********************************************************************************
    Directory Listing of system files:
    Volume in drive C has no label.
    Volume Serial Number is 640F-1CD7

    Directory of C:\WINDOWS\System32

    07/21/2005 07:54 PM 233,248 hjetcfg.dll
    07/21/2005 07:29 PM 233,248 irsmsnap.dll
    07/21/2005 10:48 AM 234,272 hrj8051ue.dll
    07/21/2005 10:33 AM 234,272 m8po0i73e8.dll
    07/20/2005 11:13 PM 234,272 n0p4la7q1d.dll
    07/20/2005 04:19 PM 234,272 cirtcli.dll
    07/20/2005 04:19 PM 234,272 cdrtcli.dll
    07/20/2005 03:15 PM 234,272 wudmtpdr.dll
    07/20/2005 03:15 PM 234,272 wnvadvd.dll
    07/20/2005 01:50 PM 234,272 mkcshext.dll
    07/20/2005 01:50 PM 234,272 mqcshext.dll
    07/20/2005 12:37 PM 234,272 mwdemui.dll
    07/20/2005 12:37 PM 234,272 mscshext.dll
    07/20/2005 11:14 AM 234,272 ipetmib1.dll
    07/20/2005 11:14 AM 234,272 iyfgnt5.dll
    07/20/2005 09:50 AM 234,272 nmobjapi.dll
    07/20/2005 09:50 AM 234,272 mavcrt20.dll
    07/20/2005 09:48 AM 234,784 ierop.dll
    07/20/2005 09:47 AM <DIR> dllcache
    07/19/2005 08:13 PM 234,272 r0r6la9s1d.dll
    07/14/2005 06:30 AM 234,784 kt68l7ju1.dll
    07/13/2005 02:16 PM 234,784 u2rulc991f.dll
    07/11/2005 05:23 PM 235,749 iqsmsnap.dll
    07/11/2005 05:18 PM 233,760 en2ql1f51.dll
    07/11/2005 03:09 PM 235,749 mv8ul9l91.dll
    07/11/2005 12:45 PM 233,760 nxtevent.dll
    08/16/2002 11:22 AM <DIR> Microsoft
    25 File(s) 5,858,218 bytes
    2 Dir(s) 34,578,849,792 bytes free
     
    Brinic,
    #6
  8. 2005/07/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Great! :)

    Now close any programs you have open since this step requires a reboot.

    From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
     
    noahdfear,
    #7
  9. 2005/07/22
    Brinic

    Brinic Inactive Thread Starter

    Joined:
    2005/06/08
    Messages:
    71
    Likes Received:
    0
    New logs

    L2Mfix 1.03a

    Running From:
    C:\Documents and Settings\User1\Desktop\l2mfix



    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-NI) ALLOW Read BUILTIN\Users
    (ID-IO) ALLOW Read BUILTIN\Users
    (ID-NI) ALLOW Full access BUILTIN\Administrators
    (ID-IO) ALLOW Full access BUILTIN\Administrators
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER



    Setting registry permissions:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!


    Denying C(CI) access for predefined group "Administrators "
    - adding new ACCESS DENY entry


    Registry Permissions set too:

    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (CI) DENY --C------- BUILTIN\Administrators
    (NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-NI) ALLOW Read BUILTIN\Users
    (ID-IO) ALLOW Read BUILTIN\Users
    (ID-NI) ALLOW Full access BUILTIN\Administrators
    (ID-IO) ALLOW Full access BUILTIN\Administrators
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER



    Setting up for Reboot


    Starting Reboot!

    C:\Documents and Settings\User1\Desktop\l2mfix
    System Rebooted!

    Running From:
    C:\Documents and Settings\User1\Desktop\l2mfix

    killing explorer and rundll32.exe

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Killing PID 1556 'explorer.exe'
    Killing PID 1556 'explorer.exe'
    Killing PID 1556 'explorer.exe'

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Killing PID 2024 'rundll32.exe'

    Scanning First Pass. Please Wait!

