Tech Support Forum - View Single Post

hplus10 · 08-17-2005, 05:57 PM

In my reply I said "thanks for helping". In looking at how it was written, I believe it may have come across wrong. I genuinely meant Thank You...I apologize if it came across as being sarcastic. It was NOT meant to be that. I'm frustrated and am very thankful for this forum's and your help. I did not include the logs because I thought after it got reinfected, they would be meaningless. Here are they are. Hope they can be still of use. The Panda scan never completed because of the deluge of incoming adware programs, so it is unavailable.

L2Mfix 1.03c

Running From:
C:\Documents and Settings\Owner\Desktop\Laptop fix\l2mfix

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting registry permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry

Registry Permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Setting up for Reboot

Starting Reboot!

C:\Documents and Settings\Owner\Desktop\Laptop fix\l2mfix
System Rebooted!

Running From:
C:\Documents and Settings\Owner\Desktop\Laptop fix\l2mfix

killing explorer and rundll32.exe

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1768 'explorer.exe'
Killing PID 1768 'explorer.exe'
Killing PID 1768 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1236 'rundll32.exe'

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!
Backing Up: C:\WINDOWS\system32\dItime.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\dItime.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ijrop.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\ijrop.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MTC71ITA.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\MTC71ITA.DLL
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\slripto.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\slripto.dll
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
Backing Up: C:\WINDOWS\system32\guard.tmp
1 file(s) copied.
deleting: C:\WINDOWS\system32\dItime.dll
Successfully Deleted: C:\WINDOWS\system32\dItime.dll
deleting: C:\WINDOWS\system32\dItime.dll
Successfully Deleted: C:\WINDOWS\system32\dItime.dll
deleting: C:\WINDOWS\system32\ijrop.dll
Successfully Deleted: C:\WINDOWS\system32\ijrop.dll
deleting: C:\WINDOWS\system32\ijrop.dll
Successfully Deleted: C:\WINDOWS\system32\ijrop.dll
deleting: C:\WINDOWS\system32\MTC71ITA.DLL
Successfully Deleted: C:\WINDOWS\system32\MTC71ITA.DLL
deleting: C:\WINDOWS\system32\MTC71ITA.DLL
Successfully Deleted: C:\WINDOWS\system32\MTC71ITA.DLL
deleting: C:\WINDOWS\system32\slripto.dll
Successfully Deleted: C:\WINDOWS\system32\slripto.dll
deleting: C:\WINDOWS\system32\slripto.dll
Successfully Deleted: C:\WINDOWS\system32\slripto.dll
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp
deleting: C:\WINDOWS\system32\guard.tmp
Successfully Deleted: C:\WINDOWS\system32\guard.tmp

Zipping up files for submission:
adding: dItime.dll (164 bytes security) (deflated 48%)
adding: ijrop.dll (164 bytes security) (deflated 48%)
adding: MTC71ITA.DLL (164 bytes security) (deflated 48%)
adding: slripto.dll (164 bytes security) (deflated 48%)
adding: guard.tmp (164 bytes security) (deflated 48%)
adding: clear.reg (164 bytes security) (deflated 22%)
adding: echo.reg (164 bytes security) (deflated 12%)
adding: direct.txt (164 bytes security) (deflated 2%)
adding: lo2.txt (164 bytes security) (deflated 80%)
adding: readme.txt (164 bytes security) (deflated 50%)
adding: test.txt (164 bytes security) (deflated 79%)
adding: test2.txt (164 bytes security) (stored 0%)
adding: test3.txt (164 bytes security) (stored 0%)
adding: test5.txt (164 bytes security) (stored 0%)
adding: xfind.txt (164 bytes security) (deflated 75%)
adding: backregs/F77B9E0C-A431-455C-89EA-F35C75E4DB3B.reg (164 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Restoring Registry Permissions:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Revoking access for predefined group "Administrators"
Inherited ACE can not be revoked here!
Inherited ACE can not be revoked here!
Warning (option /rga:(ci)) - There is no ACE to remove!

