Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Pop Ups In Ie And Firefox


  • Please log in to reply
18 replies to this topic

#1 aylaofduni

aylaofduni

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 29 January 2006 - 10:48 PM

Spybot finds nothing. Adaware finds nothing. AVG finds nothing. Bazooka scanner finds 3 things: exploit beehappyy.biz, pacerd.bundle, searchbartoolbar

I get various pop ups in both IE and Firefox, which is especially annoying to me since I haven't had a single instance of infection since switching to firefox a couple of years ago.

Some of the pop ups are based on things I have searched for in google, some are just random. I have followed the manual removal instructions that bazooka gave, but they did nothing except waste an hour of time tracking down a zillion different registry entries that turned out to not be there.

here is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 9:46:00 PM, on 1/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\DELLSU~1\DSAgnt.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Logitech\SetPoint\kem.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trillian\trillian.exe
C:\Documents and Settings\April McGee\Desktop\stng259.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [System Remote Support32] winspre64.exe
O4 - HKCU\..\Run: [DellSupport] "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll (file missing)
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O15 - Trusted Zone: Ais.Eagleacd.Com
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc...76/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg...,16/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{38876DED-01FC-4E86-B2D7-52CC86278B0B}: NameServer = 209.47.15.118,64.157.143.38
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\ktnsl7571.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

any help would be very greatly appreciated!

BC AdBot (Login to Remove)

 


#2 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:07:43 PM

Posted 01 February 2006 - 01:58 PM

Hi There! :thumbsup:

I am currently working on your log and am checking it with a teacher.

I will get back to you as soon as possible.

David :flowers:

#3 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:07:43 PM

Posted 01 February 2006 - 03:15 PM

Hi aylaofduni

*Please start a new scan with HJT and place a checkmark next to each of the following items (if present):

O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\ktnsl7571.dll


* Make sure your Internet Explorer is closed and click on "Fix Checked" and exit HijackThis when finished.

Also, you have a version of VX2. Normal scanners aren't able top combat the problem unfortunetly. We will need to use this special toolto remove the infection:

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

David

#4 aylaofduni

aylaofduni
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 02 February 2006 - 12:52 AM

Hi,

Thanks for responding. Since my original post, I have been able to get rid of the pop ups. Spy sweeper found several things for me, and got rid of them. I would still like to go through the whole process, though, in case there might still be something hiding. Here is the l2mfix log.


L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{40228974-59AD-44B0-3BA1-9FB7D3DF67DE}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="Eudora's Shell Extension"
"{C56C4E21-706D-11d0-AFC5-444553540002}"="My Digital Camera"
"{51CD2A0E-D225-493C-A989-72D038BD97B6}"="Media Jukebox"
"{B8323370-FF27-11D2-97B6-204C4F4F5020}"="SmartFTP Shell Extension DLL"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{336B02CE-F88A-4aea-8731-79EF94D3723A}"="Free AOL & Unlimited Internet.lnk"
"{5E7D9611-0A92-11D6-BCC6-C117EB0C4E52}"="RStudio Menu Handler"
"{3C7BE262-0E51-11D6-BCC6-A29C3C5B2152}"="R-Undelete"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{2B3453E4-49DF-11D3-8229-0080BE509050}"="GMail Drive"
"{2B3453E4-49DF-11D3-8229-0080BE509052}"="GMailFS Property Sheet"
"{2B3453E4-49DF-11D3-8229-0080BE509054}"="GMailFS Drop Handler"
"{2B3453E4-49DF-11D3-8229-0080BE509056}"="GMailFS Context Menu"
"{6db8213d-6561-483a-af7b-393725a1f0d3}"="eFax Messenger - Shell Extension"
"{188FBEE7-10D0-4F0E-B001-492C64BD8CD6}"=""
"{61F742B8-2AD2-4319-9CB9-2959D648F3AF}"=""
"{E26D77DA-A5BE-4CD0-8E38-0F5B106CB522}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{E26D77DA-A5BE-4CD0-8E38-0F5B106CB522}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E26D77DA-A5BE-4CD0-8E38-0F5B106CB522}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E26D77DA-A5BE-4CD0-8E38-0F5B106CB522}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E26D77DA-A5BE-4CD0-8E38-0F5B106CB522}\InprocServer32]
@="C:\\WINDOWS\\system32\\CYL3D.DLL"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
browseui.dll Wed Nov 23 2005 7:06:34p A.... 1,022,464 998.50 K
danim.dll Fri Nov 4 2005 9:16:24p A.... 1,054,208 1.00 M
gdi32.dll Wed Dec 28 2005 8:54:36p A.... 280,064 273.50 K
legitc~1.dll Fri Nov 4 2005 4:27:24p A.... 534,280 521.76 K
mshtml.dll Wed Nov 23 2005 7:06:34p A.... 3,015,680 2.88 M
shdocvw.dll Wed Nov 30 2005 9:59:30p A.... 1,492,480 1.42 M
urlmon.dll Fri Nov 4 2005 9:16:28p A.... 609,280 595.00 K
vct3216.dll Tue Nov 15 2005 2:26:58p A.... 278,016 271.50 K
wrlogo~1.dll Wed Jan 25 2006 11:06:02a A.... 492,544 481.00 K
wrlzma.dll Wed Jan 25 2006 11:05:58a A.... 17,920 17.50 K

10 items found: 10 files, 0 directories.
Total of file sizes: 8,796,936 bytes 8.39 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is E892-AA40

Directory of C:\WINDOWS\System32

01/10/2006 11:16 PM <DIR> DLLCACHE
12/10/2003 10:51 AM <DIR> Microsoft
0 File(s) 0 bytes
2 Dir(s) 7,220,801,536 bytes free

#5 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:07:43 PM

Posted 02 February 2006 - 04:29 AM

Please may i have a new HJT log :thumbsup:
David

Edited by D-Trojanator, 02 February 2006 - 04:29 AM.