    First Pass Completed

    Second Pass Scanning

    Second pass Completed!
    Backing Up: C:\WINDOWS\system32\cdrtcli.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\cirtcli.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\en2ql1f51.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\hrj8051ue.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\ierop.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\ipetmib1.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\iqsmsnap.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\irsmsnap.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\iyfgnt5.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\kt68l7ju1.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\lwadperf.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\m4820eloehqc0.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\m8po0i73e8.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\mavcrt20.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\mkcshext.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\mqcshext.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\mscshext.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\mv8ul9l91.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\mwdemui.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\n0p4la7q1d.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\nmobjapi.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\nxtevent.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\r0r6la9s1d.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\smcur32.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\u2rulc991f.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\wnvadvd.dll
    1 file(s) copied.
    Backing Up: C:\WINDOWS\system32\wudmtpdr.dll
    1 file(s) copied.
    deleting: C:\WINDOWS\system32\cdrtcli.dll
    Successfully Deleted: C:\WINDOWS\system32\cdrtcli.dll
    deleting: C:\WINDOWS\system32\cirtcli.dll
    Successfully Deleted: C:\WINDOWS\system32\cirtcli.dll
    deleting: C:\WINDOWS\system32\en2ql1f51.dll
    Successfully Deleted: C:\WINDOWS\system32\en2ql1f51.dll
    deleting: C:\WINDOWS\system32\hrj8051ue.dll
    Successfully Deleted: C:\WINDOWS\system32\hrj8051ue.dll
    deleting: C:\WINDOWS\system32\ierop.dll
    Successfully Deleted: C:\WINDOWS\system32\ierop.dll
    deleting: C:\WINDOWS\system32\ipetmib1.dll
    Successfully Deleted: C:\WINDOWS\system32\ipetmib1.dll
    deleting: C:\WINDOWS\system32\iqsmsnap.dll
    Successfully Deleted: C:\WINDOWS\system32\iqsmsnap.dll
    deleting: C:\WINDOWS\system32\irsmsnap.dll
    Successfully Deleted: C:\WINDOWS\system32\irsmsnap.dll
    deleting: C:\WINDOWS\system32\iyfgnt5.dll
    Successfully Deleted: C:\WINDOWS\system32\iyfgnt5.dll
    deleting: C:\WINDOWS\system32\kt68l7ju1.dll
    Successfully Deleted: C:\WINDOWS\system32\kt68l7ju1.dll
    deleting: C:\WINDOWS\system32\lwadperf.dll
    Successfully Deleted: C:\WINDOWS\system32\lwadperf.dll
    deleting: C:\WINDOWS\system32\m4820eloehqc0.dll
    Successfully Deleted: C:\WINDOWS\system32\m4820eloehqc0.dll
    deleting: C:\WINDOWS\system32\m8po0i73e8.dll
    Successfully Deleted: C:\WINDOWS\system32\m8po0i73e8.dll
    deleting: C:\WINDOWS\system32\mavcrt20.dll
    Successfully Deleted: C:\WINDOWS\system32\mavcrt20.dll
    deleting: C:\WINDOWS\system32\mkcshext.dll
    Successfully Deleted: C:\WINDOWS\system32\mkcshext.dll
    deleting: C:\WINDOWS\system32\mqcshext.dll
    Successfully Deleted: C:\WINDOWS\system32\mqcshext.dll
    deleting: C:\WINDOWS\system32\mscshext.dll
    Successfully Deleted: C:\WINDOWS\system32\mscshext.dll
    deleting: C:\WINDOWS\system32\mv8ul9l91.dll
    Successfully Deleted: C:\WINDOWS\system32\mv8ul9l91.dll
    deleting: C:\WINDOWS\system32\mwdemui.dll
    Successfully Deleted: C:\WINDOWS\system32\mwdemui.dll
    deleting: C:\WINDOWS\system32\n0p4la7q1d.dll
    Successfully Deleted: C:\WINDOWS\system32\n0p4la7q1d.dll
    deleting: C:\WINDOWS\system32\nmobjapi.dll
    Successfully Deleted: C:\WINDOWS\system32\nmobjapi.dll
    deleting: C:\WINDOWS\system32\nxtevent.dll
    Successfully Deleted: C:\WINDOWS\system32\nxtevent.dll
    deleting: C:\WINDOWS\system32\r0r6la9s1d.dll
    Successfully Deleted: C:\WINDOWS\system32\r0r6la9s1d.dll
    deleting: C:\WINDOWS\system32\smcur32.dll
    Successfully Deleted: C:\WINDOWS\system32\smcur32.dll
    deleting: C:\WINDOWS\system32\u2rulc991f.dll
    Successfully Deleted: C:\WINDOWS\system32\u2rulc991f.dll
    deleting: C:\WINDOWS\system32\wnvadvd.dll
    Successfully Deleted: C:\WINDOWS\system32\wnvadvd.dll
    deleting: C:\WINDOWS\system32\wudmtpdr.dll
    Successfully Deleted: C:\WINDOWS\system32\wudmtpdr.dll


