browser hijack: PLEASE help

[cissesleftleg]

hi

i have something hijacking iexplorer i.e. iexplorer constantly running twice in task manager, also getting popups quite regularly. when i try to terminate process it comes back straight away sometimes on the back of programs called greatthis and extra internet which i have found prefetch files for but not the programs themselves. have used pest patrol, ad-aware, avg, spybot and ewido but none are identifying the problem. located greatthis on hijackthis log and removed but it always returns after restart. if there is someone who knows more than myself and can tell me what i need to do to get rid of this problem i would be very grateful, cheers. this is my hijack this log


Logfile of HijackThis v1.99.1
Scan saved at 2101, on 24/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Waitrose.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Flag Ace] C:\DOCUME~1\Thomas\APPLIC~1\SECTER~1\greatthis.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/0241a1e1...p/RdxIE601.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136032192250
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

[tetonbob]

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Before begining the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------


Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

O4 - HKCU\..\Run: [Flag Ace] C:\DOCUME~1\Thomas\APPLIC~1\SECTER~1\greatthis.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/0241a1e1...p/RdxIE601.cab
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\


---------------------------------------------------------------------------------------------

Click on the Start button & select Run
Type in tasks & click Ok
In the ensuing window, click on the 'Advanced' menu (located above) & select 'View Hidden Tasks'
Review all the tasks/jobs at hand. You should be able to recognise jobs that you have created yourself.
Delete hidden jobs that look like these:

• A034B7FF91BB36BB.job
  A06F1FEF91A49933.job
  A2C3205A93B8CDFA.job
  A36F645091B91BF0.job
  A42C6F7190EFE559.job

You can recognise them by the fact that they're hidden & have names that consist of 16 random letters.


--------------------------------------------------------------------------------------

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.


Delete the followingFolders if they exist:

C:\Documents and Settings\Thomas\Application Data\SECTER~1<<<this is a folder which begins with SECTER

---------------------------------------------------------------------------------------------

Download fl.zip
Extract the contents to a new folder on your Desktop.
Within the folder, locate & double-click fl.bat.
It should produce a report at c:\findlop.txt. Post the contents of the report in your next reply

---------------------------------------------------------------------------------------------

Perform an online scan with Internet Explorer with Panda ActiveScan

Click on the "Free To Use ActiveScan" located on the top right hand corner

1. Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
2. Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting My Computer

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on See report then click Save report

*Turn off the real time scanner of any existing antivirus program while performing the online scan

---------------------------------------------------

Open Hijack This and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

Please return with results from:

findlop
Panda
HJT

[cissesleftleg]

thanks very much for your help, here are the 3 reports

findlop:

Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\All Users\Application Data

20/05/2006 16:33 <DIR> Active Kind Pure Ping
23/05/2006 12:22 <DIR> Adobe
23/05/2006 12:24 <DIR> Adobe Systems
28/12/2005 13:48 <DIR> Apple Computer
21/05/2006 14:05 <DIR> avg7
05/10/2005 15:12 <DIR> BVRP Software
19/07/2005 18:11 <DIR> Creative
19/05/2006 14:59 <DIR> G-Force
27/04/2006 14:56 <DIR> Grisoft
09/03/2006 18:36 <DIR> InstallShield
11/01/2006 17:59 <DIR> Motive
13/07/2005 21:05 <DIR> MSN6
07/05/2004 16:57 <DIR> NFS Underground
03/05/2004 18:15 <DIR> QuickTime
13/03/2006 00:34 <DIR> Roxio
09/03/2006 18:33 <DIR> Sonic
17/05/2005 15:18 <DIR> Sony Corporation
27/04/2006 15:10 <DIR> Spybot - Search & Destroy
26/04/2006 10:31 <DIR> Windows Genuine Advantage
14/01/2006 14:25 <DIR> yahoo!
14/01/2006 14:12 <DIR> Yahoo! Companion
0 File(s) 0 bytes
21 Dir(s) 2,930,286,592 bytes free
Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\Thomas\Application Data

23/05/2006 13:02 <DIR> Adobe
06/04/2006 10:27 <DIR> AdobeUM
12/02/2006 12:19 <DIR> Apple Computer
19/02/2005 21:44 <DIR> Atari
27/04/2006 14:57 <DIR> AVG7
23/04/2006 10:32 <DIR> Azureus
23/05/2006 22:31 <DIR> Blahknob
19/07/2005 18:26 <DIR> Creative
16/12/2004 13:59 0 dm.ini
04/04/2006 17:20 <DIR> Gearbox Software
31/01/2006 20:55 <DIR> Google
20/04/2006 17:57 <DIR> Help
21/04/2004 23:23 <DIR> Identities
28/07/2004 19:12 <DIR> Kazaa Lite
19/02/2005 21:27 <DIR> Leadertech
01/02/2006 17:19 <DIR> Macromedia
13/07/2005 21:06 <DIR> MSN6
31/05/2005 23:38 <DIR> Musicmatch
20/03/2006 16:18 <DIR> NASA
23/05/2006 12:54 <DIR> Opera
02/10/2004 12:55 <DIR> Real
09/03/2006 22:07 <DIR> Roxio
10/11/2005 22:34 <DIR> Samsung
26/05/2006 16:37 <DIR> sect error joy
17/05/2005 15:22 <DIR> Sony Corporation
29/04/2006 14:30 <DIR> Sun
02/05/2006 15:08 <DIR> warez
29/04/2006 12:22 <DIR> Yahoo!
1 File(s) 0 bytes
27 Dir(s) 2,930,286,592 bytes free
Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\Default User\Application Data

