Hi. I'm having a lot of trouble getting rid of browsela.dll. Norton hasn't helped at all. I've included my HijackThis log below: Logfile of HijackThis v1.99.1 Scan saved at 6:16:44 PM, on 3/25/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\DSentry.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\WINDOWS\QWxpc2E\command.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\regedit.exe C:\WINDOWS\System32\cmd.exe C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Alisa\My Documents\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - Default URLSearchHook is missing F2 - REG:system.ini: Shell= O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: ZToolbar - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\ztoolb011.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122865670796 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - http://www.kjdhendieldiouyu.com/sw/fvp.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F32FFF90-7457-438B-A105-BCB3E3B2ECBF}: NameServer = 192.168.1.1,10.0.0.138 O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\en4ml1h11.dll O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\o4840elqehqe0.dll O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\o4840elqehqe0.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll (file missing) O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWxpc2E\command.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing) Any help would be greatly appreciated!!
Hi alisag Browsela.dll isn't your problem Follow these instructions carefully: Uninstall via Add/remove programs (control panel): MySearchBar bps spyware & adware remover Fix with HjT (do a system scan only, checkamrk these and press fix checked): R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R3 - Default URLSearchHook is missing F2 - REG:system.ini: Shell= O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing) O3 - Toolbar: ZToolbar - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\ztoolb011.dll (file missing) O16 - DPF: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - http://www.kjdhendieldiouyu.com/sw/fvp.cabO20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\en4ml1h11.dll O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\o4840elqehqe0.dll O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\o4840elqehqe0.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll (file missing) O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing) Then start -> run -> services.msc -> ok Find ZESOFT, doubleclick it, click stop and select startuptype disabled Open HjT -> open misc tools -> delete nt service Type ZESOFT and press ok Delete if found: C:\WINDOWS\System32\ztoolb011.dll C:\Program Files\MyWay C:\WINDOWS\System32\vbsys2.dll C:\WINDOWS\zeta.exe Download win32delfkil -> http://users.telenet.be/marcvn/tools/win32delfkil.exe Save it on desktop and doubleclick it, it will then extract itself on win32delfkil-folder Close all windows and open win32delfkil-folder. Doubleclick fix.bat. If computer doesn't restart, restart it by yourself. Download Look2Me-Destroyer -> http://www.atribune.org/ccount/click.php?id=7 and save it on desktop IMPORTANT: Before continuing, you MUST do the following: * Print this or save as a textfile * Click start -> run -> services.msc -> ok * Check that this service is running or its startuptype is automatic Secondary logon * Disconnect from internet (unplug your network cable) * Close ALL antivirus programs (this is essential!) * Close all windows before continuing. * Double-click Look2Me-Destroyer.exe to run it. * Put a check next to Run this program as a task. * You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK * When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal. * Once it's done scanning, click the Remove L2M button. * You will receive a Done Scanning message, click OK. * When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK. * Your computer will then shutdown. * Turn your computer back on. * Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log. If you receive a message from your firewall about this program accessing the internet please allow it. If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory. http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX Post a fresh HjT-log and contents of c:\windelf.txt and C:\Look2Me-Destroyer.txt
