|
|
|
Browsela.dll problem
|
|
|
alisag
Newbie
|
24. March 2006 @ 21:25 |
Link to this message
|
Hi. I'm having a lot of trouble getting rid of browsela.dll. Norton hasn't helped at all. I've included my HijackThis log below:
Logfile of HijackThis v1.99.1
Scan saved at 6:16:44 PM, on 3/25/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\QWxpc2E\command.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\regedit.exe
C:\WINDOWS\System32\cmd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Alisa\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: ZToolbar - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\ztoolb011.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - http://www.kjdhendieldiouyu.com/sw/fvp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F32FFF90-7457-438B-A105-BCB3E3B2ECBF}: NameServer = 192.168.1.1,10.0.0.138
O20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\en4ml1h11.dll
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\o4840elqehqe0.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\o4840elqehqe0.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWxpc2E\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)
Any help would be greatly appreciated!!
|
|
Advertisement
|
|
|
|
|
-kemisti-
AfterDawn Addict
|
25. March 2006 @ 00:00 |
Link to this message
|
Hi alisag
Browsela.dll isn't your problem
Follow these instructions carefully:
Uninstall via Add/remove programs (control panel):
MySearchBar
bps spyware & adware remover
Fix with HjT (do a system scan only, checkamrk these and press fix checked):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O3 - Toolbar: ZToolbar - {A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} - C:\WINDOWS\System32\ztoolb011.dll (file missing)
O16 - DPF: {B5DD9A64-5C4B-4A48-BE56-97C1A8F85708} - http://www.kjdhendieldiouyu.com/sw/fvp.cabO20 - Winlogon Notify: browsela - C:\WINDOWS\system32\browsela.dll
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\en4ml1h11.dll
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\o4840elqehqe0.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\o4840elqehqe0.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll (file missing)
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)
Then start -> run -> services.msc -> ok
Find ZESOFT, doubleclick it, click stop and select startuptype disabled
Open HjT -> open misc tools -> delete nt service
Type ZESOFT and press ok
Delete if found:
C:\WINDOWS\System32\ztoolb011.dll
C:\Program Files\MyWay
C:\WINDOWS\System32\vbsys2.dll
C:\WINDOWS\zeta.exe
Download win32delfkil -> http://users.telenet.be/marcvn/tools/win32delfkil.exe
Save it on desktop and doubleclick it, it will then extract itself on win32delfkil-folder
Close all windows and open win32delfkil-folder. Doubleclick fix.bat. If computer doesn't restart, restart it by yourself.
Download Look2Me-Destroyer -> http://www.atribune.org/ccount/click.php?id=7 and save it on desktop
IMPORTANT: Before continuing, you MUST do the following:
* Print this or save as a textfile
* Click start -> run -> services.msc -> ok
* Check that this service is running or its startuptype is automatic
Secondary logon
* Disconnect from internet (unplug your network cable)
* Close ALL antivirus programs (this is essential!)
* Close all windows before continuing.
* Double-click Look2Me-Destroyer.exe to run it.
* Put a check next to Run this program as a task.
* You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
* When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
* Once it's done scanning, click the Remove L2M button.
* You will receive a Done Scanning message, click OK.
* When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
* Your computer will then shutdown.
* Turn your computer back on.
* Please post the contents of C:\Look2Me-Destroyer.txt and a new HiJackThis log.
If you receive a message from your firewall about this program accessing the internet please allow it.
If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
Post a fresh HjT-log and contents of c:\windelf.txt and C:\Look2Me-Destroyer.txt
This message has been edited since posting. Last time this message was edited on 25. March 2006 @ 00:12
|
|
alisag
Newbie
|
31. March 2006 @ 20:20 |
Link to this message
|
Hi kemisti,
Thanks for your reply.
When I tried to remove MySearchBar I just got a blank window with the following name:
res://C:\PROGRA~1\MyWay\myBar\1.bin\mybar.dll/101
I also couldn't find:
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\system32\en4ml1h11.dll
O20 - Winlogon Notify: Installer - C:\WINDOWS\system32\o4840elqehqe0.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\o4840elqehqe0.dll
I followed the rest of your instructions and here are the logs you requested:
Logfile of HijackThis v1.99.1
Scan saved at 4:01:58 PM, on 4/1/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\QWxpc2E\command.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Alisa\My Documents\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.philnews.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
O4 - Global Startup: WinZIP Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O10 - Unknown file in Winsock LSP: c:\program files\bulletproofsoft.com\bps spyware & adware remover\apptoport.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F32FFF90-7457-438B-A105-BCB3E3B2ECBF}: NameServer = 192.168.1.1,10.0.0.138
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWxpc2E\command.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
************************
* WIN32DELFKIL LOGFILE *
************************
by Marckie
BEFORE RUNNING WIN32DELFKIL
***************************
File(s) found in Windows directory
----------------------------------
adsldpbg.dll
adsldpbl.dll
File(s) found in system32 folder
--------------------------------
browsela.dll
SharedTaskScheduler key
-----------------------
SteelWerX Registry Console Tool 1.0
Written by Bobbi Flekman © 2005
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler
{438755C2-A8BA-11D1-B96B-00A0C90312E1} REG_SZ Browseui preloader
{8C7461EF-2B13-11d2-BE35-3078302C2030} REG_SZ Component Categories cache daemon
{203B1C4D9-BC71-8916-38AD-9DEA5D213614} REG_SZ OLE Module
{31EE3286-D785-4E3F-95FC-51D00FDABC01} REG_SZ Master Browseui
Notify key
----------
subkey browsela is present!