#6 aylaofduni

aylaofduni
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 02 February 2006 - 09:33 AM

here's a new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:30:35 AM, on 2/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\PROGRA~1\DELLSU~1\DSAgnt.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Google\Google Updater\1.0.384.22153\GoogleUpdater.exe
C:\Program Files\Logitech\SetPoint\kem.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Qualcomm\Eudora\Eudora.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [DellSupport] "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\1.0.384.22153\GoogleUpdater.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll (file missing)
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O15 - Trusted Zone: Ais.Eagleacd.Com
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc...76/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg...,16/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{38876DED-01FC-4E86-B2D7-52CC86278B0B}: NameServer = 209.47.15.118,64.157.143.38
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#7 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:07:43 PM

Posted 03 February 2006 - 03:43 AM

Hi aylaofduni :thumbsup:

You did well with your anit-spyware choice. I believe that Spysweeper is the only other tool that is able to remove the VX2 infection. I see only one entry in your HijackThis log that needs to be fixed:

*Now start a new scan with HJT and place a checkmark next to each of the following items (if present):

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

* Make sure your Internet Explorer is closed and click on "Fix Checked" and exit HijackThis when finished.

=========================

A file we need to find later may well be hidden, so we know to make Windows show these files:

Make sure that you can see hidden files (Windows XP).
-Click "Start".
-Click "My Computer".
-Select the "Tools" menu and click "Folder Options".
-Select the "View" tab.
-Under the "Hidden files and folders" heading, select "Show hidden files and folders".
-Uncheck the "Hide protected operating system files (recommended)" option.
-Click "Yes" to confirm.
-Uncheck the "Hide file extensions for known file types".
-Click "OK".

=========================

:flowers: Please visit http://virusscan.jotti.org/
Click on Browse... and navigate to the following file: C:\WINDOWS\system32\CYL3D.DLL
Click Open
Please let me know the results of the file scan by copying the repot and posting it here.

Thanks,
David

#8 aylaofduni

aylaofduni
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 03 February 2006 - 10:36 AM

hi David.

I followed the directions exactly, all hidden files and folders are showing, however C:\WINDOWS\system32\CYL3D.DLL does not exist. I have scheduled virus and spyware/adware scans on my computer each day so perhaps one of them got it?

everything else has been fine.

#9 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:07:43 PM

Posted 03 February 2006 - 03:59 PM

Hi again aylaofduni! :thumbsup:

Please open notepad and and copy and paste the following from the quote box:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{40228974-59AD-44B0-3BA1-9FB7D3DF67DE}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

[-HKEY_CLASSES_ROOT\CLSID\{E26D77DA-A5BE-4CD0-8E38-0F5B106CB522}]

Save this as "fix.reg" Choose to save as *all files and place it on your desktop.

It should look like this: Posted Image

Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Please run Option #1 from l2mfix.bat again and post the log it creates :flowers:

David

#10 aylaofduni

aylaofduni
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 03 February 2006 - 05:38 PM

ok here is the l2mfix.bat log. thanks again.



L2MFIX find log 010406
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"="Eudora's Shell Extension"
"{C56C4E21-706D-11d0-AFC5-444553540002}"="My Digital Camera"
"{51CD2A0E-D225-493C-A989-72D038BD97B6}"="Media Jukebox"
"{B8323370-FF27-11D2-97B6-204C4F4F5020}"="SmartFTP Shell Extension DLL"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{336B02CE-F88A-4aea-8731-79EF94D3723A}"="Free AOL & Unlimited Internet.lnk"
"{5E7D9611-0A92-11D6-BCC6-C117EB0C4E52}"="RStudio Menu Handler"
"{3C7BE262-0E51-11D6-BCC6-A29C3C5B2152}"="R-Undelete"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{e57ce731-33e8-4c51-8354-bb4de9d215d1}"="Universal Plug and Play Devices"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{2B3453E4-49DF-11D3-8229-0080BE509050}"="GMail Drive"
"{2B3453E4-49DF-11D3-8229-0080BE509052}"="GMailFS Property Sheet"
"{2B3453E4-49DF-11D3-8229-0080BE509054}"="GMailFS Drop Handler"
"{2B3453E4-49DF-11D3-8229-0080BE509056}"="GMailFS Context Menu"
"{6db8213d-6561-483a-af7b-393725a1f0d3}"="eFax Messenger - Shell Extension"
"{188FBEE7-10D0-4F0E-B001-492C64BD8CD6}"=""
"{61F742B8-2AD2-4319-9CB9-2959D648F3AF}"=""
"{E26D77DA-A5BE-4CD0-8E38-0F5B106CB522}"=""
"{7C9D5882-CB4A-4090-96C8-430BFE8B795B}"="Webroot Spy Sweeper Context Menu Integration"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
browseui.dll Wed Nov 23 2005 7:06:34p A.... 1,022,464 998.50 K
gdi32.dll Wed Dec 28 2005 8:54:36p A.... 280,064 273.50 K
mshtml.dll Wed Nov 23 2005 7:06:34p A.... 3,015,680 2.88 M
shdocvw.dll Wed Nov 30 2005 9:59:30p A.... 1,492,480 1.42 M
vct3216.dll Tue Nov 15 2005 2:26:58p A.... 278,016 271.50 K
wrlogo~1.dll Wed Jan 25 2006 11:06:02a A.... 492,544 481.00 K
wrlzma.dll Wed Jan 25 2006 11:05:58a A.... 17,920 17.50 K