21/04/2004 23:38 <DIR> .
21/04/2004 23:38 <DIR> ..
21/04/2004 23:38 62 desktop.ini
1 File(s) 62 bytes
2 Dir(s) 2,930,286,592 bytes free
Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\LocalService\Application Data

Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\NetworkService\Application Data

[TRACE] Enumerating jobs and queues



Panda:


Incident Status Location

Adware:Adware/Lop Not disinfected c:\docume~1\thomas\applic~1\secter~1\greatthis.exe
Adware:Adware/Lop Not disinfected c:\docume~1\thomas\applic~1\secter~1\greatt~1.exe
Adware:adware/ipinsight Not disinfected c:\windows\inf\conscorr.inf
Adware:adware/localnrd Not disinfected c:\windows\inf\localNrd.inf
Adware:adware/dollarrevenue Not disinfected c:\VSL02.exe
Spyware:spyware/surfsidekick Not disinfected C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Ssk.log
Adware:adware/blazefind Not disinfected c:\windows\Key2.txt
Potentially unwanted tool:application/mediapipe Not disinfected hkey_classes_root\clsid\{B3E19860-0CD5-4991-A066-4FCA2704DE59}
Adware:adware/exact.bargainbuddy Not disinfected Windows Registry
Adware:adware/sqwire Not disinfected Windows Registry
Adware:Adware/Lop Not disinfected C:\Documents and Settings\All Users\Application Data\Active Kind Pure Ping\EXTRA INTERNET.exe
Adware:Adware/Lop Not disinfected C:\Documents and Settings\Thomas\Application Data\sect error joy\greatthis.exe
Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@888[1].txt
Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@888[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@ad.yieldmanager[1].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@adultfriendfinder[2].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@apmebf[1].txt
Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@cassava[1].txt
Spyware:Cookie/OfferOptimizer Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@offeroptimizer[1].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@stats1.reliablestats[2].txt
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Thomas\Cookies\thomas@xmts[2].txt
Adware:Adware/Lop Not disinfected C:\Documents and Settings\Thomas\Local Settings\Temp\33486b.exe
Adware:Adware/Lop Not disinfected C:\Documents and Settings\Thomas\Local Settings\Temp\46f050.exe
Adware:Adware/Lop Not disinfected C:\Documents and Settings\Thomas\Local Settings\Temp\4f1ce1.exe
Adware:Adware/Lop Not disinfected C:\Documents and Settings\Thomas\Local Settings\Temp\sta1.exe



Hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 17:02:35, on 26/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Waitrose.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Flag Ace] C:\DOCUME~1\Thomas\APPLIC~1\SECTER~1\greatthis.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136032192250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

[tetonbob]

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4

[-hkey_classes_root\clsid\{B3E19860-0CD5-4991-A066-4FCA2704DE59}]

Save the file as "delete.reg". Make sure to save it with the quotes. Close Notepad. Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

---------------------------------------------------------------------------------------------

Download Ewido Anti-Malware

• Install Ewido Anti-Malware
• When installing, under "Additional Options" uncheck..
  • Install background guard
  • Install scan via context menu
• Double-click the icon on Desktop to launch Ewido

You will need to update Ewido to the latest definition files.

• On the left hand side of the main screen click update.
• Then click on Start Update.

The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido
When you have finished updating, EXIT Ewido.

---------------------------------------------------------------------------------------------

Download and install CleanUp!
NOTE: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Do NOT run this program if you have XP Professional 64 bit edition. If you're unsure please do not run it! If you don't already know, you're probably not using XP64, but you can download & run this tool to find out for sure.....http://www.kellys-korner-xp.com/regs...p_whichcpu.exe

Do Not run it yet.

---------------------------------------------------------------------------------------------

1. Please download The Avenger to your Desktop.

• Click on Avenger.zip to open the file
• Extract avenger.exe to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to Delete:
c:\windows\inf\conscorr.inf
c:\windows\inf\localNrd.inf
c:\VSL02.exe
C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Ssk.log
c:\windows\Key2.txt
C:\Documents and Settings\Thomas\Cookies\thomas@888[1].txt
C:\Documents and Settings\Thomas\Cookies\thomas@888[2].txt
C:\Documents and Settings\Thomas\Cookies\thomas@ad.yieldmanager[1].txt
C:\Documents and Settings\Thomas\Cookies\thomas@adultfriendfinder[2].txt
C:\Documents and Settings\Thomas\Cookies\thomas@apmebf[1].txt
C:\Documents and Settings\Thomas\Cookies\thomas@cassava[1].txt
C:\Documents and Settings\Thomas\Cookies\thomas@offeroptimizer[1].txt
C:\Documents and Settings\Thomas\Cookies\thomas@stats1.reliablestat s[2].txt
C:\Documents and Settings\Thomas\Cookies\thomas@xmts[2].txt
C:\Documents and Settings\Thomas\Local Settings\Temp\33486b.exe
C:\Documents and Settings\Thomas\Local Settings\Temp\46f050.exe
C:\Documents and Settings\Thomas\Local Settings\Temp\4f1ce1.exe
C:\Documents and Settings\Thomas\Local Settings\Temp\sta1.exe

Folders to Delete:
C:\Documents and Settings\All Users\Application Data\Active Kind Pure Ping
C:\Documents and Settings\Thomas\Application Data\Blahknob
C:\Documents and Settings\Thomas\Application Data\sect error joy

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Script file to execute" choose "Input Script Manually".
• Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
• Paste the text copied to clipboard into this window by pressing (Ctrl+V).
• Click Done
• Now click on the Green Light to begin execution of the script
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your next reply.