    Zipping up files for submission:
    adding: cdrtcli.dll (164 bytes security) (deflated 4%)
    adding: cirtcli.dll (164 bytes security) (deflated 4%)
    adding: en2ql1f51.dll (164 bytes security) (deflated 4%)
    adding: hrj8051ue.dll (164 bytes security) (deflated 4%)
    adding: ierop.dll (164 bytes security) (deflated 4%)
    adding: ipetmib1.dll (164 bytes security) (deflated 4%)
    adding: iqsmsnap.dll (164 bytes security) (deflated 5%)
    adding: irsmsnap.dll (164 bytes security) (deflated 4%)
    adding: iyfgnt5.dll (164 bytes security) (deflated 4%)
    adding: kt68l7ju1.dll (164 bytes security) (deflated 4%)
    adding: lwadperf.dll (164 bytes security) (deflated 4%)
    adding: m4820eloehqc0.dll (164 bytes security) (deflated 4%)
    adding: m8po0i73e8.dll (164 bytes security) (deflated 4%)
    adding: mavcrt20.dll (164 bytes security) (deflated 4%)
    adding: mkcshext.dll (164 bytes security) (deflated 4%)
    adding: mqcshext.dll (164 bytes security) (deflated 4%)
    adding: mscshext.dll (164 bytes security) (deflated 4%)
    adding: mv8ul9l91.dll (164 bytes security) (deflated 5%)
    adding: mwdemui.dll (164 bytes security) (deflated 4%)
    adding: n0p4la7q1d.dll (164 bytes security) (deflated 4%)
    adding: nmobjapi.dll (164 bytes security) (deflated 4%)
    adding: nxtevent.dll (164 bytes security) (deflated 4%)
    adding: r0r6la9s1d.dll (164 bytes security) (deflated 4%)
    adding: smcur32.dll (164 bytes security) (deflated 4%)
    adding: u2rulc991f.dll (164 bytes security) (deflated 4%)
    adding: wnvadvd.dll (164 bytes security) (deflated 4%)
    adding: wudmtpdr.dll (164 bytes security) (deflated 4%)
    adding: clear.reg (164 bytes security) (deflated 22%)
    adding: echo.reg (164 bytes security) (deflated 8%)
    adding: direct.txt (164 bytes security) (stored 0%)
    adding: lo2.txt (164 bytes security) (deflated 84%)
    adding: readme.txt (164 bytes security) (deflated 49%)
    adding: report.txt (164 bytes security) (deflated 64%)
    adding: test.txt (164 bytes security) (deflated 81%)
    adding: test2.txt (164 bytes security) (stored 0%)
    adding: test3.txt (164 bytes security) (stored 0%)
    adding: test5.txt (164 bytes security) (stored 0%)
    adding: xfind.txt (164 bytes security) (deflated 76%)
    adding: backregs/B7A80A86-BCE5-417D-A5AF-94D759823AE2.reg (164 bytes security) (deflated 70%)
    adding: backregs/shell.reg (164 bytes security) (deflated 73%)

    Restoring Registry Permissions:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!


    Revoking access for predefined group "Administrators "
    Inherited ACE can not be revoked here!
    Inherited ACE can not be revoked here!


    Registry permissions set too:

    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
    (NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-NI) ALLOW Read BUILTIN\Users
    (ID-IO) ALLOW Read BUILTIN\Users
    (ID-NI) ALLOW Full access BUILTIN\Administrators
    (ID-IO) ALLOW Full access BUILTIN\Administrators
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER


    Restoring Sedebugprivilege:

    Granting SeDebugPrivilege to Administrators ... successful

    deleting local copy: cdrtcli.dll
    deleting local copy: cirtcli.dll
    deleting local copy: en2ql1f51.dll
    deleting local copy: hrj8051ue.dll
    deleting local copy: ierop.dll
    deleting local copy: ipetmib1.dll
    deleting local copy: iqsmsnap.dll
    deleting local copy: irsmsnap.dll
    deleting local copy: iyfgnt5.dll
    deleting local copy: kt68l7ju1.dll
    deleting local copy: lwadperf.dll
    deleting local copy: m4820eloehqc0.dll
    deleting local copy: m8po0i73e8.dll
    deleting local copy: mavcrt20.dll
    deleting local copy: mkcshext.dll
    deleting local copy: mqcshext.dll
    deleting local copy: mscshext.dll
    deleting local copy: mv8ul9l91.dll
    deleting local copy: mwdemui.dll
    deleting local copy: n0p4la7q1d.dll
    deleting local copy: nmobjapi.dll
    deleting local copy: nxtevent.dll
    deleting local copy: r0r6la9s1d.dll
    deleting local copy: smcur32.dll
    deleting local copy: u2rulc991f.dll
    deleting local copy: wnvadvd.dll
    deleting local copy: wudmtpdr.dll

    The following Is the Current Export of the Winlogon notify key:
    ****************************************************************************
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous "=dword:00000000
    "Impersonate "=dword:00000000
    "DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff "= "ChainWlxLogoffEvent "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous "=dword:00000000
    "Impersonate "=dword:00000000
    "DllName "=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff "= "CryptnetWlxLogoffEvent "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName "= "cscdll.dll "
    "Logon "= "WinlogonLogonEvent "
    "Logoff "= "WinlogonLogoffEvent "
    "ScreenSaver "= "WinlogonScreenSaverEvent "
    "Startup "= "WinlogonStartupEvent "
    "Shutdown "= "WinlogonShutdownEvent "
    "StartShell "= "WinlogonStartShellEvent "
    "Impersonate "=dword:00000000
    "Asynchronous "=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName "= "wlnotify.dll "
    "Logon "= "SCardStartCertProp "
    "Logoff "= "SCardStopCertProp "
    "Lock "= "SCardSuspendCertProp "
    "Unlock "= "SCardResumeCertProp "
    "Enabled "=dword:00000001
    "Impersonate "=dword:00000001
    "Asynchronous "=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous "=dword:00000000
    "DllName "=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate "=dword:00000000
    "StartShell "= "SchedStartShell "
    "Logoff "= "SchedEventLogOff "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff "= "WLEventLogoff "
    "Impersonate "=dword:00000000
    "Asynchronous "=dword:00000001
    "DllName "=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName "= "WlNotify.dll "
    "Lock "= "SensLockEvent "
    "Logon "= "SensLogonEvent "
    "Logoff "= "SensLogoffEvent "
    "Safe "=dword:00000001
    "MaxWait "=dword:00000258
    "StartScreenSaver "= "SensStartScreenSaverEvent "
    "StopScreenSaver "= "SensStopScreenSaverEvent "
    "Startup "= "SensStartupEvent "
    "Shutdown "= "SensShutdownEvent "
    "StartShell "= "SensStartShellEvent "
    "PostShell "= "SensPostShellEvent "
    "Disconnect "= "SensDisconnectEvent "
    "Reconnect "= "SensReconnectEvent "
    "Unlock "= "SensUnlockEvent "
    "Impersonate "=dword:00000001
    "Asynchronous "=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous "=dword:00000000
    "DllName "=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate "=dword:00000000
    "Logoff "= "TSEventLogoff "
    "Logon "= "TSEventLogon "
    "PostShell "= "TSEventPostShell "
    "Shutdown "= "TSEventShutdown "
    "StartShell "= "TSEventStartShell "
    "Startup "= "TSEventStartup "
    "MaxWait "=dword:00000258
    "Reconnect "= "TSEventReconnect "
    "Disconnect "= "TSEventDisconnect "

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName "= "wlnotify.dll "
    "Logon "= "RegisterTicketExpiredNotificationEvent "
    "Logoff "= "UnregisterTicketExpiredNotificationEvent "
    "Impersonate "=dword:00000001
    "Asynchronous "=dword:00000001