7 items found: 7 files, 0 directories.
Total of file sizes: 6,599,168 bytes 6.29 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is E892-AA40

Directory of C:\WINDOWS\System32

01/10/2006 11:16 PM <DIR> DLLCACHE
12/10/2003 10:51 AM <DIR> Microsoft
0 File(s) 0 bytes
2 Dir(s) 7,170,711,552 bytes free

#11 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:07:43 PM

Posted 05 February 2006 - 12:19 PM

Hi aylaofduni

Your L2me infection is now clean, but i would like to take one last look at a new HijackThis log before i let you go. Before doing so i think we should hide the system files/folders that you set to 'show' a while back. I think this is a good idea, because if your system files are showing, there is a higher chance of you accidentally deleting a legitimate file.

Hide System Files
  • Click Start.
  • Open My Computer.
  • Select Tools menu
  • Click Folder Options.
  • Select the View Tab.
  • Uncheck Show hidden files and foldersin the Hidden files and folders section.
  • Select Hide protected operating system files (recommended) option.
  • Check the Hide file extensions for known file types option.
  • Click Yes.
  • Click OK.
__________________

So, please post back with a fresh HijackThis log and i can give you the all clear :thumbsup:
David

#12 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:07:43 PM

Posted 06 February 2006 - 02:07 PM

Hi again,

I would also like you to complete this. I need to get an export of the files being started via the SharedTaskScheduler registry key.

Please download the following file and save it to your desktop:

getsea.exe

Once it has downloaded, please double-click on the file, which should now be on your desktop. When the program is finished, it will create a text file on your desktop called getsts.txt and open it in notepad.

Please post the contents of this notepad as a reply to this topic.

David

#13 aylaofduni

aylaofduni
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 06 February 2006 - 04:42 PM

here is the hijack this log, and I will be right back with the other thing...

Logfile of HijackThis v1.99.1
Scan saved at 3:40:20 PM, on 2/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\PROGRA~1\DELLSU~1\DSAgnt.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Logitech\SetPoint\kem.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Qualcomm\Eudora\Eudora.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [DellSupport] "C:\PROGRA~1\DELLSU~1\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\1.0.384.22153\GoogleUpdater.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll (file missing)
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O15 - Trusted Zone: Ais.Eagleacd.Com
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc...76/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg...,16/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{38876DED-01FC-4E86-B2D7-52CC86278B0B}: NameServer = 209.47.15.118,64.157.143.38
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

#14 aylaofduni

aylaofduni
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 06 February 2006 - 04:54 PM

I had a problem with getsea. The DOS window (I think?) pops up and things seem to be ok for a moment. Then I get one of those "getsea has encountered a problem" type error messages, and it shuts down. There was still a log file generated but it doesn't seem to be complete. Here is what I got:

(GetSEA.exe) Shell Extensions Approved exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

(HKLM) {00022613-0000-0000-C000-000000000046} - Multimedia File Property Sheet => mmsys.cpl

(HKLM) {176d6597-26d3-11d1-b350-080036a75b03} - ICM Scanner Management => icmui.dll

(HKLM) {1F2E5C40-9550-11CE-99D2-00AA006E086C} - NTFS Security Page => rshx32.dll

(HKLM) {3EA48300-8CF6-101B-84FB-666CCB9BCD32} - OLE Docfile Property Page => docprop.dll

(HKLM) {40dd6e20-7c17-11ce-a804-00aa003ca9f6} - Shell extensions for sharing => ntshrui.dll

(HKLM) {41E300E0-78B6-11ce-849B-444553540000} - PlusPack CPL Extension => %SystemRoot%\System32\themeui.dll

(HKLM) {42071712-76d4-11d1-8b24-00a0c9068ff3} - Display Adapter CPL Extension => deskadp.dll

(HKLM) {42071713-76d4-11d1-8b24-00a0c9068ff3} - Display Monitor CPL Extension => deskmon.dll

(HKLM) {42071714-76d4-11d1-8b24-00a0c9068ff3} - Display Panning CPL Extension => deskpan.dll

(HKLM) {4E40F770-369C-11d0-8922-00A024AB2DBB} - DS Security Page => dssec.dll

(HKLM) {513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} - Compatibility Page => SlayerXP.dll

(HKLM) {56117100-C0CD-101B-81E2-00AA004AE837} - Shell Scrap DataHandler => shscrap.dll

(HKLM) {59099400-57FF-11CE-BD94-0020AF85B590} - Disk Copy Extension => diskcopy.dll

(HKLM) {59be4990-f85c-11ce-aff7-00aa003ca9f6} - Shell extensions for Microsoft Windows Network objects => ntlanui2.dll

(HKLM) {5DB2625A-54DF-11D0-B6C4-0800091AA605} - ICM Monitor Management => %SystemRoot%\System32\icmui.dll

(HKLM) {675F097E-4C4D-11D0-B6C1-0800091AA605} - ICM Printer Management => %SystemRoot%\system32\icmui.dll