---------------------------------------------------------------------------------------------

Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist (make sure you do not miss any) and click Fix Checked

O4 - HKCU\..\Run: [Flag Ace] C:\DOCUME~1\Thomas\APPLIC~1\SECTER~1\greatthis.exe

---------------------------------------------------------------------------------------------

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

• Empty Recycle Bins
• Delete Cookies
• Delete Prefetch files (if present)
• Cleanup! All Users
• Click on the Temporary Files tab and uncheck the box for Scan drives for files matching if it’s checked.

Click OK
Press the CleanUp! button to start the program.

It may ask you to log-off/reboot at the end, if it does please do so.

---------------------------------------------------------------------------------------------

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.

---------------------------------------------------------------------------------------------


Run Ewido with it's updated definitions:(...it's important that all windows must be closed)

• Click Scanner
• Click Complete System Scan to begin scanning.
• Click OK when prompted to clean files

With the first file it prompts to clean, select the option:

• "Perform action on all infections"
• Choose clean and click OK.

Once finished, click the Save report button & save the report to your desktop

** Ewido scan would require at least an hour.

---------------------------------------------------------------------------------------------

Restart in normal mode.

---------------------------------------------------------------------------------------------

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

---------------------------------------------------

Open Hijack This and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

---------------------------------------------------------------------------------------------

How is your system behaving now, please?

[cissesleftleg]

everything seems to be working fine now, thanks for your help

here are the reports that you requested, i'll check again incase you think there is anything else i should do:

avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\esuvymfm

*******************

Script file located at: \??\C:\Documents and Settings\ldqldfcq.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File c:\windows\inf\conscorr.inf deleted successfully.
File c:\windows\inf\localNrd.inf deleted successfully.
File c:\VSL02.exe deleted successfully.
File C:\Documents and Settings\Thomas\Local Settings\Temporary Internet Files\Ssk.log deleted successfully.
File c:\windows\Key2.txt deleted successfully.
File C:\Documents and Settings\Thomas\Cookies\thomas@888[1].txt deleted successfully.
File C:\Documents and Settings\Thomas\Cookies\thomas@888[2].txt deleted successfully.
File C:\Documents and Settings\Thomas\Cookies\thomas@ad.yieldmanager[1].txt deleted successfully.
File C:\Documents and Settings\Thomas\Cookies\thomas@adultfriendfinder[2].txt deleted successfully.
File C:\Documents and Settings\Thomas\Cookies\thomas@apmebf[1].txt deleted successfully.
File C:\Documents and Settings\Thomas\Cookies\thomas@cassava[1].txt deleted successfully.
File C:\Documents and Settings\Thomas\Cookies\thomas@offeroptimizer[1].txt deleted successfully.


File C:\Documents and Settings\Thomas\Cookies\thomas@stats1.reliablestat s[2].txt not found!
Deletion of file C:\Documents and Settings\Thomas\Cookies\thomas@stats1.reliablestat s[2].txt failed!

Could not process line:
C:\Documents and Settings\Thomas\Cookies\thomas@stats1.reliablestat s[2].txt
Status: 0xc0000034



File C:\Documents and Settings\Thomas\Cookies\thomas@xmts[2].txt not found!
Deletion of file C:\Documents and Settings\Thomas\Cookies\thomas@xmts[2].txt failed!

Could not process line:
C:\Documents and Settings\Thomas\Cookies\thomas@xmts[2].txt
Status: 0xc0000034

File C:\Documents and Settings\Thomas\Local Settings\Temp\33486b.exe deleted successfully.
File C:\Documents and Settings\Thomas\Local Settings\Temp\46f050.exe deleted successfully.
File C:\Documents and Settings\Thomas\Local Settings\Temp\4f1ce1.exe deleted successfully.
File C:\Documents and Settings\Thomas\Local Settings\Temp\sta1.exe deleted successfully.


Folder C:\Documents and Settings\All Users\Application Data\Active Kind Pure Ping not found!
Deletion of folder C:\Documents and Settings\All Users\Application Data\Active Kind Pure Ping failed!

Could not process line:
C:\Documents and Settings\All Users\Application Data\Active Kind Pure Ping
Status: 0xc0000034

Folder C:\Documents and Settings\Thomas\Application Data\Blahknob deleted successfully.


Folder C:\Documents and Settings\Thomas\Application Data\sect error joy not found!
Deletion of folder C:\Documents and Settings\Thomas\Application Data\sect error joy failed!

