TheTechGuide Forum

General Category => Tech Clinic => Topic started by: yinona on May 23, 2005, 02:30:44 PM

Title: spyware removal
Post by: yinona on May 23, 2005, 02:30:44 PM
hi all
having major problems with spyware , not able to remove no matter what...
here is the Hijack this log :

Logfile of HijackThis v1.99.1
Scan saved at 22:25:26, on 23/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
C:\Program Files\הפוך על הפוך\Hebrew.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\system32\ntvdm.exe
E:\Program Files\Adobe\Acrobat 6.0 ME\Reader\AcroRd32.exe
C:\WINDOWS\System32\WISPTIS.EXE
c:\windows\system32\vqmulu.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\ינון ורוני\שולחן העבודה\hijackthis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ynet.co.il/ (http://\"http://www.ynet.co.il/\")
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {5038FED1-CEFE-11D2-9E74-00A0C945A948} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AZE Search - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - C:\WINDOWS\system32\azesearch3.ocx (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Hebrew] C:\Program Files\הפוך על הפוך\Hebrew.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [ogugsu] c:\windows\system32\vqmulu.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: הפעלה מהירה של Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: &יצא ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: ... פתח את כל הקישורים בדף זה - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: הדגש - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: הוסף לרשימת הפרסומות החסומות - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: חסום את כל התמונות משרת זה - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: חפש - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD...sharingctrl.cab (http://\"http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab\")
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab (http://\"http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\..\{33767120-AE01-4B6C-8CA0-2BF5DA9B41C7}: NameServer = 212.150.49.10 206.49.94.234
O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\e0202afmgd2a2.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Title: spyware removal
Post by: guestolo on May 23, 2005, 03:38:38 PM
Can you do the following please

Download L2mfix from here

http://www.atribune.org/downloads/l2mfix.exe (http://\"http://www.atribune.org/downloads/l2mfix.exe\")

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

[color=\"red\"]IMPORTANT:  Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so![/color]
Title: spyware removal
Post by: yinona on May 24, 2005, 01:00:36 PM
L2MFIX find log 1.03
These are the registry keys present
********************************************************************************
**
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Themes]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\e0202afmgd2a2.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

********************************************************************************
**
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