(HKLM) {77597368-7b15-11d0-a0c2-080036af3f03} - Web Printer Shell Extension => printui.dll

(HKLM) {7988B573-EC89-11cf-9C00-00AA00A14F56} - Disk Quota UI => dskquoui.dll

(HKLM) {85BBD920-42A0-1069-A2E4-08002B30309D} - Briefcase => syncui.dll

(HKLM) {88895560-9AA2-1069-930E-00AA0030EBC8} - HyperTerminal Icon Ext => C:\WINDOWS\System32\hticons.dll

(HKLM) {BD84B380-8CA2-1069-AB1D-08000948F534} - Fonts => fontext.dll

(HKLM) {DBCE2480-C732-101B-BE72-BA78E9AD5B27} - ICC Profile => %SystemRoot%\system32\icmui.dll

(HKLM) {F37C5810-4D3F-11d0-B4BF-00AA00BBB723} - Printers Security Page => rshx32.dll

(HKLM) {f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} - Shell extensions for sharing => ntshrui.dll

(HKLM) {f92e8c40-3d33-11d2-b1aa-080036a75b03} - Display TroubleShoot CPL Extension => deskperf.dll

(HKLM) {7444C717-39BF-11D1-8CD9-00C04FC29D45} - Crypto PKO Extension => C:\WINDOWS\system32\cryptext.dll

(HKLM) {7444C719-39BF-11D1-8CD9-00C04FC29D45} - Crypto Sign Extension => C:\WINDOWS\system32\cryptext.dll

(HKLM) {7007ACC7-3202-11D1-AAD2-00805FC1270E} - Network Connections => C:\WINDOWS\system32\NETSHELL.dll

(HKLM) {992CFFA0-F557-101A-88EC-00DD010CCC48} - Network Connections => C:\WINDOWS\system32\NETSHELL.dll

(HKLM) {E211B736-43FD-11D1-9EFB-0000F8757FCD} - Scanners & Cameras => wiashext.dll

(HKLM) {FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD} - Scanners & Cameras => wiashext.dll

(HKLM) {905667aa-acd6-11d2-8080-00805f6596d2} - Scanners & Cameras => wiashext.dll

(HKLM) {3F953603-1008-4f6e-A73A-04AAC7A992F1} - Scanners & Cameras => wiashext.dll

(HKLM) {83bbcbf3-b28a-4919-a5aa-73027445d672} - Scanners & Cameras => wiashext.dll

(HKLM) {F0152790-D56E-4445-850E-4F3117DB740C} - Remote Sessions CPL Extension => C:\WINDOWS\System32\remotepg.dll

(HKLM) {60254CA5-953B-11CF-8C96-00AA00B8708C} - Shell extensions for Windows Script Host => C:\WINDOWS\system32\wshext.dll

(HKLM) {2206CDB2-19C1-11D1-89E0-00C04FD7A829} - Microsoft Data Link => C:\Program Files\Common Files\System\Ole DB\oledb32.dll

(HKLM) {DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF} - Tasks Folder Icon Handler => C:\WINDOWS\System32\mstask.dll

(HKLM) {797F1E90-9EDD-11cf-8D8E-00AA0060F5BF} - Tasks Folder Shell Extension => C:\WINDOWS\System32\mstask.dll

(HKLM) {D6277990-4C6A-11CF-8D87-00AA0060F5BF} - Scheduled Tasks => C:\WINDOWS\System32\mstask.dll

(HKLM) {2559a1f0-21d7-11d4-bdaf-00c04f60b9f0} - Search => %SystemRoot%\system32\shdocvw.dll

(HKLM) {2559a1f1-21d7-11d4-bdaf-00c04f60b9f0} - Help and Support => %SystemRoot%\system32\shdocvw.dll

(HKLM) {2559a1f2-21d7-11d4-bdaf-00c04f60b9f0} - Help and Support => %SystemRoot%\system32\shdocvw.dll

(HKLM) {2559a1f3-21d7-11d4-bdaf-00c04f60b9f0} - Run... => %SystemRoot%\system32\shdocvw.dll

(HKLM) {2559a1f4-21d7-11d4-bdaf-00c04f60b9f0} - Internet => %SystemRoot%\system32\shdocvw.dll

(HKLM) {2559a1f5-21d7-11d4-bdaf-00c04f60b9f0} - E-mail => %SystemRoot%\system32\shdocvw.dll

(HKLM) {D20EA4E1-3957-11d2-A40B-0C5020524152} - Fonts => %SystemRoot%\system32\shdocvw.dll

(HKLM) {D20EA4E1-3957-11d2-A40B-0C5020524153} - Administrative Tools => %SystemRoot%\system32\shdocvw.dll

(HKLM) {875CB1A1-0F29-45de-A1AE-CFB4950D0B78} - Audio Media Properties Handler => %SystemRoot%\System32\shmedia.dll

(HKLM) {40C3D757-D6E4-4b49-BB41-0E5BBEA28817} - Video Media Properties Handler => %SystemRoot%\System32\shmedia.dll

(HKLM) {E4B29F9D-D390-480b-92FD-7DDB47101D71} - Wav Properties Handler => %SystemRoot%\System32\shmedia.dll

(HKLM) {87D62D94-71B3-4b9a-9489-5FE6850DC73E} - Avi Properties Handler => %SystemRoot%\System32\shmedia.dll

(HKLM) {A6FD9E45-6E44-43f9-8644-08598F5A74D9} - Midi Properties Handler => %SystemRoot%\System32\shmedia.dll