Hi kemisti, Thanks for your reply. When I tried to remove MySearchBar I just got a blank window with the following name: res://C:\PROGRA~1\MyWay\myBar\1.bin\mybar.dll/101 I also couldn't find: O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing) O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\en4ml1h11.dll O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\o4840elqehqe0.dll O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\o4840elqehqe0.dll I followed the rest of your instructions and here are the logs you requested: Logfile of HijackThis v1.99.1 Scan saved at 4:01:58 PM, on 4/1/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\QWxpc2E\command.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Alisa\My Documents\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.philnews.com/ O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122865670796 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F32FFF90-7457-438B-A105-BCB3E3B2ECBF}: NameServer = 192.168.1.1,10.0.0.138 O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWxpc2E\command.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe ************************ * WIN32DELFKIL LOGFILE * ************************ by Marckie BEFORE RUNNING WIN32DELFKIL *************************** File(s) found in Windows directory ---------------------------------- adsldpbg.dll adsldpbl.dll File(s) found in system32 folder -------------------------------- browsela.dll SharedTaskScheduler key ----------------------- SteelWerX Registry Console Tool 1.0 Written by Bobbi Flekman © 2005 HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler {438755C2-A8BA-11D1-B96B-00A0C90312E1} REG_SZ Browseui preloader {8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Component Categories cache daemon {203B1C4D9-BC71-8916-38AD-9DEA5D213614} REG_SZ OLE Module {31EE3286-D785-4E3F-95FC-51D00FDABC01} REG_SZ Master Browseui Notify key ---------- subkey browsela is present! Look2Me-Destroyer V1.0.12 Scanning for infected files..... Scan started at 4/1/2006 3:57:08 PM Infected! C:\WINDOWS\system32\k008ladu1d08.dll Infected! C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1\A0000080.dll Infected! C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000143.dll Infected! C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000170.dll Infected! C:\WINDOWS\SYSTEM32\aza40a7qed.dll Infected! C:\WINDOWS\SYSTEM32\azaoleh31h4.dll Infected! C:\WINDOWS\SYSTEM32\azas03l7e.dll Infected! C:\WINDOWS\SYSTEM32\d4j00e1meh.dll Infected! C:\WINDOWS\SYSTEM32\dnjo0113e.dll Infected! C:\WINDOWS\SYSTEM32\emcimgn.dll Infected! C:\WINDOWS\SYSTEM32\en4ml1h11.dll Infected! C:\WINDOWS\SYSTEM32\en80l1lm1.dll Infected! C:\WINDOWS\SYSTEM32\en8sl1l71.dll Infected! C:\WINDOWS\SYSTEM32\fp8s03l7e.dll Infected! C:\WINDOWS\SYSTEM32\fpr0039me.dll Infected! C:\WINDOWS\SYSTEM32\gplsl3371.dll Infected! C:\WINDOWS\SYSTEM32\h4l20e3oeh.dll Infected! C:\WINDOWS\SYSTEM32\i4jqle151h.dll Infected! C:\WINDOWS\SYSTEM32\irlsl5371.dll Infected! C:\WINDOWS\SYSTEM32\j44oleh31h4.dll Infected! C:\WINDOWS\SYSTEM32\j6p0lg7m16.dll Infected! C:\WINDOWS\SYSTEM32\j8p00i7me8.dll Infected! C:\WINDOWS\SYSTEM32\jt6s07j7e.dll Infected! C:\WINDOWS\SYSTEM32\jtp8077ue.dll Infected! C:\WINDOWS\SYSTEM32\k008ladu1d08.dll Infected! C:\WINDOWS\SYSTEM32\k0pmla711d.dll Infected! C:\WINDOWS\SYSTEM32\k4pm0e71eh.dll Infected! C:\WINDOWS\SYSTEM32\kt20l7fm1.dll Infected! C:\WINDOWS\SYSTEM32\l02slaf71d2.dll Infected! C:\WINDOWS\SYSTEM32\l8p20i7oe8.dll Infected! C:\WINDOWS\SYSTEM32\Lokrn70n.dll Infected! C:\WINDOWS\SYSTEM32\lv8m09l1e.dll Infected! C:\WINDOWS\SYSTEM32\lvjs0917e.dll Infected! C:\WINDOWS\SYSTEM32\lvlu0939e.dll Infected! C:\WINDOWS\SYSTEM32\m282lclo1fqc.dll Infected! C:\WINDOWS\SYSTEM32\m6polg7316.dll Infected! C:\WINDOWS\SYSTEM32\mv44l9hq1.dll Infected! C:\WINDOWS\SYSTEM32\n0p40a7qed.dll Infected! C:\WINDOWS\SYSTEM32\n8n60i5se8.dll Infected! C:\WINDOWS\SYSTEM32\o0lula391d.dll Infected! C:\WINDOWS\SYSTEM32\o248lchu1f48.dll Infected! C:\WINDOWS\SYSTEM32\o2ns0c57ef.dll Infected! C:\WINDOWS\SYSTEM32\o448lehu1h48.dll Infected! C:\WINDOWS\SYSTEM32\o4840elqehqe0.dll Infected! C:\WINDOWS\SYSTEM32\oY48lchu1f48.dll Infected! C:\WINDOWS\SYSTEM32\p4p60e7seh.dll Infected! C:\WINDOWS\SYSTEM32\q4rqle951h.dll Infected! C:\WINDOWS\SYSTEM32\q886lils18q6.dll Infected! C:\WINDOWS\SYSTEM32\s4rs0e97eh.dll Infected! C:\WINDOWS\SYSTEM32\s6rslg9716.dll Infected! C:\WINDOWS\SYSTEM32\vqwwdm32.dll Infected! C:\WINDOWS\SYSTEM32\zjpfldr.dll Attempting to delete infected files... Attempting to delete: C:\WINDOWS\system32\k008ladu1d08.dll C:\WINDOWS\system32\k008ladu1d08.