Look2Me-Destroyer V1.0.12
Scanning for infected files.....
Scan started at 4/1/2006 3:57:08 PM
Infected! C:\WINDOWS\system32\k008ladu1d08.dll
Infected! C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1\A0000080.dll
Infected! C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000143.dll
Infected! C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000170.dll
Infected! C:\WINDOWS\SYSTEM32\aza40a7qed.dll
Infected! C:\WINDOWS\SYSTEM32\azaoleh31h4.dll
Infected! C:\WINDOWS\SYSTEM32\azas03l7e.dll
Infected! C:\WINDOWS\SYSTEM32\d4j00e1meh.dll
Infected! C:\WINDOWS\SYSTEM32\dnjo0113e.dll
Infected! C:\WINDOWS\SYSTEM32\emcimgn.dll
Infected! C:\WINDOWS\SYSTEM32\en4ml1h11.dll
Infected! C:\WINDOWS\SYSTEM32\en80l1lm1.dll
Infected! C:\WINDOWS\SYSTEM32\en8sl1l71.dll
Infected! C:\WINDOWS\SYSTEM32\fp8s03l7e.dll
Infected! C:\WINDOWS\SYSTEM32\fpr0039me.dll
Infected! C:\WINDOWS\SYSTEM32\gplsl3371.dll
Infected! C:\WINDOWS\SYSTEM32\h4l20e3oeh.dll
Infected! C:\WINDOWS\SYSTEM32\i4jqle151h.dll
Infected! C:\WINDOWS\SYSTEM32\irlsl5371.dll
Infected! C:\WINDOWS\SYSTEM32\j44oleh31h4.dll
Infected! C:\WINDOWS\SYSTEM32\j6p0lg7m16.dll
Infected! C:\WINDOWS\SYSTEM32\j8p00i7me8.dll
Infected! C:\WINDOWS\SYSTEM32\jt6s07j7e.dll
Infected! C:\WINDOWS\SYSTEM32\jtp8077ue.dll
Infected! C:\WINDOWS\SYSTEM32\k008ladu1d08.dll
Infected! C:\WINDOWS\SYSTEM32\k0pmla711d.dll
Infected! C:\WINDOWS\SYSTEM32\k4pm0e71eh.dll
Infected! C:\WINDOWS\SYSTEM32\kt20l7fm1.dll
Infected! C:\WINDOWS\SYSTEM32\l02slaf71d2.dll
Infected! C:\WINDOWS\SYSTEM32\l8p20i7oe8.dll
Infected! C:\WINDOWS\SYSTEM32\Lokrn70n.dll
Infected! C:\WINDOWS\SYSTEM32\lv8m09l1e.dll
Infected! C:\WINDOWS\SYSTEM32\lvjs0917e.dll
Infected! C:\WINDOWS\SYSTEM32\lvlu0939e.dll
Infected! C:\WINDOWS\SYSTEM32\m282lclo1fqc.dll
Infected! C:\WINDOWS\SYSTEM32\m6polg7316.dll
Infected! C:\WINDOWS\SYSTEM32\mv44l9hq1.dll
Infected! C:\WINDOWS\SYSTEM32\n0p40a7qed.dll
Infected! C:\WINDOWS\SYSTEM32\n8n60i5se8.dll
Infected! C:\WINDOWS\SYSTEM32\o0lula391d.dll
Infected! C:\WINDOWS\SYSTEM32\o248lchu1f48.dll
Infected! C:\WINDOWS\SYSTEM32\o2ns0c57ef.dll
Infected! C:\WINDOWS\SYSTEM32\o448lehu1h48.dll
Infected! C:\WINDOWS\SYSTEM32\o4840elqehqe0.dll
Infected! C:\WINDOWS\SYSTEM32\oY48lchu1f48.dll
Infected! C:\WINDOWS\SYSTEM32\p4p60e7seh.dll
Infected! C:\WINDOWS\SYSTEM32\q4rqle951h.dll
Infected! C:\WINDOWS\SYSTEM32\q886lils18q6.dll
Infected! C:\WINDOWS\SYSTEM32\s4rs0e97eh.dll
Infected! C:\WINDOWS\SYSTEM32\s6rslg9716.dll
Infected! C:\WINDOWS\SYSTEM32\vqwwdm32.dll
Infected! C:\WINDOWS\SYSTEM32\zjpfldr.dll
Attempting to delete infected files...