(HKLM) {c5a40261-cd64-4ccf-84cb-c394da41d590} - Video Thumbnail Extractor => %SystemRoot%\System32\shmedia.dll

(HKLM) {5E6AB780-7743-11CF-A12B-00AA004AE837} - Microsoft Internet Toolbar => %SystemRoot%\System32\browseui.dll

(HKLM) {22BF0C20-6DA7-11D0-B373-00A0C9034938} - Download Status => %SystemRoot%\System32\browseui.dll

(HKLM) {91EA3F8B-C99B-11d0-9815-00C04FD91972} - Augmented Shell Folder => %SystemRoot%\System32\browseui.dll

(HKLM) {6413BA2C-B461-11d1-A18A-080036B11A03} - Augmented Shell Folder 2 => %SystemRoot%\System32\browseui.dll

(HKLM) {F61FFEC1-754F-11d0-80CA-00AA005B4383} - BandProxy => %SystemRoot%\System32\browseui.dll

(HKLM) {7BA4C742-9E81-11CF-99D3-00AA004AE837} - Microsoft BrowserBand => %SystemRoot%\System32\browseui.dll

(HKLM) {30D02401-6A81-11d0-8274-00C04FD5AE38} - Search Band => %SystemRoot%\System32\browseui.dll

(HKLM) {169A0691-8DF9-11d1-A1C4-00C04FD75D13} - In-pane search => %SystemRoot%\System32\browseui.dll

(HKLM) {07798131-AF23-11d1-9111-00A0C98BA67D} - Web Search => %SystemRoot%\System32\browseui.dll

(HKLM) {AF4F6510-F982-11d0-8595-00AA004CD6D8} - Registry Tree Options Utility => %SystemRoot%\System32\browseui.dll

(HKLM) {01E04581-4EEE-11d0-BFE9-00AA005B4383} - &Address => %SystemRoot%\System32\browseui.dll

(HKLM) {A08C11D2-A228-11d0-825B-00AA005B4383} - Address EditBox => %SystemRoot%\System32\browseui.dll

(HKLM) {00BB2763-6A77-11D0-A535-00C04FD7D062} - Microsoft AutoComplete => %SystemRoot%\System32\browseui.dll

(HKLM) {7376D660-C583-11d0-A3A5-00C04FD706EC} - TridentImageExtractor => %SystemRoot%\System32\browseui.dll

(HKLM) {6756A641-DE71-11d0-831B-00AA005B4383} - MRU AutoComplete List => %SystemRoot%\System32\browseui.dll

(HKLM) {6935DB93-21E8-4ccc-BEB9-9FE3C77A297A} - Custom MRU AutoCompleted List => %SystemRoot%\System32\browseui.dll

(HKLM) {7e653215-fa25-46bd-a339-34a2790f3cb7} - Accessible => %SystemRoot%\System32\browseui.dll

(HKLM) {acf35015-526e-4230-9596-becbe19f0ac9} - Track Popup Bar => %SystemRoot%\System32\browseui.dll

(HKLM) {E0E11A09-5CB8-4B6C-8332-E00720A168F2} - Address Bar Parser => %SystemRoot%\System32\browseui.dll

(HKLM) {00BB2764-6A77-11D0-A535-00C04FD7D062} - Microsoft History AutoComplete List => %SystemRoot%\System32\browseui.dll

(HKLM) {03C036F1-A186-11D0-824A-00AA005B4383} - Microsoft Shell Folder AutoComplete List => %SystemRoot%\System32\browseui.dll

(HKLM) {00BB2765-6A77-11D0-A535-00C04FD7D062} - Microsoft Multiple AutoComplete List Container => %SystemRoot%\System32\browseui.dll

(HKLM) {ECD4FC4E-521C-11D0-B792-00A0C90312E1} - Shell Band Site Menu => %SystemRoot%\System32\browseui.dll

(HKLM) {3CCF8A41-5C85-11d0-9796-00AA00B90ADF} - Shell DeskBarApp => %SystemRoot%\System32\browseui.dll

(HKLM) {ECD4FC4C-521C-11D0-B792-00A0C90312E1} - Shell DeskBar => %SystemRoot%\System32\browseui.dll

(HKLM) {ECD4FC4D-521C-11D0-B792-00A0C90312E1} - Shell Rebar BandSite => %SystemRoot%\System32\browseui.dll

(HKLM) {DD313E04-FEFF-11d1-8ECD-0000F87A470C} - User Assist => %SystemRoot%\System32\browseui.dll

(HKLM) {EF8AD2D1-AE36-11D1-B2D2-006097DF8C11} - Global Folder Settings => %SystemRoot%\System32\browseui.dll

(HKLM) {EFA24E61-B078-11d0-89E4-00C04FC9E26E} - Favorites Band => %SystemRoot%\System32\shdocvw.dll

(HKLM) {0A89A860-D7B1-11CE-8350-444553540000} - Shell Automation Inproc Service => %SystemRoot%\System32\shdocvw.dll

(HKLM) {E7E4BC40-E76A-11CE-A9BB-00AA004AE837} - Shell DocObject Viewer => %SystemRoot%\System32\shdocvw.dll

(HKLM) {A5E46E3A-8849-11D1-9D8C-00C04FC99D61} - Microsoft Browser Architecture => %SystemRoot%\System32\shdocvw.dll