Could not process line:
C:\Documents and Settings\Thomas\Application Data\sect error joy
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.



kaspersky:

KASPERSKY ON-LINE SCANNER REPORT
Saturday, May 27, 2006 8:01:21 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 27/05/2006
Kaspersky Anti-Virus database records: 196772
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan Statistics:
Total number of scanned objects: 117149
Number of viruses found: 18
Number of infected objects: 50
Number of suspicious objects: 6
Duration of the scan process: 01:52:08

Infected Object Name / Virus Name / Last Action
C:\avenger\backup.zip/avenger/46f050.exe Infected: Trojan-Downloader.Win32.Swizzor.eu skipped
C:\avenger\backup.zip/avenger/sta1.exe Infected: Trojan-Downloader.Win32.Swizzor.fh skipped
C:\avenger\backup.zip/avenger/VSL02.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
C:\avenger\backup.zip/avenger/VSL02.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
C:\avenger\backup.zip/avenger/VSL02.exe Infected: Trojan-Downloader.Win32.Small.ajc skipped
C:\avenger\backup.zip ZIP: infected - 5 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Deskwizz1.zip/sk02.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Deskwizz1.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC16.zip/drsmartload46a.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC16.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC17.zip/drsmartload45a.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC17.zip ZIP: suspicious - 1 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297026.exe Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297031.exe/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297031.exe/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297031.exe/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297031.exe/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297031.exe/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer.381 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297031.exe RarSFX: infected - 5 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297052.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297060.exe Infected: not-a-virus:Monitor.Win32.NetMon.a skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297086.exe/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297086.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297105.dll Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297106.exe Infected: not-a-virus:AdWare.Win32.CommAd.a skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297391.dll Infected: not-a-virus:AdWare.Win32.SurfSide.at skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297392.dll Infected: not-a-virus:AdWare.Win32.SurfSide.at skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297393.exe Infected: not-a-virus:AdWare.Win32.SurfSide.al skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297394.exe/InpB/SskBho.dll Infected: not-a-virus:AdWare.Win32.SurfSide.at skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297394.exe/InpB/SskCore.dll Infected: not-a-virus:AdWare.Win32.SurfSide.at skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297394.exe/InpB/Ssk.exe Infected: not-a-virus:AdWare.Win32.SurfSide.al skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297394.exe/InpB/Ssk3RepairInstall.exe Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297394.exe/InpB Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297394.exe CAB: infected - 5 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297395.dll Infected: not-a-virus:AdWare.Win32.SurfSide.ap skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297471.exe/data0003 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297471.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297545.exe Infected: Trojan-Downloader.Win32.Swizzor.co skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297546.exe Infected: Trojan-Downloader.Win32.Swizzor.fg skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297569.exe/data0013 Infected: not-a-virus:RiskTool.Win32.PsKill.n skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP526\A0297569.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP540\A0305970.exe Infected: Trojan-Downloader.Win32.Swizzor.co skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP540\A0305971.exe Infected: Trojan-Downloader.Win32.Swizzor.fg skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP540\A0305972.exe Infected: Trojan-Downloader.Win32.Swizzor.fg skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP548\A0306283.dll Infected: not-a-virus:AdWare.Win32.Look2Me.ab skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP548\A0306288.exe Infected: Trojan-Downloader.Win32.Swizzor.fg skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP551\A0306766.exe Infected: not-a-virus:AdWare.Win32.Lop.bb skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP551\A0306767.exe Infected: Trojan-Downloader.Win32.Swizzor.fg skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP551\A0306775.exe Infected: not-a-virus:AdWare.Win32.Lop.bb skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP551\A0306776.exe Infected: Trojan-Downloader.Win32.Swizzor.fh skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP551\A0306811.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctp skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP551\A0306811.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
C:\System Volume Information\_restore{1EA7B62A-8950-40DF-8C59-E19482890963}\RP551\A0306811.exe NSIS: infected - 2 skipped
C:\WINDOWS\WPRE.exe/data0004 Infected: Trojan-Downloader.Win32.Small.ctb skipped
C:\WINDOWS\WPRE.exe/data0005 Infected: Trojan-Downloader.Win32.Small.ajc skipped
C:\WINDOWS\WPRE.exe NSIS: infected - 2 skipped

Scan process completed.





hijackthis:

Logfile of HijackThis v1.99.1
Scan saved at 20:01:53, on 27/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\BitComet\BitComet.exe
C:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Waitrose.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - Default URLSearchHook is missing
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - blank (file missing)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136032192250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

[tetonbob]

That's looking much better, but it appears you've had several different infections on this system. I'll be asking for a few more Identification logs.

--------------------------------------------------------------------------------------------

• Double click on HijackThis.exe to run it.
• Click on Open the Misc Tools section
• click the button labelled "Delete A File on Reboot..."
• In the dialogue that shows up, enter the path (type, or copy and paste) of the file in "file name:" field C:\WINDOWS\WPRE.exe
• When you have selected the file, Click the "Open" Button
• Click yes at the next prompt and your system will reboot.

--------------------------------------------------------------------------------------------

When files found by other scanners are in the Recovery directory inside the Spybot-S&D directory, it is only a backup. It is no longer of any harm there, as the file won't be loaded from there. But once you are sure you don't need the backup, go to the Recovery section inside Spybot-S&D and purge the files.

--------------------------------------------------------------------------------------------

CLEAR & RESET SYSTEM RESTORE'S CACHE

Go to Start >> Run - type or copy/paste control sysdm.cpl,,4 & press Enter

* Tick on the checkbox - Turn off System Restore on all drives
* Click Apply

Turn it back 'On' by unticking the same checkbox & click Apply, and then OK

--------------------------------------------------------------------------------------------

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"
and a text file will appear which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

IMPORTANT: Do NOT run option #2 OR any other option until you are directed to do so!

