Plz help, i have another trojan...

[InFamousKon]

You didnt give up on me, did ya man?

[Gecko]

Now that you got your anti virus fixed lets try the l2mfix again.

Download L2mfix from one of these two locations:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
Save the file to your desktop and double click l2mfix.exe.
Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.
Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter.
This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log.
Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

[InFamousKon]

Here it is:

L2MFIX find log 032106
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
"Impersonate"=dword:00000000
"Logoff"="LogOut"
"DllName"="C:\\PROGRA~1\\Stardock\\OBJECT~1\\WINDOW~1\\wbsrv.dll"
"LogOn"="StartSys"
"Unlock"="Sys"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winm32]
"DllName"=hex(2):77,00,69,00,6e,00,6d,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,\
00,00
"Startup"="MemMMView7"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"MaxWait"=dword:00000001
"secureUID"="[38552162023841402226]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Multimedia File Property Sheet"
"{176d6597-26d3-11d1-b350-080036a75b03}"="ICM Scanner Management"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="NTFS Security Page"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="OLE Docfile Property Page"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Shell extensions for sharing"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Display Adapter CPL Extension"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Display Monitor CPL Extension"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Display Panning CPL Extension"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="DS Security Page"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Compatibility Page"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Shell Scrap DataHandler"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Disk Copy Extension"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Shell extensions for Microsoft Windows Network objects"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="ICM Monitor Management"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="ICM Printer Management"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Shell extensions for file compression"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Web Printer Shell Extension"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Encryption Context Menu"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Briefcase"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="HyperTerminal Icon Ext"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="ICC Profile"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Printers Security Page"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Shell extensions for sharing"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Crypto PKO Extension"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Crypto Sign Extension"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Network Connections"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Network Connections"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="Scanners & Cameras"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="Scanners & Cameras"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="Scanners & Cameras"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="Scanners & Cameras"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="Scanners & Cameras"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Shell extensions for Windows Script Host"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Microsoft Data Link"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Scheduled Tasks"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Taskbar and Start Menu"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Search"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Help and Support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Run..