Registry permissions set too:

RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!

Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER

Restoring Sedebugprivilege:

Granting SeDebugPrivilege to Administrators ... successful

Restoring Windows Update Certificates.:

deleting local copy: dItime.dll
deleting local copy: dItime.dll
deleting local copy: ijrop.dll
deleting local copy: ijrop.dll
deleting local copy: MTC71ITA.DLL
deleting local copy: MTC71ITA.DLL
deleting local copy: slripto.dll
deleting local copy: slripto.dll
deleting local copy: guard.tmp
deleting local copy: guard.tmp

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WebCheck]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mvhgrcoi.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]
"DLLName"="wzcdlg.dll"
"Logon"="WZCEventLogon"
"Logoff"="WZCEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000000

The following are the files found:
****************************************************************************
C:\WINDOWS\system32\dItime.dll
C:\WINDOWS\system32\dItime.dll
C:\WINDOWS\system32\ijrop.dll
C:\WINDOWS\system32\ijrop.dll
C:\WINDOWS\system32\MTC71ITA.DLL
C:\WINDOWS\system32\MTC71ITA.DLL
C:\WINDOWS\system32\slripto.dll
C:\WINDOWS\system32\slripto.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\guard.tmp

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{F77B9E0C-A431-455C-89EA-F35C75E4DB3B}"=-
[-HKEY_CLASSES_ROOT\CLSID\{F77B9E0C-A431-455C-89EA-F35C75E4DB3B}]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************