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1\A0000080.dll C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1\A0000080.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000143.dll C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000143.dll Deleted successfully! Attempting to delete: C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000170.dll C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000170.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\aza40a7qed.dll C:\WINDOWS\SYSTEM32\aza40a7qed.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\azaoleh31h4.dll C:\WINDOWS\SYSTEM32\azaoleh31h4.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\azas03l7e.dll C:\WINDOWS\SYSTEM32\azas03l7e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\d4j00e1meh.dll C:\WINDOWS\SYSTEM32\d4j00e1meh.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\dnjo0113e.dll C:\WINDOWS\SYSTEM32\dnjo0113e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\emcimgn.dll C:\WINDOWS\SYSTEM32\emcimgn.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\en4ml1h11.dll C:\WINDOWS\SYSTEM32\en4ml1h11.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\en80l1lm1.dll C:\WINDOWS\SYSTEM32\en80l1lm1.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\en8sl1l71.dll C:\WINDOWS\SYSTEM32\en8sl1l71.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\fp8s03l7e.dll C:\WINDOWS\SYSTEM32\fp8s03l7e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\fpr0039me.dll C:\WINDOWS\SYSTEM32\fpr0039me.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\gplsl3371.dll C:\WINDOWS\SYSTEM32\gplsl3371.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\h4l20e3oeh.dll C:\WINDOWS\SYSTEM32\h4l20e3oeh.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\i4jqle151h.dll C:\WINDOWS\SYSTEM32\i4jqle151h.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\irlsl5371.dll C:\WINDOWS\SYSTEM32\irlsl5371.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\j44oleh31h4.dll C:\WINDOWS\SYSTEM32\j44oleh31h4.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\j6p0lg7m16.dll C:\WINDOWS\SYSTEM32\j6p0lg7m16.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\j8p00i7me8.dll C:\WINDOWS\SYSTEM32\j8p00i7me8.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\jt6s07j7e.dll C:\WINDOWS\SYSTEM32\jt6s07j7e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\jtp8077ue.dll C:\WINDOWS\SYSTEM32\jtp8077ue.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\k008ladu1d08.dll C:\WINDOWS\SYSTEM32\k008ladu1d08.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\k0pmla711d.dll C:\WINDOWS\SYSTEM32\k0pmla711d.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\k4pm0e71eh.dll C:\WINDOWS\SYSTEM32\k4pm0e71eh.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\kt20l7fm1.dll C:\WINDOWS\SYSTEM32\kt20l7fm1.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\l02slaf71d2.dll C:\WINDOWS\SYSTEM32\l02slaf71d2.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\l8p20i7oe8.dll C:\WINDOWS\SYSTEM32\l8p20i7oe8.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\Lokrn70n.dll C:\WINDOWS\SYSTEM32\Lokrn70n.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\lv8m09l1e.dll C:\WINDOWS\SYSTEM32\lv8m09l1e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\lvjs0917e.dll C:\WINDOWS\SYSTEM32\lvjs0917e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\lvlu0939e.dll C:\WINDOWS\SYSTEM32\lvlu0939e.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\m282lclo1fqc.dll C:\WINDOWS\SYSTEM32\m282lclo1fqc.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\m6polg7316.dll C:\WINDOWS\SYSTEM32\m6polg7316.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\mv44l9hq1.dll C:\WINDOWS\SYSTEM32\mv44l9hq1.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\n0p40a7qed.dll C:\WINDOWS\SYSTEM32\n0p40a7qed.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\n8n60i5se8.dll C:\WINDOWS\SYSTEM32\n8n60i5se8.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\o0lula391d.dll C:\WINDOWS\SYSTEM32\o0lula391d.