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="E-mail"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Fonts"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Administrative Tools"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Microsoft Internet Toolbar"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="Download Status"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Augmented Shell Folder"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Augmented Shell Folder 2"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Microsoft BrowserBand"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Search Band"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="In-pane search"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Web Search"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Registry Tree Options Utility"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Address"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="Address EditBox"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Microsoft AutoComplete"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="MRU AutoComplete List"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Custom MRU AutoCompleted List"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Track Popup Bar"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Address Bar Parser"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Microsoft History AutoComplete List"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Microsoft Shell Folder AutoComplete List"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Microsoft Multiple AutoComplete List Container"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Shell Band Site Menu"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Shell DeskBar"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="User Assist"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="Global Folder Settings"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="History"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="IE4 Suite Splash Screen"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="The Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="ActiveX Cache Folder"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Subscription Folder"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Shell Application Manager"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="Installed Apps Enumerator"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Darwin App Publisher"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="GDI+ file thumbnail extractor"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Summary Info Thumbnail handler (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="HTML Thumbnail Extractor"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Web Publishing Wizard"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Print Ordering via the Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Shell Publishing Wizard Object"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Get a Passport Wizard"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="User Accounts"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Offline Files Folder"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="For &People..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{2F5AC606-70CF-461C-BFE1-734234536262}"="WindowBlinds CPL Extension"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Channel File"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Channel Shortcut"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
"{0E6C58A9-F592-4862-B35F-CA45E24003B3}"="CloneCD"
"{32020A01-506E-484D-A2A8-BE3CF17601C3}"="AlcoholShellEx"
"{5464D816-CF16-4784-B9F3-75C0DB52B499}"="Yahoo! Mail"
"{88CBF1CB-6F55-11D8-ABF8-C5E6374AC960}"="Cheetah Burner Context Menu"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
3ivx.dll Wed Apr 16 2003 5:39:10p A.... 835,584 816.00 K
3ivxvf~1.dll Wed Apr 16 2003 5:39:36p A.... 339,968 332.00 K
a1.dll Wed Jul 13 2005 3:13:00p A.... 65,536 64.00 K
ammpp.dll Fri Oct 21 2005 8:20:26p A.... 278,528 272.00 K
amstream.dll Thu Dec 12 2002 12:14:32a A.... 64,512 63.00 K
asferror.dll Fri Jan 28 2005 1:44:28p A.... 8,192 8.00 K
atl71.dll Tue Mar 18 2003 9:05:50p A...R 89,088 87.00 K
audiodev.dll Fri Jan 28 2005 1:44:28p ..... 484,352 473.00 K
bitsprx2.dll Thu Jul 1 2004 5:08:18p A.... 7,680 7.50 K
bitsprx3.dll Thu Jul 1 2004 5:08:18p A.... 7,168 7.00 K
blackbox.dll Fri Jan 28 2005 1:44:28p A.... 294,912 288.00 K
catsrv.dll Fri Mar 5 2004 9:04:56p A.... 225,280 220.00 K
catsrvut.dll Fri Mar 5 2004 9:04:58p A.... 596,480 582.50 K
cdm.dll Tue Aug 3 2004 2:00:12p A.... 71,448 69.77 K
cewmdm.dll Fri Jan 28 2005 1:44:28p A.... 164,864 161.00 K
clbcatex.dll Fri Mar 5 2004 9:04:58p A.... 110,080 107.50 K
clbcatq.dll Fri Mar 5 2004 6:05:00p A.... 499,712 488.00 K
cmdlin~1.dll Mon Feb 13 2006 9:33:16p A.... 98,304 96.00 K
colbact.dll Fri Mar 5 2004 9:05:00p A.... 64,512 63.00 K
comsvcs.dll Fri Mar 5 2004 9:05:02p A.... 1,177,088 1.12 M
comuid.dll Fri Mar 5 2004 9:05:04p A.... 499,200 487.50 K
d3d8.dll Fri Jul 9 2004 4:27:28a A.... 1,201,152 1.14 M
d3d8thk.dll Thu Dec 12 2002 12:14:32a A.... 8,192 8.00 K