(HKLM) {FBF23B40-E3F0-101B-8488-00AA003E56F8} - InternetShortcut => shdocvw.dll

(HKLM) {3C374A40-BAE4-11CF-BF7D-00AA006946EE} - Microsoft Url History Service => %SystemRoot%\System32\shdocvw.dll

(HKLM) {FF393560-C2A7-11CF-BFF4-444553540000} - History => %SystemRoot%\System32\shdocvw.dll

(HKLM) {7BD29E00-76C1-11CF-9DD0-00A0C9034933} - Temporary Internet Files => %SystemRoot%\System32\shdocvw.dll

(HKLM) {7BD29E01-76C1-11CF-9DD0-00A0C9034933} - Temporary Internet Files => %SystemRoot%\System32\shdocvw.dll

(HKLM) {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Microsoft Url Search Hook => %SystemRoot%\System32\shdocvw.dll

(HKLM) {A2B0DD40-CC59-11d0-A3A5-00C04FD706EC} - IE4 Suite Splash Screen => %SystemRoot%\System32\shdocvw.dll

(HKLM) {67EA19A0-CCEF-11d0-8024-00C04FD75D13} - CDF Extension Copy Hook => %SystemRoot%\System32\shdocvw.dll

(HKLM) {131A6951-7F78-11D0-A979-00C04FD705A2} - ISFBand OC => %SystemRoot%\System32\shdocvw.dll

(HKLM) {9461b922-3c5a-11d2-bf8b-00c04fb93661} - Search Assistant OC => %SystemRoot%\System32\shdocvw.dll

(HKLM) {3DC7A020-0ACD-11CF-A9BB-00AA004AE837} - The Internet => %SystemRoot%\System32\shdocvw.dll

(HKLM) {871C5380-42A0-1069-A2EA-08002B30309D} - Internet Name Space => %SystemRoot%\System32\shdocvw.dll

(HKLM) {EFA24E64-B078-11d0-89E4-00C04FC9E26E} - Explorer Band => %SystemRoot%\System32\shdocvw.dll

(HKLM) {9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} - Sendmail service => C:\WINDOWS\System32\sendmail.dll

(HKLM) {9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} - Sendmail service => C:\WINDOWS\System32\sendmail.dll

(HKLM) {88C6C381-2E85-11D0-94DE-444553540000} - ActiveX Cache Folder => %SystemRoot%\system32\occache.dll

(HKLM) {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - WebCheck => %SystemRoot%\System32\webcheck.dll

(HKLM) {ABBE31D0-6DAE-11D0-BECA-00C04FD940BE} - Subscription Mgr => %SystemRoot%\System32\webcheck.dll

(HKLM) {F5175861-2688-11d0-9C5E-00AA00A45957} - Subscription Folder => %SystemRoot%\System32\webcheck.dll

(HKLM) {08165EA0-E946-11CF-9C87-00AA005127ED} - WebCheckWebCrawler => %SystemRoot%\System32\webcheck.dll

(HKLM) {E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB} - WebCheckChannelAgent => %SystemRoot%\System32\webcheck.dll

(HKLM) {E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7} - TrayAgent => %SystemRoot%\System32\webcheck.dll

(HKLM) {7D559C10-9FE9-11d0-93F7-00AA0059CE02} - Code Download Agent => %SystemRoot%\System32\webcheck.dll

(HKLM) {E6CC6978-6B6E-11D0-BECA-00C04FD940BE} - ConnectionAgent => %SystemRoot%\System32\webcheck.dll

(HKLM) {D8BD2030-6FC9-11D0-864F-00AA006809D9} - PostAgent => %SystemRoot%\System32\webcheck.dll

(HKLM) {7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB} - WebCheck SyncMgr Handler => %SystemRoot%\System32\webcheck.dll

(HKLM) {352EC2B7-8B9A-11D1-B8AE-006008059382} - Shell Application Manager => %SystemRoot%\System32\appwiz.cpl

(HKLM) {0B124F8F-91F0-11D1-B8B5-006008059382} - Installed Apps Enumerator => %SystemRoot%\System32\appwiz.cpl

(HKLM) {CFCCC7A0-A282-11D1-9082-006008059382} - Darwin App Publisher => %SystemRoot%\System32\appwiz.cpl

(HKLM) {e84fda7c-1d6a-45f6-b725-cb260c236066} - Shell Image Verbs => %SystemRoot%\System32\shimgvw.dll

(HKLM) {66e4e4fb-f385-4dd0-8d74-a2efd1bc6178} - Shell Image Data Factory => %SystemRoot%\System32\shimgvw.dll

(HKLM) {3F30C968-480A-4C6C-862D-EFC0897BB84B} - GDI+ file thumbnail extractor => C:\WINDOWS\System32\shimgvw.dll

(HKLM) {9DBD2C50-62AD-11d0-B806-00C04FD706EC} - Summary Info Thumbnail handler (DOCFILES) => C:\WINDOWS\System32\shimgvw.dll

(HKLM) {EAB841A0-9550-11cf-8C16-00805F1408F3} - HTML Thumbnail Extractor => C:\WINDOWS\System32\shimgvw.dll

(HKLM) {eb9b1153-3b57-4e68-959a-a3266bc3d7fe} - Shell Image Property Handler => %SystemRoot%\System32\shimgvw.dll

(HKLM) {CC6EEFFB-43F6-46c5-9619-51D571967F7D} - Web Publishing Wizard => %SystemRoot%\System32\netplwiz.dll