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\o248lchu1f48.dll C:\WINDOWS\SYSTEM32\o248lchu1f48.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\o2ns0c57ef.dll C:\WINDOWS\SYSTEM32\o2ns0c57ef.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\o448lehu1h48.dll C:\WINDOWS\SYSTEM32\o448lehu1h48.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\o4840elqehqe0.dll C:\WINDOWS\SYSTEM32\o4840elqehqe0.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\oY48lchu1f48.dll C:\WINDOWS\SYSTEM32\oY48lchu1f48.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\p4p60e7seh.dll C:\WINDOWS\SYSTEM32\p4p60e7seh.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\q4rqle951h.dll C:\WINDOWS\SYSTEM32\q4rqle951h.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\q886lils18q6.dll C:\WINDOWS\SYSTEM32\q886lils18q6.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\s4rs0e97eh.dll C:\WINDOWS\SYSTEM32\s4rs0e97eh.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\s6rslg9716.dll C:\WINDOWS\SYSTEM32\s6rslg9716.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\vqwwdm32.dll C:\WINDOWS\SYSTEM32\vqwwdm32.dll Deleted successfully! Attempting to delete: C:\WINDOWS\SYSTEM32\zjpfldr.dll C:\WINDOWS\SYSTEM32\zjpfldr.dll Deleted successfully! Making registry repairs. Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{39FD5AD6-41E3-4BE4-992B-928DEBECA4AD}" HKCR\Clsid\{39FD5AD6-41E3-4BE4-992B-928DEBECA4AD} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{77CD362D-A3A6-4CD3-813C-FB85FE7A5AEF}" HKCR\Clsid\{77CD362D-A3A6-4CD3-813C-FB85FE7A5AEF} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A57A2242-FE54-4E7B-83DD-EBFE7C6D54B3}" HKCR\Clsid\{A57A2242-FE54-4E7B-83DD-EBFE7C6D54B3} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{0470876F-77A4-4AD8-8B1D-C11A8D015BC8}" HKCR\Clsid\{0470876F-77A4-4AD8-8B1D-C11A8D015BC8} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{26F31406-AF2C-4380-8480-470EB6DE2AA1}" HKCR\Clsid\{26F31406-AF2C-4380-8480-470EB6DE2AA1} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{CDE835F3-7F11-4E8F-A544-9DF01F25CA61}" HKCR\Clsid\{CDE835F3-7F11-4E8F-A544-9DF01F25CA61} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F21772AD-E58A-4194-BF35-408E305C767F}" HKCR\Clsid\{F21772AD-E58A-4194-BF35-408E305C767F} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{4F6F5636-847C-4AD2-877E-D4241C12C21A}" HKCR\Clsid\{4F6F5636-847C-4AD2-877E-D4241C12C21A} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BE1EBECB-20C9-4D70-B293-06D1DDBBFEBE}" HKCR\Clsid\{BE1EBECB-20C9-4D70-B293-06D1DDBBFEBE} Restoring Windows certificates. Replaced hosts file with default windows hosts file Restoring SeDebugPrivilege for Administrators - Succeeded Thanks so much for your help so far. I look forward to your next reply.
Hi alisag Still something to do Download LSPFix http://cexx.org/LSPFix.exe Save it on desktop Open LSPFix Checkmark box "I know what I’m doing". Click apptoport.dll on left (there can be multiple instances, move them all) , move in to right side with >>-button , click "Remove", press Finish and close LSPFix. Fix with HjT(do a system scan only, checkmark these and press fix checked): O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWxpc2E\command.exe Then start -> run -> services.msc -> ok Find Command Service, doubleclick it, click stop and select startuptype disabled Open HjT -> open misc tools -> delete nt service Type cmdService and press ok Delete if still present: C:\WINDOWS\QWxpc2E Also, that win32delfkil log isn't complete. So could you please resend it and compelete this time? Reboot, post a fresh HjT-log and contents of c:\windelf.txt
Hi kemisti, I copied and pasted the entire windelf.txt file. Should I run the fix.bat file again? Here's the HjT log I just ran: Logfile of HijackThis v1.99.1 Scan saved at 7:21:13 PM, on 4/4/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Messenger\msmsgs.exe C:\Documents and Settings\Alisa\My Documents\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dellnet.msn.com/ O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: BitTorrent.lnk = C:\Program Files\BitTorrent\bittorrent.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122865670796 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F32FFF90-7457-438B-A105-BCB3E3B2ECBF}: NameServer = 192.168.1.1,10.0.0.138 O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe Thank you again!