Started Scanning
Internet Cookies
Programs in Memory
Windows Registry
Found '' in 'SOFTWARE\Morpheus'
Found '' in 'SOFTWARE\Classes\.xmfg'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\Control'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\InprocServer32'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\MiscStatus'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\MiscStatus\1'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\ProgID'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\ToolboxBitmap32'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\TypeLib'
Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\Version'
Found '' in 'SOFTWARE\Classes\CLSID\{B666CF5A-B50A-49E4-8354-37AC595C5B7E}'
Found '' in 'SOFTWARE\Classes\CLSID\{B666CF5A-B50A-49E4-8354-37AC595C5B7E}\InprocServer32'
Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0'
Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0\0\win32'
Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0\FLAGS'
Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0\HELPDIR'
Found '' in 'SOFTWARE\Classes\XMIRAGE.XMirageCtrl.1'
Found '' in 'SOFTWARE\Classes\XMIRAGE.XMirageCtrl.1\CLSID'
Found '' in 'SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}'
Found '' in 'SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\InProcServer32'
Found '' in 'SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\ProgID'
Found '' in 'SOFTWARE\Classes\GnucDNA.Core'
Found '' in 'SOFTWARE\Classes\GnucDNA.Core\CLSID'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\TypeLib'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid32'
Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\TypeLib'
Found '' in 'SOFTWARE\Classes\morpheus'
Found '' in 'SOFTWARE\Classes\morpheus\DefaultIcon'
Found '' in 'SOFTWARE\Classes\morpheus\shell\open\command'
Found '' in 'SOFTWARE\Morpheus\Matrix'
Found '' in 'SOFTWARE\Morpheus\MediaManager'
Found '' in 'SOFTWARE\ClickSpring'
Internet URL Shortcuts
Files and Directories
Found 's4Setp.exe' in 'C:\Documents and Settings\Owner\Local Settings\Temp'
Found 'Folder.ico' in 'C:\Program Files\StreamCast\Morpheus'
Found 'Morpheus.exe' in 'C:\Program Files\StreamCast\Morpheus'
Found 'muninstall.exe' in 'C:\Program Files\StreamCast\Morpheus'
Found '' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'application.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'application.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'document.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'document.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'image.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'image.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'rom.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'rom.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'video.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas'
Found 'CWRKArea.wrk' in 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp'
Found 'DWRKArea.wrk' in 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp'
Found 'MCATArea.wrk' in 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp'
Found 'CWRKArea.wrk' in 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp'
Found 'DWRKArea.wrk' in 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp'
Found 'MCATArea.wrk' in 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp'
Found 'CWRKArea.wrk' in 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp'
Found 'DWRKArea.wrk' in 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp'
Found 'MCATArea.wrk' in 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp'
Found 'screengenie.scr' in 'C:\WINDOWS'
Found 'Decln.dll' in 'C:\WINDOWS\system32'
Found 'Declw.dll' in 'C:\WINDOWS\system32'
Found 'mfimage.dll' in 'C:\WINDOWS\system32'
Found 'npmirage.dll' in 'C:\WINDOWS\system32'
Found 'xmforgert.exe' in 'C:\WINDOWS\system32'
Found 'XMirage.ocx' in 'C:\WINDOWS\system32'
Found 'GLF12.tmp' in 'C:\WINDOWS\Temp'
Finished Scanning
Started Backup
Finished Backup
Started Cleaning
Checking for 'C:\Documents and Settings\Owner\Local Settings\Temp\s4Setp.exe' in shortcut areas.
Checking for 'C:\Documents and Settings\Owner\Local Settings\Temp\s4Setp.exe' in startup areas.
Cleaning 'C:\Documents and Settings\Owner\Local Settings\Temp\s4Setp.exe'
Checking for 'C:\Program Files\StreamCast\Morpheus\Folder.ico' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Folder.ico' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Folder.ico'
Checking for 'C:\Program Files\StreamCast\Morpheus\Morpheus.exe' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Morpheus.exe' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Morpheus.exe'
Checking for 'C:\Program Files\StreamCast\Morpheus\muninstall.exe' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\muninstall.exe' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\muninstall.exe'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xml'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xsd'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xsd'
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in shortcut areas.
Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in startup areas.
Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml'
[SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' was not found. Most likely already cleaned by another scanner module.
Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\CWRKArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\CWRKArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\CWRKArea.wrk'
Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\DWRKArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\DWRKArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\DWRKArea.wrk'
Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\MCATArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\MCATArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\MCATArea.wrk'
Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\CWRKArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\CWRKArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\CWRKArea.wrk'
Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\DWRKArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\DWRKArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\DWRKArea.wrk'
Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\MCATArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\MCATArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\MCATArea.wrk'
Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\CWRKArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\CWRKArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\CWRKArea.wrk'
Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\DWRKArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\DWRKArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\DWRKArea.wrk'
Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\MCATArea.wrk' in shortcut areas.
Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\MCATArea.wrk' in startup areas.
Cleaning 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\MCATArea.wrk'
Checking for 'C:\WINDOWS\screengenie.scr' in shortcut areas.
Checking for 'C:\WINDOWS\screengenie.scr' in startup areas.
Cleaning 'C:\WINDOWS\screengenie.scr'
Checking for 'C:\WINDOWS\system32\Decln.dll' in shortcut areas.
Checking for 'C:\WINDOWS\system32\Decln.dll' in startup areas.
Cleaning 'C:\WINDOWS\system32\Decln.dll'
Checking for 'C:\WINDOWS\system32\Declw.dll' in shortcut areas.
Checking for 'C:\WINDOWS\system32\Declw.dll' in startup areas.
Cleaning 'C:\WINDOWS\system32\Declw.dll'
Checking for 'C:\WINDOWS\system32\mfimage.dll' in shortcut areas.
Checking for 'C:\WINDOWS\system32\mfimage.dll' in startup areas.
Cleaning 'C:\WINDOWS\system32\mfimage.dll'
Checking for 'C:\WINDOWS\system32\npmirage.dll' in shortcut areas.
Checking for 'C:\WINDOWS\system32\npmirage.dll' in startup areas.
Cleaning 'C:\WINDOWS\system32\npmirage.dll'
Checking for 'C:\WINDOWS\system32\xmforgert.exe' in shortcut areas.
Checking for 'C:\WINDOWS\system32\xmforgert.exe' in startup areas.
Cleaning 'C:\WINDOWS\system32\xmforgert.exe'
Checking for 'C:\WINDOWS\system32\XMirage.ocx' in shortcut areas.
Checking for 'C:\WINDOWS\system32\XMirage.ocx' in startup areas.
Cleaning 'C:\WINDOWS\system32\XMirage.ocx'
Checking for 'C:\WINDOWS\Temp\GLF12.tmp' in shortcut areas.
Checking for 'C:\WINDOWS\Temp\GLF12.tmp' in startup areas.
Cleaning 'C:\WINDOWS\Temp\GLF12.tmp'
Finished Cleaning