--------------------------------------------------------------------------------------------

Please run fl.bat once again....and post it's results, findlop.txt

--------------------------------------------------------------------------------------------

Also do this:

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

*Note*

If you receive an error while running option #1 similar to this below..

''C:windowssystem32cmd.exe, C:windowssystem32autoexec.nt the system file is not suitable for running ms-dos and microsoft windows applications" please choose Close to terminate the application.

Then run Option 5 or the web page link in the l2mfix folder to solve this error condition. DO NOT run the fix portion (Option 2 or 6) without fixing this first.

--------------------------------------------------------------------------------------------

Please return with logs from:

findlop.txt(fl.bat)
rapport.txt(SmitfraudFix)
L2MFix

[cissesleftleg]

once again thanks for your help here are the reports;

findlop:

Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\All Users\Application Data

23/05/2006 12:22 <DIR> Adobe
23/05/2006 12:24 <DIR> Adobe Systems
28/12/2005 13:48 <DIR> Apple Computer
21/05/2006 14:05 <DIR> avg7
05/10/2005 15:12 <DIR> BVRP Software
19/07/2005 18:11 <DIR> Creative
19/05/2006 14:59 <DIR> G-Force
27/04/2006 14:56 <DIR> Grisoft
09/03/2006 18:36 <DIR> InstallShield
11/01/2006 17:59 <DIR> Motive
13/07/2005 21:05 <DIR> MSN6
07/05/2004 16:57 <DIR> NFS Underground
03/05/2004 18:15 <DIR> QuickTime
13/03/2006 00:34 <DIR> Roxio
09/03/2006 18:33 <DIR> Sonic
17/05/2005 15:18 <DIR> Sony Corporation
27/04/2006 15:10 <DIR> Spybot - Search & Destroy
26/04/2006 10:31 <DIR> Windows Genuine Advantage
14/01/2006 14:25 <DIR> yahoo!
14/01/2006 14:12 <DIR> Yahoo! Companion
0 File(s) 0 bytes
20 Dir(s) 12,992,712,704 bytes free
Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\Thomas\Application Data

23/05/2006 13:02 <DIR> Adobe
06/04/2006 10:27 <DIR> AdobeUM
12/02/2006 12:19 <DIR> Apple Computer
19/02/2005 21:44 <DIR> Atari
27/04/2006 14:57 <DIR> AVG7
23/04/2006 10:32 <DIR> Azureus
19/07/2005 18:26 <DIR> Creative
16/12/2004 13:59 0 dm.ini
04/04/2006 17:20 <DIR> Gearbox Software
31/01/2006 20:55 <DIR> Google
20/04/2006 17:57 <DIR> Help
21/04/2004 23:23 <DIR> Identities
28/07/2004 19:12 <DIR> Kazaa Lite
19/02/2005 21:27 <DIR> Leadertech
01/02/2006 17:19 <DIR> Macromedia
13/07/2005 21:06 <DIR> MSN6
31/05/2005 23:38 <DIR> Musicmatch
20/03/2006 16:18 <DIR> NASA
23/05/2006 12:54 <DIR> Opera
02/10/2004 12:55 <DIR> Real
09/03/2006 22:07 <DIR> Roxio
10/11/2005 22:34 <DIR> Samsung
17/05/2005 15:22 <DIR> Sony Corporation
29/04/2006 14:30 <DIR> Sun
02/05/2006 15:08 <DIR> warez
29/04/2006 12:22 <DIR> Yahoo!
1 File(s) 0 bytes
25 Dir(s) 12,992,712,704 bytes free
Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\Default User\Application Data

21/04/2004 23:38 <DIR> .
21/04/2004 23:38 <DIR> ..
21/04/2004 23:38 62 desktop.ini
1 File(s) 62 bytes
2 Dir(s) 12,992,712,704 bytes free
Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\LocalService\Application Data

Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\Documents and Settings\NetworkService\Application Data

[TRACE] Enumerating jobs and queues





rapport-smitfraud

SmitFraudFix v2.50

Scan done at 19:25:17.89, 29/05/2006
Run from C:\Documents and Settings\Thomas\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Thomas\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Thomas\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"=""
"SubscribedURL"=""
"FriendlyName"=""

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End







l2mfix:

L2MFIX find log 051206
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
"Logon"="WLEventLogon"
"Logoff"="WLEventLogoff"
"Startup"="WLEventStartup"
"Shutdown"="WLEventShutdown"
"StartScreenSaver"="WLEventStartScreenSaver"
"StopScreenSaver"="WLEventStopScreenSaver"
"Lock"="WLEventLock"
"Unlock"="WLEventUnlock"
"StartShell"="WLEventStartShell"
"PostShell"="WLEventPostShell"
"Disconnect"="WLEventDisconnect"
"Reconnect"="WLEventReconnect"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000000
"SafeMode"=dword:00000001
"MaxWait"=dword:ffffffff
"DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Event"=dword:00000003
"InstallNotifyShown"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
"Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
00,00,41,ad,ec,73,0b,0a,40,46,a3,a2,10,bb,10,2b,4d,16,04,00,00,00,04,00,00,\
00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,e9,22,21,fc,ce,fd,21,02,\
65,65,ad,15,0c,f6,26,c2,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,99,\
a3,cd,d9,77,e8,96,55,e7,52,f1,79,ec,36,6b,b5,48,04,00,00,7a,fb,14,c2,88,8e,\
3f,8e,a2,74,71,68,e0,7f,70,73,e3,7f,0b,d0,88,ab,41,00,f3,cf,c7,bd,43,ac,6b,\
ac,04,69,14,0f,f6,eb,0b,50,ab,46,e5,e8,c3,05,67,c9,78,48,54,f0,bd,0a,ef,58,\
c7,63,0b,66,7e,44,2d,e1,22,2c,38,1a,fa,f5,ed,4a,6b,aa,8f,cd,4d,e1,f0,85,b0,\
0b,cd,bb,b4,d0,ed,0b,44,2d,38,be,7b,d0,88,8a,25,02,f6,49,5f,e2,e9,e7,11,d1,\
92,dc,d4,44,8d,d0,9d,58,f7,0d,58,0a,15,a2,b0,6d,fc,c8,8b,78,9b,c3,e9,03,9b,\
86,a3,74,02,a5,86,6f,57,d5,fa,79,67,d6,2e,2c,66,94,37,bc,83,9e,8c,a2,f3,87,\
79,91,d6,97,31,0f,6b,5f,01,a8,45,b1,84,17,71,3f,bb,39,df,dd,c0,7d,89,cc,7c,\
2b,da,55,56,84,c2,61,d7,b1,28,49,42,02,fc,fa,93,c2,a5,5d,e1,a4,0e,76,14,6c,\
bc,fe,af,df,91,3f,65,25,51,c3,b2,fc,34,5f,d8,bd,f9,50,3d,5e,9f,09,be,b3,6b,\
9b,45,ec,18,73,31,80,48,4f,b9,f9,69,bd,1f,59,c8,98,e7,d6,f3,ce,6d,49,08,36,\
01,4e,6f,ab,63,f7,2f,6e,1b,93,77,4a,43,1a,7a,c2,0c,37,51,39,9a,01,91,38,12,\
e4,e1,52,c8,e1,11,35,d8,14,cb,4e,cc,9c,af,fa,2d,0b,63,2e,99,cd,46,81,18,7e,\
e2,c2,3f,3b,d5,55,23,9c,a9,be,08,79,c4,78,8e,4e,d1,26,1b,b9,d4,8e,eb,2a,12,\
97,63,fe,98,ce,e0,04,32,65,d8,01,3a,28,ec,97,5d,73,de,1f,7c,a6,69,67,6e,58,\
94,0e,7b,60,31,f3,d7,9c,ee,df,65,5e,b2,ee,f8,94,7a,32,67,3e,45,a6,aa,a4,b0,\
f6,7b,45,5e,aa,c3,28,9d,ce,12,e5,c0,e0,06,18,bc,d0,2e,b6,09,3a,a3,08,59,37,\
f9,07,cb,ad,7d,57,6f,ea,d0,be,26,88,54,fc,d5,c4,f5,3a,40,79,d5,5a,19,f4,57,\
7f,53,c5,d0,7e,81,56,ef,7e,2e,d2,59,5b,f6,54,b5,aa,fd,92,4a,6b,b1,d1,ea,94,\
a9,f5,c5,ac,af,54,8c,b7,14,71,b0,ee,10,e2,c5,1b,fe,98,86,a0,ab,81,ce,25,30,\
e8,27,a0,b4,4c,0d,36,d5,69,3d,b5,97,9b,7a,9e,42,22,d5,f2,78,a4,f2,47,88,45,\
86,48,e4,94,db,ca,3f,c6,77,87,f7,ae,8d,e8,00,53,e0,33,52,88,92,cf,ee,ea,1f,\
21,5d,0b,c4,87,2f,5b,6c,7e,2b,0a,f0,02,2f,41,34,f6,29,7c,df,64,d4,78,34,75,\
d5,96,2e,22,86,3a,3f,96,a9,74,75,f9,34,db,d7,6b,0d,a6,2c,94,a8,7d,67,16,ee,\
f7,fb,c9,08,18,9c,9b,28,66,09,21,32,03,b9,89,22,3f,2c,fd,a3,68,fd,cd,5e,85,\
2c,95,a5,a2,fb,3b,f2,15,95,9a,c7,9a,e0,ae,dc,a4,6c,f7,36,ab,73,8a,d5,ba,66,\
57,f4,52,59,0f,61,9e,e2,ab,59,44,fa,6e,28,88,55,10,c4,fb,de,0c,70,30,f7,9e,\
b5,44,33,70,2b,3e,35,6b,90,78,ce,b2,68,6d,48,c1,08,d4,fd,50,66,41,91,6f,f0,\
b5,ae,79,c2,33,1f,53,74,a6,5d,16,8c,93,18,cc,10,47,db,3b,c9,24,f5,a7,84,59,\
4e,cb,9f,05,e8,99,fd,8d,70,b2,a5,01,6f,39,7c,5d,bb,d3,83,7d,ad,b9,84,41,55,\
c1,29,6c,df,e4,c0,09,ca,4a,14,0e,2e,4d,fc,03,93,64,57,3c,d6,31,8c,82,1c,01,\
a6,90,eb,76,b5,54,02,17,c7,77,d4,e5,ee,02,d3,9b,63,87,78,5c,9b,e9,09,af,74,\
b2,bd,07,35,4e,a3,0d,9b,5c,71,3d,8a,73,14,51,66,07,4e,31,0d,75,04,c1,41,61,\
88,78,54,10,f9,a1,16,c1,61,82,f4,f1,b1,ee,e6,b7,2b,f0,98,bc,ba,13,7e,4e,31,\
16,c5,ab,2f,80,c6,52,f5,17,83,08,d8,15,1e,f6,97,c3,e5,97,1a,da,e0,e5,f2,ad,\
33,ea,28,fb,b0,4b,5a,1d,ba,2f,6d,ae,15,db,bb,9a,a4,e3,bc,d4,c9,0a,db,55,90,\
04,fb,ae,8e,dc,3a,0c,f9,68,15,35,5e,8e,84,25,e1,de,10,45,9c,66,9c,90,90,e1,\
38,9b,ee,e4,f1,1e,0d,a0,37,ee,cd,31,fc,27,ad,57,85,e6,fa,73,16,1b,17,81,02,\
c2,39,f8,22,d7,62,7b,2d,46,c9,d4,b3,d0,c6,c9,b7,2b,ce,2a,91,b6,c9,99,a1,2e,\
a3,da,8e,82,70,0b,c2,eb,df,75,74,60,32,39,3f,c0,c5,df,f2,8d,51,0d,4e,22,e5,\
04,9d,52,b8,1a,cf,7f,e3,02,87,d0,a3,10,e3,41,c6,08,c4,0a,eb,d9,b8,5d,d6,ec,\
37,fa,f2,b3,20,ac,cc,07,bf,06,5e,8d,b0,ad,d6,a7,ba,81,f4,93,98,82,a5,91,22,\
5b,59,4e,c1,0c,00,67,c3,b7,00,cb,2d,d0,6e,87,36,59,d2,d7,92,1d,34,16,73,bb,\
d7,01,89,99,20,a5,8a,56,fc,7b,40,c3,04,92,a2,ad,08,da,7f,69,0d,5b,ad,58,85,\
88,24,71,54,1d,b8,72,f3,69,be,d6,58,eb,12,2f,14,00,00,00,53,6d,ea,55,a1,5b,\
8f,45,a7,33,22,11,9c,ef,7a,05,ef,b1,af,7c