********************************************************************************
**
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="‚Œ‰… Ž€”‰‰‰ ™Œ —…• Ž…Œˆ‰Žƒ‰„"
"{176d6597-26d3-11d1-b350-080036a75b03}"="‰„…Œ ‘…˜— ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="’Ž…ƒ €ˆ‡„ ™Œ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="’Ž…ƒ Ž€”‰‰‰ ™Œ —…• Ž‘ŽŠ OLE"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="„˜‡…š Ž’ˆ”š Œ™‰š…“"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="„˜‡š Œ…‡ „—˜„ ŒŽš€Ž‰ š–…‚„"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="„˜‡š Œ…‡ „—˜„ Œ–‚"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="„˜‡š Œ…‡ „—˜„ Œš–…‚„ ”…˜Ž‰š"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="’Ž…ƒ €ˆ‡„ ™Œ ™‰˜…š‰ ‘”˜‰…š"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="ƒ“ š€‰Ž…š"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="„˜‡„ Œ„’š—š ƒ‰‘—"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="„˜‡…š Ž’ˆ”š Œ€…‰‰—ˆ‰ ˜™š ™Œ Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="‰„…Œ –‚ ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="‰„…Œ Žƒ”‘š ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="„˜‡…š Ž’ˆ”š Œƒ‡‰‘š —–‰"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="„˜‡š Ž’ˆ”š ™Œ Žƒ”‘š ˜™š"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="š”˜‰ˆ „—™˜ „–”„"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="”˜…”‰Œ ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="’Ž…ƒ €ˆ‡„ ™Œ Žƒ”‘…š"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="„˜‡…š Ž’ˆ”š Œ™‰š…“"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="„˜‡š PKO ™Œ Crypto"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="„˜‡š ‡š‰Ž„ ™Œ Crypto"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="‡‰…˜‰ ˜™š"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="‡‰…˜‰ ˜™š"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="„˜‡…š Ž’ˆ”š ’…˜ Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Ž™‰Ž…š Žš…†Ž…š"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="™…˜š „Ž™‰Ž…š …š”˜‰ˆ „š‡Œ„"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="‡‰”…™"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="’†˜„ …šŽ‰‹„"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="’†˜„ …šŽ‰‹„"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="„”’Œ„..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="€‰ˆ˜ˆ"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="ƒ…€˜ €Œ—ˆ˜…‰"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="‹Œ‰ ‰„…Œ"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="‘˜‚Œ „‹Œ‰ €‰ˆ˜ˆ ™Œ Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Ž– „…˜ƒ„"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="š‰—‰‰š Ž’ˆ”š Ž…˜‡š"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="š‰—‰‰š Ž’ˆ”š Ž…˜‡š 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="˜–…’š „ƒ”ƒ” ™Œ Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="˜–…’š „‡‰”…™"
"{32683183-48a0-441b-a342-7c2a440a9478}"="˜–…’š Žƒ‰„"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="‡‰”…™ š…Š „‡Œ…‰š"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="‡‰”…™ €‰ˆ˜ˆ"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="‹Œ‰ ™‰˜…š Œ€”™˜…‰…š ’• „˜‰™…"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&‹š…š"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="š‰š ’˜‰‹š ‹š…š"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="„™ŒŽ„ €…ˆ…Žˆ‰š ™Œ Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="˜™‰Žš „™ŒŽ„ €…ˆ…Žˆ‰š ™Œ MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="˜™‰Žš „™ŒŽ„ €…ˆ…Žˆ‰š Ž…š€Žš €‰™‰š ™Œ MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="‚‰™"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="‘˜‚Œ Ž’— Ž…—”•"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Žš‡ ™…˜š „‹š…š"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="˜™‰Žš „„™ŒŽ„ „€…ˆ…Žˆ‰š ™Œ „„‰‘ˆ…˜‰„ ™Œ Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="˜™‰Žš „„™ŒŽ„ „€…ˆ…Žˆ‰š ™Œ š‰—‰…š „Ž’ˆ”š ™Œ Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="‹Œ‰ „—‰…Œ ™Œ ˜™‰Ž…š „„™ŒŽ„ „€…ˆ…Žˆ‰š „Ž˜……š ™Œ Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="š”˜‰ˆ €š˜‰ ˜–…’š „Ž’ˆ”š"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="‘‰…’ ŒŽ™šŽ™"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="„‚ƒ˜…š š‰—‰…š ‹ŒŒ‰…š"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="™‰˜…š „‰‘ˆ…˜‰‰š ‹š……š URL ™Œ Microsoft"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="‹Œ‰ ‡‰”…™ ‹š……š URL ™Œ Microsoft"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Ž‘Š ”š‰‡„ ™Œ ‡‰Œš IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="„€‰ˆ˜ˆ"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="š‰—‰‰š ŽˆŽ… ™Œ ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="š‰—‰‰š Ž…‰‰"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="??Ž„Œ ‰‰™…Ž‰ „Ž’ˆ”š"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Ž…„ „‰‰™…Ž‰ „Ž…š—‰"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Ž”˜‘ ‰‰™…Ž‰ ƒ˜……‰"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="€™“ „”˜‘… Œ€‰ˆ˜ˆ"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="„†Žš „ƒ”‘…š €‰ˆ˜ˆ"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="€…‰‰—ˆ Ž’ˆ”š ™Œ €™“ „”˜‘…"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="€™“ —Œš Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="‡™……š Ž™šŽ™‰"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="—…• ’˜…•"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="—‰–…˜ ƒ˜Š Œ’˜…•"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="€…‰‰—ˆ Žˆ”Œ ’˜…•"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="š‰—‰‰š —–‰ Œ€ Ž—……‰"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="’…˜ &€™‰..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}"="My Logitech Pictures"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{243A006D-9C08-4F4D-A357-2F5BB633B9D3}"=""
"{509B7A82-2686-4CED-932C-8734D83DA52D}"=""