The 2nd time through, their was no log, but the window had said it was clean with nothing found.

Hope this can be still of help. Thanks.

08-17-2005, 05:57 PM	#6 (permalink)
hplus10 Registered User Join Date: Aug 2005 Posts: 14 OS: xp	I think my post came off wrong, I'm sorry In my reply I said "thanks for helping". In looking at how it was written, I believe it may have come across wrong. I genuinely meant Thank You...I apologize if it came across as being sarcastic. It was NOT meant to be that. I'm frustrated and am very thankful for this forum's and your help. I did not include the logs because I thought after it got reinfected, they would be meaningless. Here are they are. Hope they can be still of use. The Panda scan never completed because of the deluge of incoming adware programs, so it is unavailable. L2Mfix 1.03c Running From: C:\Documents and Settings\Owner\Desktop\Laptop fix\l2mfix RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Denying C(CI) access for predefined group "Administrators" - adding new ACCESS DENY entry Registry Permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Setting up for Reboot Starting Reboot! C:\Documents and Settings\Owner\Desktop\Laptop fix\l2mfix System Rebooted! Running From: C:\Documents and Settings\Owner\Desktop\Laptop fix\l2mfix killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 1768 'explorer.exe' Killing PID 1768 'explorer.exe' Killing PID 1768 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org Killing PID 1236 'rundll32.exe' Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! Backing Up: C:\WINDOWS\system32\dItime.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\dItime.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\ijrop.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\ijrop.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MTC71ITA.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\MTC71ITA.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\slripto.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\slripto.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\guard.tmp 1 file(s) copied. Backing Up: C:\WINDOWS\system32\guard.tmp 1 file(s) copied. deleting: C:\WINDOWS\system32\dItime.dll Successfully Deleted: C:\WINDOWS\system32\dItime.dll deleting: C:\WINDOWS\system32\dItime.dll Successfully Deleted: C:\WINDOWS\system32\dItime.dll deleting: C:\WINDOWS\system32\ijrop.dll Successfully Deleted: C:\WINDOWS\system32\ijrop.dll deleting: C:\WINDOWS\system32\ijrop.dll Successfully Deleted: C:\WINDOWS\system32\ijrop.dll deleting: C:\WINDOWS\system32\MTC71ITA.DLL Successfully Deleted: C:\WINDOWS\system32\MTC71ITA.DLL deleting: C:\WINDOWS\system32\MTC71ITA.DLL Successfully Deleted: C:\WINDOWS\system32\MTC71ITA.DLL deleting: C:\WINDOWS\system32\slripto.dll Successfully Deleted: C:\WINDOWS\system32\slripto.dll deleting: C:\WINDOWS\system32\slripto.dll Successfully Deleted: C:\WINDOWS\system32\slripto.dll deleting: C:\WINDOWS\system32\guard.tmp Successfully Deleted: C:\WINDOWS\system32\guard.tmp deleting: C:\WINDOWS\system32\guard.tmp Successfully Deleted: C:\WINDOWS\system32\guard.tmp Zipping up files for submission: adding: dItime.dll (164 bytes security) (deflated 48%) adding: ijrop.dll (164 bytes security) (deflated 48%) adding: MTC71ITA.DLL (164 bytes security) (deflated 48%) adding: slripto.dll (164 bytes security) (deflated 48%) adding: guard.tmp (164 bytes security) (deflated 48%) adding: clear.reg (164 bytes security) (deflated 22%) adding: echo.reg (164 bytes security) (deflated 12%) adding: direct.txt (164 bytes security) (deflated 2%) adding: lo2.txt (164 bytes security) (deflated 80%) adding: readme.txt (164 bytes security) (deflated 50%) adding: test.txt (164 bytes security) (deflated 79%) adding: test2.txt (164 bytes security) (stored 0%) adding: test3.txt (164 bytes security) (stored 0%) adding: test5.txt (164 bytes security) (stored 0%) adding: xfind.txt (164 bytes security) (deflated 75%) adding: backregs/F77B9E0C-A431-455C-89EA-F35C75E4DB3B.reg (164 bytes security) (deflated 70%) adding: backregs/notibac.reg (164 bytes security) (deflated 87%) adding: backregs/shell.reg (164 bytes security) (deflated 73%) Restoring Registry Permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Revoking access for predefined group "Administrators" Inherited ACE can not be revoked here! Inherited ACE can not be revoked here! Warning (option /rga:(ci)) - There is no ACE to remove! Registry permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrators ... successful Restoring Windows Update Certificates.: deleting local copy: dItime.dll deleting local copy: dItime.dll deleting local copy: ijrop.dll deleting local copy: ijrop.dll deleting local copy: MTC71ITA.DLL deleting local copy: MTC71ITA.DLL deleting local copy: slripto.dll deleting local copy: slripto.dll deleting local copy: guard.tmp deleting local copy: guard.tmp The following Is the Current Export of the Winlogon notify key: ************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WebCheck] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\mvhgrcoi.