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{C1332592-6197-CCFD-1DD3-30DBC61ED023}"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Office Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{5E2121EE-0300-11D4-8D3B-444553540000}"="Catalyst Context Menu extension"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{97FA8AA2-EE77-4FF2-9449-424D8924EF21}"="IntelliType Pro Zooming Control Panel Property Page"
"{111D8120-25EB-4E1C-A4DF-C9EE5FCA35CB}"="IntelliType Pro Scrolling Control Panel Property Page"
"{ED6E87C6-8A83-43aa-8208-8DBC8247F4D2}"="IntelliType Pro Key Settings Control Panel Property Page"
"{A2569D1F-4E06-43EC-9825-0088B471BE47}"="IntelliType Pro Wireless Control Panel Property Page"
"{20082881-FC36-4E47-9A7A-644C95FF749F}"="IntelliPoint Wireless Control Panel Property Page"
"{AF90F543-6A3A-4C1B-8B16-ECEC073E69BE}"="IntelliPoint Wheel Control Panel Property Page"
"{653DCCC2-13DB-45B2-A389-427885776CFE}"="IntelliPoint Activities Control Panel Property Page"
"{124597D8-850A-41AE-849C-017A4FA99CA2}"="IntelliPoint Buttons Control Panel Property Page"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{BF05BB6E-442C-428B-8025-82280B7BC26C}"="Zen Micro Media Explorer"
"{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
"{5464D816-CF16-4784-B9F3-75C0DB52B499}"="Yahoo! Mail"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{967B2D40-8B7D-4127-9049-61EA0C2C6DCE}"="PowerISO"
"{0170E959-7EF4-497D-8C8F-EABD5AA36FE7}"=""
"{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}"="AVG7 Shell Extension"
"{9F97547E-460A-42C5-AE0C-81C61FFAEBC3}"="AVG7 Find Extension"
"{95EAA34B-AB7F-4BDC-BAC7-858B3A1D7DA2}"=""
"{FBE44A72-22AB-498E-B5DE-1E554F1409EF}"=""
"{3E473117-EF9D-4E18-856D-CEF518CF2851}"=""

**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{0170E959-7EF4-497D-8C8F-EABD5AA36FE7}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0170E959-7EF4-497D-8C8F-EABD5AA36FE7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0170E959-7EF4-497D-8C8F-EABD5AA36FE7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{0170E959-7EF4-497D-8C8F-EABD5AA36FE7}\InprocServer32]
@="blank"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{95EAA34B-AB7F-4BDC-BAC7-858B3A1D7DA2}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{95EAA34B-AB7F-4BDC-BAC7-858B3A1D7DA2}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{95EAA34B-AB7F-4BDC-BAC7-858B3A1D7DA2}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{95EAA34B-AB7F-4BDC-BAC7-858B3A1D7DA2}\InprocServer32]
@="blank"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{FBE44A72-22AB-498E-B5DE-1E554F1409EF}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FBE44A72-22AB-498E-B5DE-1E554F1409EF}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FBE44A72-22AB-498E-B5DE-1E554F1409EF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{FBE44A72-22AB-498E-B5DE-1E554F1409EF}\InprocServer32]
@="blank"
"ThreadingModel"="Apartment"

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\CLSID\{3E473117-EF9D-4E18-856D-CEF518CF2851}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3E473117-EF9D-4E18-856D-CEF518CF2851}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3E473117-EF9D-4E18-856D-CEF518CF2851}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{3E473117-EF9D-4E18-856D-CEF518CF2851}\InprocServer32]
@="blank"
"ThreadingModel"="Apartment"

**********************************************************************************
Files Found are not all bad files:
Volume in drive C is SAFRI
Volume Serial Number is ECC5-552C

Directory of C:\WINDOWS\System32

26/04/2006 10:31 <DIR> dllcache
21/04/2004 23:28 <DIR> Microsoft
0 File(s) 0 bytes
2 Dir(s) 12,990,902,272 bytes free

[greyknight17]

Fix this in HijackThis:

R3 - Default URLSearchHook is missing

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing Enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2MFix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new HijackThis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[cissesleftleg]

here are the logs requested:

l2mfix:

L2mfix 051206
Creating Account.
The command completed successfully.

Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
zip warning: name not matched: dlls\*.*

zip error: Nothing to do! (backup.zip)
adding: backregs/notibac.reg (164 bytes security) (deflated 79%)


hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 19:55:47, on 04/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Waitrose.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - blank (file missing)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1136032192250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

[greyknight17]

Hmm...are you logged into a Administrator account? l2mfix option #2 should have produced a bigger log than what you posted. Let's try this instead:

Print out these instructions and close ALL windows before continuing.

Download Look2Me-Destroyer http://www.atribune.org/ccount/click.php?id=7 and save the file to your desktop.
* Double-click Look2Me-Destroyer.exe to run it.
* Put a check next to 'Run this program as a task'.
* You will receive a message saying 'Look2Me-Destroyer will close and re-open in approximately 10 seconds'. Click OK.
* When Look2Me-Destroyer re-opens, click the 'Scan for L2M button'. Your desktop icons will disappear - this is normal.
* Once it's done scanning, click the 'Remove L2M button'.
* You will receive a 'Done Scanning message'. Click OK.
* When completed, you will receive this message: 'Done removing infected files! Look2Me-Destroyer will now shutdown your computer'. Click OK.
* Your computer will then shutdown.
* Turn your computer back on.

Post the contents of C:\Look2Me-Destroyer.txt here.

*NOTE: If for some reason you get a mswinsck.ocx file missing when running Look2Me Destroyer, go to http://www.ascentive.com/support/new...e=MSWINSCK.OCX and get the file there instead. Then try running Look2Me Destroyer again.

[cissesleftleg]

thanks for your continuing help

heres the log:


Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 6/6/2006 2:58:16 PM


Attempting to delete infected files...

Making registry repairs.


Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{0170E959-7EF4-497D-8C8F-EABD5AA36FE7}"
HKCR\Clsid\{0170E959-7EF4-497D-8C8F-EABD5AA36FE7}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{95EAA34B-AB7F-4BDC-BAC7-858B3A1D7DA2}"
HKCR\Clsid\{95EAA34B-AB7F-4BDC-BAC7-858B3A1D7DA2}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{FBE44A72-22AB-498E-B5DE-1E554F1409EF}"
HKCR\Clsid\{FBE44A72-22AB-498E-B5DE-1E554F1409EF}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3E473117-EF9D-4E18-856D-CEF518CF2851}"
HKCR\Clsid\{3E473117-EF9D-4E18-856D-CEF518CF2851}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administrators - Succeeded

[tetonbob]

That worked.

Well done. Your logs are clean. Any more issues? If not you should be good to go. We still have a few items to address.


Reset hidden/system files and folders

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

Create a new System Restore point

• click Start >> Run - type SYSDM.CPL & press Enter
• select the System Restore Tab
• tick on the checkbox - "Turn off System Restore on all drives"
• click Apply
• then untick the same checkbox & click OK

Please ensure that you have already patched your system against the recent WMF exploit.
Go to this page to get the KB912919 patch.

Enable Windows Auto Update

• Go to Start>Run - type wuaucpl.cpl
• tick on the checkbox - "Keep my computer up to date"
• Under settings, choose "Automatically download the updates, and install them on the schedule that I specify".
• Click on "OK".

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• SpywareGuard to catch and block spyware before it can execute.
  
• SPYBOT - SEARCH & DESTROY
  Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
  
• AD-AWARE
  Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here
  
• Winpatrol - Download and install the free version of Winpatrol.
  A tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software
  
  
• IE-SPYAD - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Download IE-SpyAD - Extract the contents to a new folder
    From within the folder, double-click install.bat
    Select Option #2 - Install the new IE-SPYAD list.
    Then return to the main menu.
    Select option #4 - Add the old porn sites domain
  
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
    
  • Click Next, click Next, select the option:
    "Show Extracted files", click Finish
    
  • This will open the newly created hosts folder on your Desktop.
    
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  
  
  
• ANTIVIRUS SOFTWARE
  It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online antivirus scanners:
  
  Anti-Spyware Tutorial
  
  Here are two very good free Antivirus products which are available:
  
• Avast!
  
  
• AVG

If you do not have a firewall, here are 4 free ones available for personal use:

• ZoneAlarm
• Avast Antivirus/Firewall
• Tiny Personal Firewall
• OutPost Firewall

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• HOW DID I GET INFECTED IN THE FIRST PLACE?
• THE ANTI-SPYWARE TUTORIAL
• MAKING INTERNET EXPLORER SAFER

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[cissesleftleg]

all seems to be working well, thanks very much for your time and help. i shall try to be more careful in future so that i don't have a mess to get out of. again, cheers.