********************************************************************************
**
HKEY ROOT CLASSIDS:
********************************************************************************
**
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
   authz.dll      Wed  2 Mar 2005  20:10:36   A....         56,832    55.50 K
   browseui.dll   Thu 10 Mar 2005  10:04:10   A....      1,016,832   993.00 K
   cdfview.dll    Thu 10 Mar 2005  10:04:10   A....        151,040   147.50 K
   iepeers.dll    Thu 10 Mar 2005  10:04:10   A....        250,880   245.00 K
   inseng.dll     Thu 10 Mar 2005  10:04:10   A....         96,256    94.00 K
   mshtml.dll     Thu 10 Mar 2005  10:04:10   A....      3,010,560     2.87 M
   msi.dll        Wed  4 May 2005  14:45:32   A....      2,890,240     2.75 M
   msihnd.dll     Mon 21 Mar 2005  15:00:22   A....        271,360   265.00 K
   msimsg.dll     Mon 21 Mar 2005  15:00:22   A....        884,736   864.00 K
   msisip.dll     Mon 21 Mar 2005  15:00:22   A....         15,360    15.00 K
   msrating.dll   Thu 10 Mar 2005  10:04:10   A....        146,432   143.00 K
   shdocvw.dll    Thu 10 Mar 2005  10:04:10   A....      1,483,264     1.41 M
   shell32.dll    Tue  1 Mar 2005   1:12:24   A....      8,417,280     8.03 M
   shlwapi.dll    Thu 10 Mar 2005  10:04:12   A....        473,600   462.50 K
   spmsg.dll      Wed  4 May 2005  14:45:28   .....         13,024    12.72 K
   sporder.dll    Mon 25 Apr 2005  12:04:32   A....          8,464     8.27 K
   symneti.dll    Tue  5 Apr 2005  11:17:04   A....        517,848   505.71 K
   symredir.dll   Tue  5 Apr 2005  11:17:04   A....        132,824   129.71 K
   urlmon.dll     Thu 10 Mar 2005  10:04:12   A....        602,112   588.00 K
   user32.dll     Wed  2 Mar 2005  20:10:36   A....        575,488   562.00 K
   wininet.dll    Thu 10 Mar 2005  10:04:12   A....        653,312   638.00 K
   winsrv.dll     Wed  2 Mar 2005  20:10:36   A....        329,216   321.50 K

22 items found:  22 files, 0 directories.
   Total of file sizes:  21,996,960 bytes     20.98 M
Locate .tmp files:

No matches found.
********************************************************************************
**
Directory Listing of system files:
 Volume in drive C has no label.
 Volume Serial Number is B45B-F0CE

 Directory of C:\WINDOWS\System32

05/16/2005  11:21 PM    <DIR>          dllcache
01/02/2004  06:24 PM    <DIR>          Microsoft
03/21/2002  02:58 PM           188,416 archlib.dll
09/30/1999  07:21 PM           166,672 mstext35.dll
09/09/1999  10:06 PM           168,720 msltus35.dll
09/09/1999  10:06 PM           252,688 msexcl35.dll
08/25/1999  02:57 PM           415,504 msrepl35.dll
06/07/1999  06:59 PM           250,128 mspdox35.dll
04/25/1999  05:00 PM           287,504 Msxbse35.dll
               7 File(s)      1,729,632 bytes
               2 Dir(s)  12,475,297,792 bytes free
Title: spyware removal
Post by: guestolo on May 24, 2005, 11:08:35 PM
I wanted to hold off on a fix to this post until we resolved your other issue
Didn't want to take the chance of overwriting your files if we installed other software
and needed recovery software to retreive the lost files
But you got them back so let's carry on

Download and UNZIP to desktop Fix.zip, so you now have fix.reg on the desktop
We'll need this later
[attachment=243:attachment]

==Please download Nailfix from here:
http://www.noidea.us/easyfile/file.php?dow...050515010747824 (http://\"http://www.noidea.us/easyfile/file.php?download=20050515010747824\")
Unzip it to the desktop but please do NOT run it yet.