(HKLM) {add36aa8-751a-4579-a266-d66f5202ccbb} - Print Ordering via the Web => %SystemRoot%\System32\netplwiz.dll

(HKLM) {6b33163c-76a5-4b6c-bf21-45de9cd503a1} - Shell Publishing Wizard Object => %SystemRoot%\System32\netplwiz.dll

(HKLM) {58f1f272-9240-4f51-b6d4-fd63d1618591} - Get a Passport Wizard => %SystemRoot%\System32\netplwiz.dll

(HKLM) {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} - Compressed (zipped) Folder => %SystemRoot%\System32\zipfldr.dll

(HKLM) {BD472F60-27FA-11cf-B8B4-444553540000} - Compressed (zipped) Folder Right Drag Handler => %SystemRoot%\System32\zipfldr.dll

(HKLM) {888DCA60-FC0A-11CF-8F0F-00C04FD7D062} - Compressed (zipped) Folder SendTo Target => %SystemRoot%\System32\zipfldr.dll

(HKLM) {f39a0dc0-9cc8-11d0-a599-00c04fd64433} - Channel File => %SystemRoot%\System32\cdfview.dll

(HKLM) {f3aa0dc0-9cc8-11d0-a599-00c04fd64434} - Channel Shortcut => %SystemRoot%\System32\cdfview.dll

(HKLM) {f3ba0dc0-9cc8-11d0-a599-00c04fd64435} - Channel Handler Object => %SystemRoot%\System32\cdfview.dll

(HKLM) {f3da0dc0-9cc8-11d0-a599-00c04fd64437} - Channel Menu => %SystemRoot%\System32\cdfview.dll

(HKLM) {f3ea0dc0-9cc8-11d0-a599-00c04fd64438} - Channel Properties => %SystemRoot%\System32\cdfview.dll

(HKLM) {63da6ec0-2e98-11cf-8d82-444553540000} - FTP Folders Webview => C:\WINDOWS\System32\msieftp.dll

(HKLM) {883373C3-BF89-11D1-BE35-080036B11A03} - Microsoft DocProp Shell Ext => C:\WINDOWS\System32\docprop2.dll

(HKLM) {A9CF0EAE-901A-4739-A481-E35B73E47F6D} - Microsoft DocProp Inplace Edit Box Control => C:\WINDOWS\System32\docprop2.dll

(HKLM) {8EE97210-FD1F-4B19-91DA-67914005F020} - Microsoft DocProp Inplace ML Edit Box Control => C:\WINDOWS\System32\docprop2.dll

(HKLM) {0EEA25CC-4362-4A12-850B-86EE61B0D3EB} - Microsoft DocProp Inplace Droplist Combo Control => C:\WINDOWS\System32\docprop2.dll

(HKLM) {6A205B57-2567-4A2C-B881-F787FAB579A3} - Microsoft DocProp Inplace Calendar Control => C:\WINDOWS\System32\docprop2.dll

(HKLM) {28F8A4AC-BBB3-4D9B-B177-82BFC914FA33} - Microsoft DocProp Inplace Time Control => C:\WINDOWS\System32\docprop2.dll

(HKLM) {8A23E65E-31C2-11d0-891C-00A024AB2DBB} - Directory Query UI => %SystemRoot%\System32\dsquery.dll

(HKLM) {9E51E0D0-6E0F-11d2-9601-00C04FA31A86} - Shell properties for a DS object => %SystemRoot%\System32\dsquery.dll

(HKLM) {163FDC20-2ABC-11d0-88F0-00A024AB2DBB} - Directory Object Find => %SystemRoot%\System32\dsquery.dll

(HKLM) {F020E586-5264-11d1-A532-0000F8757D7E} - Directory Start/Search Find => %SystemRoot%\System32\dsquery.dll

(HKLM) {0D45D530-764B-11d0-A1CA-00AA00C16E65} - Directory Property UI => %SystemRoot%\System32\dsuiext.dll

(HKLM) {62AE1F9A-126A-11D0-A14B-0800361B1103} - Directory Context Menu Verbs => %SystemRoot%\System32\dsuiext.dll

(HKLM) {ECF03A33-103D-11d2-854D-006008059367} - MyDocs Copy Hook => %SystemRoot%\System32\mydocs.dll

(HKLM) {ECF03A32-103D-11d2-854D-006008059367} - MyDocs Drop Target => %SystemRoot%\System32\mydocs.dll

(HKLM) {4a7ded0a-ad25-11d0-98a8-0800361b1103} - MyDocs Properties => %SystemRoot%\System32\mydocs.dll

(HKLM) {750fdf0e-2a26-11d1-a3ea-080036587f03} - Offline Files Menu => %SystemRoot%\System32\cscui.dll

(HKLM) {10CFC467-4392-11d2-8DB4-00C04FA31A66} - Offline Files Folder Options => %SystemRoot%\System32\cscui.dll

(HKLM) {AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E} - Offline Files Folder => %SystemRoot%\System32\cscui.dll

(HKLM) {143A62C8-C33B-11D1-84FE-00C04FA34A14} - Microsoft Agent Character Property Sheet Handler => C:\WINDOWS\msagent\agentpsh.dll

(HKLM) {ECCDF543-45CC-11CE-B9BF-0080C87CDBA6} - DfsShell => C:\WINDOWS\System32\dfsshlex.dll

(HKLM) {60fd46de-f830-4894-a628-6fa81bc0190d} - %DESC_PublishDropTarget% => %SystemRoot%\System32\photowiz.dll