Attempting to delete: C:\WINDOWS\system32\k008ladu1d08.dll
C:\WINDOWS\system32\k008ladu1d08.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1\A0000080.dll
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1\A0000080.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000143.dll
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000143.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000170.dll
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0000170.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\aza40a7qed.dll
C:\WINDOWS\SYSTEM32\aza40a7qed.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\azaoleh31h4.dll
C:\WINDOWS\SYSTEM32\azaoleh31h4.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\azas03l7e.dll
C:\WINDOWS\SYSTEM32\azas03l7e.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\d4j00e1meh.dll
C:\WINDOWS\SYSTEM32\d4j00e1meh.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\dnjo0113e.dll
C:\WINDOWS\SYSTEM32\dnjo0113e.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\emcimgn.dll
C:\WINDOWS\SYSTEM32\emcimgn.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\en4ml1h11.dll
C:\WINDOWS\SYSTEM32\en4ml1h11.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\en80l1lm1.dll
C:\WINDOWS\SYSTEM32\en80l1lm1.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\en8sl1l71.dll
C:\WINDOWS\SYSTEM32\en8sl1l71.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\fp8s03l7e.dll
C:\WINDOWS\SYSTEM32\fp8s03l7e.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\fpr0039me.dll
C:\WINDOWS\SYSTEM32\fpr0039me.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\gplsl3371.dll
C:\WINDOWS\SYSTEM32\gplsl3371.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\h4l20e3oeh.dll
C:\WINDOWS\SYSTEM32\h4l20e3oeh.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\i4jqle151h.dll
C:\WINDOWS\SYSTEM32\i4jqle151h.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\irlsl5371.dll
C:\WINDOWS\SYSTEM32\irlsl5371.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\j44oleh31h4.dll
C:\WINDOWS\SYSTEM32\j44oleh31h4.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\j6p0lg7m16.dll
C:\WINDOWS\SYSTEM32\j6p0lg7m16.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\j8p00i7me8.dll
C:\WINDOWS\SYSTEM32\j8p00i7me8.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\jt6s07j7e.dll
C:\WINDOWS\SYSTEM32\jt6s07j7e.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\jtp8077ue.dll
C:\WINDOWS\SYSTEM32\jtp8077ue.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\k008ladu1d08.dll
C:\WINDOWS\SYSTEM32\k008ladu1d08.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\k0pmla711d.dll
C:\WINDOWS\SYSTEM32\k0pmla711d.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\k4pm0e71eh.dll
C:\WINDOWS\SYSTEM32\k4pm0e71eh.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\kt20l7fm1.dll
C:\WINDOWS\SYSTEM32\kt20l7fm1.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\l02slaf71d2.dll
C:\WINDOWS\SYSTEM32\l02slaf71d2.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\l8p20i7oe8.dll
C:\WINDOWS\SYSTEM32\l8p20i7oe8.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\Lokrn70n.dll
C:\WINDOWS\SYSTEM32\Lokrn70n.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\lv8m09l1e.dll
C:\WINDOWS\SYSTEM32\lv8m09l1e.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\lvjs0917e.dll
C:\WINDOWS\SYSTEM32\lvjs0917e.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\lvlu0939e.dll
C:\WINDOWS\SYSTEM32\lvlu0939e.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\m282lclo1fqc.dll
C:\WINDOWS\SYSTEM32\m282lclo1fqc.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\m6polg7316.dll
C:\WINDOWS\SYSTEM32\m6polg7316.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\mv44l9hq1.dll
C:\WINDOWS\SYSTEM32\mv44l9hq1.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\n0p40a7qed.dll
C:\WINDOWS\SYSTEM32\n0p40a7qed.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\n8n60i5se8.dll
C:\WINDOWS\SYSTEM32\n8n60i5se8.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\o0lula391d.dll
C:\WINDOWS\SYSTEM32\o0lula391d.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\o248lchu1f48.dll
C:\WINDOWS\SYSTEM32\o248lchu1f48.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\o2ns0c57ef.dll
C:\WINDOWS\SYSTEM32\o2ns0c57ef.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\o448lehu1h48.dll
C:\WINDOWS\SYSTEM32\o448lehu1h48.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\o4840elqehqe0.dll
C:\WINDOWS\SYSTEM32\o4840elqehqe0.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\oY48lchu1f48.dll
C:\WINDOWS\SYSTEM32\oY48lchu1f48.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\p4p60e7seh.dll
C:\WINDOWS\SYSTEM32\p4p60e7seh.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\q4rqle951h.dll
C:\WINDOWS\SYSTEM32\q4rqle951h.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\q886lils18q6.dll
C:\WINDOWS\SYSTEM32\q886lils18q6.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\s4rs0e97eh.dll
C:\WINDOWS\SYSTEM32\s4rs0e97eh.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\s6rslg9716.dll
C:\WINDOWS\SYSTEM32\s6rslg9716.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\vqwwdm32.dll
C:\WINDOWS\SYSTEM32\vqwwdm32.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\SYSTEM32\zjpfldr.dll
C:\WINDOWS\SYSTEM32\zjpfldr.dll Deleted successfully!