Please Print this out or save these instructions to a Notepad file and save it to your Desktop
RESTART your Computer in SAFE MODE (http://\"http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001060608000039?OpenDocument&ExpandSection=4#_Section4\")
You can do this by tapping the F8 key as the system is restarting, after the single post beep, or use the link
I supplied for a more detailed explanation

Once in Safe mode
Double-click on Nailfix.cmd.  Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Find and delete this file if found
c:\windows\system32\vqmulu.exe <-file

Double click on fix.reg and allow to add or merge to the registry

Do another scan with Hijackthis and put a check next to these entries:
Not all may remain, but take a look

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {5038FED1-CEFE-11D2-9E74-00A0C945A948} - (no file)

O3 - Toolbar: AZE Search - {a19ef336-01d4-48e6-926a-fe7e1c747aed} - C:\WINDOWS\system32\azesearch3.ocx (file missing)

O4 - HKLM\..\Run: [ogugsu] c:\windows\system32\vqmulu.exe

O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\e0202afmgd2a2.dll (file missing)

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

After you have ticked the above entries, close All other open windows,
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Restart back to Normal mode

Run another scan with Hijackthis and post a fresh log

Could you also
Download Find_It's.zip (http://\"http://forums.net-integration.net/index.php?act=Attach&type=post&id=142443\")
UNZIP the contents
Open the FindIt's folder and double click on the FindIt's.bat
Wait for the log and post it back here
Title: spyware removal
Post by: yinona on May 25, 2005, 04:11:59 PM
thank you for all your  help...
attached is the log after doing what you have advised..
** while i restarted my computer in normal mode there was a message saying that the system couldnt find the file Nail.exe ??

Logfile of HijackThis v1.99.1
Scan saved at 00:05:43, on 26/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\LVComS.exe
C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\ינון ורוני\שולחן העבודה\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ynet.co.il/ (http://\"http://www.ynet.co.il/\")
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Hebrew] C:\Program Files\הפוך על הפוך\Hebrew.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: הפעלה מהירה של Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: &יצא ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: ... פתח את כל הקישורים בדף זה - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: הדגש - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: הוסף לרשימת הפרסומות החסומות - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: חסום את כל התמונות משרת זה - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: חפש - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD...sharingctrl.cab (http://\"http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab\")
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab (http://\"http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\..\{33767120-AE01-4B6C-8CA0-2BF5DA9B41C7}: NameServer = 212.150.49.10 206.49.94.234
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

***** [color=\"red\"]this is the find_it's log :[/B[/color]]


Microsoft Windows XP [Version 5.1.2600]
The current date is: Thu 05/26/2005
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
»»»»»»»»»»»»»»»»»»»»»»»» Todo Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»» aurora Files found »»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»»»»»»»»»»»»»»»»»»»»» Suspect's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Dont delete file's in the section without guidance
If any doubt back them up first
 
* UPX!  C:\WINDOWS\System32\FYAGSU.EXE
* UPX!  C:\WINDOWS\ICONT.EXE
 
»»»»» lagitamate file's can/will show in this section.
 
* UPX!  C:\WINDOWS\System32\MACDEC.DLL
* UPX!  C:\WINDOWS\DAEMON.DLL
»»»»»»»»»»»»»»»»»»»»»»»» Buddy file's »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
»»»»»»»»»»»»»»»»»»»»»»»» SAHAgent Files found »»»»»»»»»»»»»»»»»»»»»»»»»
 
»»»»»»»»»»»»»»»»»»»»»»»» Misc checks »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
 
 
»»»»» Check for Windows\SYSTEM32\cache32_rtneg* folder.
 