    The following are the files found:
    ****************************************************************************
    C:\WINDOWS\system32\cdrtcli.dll
    C:\WINDOWS\system32\cirtcli.dll
    C:\WINDOWS\system32\en2ql1f51.dll
    C:\WINDOWS\system32\hrj8051ue.dll
    C:\WINDOWS\system32\ierop.dll
    C:\WINDOWS\system32\ipetmib1.dll
    C:\WINDOWS\system32\iqsmsnap.dll
    C:\WINDOWS\system32\irsmsnap.dll
    C:\WINDOWS\system32\iyfgnt5.dll
    C:\WINDOWS\system32\kt68l7ju1.dll
    C:\WINDOWS\system32\lwadperf.dll
    C:\WINDOWS\system32\m4820eloehqc0.dll
    C:\WINDOWS\system32\m8po0i73e8.dll
    C:\WINDOWS\system32\mavcrt20.dll
    C:\WINDOWS\system32\mkcshext.dll
    C:\WINDOWS\system32\mqcshext.dll
    C:\WINDOWS\system32\mscshext.dll
    C:\WINDOWS\system32\mv8ul9l91.dll
    C:\WINDOWS\system32\mwdemui.dll
    C:\WINDOWS\system32\n0p4la7q1d.dll
    C:\WINDOWS\system32\nmobjapi.dll
    C:\WINDOWS\system32\nxtevent.dll
    C:\WINDOWS\system32\r0r6la9s1d.dll
    C:\WINDOWS\system32\smcur32.dll
    C:\WINDOWS\system32\u2rulc991f.dll
    C:\WINDOWS\system32\wnvadvd.dll
    C:\WINDOWS\system32\wudmtpdr.dll

    Registry Entries that were Deleted:
    Please verify that the listing looks ok.
    If there was something deleted wrongly there are backups in the backreg folder.
    ****************************************************************************
    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{B7A80A86-BCE5-417D-A5AF-94D759823AE2} "=-
    [-HKEY_CLASSES_ROOT\CLSID\{B7A80A86-BCE5-417D-A5AF-94D759823AE2}]
    REGEDIT4

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "SV1 "=" "
    ****************************************************************************
    Desktop.ini Contents:
    ****************************************************************************
    ****************************************************************************
    
     
    Brinic,
    #8
  10. 2005/07/22
    Brinic

    Brinic Inactive Thread Starter

    Joined:
    2005/06/08
    Messages:
    71
    Likes Received:
    0
    New logs con't

    Logfile of HijackThis v1.99.1
    Scan saved at 7:20:34 AM, on 7/22/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\HijackThis\HijackThis.exe
    C:\Program Files\Messenger\msmsgs.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sympatico.ca/homepage.html?blink=static
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.netscape.ca/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.sympatico.ca/homepage.html?blink=static
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1120256448682
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
    O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{FEDA78BB-6223-4901-AEAF-3F99397EC698}: NameServer = 207.236.176.10 206.47.244.89
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
     
    Brinic,
    #9
  11. 2005/07/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Delete the following files and folders if present.

    C:\WINDOWS\SYSTEM32\cd_clint.dll
    C:\GatorPatch.log
    C:\keys.ini
    C:\WINDOWS\smdat32m.sys
    C:\WINDOWS\usta33.ini
    C:\PROGRAM FILES\Altnet << folder
    C:\PROGRAM FILES\SideFind << folder
    C:\Program Files\KaZaA << folder
    C:\WINDOWS\SYSTEM32\P2P Networking << folder

    If you're comfortable in the registry, delete the following in bold.

    HKEY_CLASSES_ROOT\CLSID\{147A976E-EEE1-4377-8EA7-4716E4CDD239}
    HKEY_CLASSES_ROOT\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
    HKEY_CURRENT_USER\SOFTWARE\P2P NETWORKING
    HKEY_LOCAL_MACHINE\software\classes\CLSID\{9AFB824 8-617F-460d-9366-D71CDEDA3179}
    HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMANAGEMENT\ARPCACHE\INTERNET OPTIMIZER
    HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/DOWNLOADED PROGRAM FILES/MEDIAACCX.DLL

    Download the stand-alone CWShredder 2.15 from here. Save it to the desktop. Open, close all other windows and click fix.

    If you don't already have Ad-aware SE Personal 1.06, download it from my signature, install and update, then run a full scan. Remove all it finds. If you have it, update and scan.

    Open My Computer, right click Local disk C: and choose properties, then disk cleanup. Check all boxes except compress old files and click OK.

    Reboot.

    Download and install SpywareBlaster. Enable all protections, check for updates and enable them too. Then download IESpyad.exe, double click to extract (it extracts to C:\IESpyad by default), open the folder, double click the ie-ads.reg file and allow it to merge into the registry.

    Run another Panda scan and post the report, along with a New HijackThis log.
     
    noahdfear,
    #10
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...