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif] "DLLName"="wzcdlg.dll" "Logon"="WZCEventLogon" "Logoff"="WZCEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000000 The following are the files found: ************************************************************************ C:\WINDOWS\system32\dItime.dll C:\WINDOWS\system32\dItime.dll C:\WINDOWS\system32\ijrop.dll C:\WINDOWS\system32\ijrop.dll C:\WINDOWS\system32\MTC71ITA.DLL C:\WINDOWS\system32\MTC71ITA.DLL C:\WINDOWS\system32\slripto.dll C:\WINDOWS\system32\slripto.dll C:\WINDOWS\system32\guard.tmp C:\WINDOWS\system32\guard.tmp Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. ************************************************************************ REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{F77B9E0C-A431-455C-89EA-F35C75E4DB3B}"=- [-HKEY_CLASSES_ROOT\CLSID\{F77B9E0C-A431-455C-89EA-F35C75E4DB3B}] REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" ************************************************************************ Desktop.ini Contents: ************************************************************************ ************************************************************************** Started Scanning Internet Cookies Programs in Memory Windows Registry Found '' in 'SOFTWARE\Morpheus' Found '' in 'SOFTWARE\Classes\.xmfg' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\Control' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\InprocServer32' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\MiscStatus' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\MiscStatus\1' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\ProgID' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\ToolboxBitmap32' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\TypeLib' Found '' in 'SOFTWARE\Classes\CLSID\{21F16767-8DA7-4113-BEB0-F161B313407F}\Version' Found '' in 'SOFTWARE\Classes\CLSID\{B666CF5A-B50A-49E4-8354-37AC595C5B7E}' Found '' in 'SOFTWARE\Classes\CLSID\{B666CF5A-B50A-49E4-8354-37AC595C5B7E}\InprocServer32' Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0' Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0\0\win32' Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0\FLAGS' Found '' in 'SOFTWARE\Classes\TypeLib\{6043F8F5-4FBE-47DA-A789-146B02AE6FA0}\1.0\HELPDIR' Found '' in 'SOFTWARE\Classes\XMIRAGE.XMirageCtrl.1' Found '' in 'SOFTWARE\Classes\XMIRAGE.XMirageCtrl.1\CLSID' Found '' in 'SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}' Found '' in 'SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\InProcServer32' Found '' in 'SOFTWARE\Classes\CLSID\{F02C0AE1-D796-42C9-81E1-084D88F79B8E}\ProgID' Found '' in 'SOFTWARE\Classes\GnucDNA.Core' Found '' in 'SOFTWARE\Classes\GnucDNA.Core\CLSID' Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}' Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{0BE385A3-85A5-4722-B677-68DAE891FF21}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}' Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{272C0D60-0561-4C83-B3DB-EB0A71F9D2EB}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}' Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{284477E4-A7CB-4055-9E1B-0EA7CBA28945}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}' Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{70CA4938-6A0F-4641-A9A9-C936E4C1E7DE}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}' Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{7468213E-010E-4EC6-A17D-642E909BA7EC}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}' Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{89DC33A2-F86F-42A1-8B5F-D4D1943EFC9C}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}' Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{B86F4810-19A9-4050-9AC9-B5CF60B5799A}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}' Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{BB5B7E14-F8B4-4365-A24D-F4965C33E1EE}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}' Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{C13D4627-02F5-4B03-897A-BF6A90022DD2}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}' Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{C636F1FC-6AE4-4E6A-90AB-6D61D821A0DD}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}' Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{CB971AC0-6408-40DA-A540-92F9F256F51F}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}' Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{D5694DFE-43B6-4E05-AA29-8C556C968973}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}' Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{E2032EC2-A9AC-4ED7-9BDB-EBECACF076F2}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}' Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{EBAB4A71-8C34-461A-B57D-DD041D439555}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}' Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{F06FEA43-0CC3-4BF6-A85B-5EFB1C07AA4B}\TypeLib' Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}' Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid' Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\ProxyStubClsid32' Found '' in 'SOFTWARE\Classes\Interface\{FC94A0F7-9C7C-4AE2-9106-5C212332B209}\TypeLib' Found '' in 'SOFTWARE\Classes\morpheus' Found '' in 'SOFTWARE\Classes\morpheus\DefaultIcon' Found '' in 'SOFTWARE\Classes\morpheus\shell\open\command' Found '' in 'SOFTWARE\Morpheus\Matrix' Found '' in 'SOFTWARE\Morpheus\MediaManager' Found '' in 'SOFTWARE\ClickSpring' Internet URL Shortcuts Files and Directories Found 's4Setp.exe' in 'C:\Documents and Settings\Owner\Local Settings\Temp' Found 'Folder.ico' in 'C:\Program Files\StreamCast\Morpheus' Found 'Morpheus.exe' in 'C:\Program Files\StreamCast\Morpheus' Found 'muninstall.exe' in 'C:\Program Files\StreamCast\Morpheus' Found '' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'application.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'application.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'document.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'document.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'image.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'image.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'rom.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'rom.xsd' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'video.xml' in 'C:\Program Files\StreamCast\Morpheus\Schemas' Found 'CWRKArea.wrk' in 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp' Found 'DWRKArea.wrk' in 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp' Found 'MCATArea.wrk' in 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp' Found 'CWRKArea.wrk' in 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp' Found 'DWRKArea.wrk' in 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp' Found 'MCATArea.wrk' in 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp' Found 'CWRKArea.wrk' in 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp' Found 'DWRKArea.wrk' in 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp' Found 'MCATArea.wrk' in 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp' Found 'screengenie.scr' in 'C:\WINDOWS' Found 'Decln.dll' in 'C:\WINDOWS\system32' Found 'Declw.dll' in 'C:\WINDOWS\system32' Found 'mfimage.dll' in 'C:\WINDOWS\system32' Found 'npmirage.dll' in 'C:\WINDOWS\system32' Found 'xmforgert.exe' in 'C:\WINDOWS\system32' Found 'XMirage.ocx' in 'C:\WINDOWS\system32' Found 'GLF12.tmp' in 'C:\WINDOWS\Temp' Finished Scanning Started Backup Finished Backup Started Cleaning Checking for 'C:\Documents and Settings\Owner\Local Settings\Temp\s4Setp.exe' in shortcut areas. Checking for 'C:\Documents and Settings\Owner\Local Settings\Temp\s4Setp.exe' in startup areas. Cleaning 'C:\Documents and Settings\Owner\Local Settings\Temp\s4Setp.exe' Checking for 'C:\Program Files\StreamCast\Morpheus\Folder.ico' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Folder.ico' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Folder.ico' Checking for 'C:\Program Files\StreamCast\Morpheus\Morpheus.exe' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Morpheus.exe' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Morpheus.exe' Checking for 'C:\Program