 Volume in drive C has no label.
 Volume Serial Number is B45B-F0CE

 Directory of C:\WINDOWS\SYSTEM32

»»»»» Checking for SAHAgent ico files.
 Volume in drive C has no label.
 Volume Serial Number is B45B-F0CE

 Directory of C:\WINDOWS\system32

 
»»»»»»»»»»»»»»»»»»»»»»»».
Title: spyware removal
Post by: guestolo on May 25, 2005, 07:04:42 PM
Can you do the following please

Open Hijackthis>>Open Misc tools section>>Open "Delete a file on Reboot"
Copy and paste the full path of the file to delete in bold directly below to the File name field

C:\WINDOWS\ICONT.EXE

Then Click OPEN
Hijackthis should prompt you that the file will be deleted and to Reboot your computer
DON'T allow to Reboot yet

Instead

Do another scan with Hijackthis and put a check next to these entries:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

After you have ticked the above entries, close All other open windows, including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis

Restart your computer

Back in Windows

Set Windows To Show Hidden Files and Folders
    * Click Start.
    * Open My Computer.
    * Select the Tools menu and click Folder Options.
    * Select the View Tab.
    * Under the Hidden files and folders heading select Show hidden files and folders.
    * Uncheck the Hide protected operating system files (recommended) option.
    * Uncheck the Hide Extensions for known file types
    * Click Yes to confirm.
    * Click OK.

Make sure this file is gone

C:\WINDOWS\ICONT.EXE

Also
Can you go to this link
Give this site time to load
Jotti's Online Malware scan (http://\"http://virusscan.jotti.org/\")

Use the browse button and navigate to this file on your hard drive
C:\WINDOWS\System32\FYAGSU.EXE <-this file
Right click on it  and choose Select
Then use the Submit button
Let it finish scanning
Could you post back the results of the scan back here please, just the scanner results

Do the same for this file, I believe this next one is legit, I want to be sure
C:\WINDOWS\system32\MACDEC.DLL
Title: spyware removal
Post by: Guest on May 26, 2005, 01:47:44 PM
thank you here are the scanner results :
Scanner results  
AntiVir  Found TR/Agent.ABS  
Avast  Found Win32:Trojano-1267  
AVG Antivirus  Found Collected.6.BV  
BitDefender  Found Trojan.Agent.CP  
ClamAV  Found nothing
Dr.Web  Found not a virus Adware.CallingHome  
F-Prot Antivirus  Found W32/Agent.NP  
Fortinet  Found W32/Agent.ABS-tr  
Kaspersky Anti-Virus  Found Trojan.Win32.Agent.cp  
mks_vir  Found Trojan.Agent.Cp  
NOD32  Found Win32/Agent.CP  
Norman Virus Control  Found W32/Agent.CYT  
VBA32  Found Trojan.Win32.Agent.cp  
 
the second file :

 
Service  
Service load:  0%        100%  
 
File:  MACDec.dll  
Status:  MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.) (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)  
MD5  451cd43bd3b5d00cadd6720569602764  
Packers detected:  UPX
Scanner results  
AntiVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
Fortinet  Found nothing
Kaspersky Anti-Virus  Found nothing
mks_vir  Found nothing
NOD32  Found nothing
Norman Virus Control  Found nothing
VBA32  Found nothing
Title: spyware removal
Post by: guestolo on May 26, 2005, 08:29:07 PM
Go ahead and delete this file
C:\WINDOWS\System32\FYAGSU.EXE

FYI
these 2 entries in your log
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

If you don't read the Memory Dumps, you can disable this feature, most do

Used in connection with memory dumps - you can disable these by - right clicking on My Computer selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane - under 'Write debugging information' - click on the down arrow and then select 'None' - OK your way out

Could you post a fresh Hijackthis log afterwards and let me know how everythings running

Also, can you do this one more time
Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.
Title: spyware removal
Post by: yinon on May 27, 2005, 12:02:52 PM
thank you ,

Logfile of HijackThis v1.99.1
Scan saved at 20:03:15, on 27/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVComS.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Raxco\PerfectDisk\PDSched.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Avant Browser\avant.exe
C:\Documents and Settings\ינון ורוני\שולחן העבודה\hijackthis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ynet.co.il/ (http://\"http://www.ynet.co.il/\")
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.24.0\gnotify.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Hebrew] C:\Program Files\הפוך על הפוך\Hebrew.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: הפעלה מהירה של Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O8 - Extra context menu item: &יצא ל- Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: ... פתח את כל הקישורים בדף זה - C:\Program Files\Avant Browser\OpenAllLinks.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: הדגש - C:\Program Files\Avant Browser\Highlight.htm
O8 - Extra context menu item: הוסף לרשימת הפרסומות החסומות - C:\Program Files\Avant Browser\AddToADBlackList.htm
O8 - Extra context menu item: חסום את כל התמונות משרת זה - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
O8 - Extra context menu item: חפש - C:\Program Files\Avant Browser\Search.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD...sharingctrl.cab (http://\"http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab\")
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab (http://\"http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\..\{33767120-AE01-4B6C-8CA0-2BF5DA9B41C7}: NameServer = 212.150.49.10 206.49.94.234
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe



L2MFIX find log 1.03
These are the registry keys present
********************************************************************************
**
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
  6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

********************************************************************************
**
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

********************************************************************************
**
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="‚Œ‰… Ž€”‰‰‰ ™Œ —…• Ž…Œˆ‰Žƒ‰„"
"{176d6597-26d3-11d1-b350-080036a75b03}"="‰„…Œ ‘…˜— ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="’Ž…ƒ €ˆ‡„ ™Œ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="’Ž…ƒ Ž€”‰‰‰ ™Œ —…• Ž‘ŽŠ OLE"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="„˜‡…š Ž’ˆ”š Œ™‰š…“"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="„˜‡š Œ…‡ „—˜„ ŒŽš€Ž‰ š–…‚„"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="„˜‡š Œ…‡ „—˜„ Œ–‚"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="„˜‡š Œ…‡ „—˜„ Œš–…‚„ ”…˜Ž‰š"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="’Ž…ƒ €ˆ‡„ ™Œ ™‰˜…š‰ ‘”˜‰…š"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="ƒ“ š€‰Ž…š"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="„˜‡„ Œ„’š—š ƒ‰‘—"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="„˜‡…š Ž’ˆ”š Œ€…‰‰—ˆ‰ ˜™š ™Œ Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="‰„…Œ –‚ ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="‰„…Œ Žƒ”‘š ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="„˜‡…š Ž’ˆ”š Œƒ‡‰‘š —–‰"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="„˜‡š Ž’ˆ”š ™Œ Žƒ”‘š ˜™š"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="š”˜‰ˆ „—™˜ „–”„"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="”˜…”‰Œ ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="’Ž…ƒ €ˆ‡„ ™Œ Žƒ”‘…š"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="„˜‡…š Ž’ˆ”š Œ™‰š…“"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="„˜‡š PKO ™Œ Crypto"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="„˜‡š ‡š‰Ž„ ™Œ Crypto"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="‡‰…˜‰ ˜™š"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="‡‰…˜‰ ˜™š"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&‘…˜—‰ …Ž–ŒŽ…š"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="„˜‡…š Ž’ˆ”š ’…˜ Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Ž™‰Ž…š Žš…†Ž…š"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="™…˜š „Ž™‰Ž…š …š”˜‰ˆ „š‡Œ„"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="‡‰”…™"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="’†˜„ …šŽ‰‹„"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="’†˜„ …šŽ‰‹„"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="„”’Œ„..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="€‰ˆ˜ˆ"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="ƒ…€˜ €Œ—ˆ˜…‰"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="‹Œ‰ ‰„…Œ"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="‘˜‚Œ „‹Œ‰ €‰ˆ˜ˆ ™Œ Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Ž– „…˜ƒ„"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="š‰—‰‰š Ž’ˆ”š Ž…˜‡š"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="š‰—‰‰š Ž’ˆ”š Ž…˜‡š 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="˜–…’š „ƒ”ƒ” ™Œ Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="˜–…’š „‡‰”…™"
"{32683183-48a0-441b-a342-7c2a440a9478}"="˜–…’š Žƒ‰„"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="‡‰”…™ š…Š „‡Œ…‰š"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="‡‰”…™ €‰ˆ˜ˆ"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="‹Œ‰ ™‰˜…š Œ€”™˜…‰…š ’• „˜‰™…"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&‹š…š"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="š‰š ’˜‰‹š ‹š…š"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="„™ŒŽ„ €…ˆ…Žˆ‰š ™Œ Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="˜™‰Žš „™ŒŽ„ €…ˆ…Žˆ‰š ™Œ MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="˜™‰Žš „™ŒŽ„ €…ˆ…Žˆ‰š Ž…š€Žš €‰™‰š ™Œ MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="‚‰™"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="‘˜‚Œ Ž’— Ž…—”•"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Žš‡ ™…˜š „‹š…š"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="˜™‰Žš „„™ŒŽ„ „€…ˆ…Žˆ‰š ™Œ „„‰‘ˆ…˜‰„ ™Œ Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="˜™‰Žš „„™ŒŽ„ „€…ˆ…Žˆ‰š ™Œ š‰—‰…š „Ž’ˆ”š ™Œ Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="‹Œ‰ „—‰…Œ ™Œ ˜™‰Ž…š „„™ŒŽ„ „€…ˆ…Žˆ‰š „Ž˜……š ™Œ Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="š”˜‰ˆ €š˜‰ ˜–…’š „Ž’ˆ”š"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="‘‰…’ ŒŽ™šŽ™"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="„‚ƒ˜…š š‰—‰…š ‹ŒŒ‰…š"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="™‰˜…š „‰‘ˆ…˜‰‰š ‹š……š URL ™Œ Microsoft"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="‹Œ‰ ‡‰”…™ ‹š……š URL ™Œ Microsoft"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Ž‘Š ”š‰‡„ ™Œ ‡‰Œš IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="„€‰ˆ˜ˆ"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="š‰—‰‰š ŽˆŽ… ™Œ ActiveX"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="š‰—‰‰š Ž…‰‰"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="??Ž„Œ ‰‰™…Ž‰ „Ž’ˆ”š"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Ž…„ „‰‰™…Ž‰ „Ž…š—‰"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Ž”˜‘ ‰‰™…Ž‰ ƒ˜……‰"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="€™“ „”˜‘… Œ€‰ˆ˜ˆ"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="„†Žš „ƒ”‘…š €‰ˆ˜ˆ"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="€…‰‰—ˆ Ž’ˆ”š ™Œ €™“ „”˜‘…"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="€™“ —Œš Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="‡™……š Ž™šŽ™‰"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="—…• ’˜…•"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="—‰–…˜ ƒ˜Š Œ’˜…•"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="€…‰‰—ˆ Žˆ”Œ ’˜…•"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="š‰—‰‰š —–‰ Œ€ Ž—……‰"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="’…˜ &€™‰..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Web Folders"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}"="My Logitech Pictures"
"{00020D75-0000-0000-C000-000000000046}"="Microsoft Office Outlook Desktop Icon Handler"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"="Adobe.Acrobat.ContextMenu"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{E0D79304-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79305-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79306-84BE-11CE-9641-444553540000}"="WinZip"
"{E0D79307-84BE-11CE-9641-444553540000}"="WinZip"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"