Making registry repairs.
Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{39FD5AD6-41E3-4BE4-992B-928DEBECA4AD}"
HKCR\Clsid\{39FD5AD6-41E3-4BE4-992B-928DEBECA4AD}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{77CD362D-A3A6-4CD3-813C-FB85FE7A5AEF}"
HKCR\Clsid\{77CD362D-A3A6-4CD3-813C-FB85FE7A5AEF}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A57A2242-FE54-4E7B-83DD-EBFE7C6D54B3}"
HKCR\Clsid\{A57A2242-FE54-4E7B-83DD-EBFE7C6D54B3}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{0470876F-77A4-4AD8-8B1D-C11A8D015BC8}"
HKCR\Clsid\{0470876F-77A4-4AD8-8B1D-C11A8D015BC8}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{26F31406-AF2C-4380-8480-470EB6DE2AA1}"
HKCR\Clsid\{26F31406-AF2C-4380-8480-470EB6DE2AA1}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{CDE835F3-7F11-4E8F-A544-9DF01F25CA61}"
HKCR\Clsid\{CDE835F3-7F11-4E8F-A544-9DF01F25CA61}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F21772AD-E58A-4194-BF35-408E305C767F}"
HKCR\Clsid\{F21772AD-E58A-4194-BF35-408E305C767F}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{4F6F5636-847C-4AD2-877E-D4241C12C21A}"
HKCR\Clsid\{4F6F5636-847C-4AD2-877E-D4241C12C21A}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BE1EBECB-20C9-4D70-B293-06D1DDBBFEBE}"
HKCR\Clsid\{BE1EBECB-20C9-4D70-B293-06D1DDBBFEBE}
Restoring Windows certificates.
Replaced hosts file with default windows hosts file
Restoring SeDebugPrivilege for Administrators - Succeeded
Thanks so much for your help so far. I look forward to your next reply.
|
|
-kemisti-
AfterDawn Addict
|
31. March 2006 @ 22:55 |
Link to this message
|
Hi alisag
Still something to do
Download LSPFix http://cexx.org/LSPFix.exe
Save it on desktop
Open LSPFix
Checkmark box "I know what I?m doing".
Click apptoport.dll on left (there can be multiple instances, move them all) , move in to right side with >>-button , click "Remove", press Finish and close LSPFix.
Fix with HjT(do a system scan only, checkmark these and press fix checked):
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\QWxpc2E\command.exe
Then start -> run -> services.msc -> ok
Find Command Service, doubleclick it, click stop and select startuptype disabled
Open HjT -> open misc tools -> delete nt service
Type cmdService and press ok
Delete if still present:
C:\WINDOWS\QWxpc2E
Also, that win32delfkil log isn't complete. So could you please resend it and compelete this time?
Reboot, post a fresh HjT-log and contents of c:\windelf.txt
This message has been edited since posting. Last time this message was edited on 31. March 2006 @ 22:56
|
|
alisag
Newbie
|
4. April 2006 @ 01:22 |
Link to this message
|
Hi kemisti,
I copied and pasted the entire windelf.txt file. Should I run the fix.bat file again?
Here's the HjT log I just ran:
Logfile of HijackThis v1.99.1
Scan saved at 7:21:13 PM, on 4/4/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Alisa\My Documents\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dellnet.msn.com/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: BitTorrent.lnk = C:\Program Files\BitTorrent\bittorrent.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111v2 USB Adapter\MA111v2.exe
O4 - Global Startup: WinZIP Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F32FFF90-7457-438B-A105-BCB3E3B2ECBF}: NameServer = 192.168.1.1,10.0.0.138
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Thank you again!
|
|
Advertisement
|
|
|
|
-kemisti-
AfterDawn Addict
|
4. April 2006 @ 02:42 |
Link to this message
|
|
Hi alisag
Yes, please re-run fix.bat and send contents of c:\windelf.txt
Your HjT-log looks good :)
This message has been edited since posting. Last time this message was edited on 4. April 2006 @ 02:42
|
|