(HKLM) {7A80E4A8-8005-11D2-BCF8-00C04F72C717} - MMC Icon Handler => %SystemRoot%\System32\mmcshext.dll

(HKLM) {0CD7A5C0-9F37-11CE-AE65-08002B2E1262} - .CAB file viewer => cabview.dll

(HKLM) {32714800-2E5F-11d0-8B85-00AA0044F941} - For &People... => C:\Program Files\Outlook Express\wabfind.dll

(HKLM) {8DD448E6-C188-4aed-AF92-44956194EB1F} - Windows Media Player Play as Playlist Context Menu Handler => C:\WINDOWS\system32\wmpshell.dll

(HKLM) {CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C} - Windows Media Player Burn Audio CD Context Menu Handler => C:\WINDOWS\system32\wmpshell.dll

(HKLM) {F1B9284F-E9DC-4e68-9D7E-42362A59F0FD} - Windows Media Player Add to Playlist Context Menu Handler => C:\WINDOWS\system32\wmpshell.dll

(HKLM) {1D2680C9-0E2A-469d-B787-065558BC7D43} - Fusion Cache => C:\WINDOWS\system32\mscoree.dll

(HKLM) {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - Shell Extensions for RealOne Player => C:\Program Files\Real\RealPlayer\rpshellext.dll

(HKLM) {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - Eudora's Shell Extension => C:\Program Files\Qualcomm\Eudora\EuShlExt.dll

(HKLM) {C56C4E21-706D-11d0-AFC5-444553540002} - My Digital Camera => C:\Program Files\PhotoDeluxe HE 3.1\FotoNation Explorer\camview.dll

(HKLM) {B8323370-FF27-11D2-97B6-204C4F4F5020} - SmartFTP Shell Extension DLL => C:\Program Files\SmartFTP\smarthook.dll

(HKLM) {5F327514-6C5E-4d60-8F16-D07FA08A78ED} - Auto Update Property Sheet Extension => C:\WINDOWS\system32\wuaucpl.cpl

(HKLM) {336B02CE-F88A-4aea-8731-79EF94D3723A} - Free AOL & Unlimited Internet.lnk => C:\WINDOWS\aod\aodshext.dll

(HKLM) {2559a1f7-21d7-11d4-bdaf-00c04f60b9f0} - Set Program Access and Defaults => %SystemRoot%\system32\shdocvw.dll

(HKLM) {596AB062-B4D2-4215-9F74-E9109B0A8153} - Previous Versions Property Page => C:\WINDOWS\System32\twext.dll

(HKLM) {9DB7A13C-F208-4981-8353-73CC61AE2783} - Previous Versions => C:\WINDOWS\System32\twext.dll

(HKLM) {692F0339-CBAA-47e6-B5B5-3B84DB604E87} - Extensions Manager Folder => C:\WINDOWS\System32\extmgr.dll

(HKLM) {640167b4-59b0-47a6-b335-a6b3c0695aea} - Portable Media Devices => %SystemRoot%\system32\Audiodev.dll

(HKLM) {cc86590a-b60a-48e6-996b-41d25ed39a1e} - Portable Media Devices Menu => %SystemRoot%\system32\Audiodev.dll

(HKLM) {B41DB860-8EE4-11D2-9906-E49FADC173CA} - WinRAR shell extension => C:\Program Files\WinRAR\rarext.dll

(HKLM) {9F97547E-4609-42C5-AE0C-81C61FFAEBC3} - AVG7 Shell Extension => C:\Program Files\Grisoft\AVG Free\avgse.dll

(HKLM) {9F97547E-460A-42C5-AE0C-81C61FFAEBC3} - AVG7 Find Extension => C:\Program Files\Grisoft\AVG Free\avgse.dll

(HKLM) {e57ce731-33e8-4c51-8354-bb4de9d215d1} - Universal Plug and Play Devices => C:\WINDOWS\system32\upnpui.dll

(HKLM) {BDEADF00-C265-11D0-BCED-00A0C90AB50F} - Web Folders => C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

(HKLM) {00020D75-0000-0000-C000-000000000046} - Microsoft Office Outlook Desktop Icon Handler => C:\PROGRA~1\MI1933~1\OFFICE11\MLSHEXT.DLL

(HKLM) {0006F045-0000-0000-C000-000000000046} - Microsoft Office Outlook Custom Icon Handler => C:\PROGRA~1\MI1933~1\OFFICE11\OLKFSTUB.DLL

(HKLM) {42042206-2D85-11D3-8CFF-005004838597} - Microsoft Office HTML Icon Handler => C:\Program Files\Microsoft Office\OFFICE11\msohev.dll

(HKLM) {21569614-B795-46b1-85F4-E737A8DC09AD} - Shell Search Band => %SystemRoot%\system32\browseui.dll

(HKLM) {6db8213d-6561-483a-af7b-393725a1f0d3} - eFax Messenger - Shell Extension => C:\Program Files\eFax Messenger 4.1\J2GShell.dll

(HKLM) {7C9D5882-CB4A-4090-96C8-430BFE8B795B} - Webroot Spy Sweeper Context Menu Integration => C:\PROGRA~1\Webroot\SPYSWE~1\

#15 aylaofduni

aylaofduni
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:01:43 PM

Posted 06 February 2006 - 04:56 PM

I just wanted to add... I did try restarting the computer and running getsea again, but with the same result.

Edited by aylaofduni, 06 February 2006 - 05:48 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users