********************************************************************************
**
HKEY ROOT CLASSIDS:
********************************************************************************
**
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
   authz.dll      Wed  2 Mar 2005  20:10:36   A....         56,832    55.50 K
   browseui.dll   Thu 10 Mar 2005  10:04:10   A....      1,016,832   993.00 K
   cdfview.dll    Thu 10 Mar 2005  10:04:10   A....        151,040   147.50 K
   iepeers.dll    Thu 10 Mar 2005  10:04:10   A....        250,880   245.00 K
   inseng.dll     Thu 10 Mar 2005  10:04:10   A....         96,256    94.00 K
   mshtml.dll     Thu 10 Mar 2005  10:04:10   A....      3,010,560     2.87 M
   msi.dll        Wed  4 May 2005  14:45:32   A....      2,890,240     2.75 M
   msihnd.dll     Mon 21 Mar 2005  15:00:22   A....        271,360   265.00 K
   msimsg.dll     Mon 21 Mar 2005  15:00:22   A....        884,736   864.00 K
   msisip.dll     Mon 21 Mar 2005  15:00:22   A....         15,360    15.00 K
   msrating.dll   Thu 10 Mar 2005  10:04:10   A....        146,432   143.00 K
   shdocvw.dll    Thu 10 Mar 2005  10:04:10   A....      1,483,264     1.41 M
   shell32.dll    Tue  1 Mar 2005   1:12:24   A....      8,417,280     8.03 M
   shlwapi.dll    Thu 10 Mar 2005  10:04:12   A....        473,600   462.50 K
   spmsg.dll      Wed  4 May 2005  14:45:28   .....         13,024    12.72 K
   sporder.dll    Mon 25 Apr 2005  12:04:32   A....          8,464     8.27 K
   symneti.dll    Tue  5 Apr 2005  11:17:04   A....        517,848   505.71 K
   symredir.dll   Tue  5 Apr 2005  11:17:04   A....        132,824   129.71 K
   urlmon.dll     Thu 10 Mar 2005  10:04:12   A....        602,112   588.00 K
   user32.dll     Wed  2 Mar 2005  20:10:36   A....        575,488   562.00 K
   wininet.dll    Thu 10 Mar 2005  10:04:12   A....        653,312   638.00 K
   winsrv.dll     Wed  2 Mar 2005  20:10:36   A....        329,216   321.50 K