Files\StreamCast\Morpheus\muninstall.exe' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\muninstall.exe' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\muninstall.exe' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xml' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\audio.xsd' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xsd' Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xml' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\application.xsd' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xml' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\document.xsd' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xml' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\image.xsd' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xml' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\rom.xsd' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in shortcut areas. Checking for 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' in startup areas. Cleaning 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' [SCANMODS] The file 'C:\Program Files\StreamCast\Morpheus\Schemas\video.xml' was not found. Most likely already cleaned by another scanner module. Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\CWRKArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\CWRKArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\CWRKArea.wrk' Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\DWRKArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\DWRKArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\DWRKArea.wrk' Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\MCATArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\MCATArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 7.2 (Build 1563)\MyWork\EL13.tmp\MCATArea.wrk' Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\CWRKArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\CWRKArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\CWRKArea.wrk' Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\DWRKArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\DWRKArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\DWRKArea.wrk' Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\MCATArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\MCATArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 8.0 (Build 1869)\MyWork\EL13.tmp\MCATArea.wrk' Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\CWRKArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\CWRKArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\CWRKArea.wrk' Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\DWRKArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\DWRKArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\DWRKArea.wrk' Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\MCATArea.wrk' in shortcut areas. Checking for 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\MCATArea.wrk' in startup areas. Cleaning 'C:\Program Files\TradeStation 8.1 (Build 2172)\MyWork\EL13.tmp\MCATArea.wrk' Checking for 'C:\WINDOWS\screengenie.scr' in shortcut areas. Checking for 'C:\WINDOWS\screengenie.scr' in startup areas. Cleaning 'C:\WINDOWS\screengenie.scr' Checking for 'C:\WINDOWS\system32\Decln.dll' in shortcut areas. Checking for 'C:\WINDOWS\system32\Decln.dll' in startup areas. Cleaning 'C:\WINDOWS\system32\Decln.dll' Checking for 'C:\WINDOWS\system32\Declw.dll' in shortcut areas. Checking for 'C:\WINDOWS\system32\Declw.dll' in startup areas. Cleaning 'C:\WINDOWS\system32\Declw.dll' Checking for 'C:\WINDOWS\system32\mfimage.dll' in shortcut areas. Checking for 'C:\WINDOWS\system32\mfimage.dll' in startup areas. Cleaning 'C:\WINDOWS\system32\mfimage.dll' Checking for 'C:\WINDOWS\system32\npmirage.dll' in shortcut areas. Checking for 'C:\WINDOWS\system32\npmirage.dll' in startup areas. Cleaning 'C:\WINDOWS\system32\npmirage.dll' Checking for 'C:\WINDOWS\system32\xmforgert.exe' in shortcut areas. Checking for 'C:\WINDOWS\system32\xmforgert.exe' in startup areas. Cleaning 'C:\WINDOWS\system32\xmforgert.exe' Checking for 'C:\WINDOWS\system32\XMirage.ocx' in shortcut areas. Checking for 'C:\WINDOWS\system32\XMirage.ocx' in startup areas. Cleaning 'C:\WINDOWS\system32\XMirage.ocx' Checking for 'C:\WINDOWS\Temp\GLF12.tmp' in shortcut areas. Checking for 'C:\WINDOWS\Temp\GLF12.tmp' in startup areas. Cleaning 'C:\WINDOWS\Temp\GLF12.tmp' Finished Cleaning The 2nd time through, their was no log, but the window had said it was clean with nothing found. Hope this can be still of help. Thanks.