22 items found:  22 files, 0 directories.
   Total of file sizes:  21,996,960 bytes     20.98 M
Locate .tmp files:

No matches found.
********************************************************************************
**
Directory Listing of system files:
 Volume in drive C has no label.
 Volume Serial Number is B45B-F0CE

 Directory of C:\WINDOWS\System32

05/16/2005  11:21 PM    <DIR>          dllcache
01/02/2004  06:24 PM    <DIR>          Microsoft
03/21/2002  02:58 PM           188,416 archlib.dll
09/30/1999  07:21 PM           166,672 mstext35.dll
09/09/1999  10:06 PM           168,720 msltus35.dll
09/09/1999  10:06 PM           252,688 msexcl35.dll
08/25/1999  02:57 PM           415,504 msrepl35.dll
06/07/1999  06:59 PM           250,128 mspdox35.dll
04/25/1999  05:00 PM           287,504 Msxbse35.dll
               7 File(s)      1,729,632 bytes
               2 Dir(s)  12,484,792,320 bytes free
Title: spyware removal
Post by: guestolo on May 28, 2005, 11:47:36 PM
That's looking good, can you do the following for some final cleanup please

Open Notepad (START>>>RUN>>>type in notepad)
Hit OK
Copy the contents of the CODE box to notepad, not including the word "code"
In Notepad click FILE>>SAVE AS
IMPORTANT>>>Change the Save as Type to All Files.
Name the file as fix2.reg

Save this file on the desktop

 
Code: [Select]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

[-HKEY_CLASSES_ROOT\CLSID\{243A006D-9C08-4F4D-A357-2F5BB633B9D3}]

[-HKEY_CLASSES_ROOT\CLSID\{509B7A82-2686-4CED-932C-8734D83DA52D}]
 Double click on fix2.reg and allow to add or Merge to the registry

Restart the computer

Back in Windows

You should disable system restore---restart your computer--enable system restore
This will clear all your restore points and ensure you don't restore any nasties
Once reenabled it will create a fresh restore point
How to Disable and Re-enable System Restore feature (http://\"http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm\")

Once back in Windows and System Restore is reenabled

You should set up protection against future attacks

SpywareBlaster 3.3 by JavaCool (http://\"http://www.javacoolsoftware.com/spywareblaster.html\")
*Will block bad ActiveX Controls
*Block Malevolent cookies in Internet Explorer and Firefox
*Restrict actions of potentially dangerous sites in Internet Explorer


IE-Spyad---IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
Here is a tutorial and download link
TUTORIAL==Link to Tutorial (http://\"http://www.bleepingcomputer.com/forums/index.php?showtutorial=53\")
Download link (http://\"https://netfiles.uiuc.edu/ehowes/www/resource.htm#IESPYAD\")

With both, Check for updates every couple of weeks
Keep the link to IE-Spyad bookmarked so you can check for updates
SpywareBlaster, after every update just simply Click the "enable all protection"