d3d9.dll Fri Jul 9 2004 4:27:28a A.... 1,703,936 1.63 M
d3dim700.dll Fri May 30 2003 9:00:02a A.... 797,184 778.50 K
d3dx9_24.dll Sat Feb 5 2005 7:45:26p A.... 2,222,800 2.12 M
d3dx9_25.dll Fri Mar 18 2005 5:19:58p A.... 2,337,488 2.23 M
d3dx9_26.dll Thu May 26 2005 3:34:52p A.... 2,297,552 2.19 M
d3dx9_27.dll Fri Jul 22 2005 7:59:04p A.... 2,319,568 2.21 M
d3dx9_28.dll Mon Dec 5 2005 6:09:18p A.... 2,323,664 2.21 M
ddraw.dll Fri Jul 9 2004 4:27:28a A.... 292,864 286.00 K
ddrawex.dll Thu Dec 12 2002 12:14:32a A.... 24,064 23.50 K
devenum.dll Fri May 30 2003 9:00:02a A.... 132,608 129.50 K
dinput.dll Thu Aug 29 2002 3:40:00a A.... 648,704 633.50 K
dinput8.dll Thu Aug 29 2002 3:40:00a A.... 667,648 652.00 K
divx.dll Wed Apr 30 2003 4:34:46p A.... 1,541,120 1.47 M
divxc32f.dll Thu Aug 22 2002 6:00:00a A.... 413,760 404.06 K
dmband.dll Thu Dec 12 2002 12:14:32a A.... 27,136 26.50 K
dmcompos.dll Thu Dec 12 2002 12:14:32a A.... 58,368 57.00 K
dmime.dll Fri Jul 9 2004 4:27:28a A.... 181,248 177.00 K
dmloader.dll Thu Dec 12 2002 12:14:32a A.... 33,280 32.50 K
dmscript.dll Thu Dec 12 2002 12:14:32a A.... 76,800 75.00 K
dmstyle.dll Thu Dec 12 2002 12:14:32a A.... 98,816 96.50 K
dmsynth.dll Thu Dec 12 2002 12:14:32a A.... 100,864 98.50 K
dmusic.dll Fri Jul 9 2004 4:27:28a A.... 122,880 120.00 K
dplayx.dll Fri Jul 9 2004 4:27:28a A.... 230,400 225.00 K
dpmodemx.dll Thu Dec 12 2002 12:14:32a A.... 77,824 76.00 K
dpnaddr.dll Thu Dec 12 2002 12:14:32a A.... 3,072 3.00 K
dpnet.dll Thu Dec 12 2002 12:14:32a A.... 723,968 707.00 K
dpnhpast.dll Mon Mar 24 2003 9:00:02a A.... 32,768 32.00 K
dpnhupnp.dll Mon Mar 24 2003 9:00:02a A.... 68,096 66.50 K
dpnlobby.dll Thu Dec 12 2002 12:14:32a A.... 3,072 3.00 K
dpvacm.dll Thu Dec 12 2002 12:14:32a A.... 19,968 19.50 K
dpvoice.dll Thu Dec 12 2002 12:14:32a A.... 381,952 373.00 K
dpvvox.dll Thu Dec 12 2002 12:14:32a A.... 112,128 109.50 K
dpwsockx.dll Fri Jul 9 2004 4:27:28a A.... 79,360 77.50 K
drmclien.dll Fri Jan 28 2005 1:44:28p A.... 258,296 252.24 K
drmstor.dll Fri Jan 28 2005 1:44:28p A.... 96,768 94.50 K
drmv2clt.dll Fri Jan 28 2005 1:44:28p A.... 502,272 490.50 K
dsdmo.dll Thu Dec 12 2002 12:14:32a A.... 186,880 182.50 K
dsdmoprp.dll Thu Dec 12 2002 12:14:32a A.... 491,520 480.00 K
dsound.dll Fri Jul 9 2004 4:27:28a A.... 381,952 373.00 K
dsound3d.dll Thu Dec 12 2002 12:14:32a A.... 1,294,336 1.23 M
dswave.dll Thu Dec 12 2002 12:14:32a A.... 18,432 18.00 K
dvdprox2.dll Wed Jun 2 2004 1:24:40a A.... 622,592 608.00 K
dx7vb.dll Thu Dec 12 2002 12:14:32a A.... 602,624 588.50 K
dx8vb.dll Fri May 30 2003 9:00:02a A.... 1,189,888 1.13 M
dxdiagn.dll Fri Jul 9 2004 4:27:28a A.... 1,769,472 1.69 M
ebpmon24.dll Thu May 22 2003 6:06:00p A.... 73,869 72.14 K
ecbteg.dll Tue May 20 2003 7:27:00p A.... 64,000 62.50 K
elbycdio.dll Sat Sep 20 2003 2:23:06p A.... 65,536 64.00 K
elbyvcd.dll Mon Nov 4 2002 6:46:34p A.... 65,536 64.00 K
encapi.dll Thu Dec 12 2002 12:14:32a A.... 18,944 18.50 K
e_sagset.dll Wed May 28 2003 6:01:00p A.... 91,648 89.50 K
idepro~1.dll Tue Aug 20 2002 1:58:32a A...R 139,264 136.00 K
iehelp~2.dll Thu Mar 30 2006 2:09:12p A.... 100,050 97.70 K
imagx7.dll Mon Jul 26 2004 4:16:10p ..... 1,568,768 1.50 M
imagxpr7.dll Mon Jul 26 2004 4:16:10p ..... 476,320 465.16 K
imagxr7.dll Mon Jul 26 2004 4:16:10p ..... 262,144 256.00 K
imagxra7.dll Mon Jul 26 2004 4:16:10p ..... 471,040 460.00 K
incine~1.dll Mon Jun 14 2004 8:25:00a A.... 472,576 461.50 K
iuengine.dll Tue Aug 3 2004 2:04:40p A.... 185,624 181.27 K
ksuser.dll Thu Dec 12 2002 12:14:32a A.... 4,096 4.00 K
laprxy.dll Fri Jan 28 2005 1:44:28p A.... 6,656 6.50 K
libfaad.dll Wed Apr 16 2003 5:39:44p A.... 81,920 80.00 K
mcgdmgr.dll Tue May 24 2005 7:23:32p A.... 288,320 281.56 K
mcinsctl.dll Tue Oct 18 2005 11:08:04a A.... 349,760 341.56 K
mciqtz32.dll Thu Dec 12 2002 12:14:32a A.... 34,304 33.50 K
mclsp.dll Fri Oct 28 2005 10:30:36a A.... 131,072 128.00 K
mcrtl32.dll Fri Oct 28 2005 10:30:36a A.... 90,112 88.00 K
mfc71.dll Tue Mar 18 2003 9:20:00p A.... 1,060,864 1.01 M
mfc71chs.dll Tue Mar 18 2003 8:44:36p A.... 40,960 40.00 K
mfc71cht.dll Tue Mar 18 2003 8:44:36p A.... 45,056 44.00 K
mfc71deu.dll Tue Mar 18 2003 8:44:34p A.... 65,536 64.00 K
mfc71enu.dll Tue Mar 18 2003 8:44:38p A.... 57,344 56.00 K
mfc71esp.dll Tue Mar 18 2003 8:44:36p A.... 61,440 60.00 K
mfc71fra.dll Tue Mar 18 2003 8:44:34p A.... 61,440 60.00 K
mfc71ita.dll Tue Mar 18 2003 8:44:36p A.... 61,440 60.00 K
mfc71jpn.dll Tue Mar 18 2003 8:44:34p A.... 49,152 48.00 K
mfc71kor.dll Tue Mar 18 2003 8:44:38p A.... 49,152 48.00 K
mfc71u.dll Tue Mar 18 2003 9:12:12p A.... 1,047,552 1023.00 K
mpfapi.dll Fri Nov 11 2005 4:38:50p A.... 9,216 9.00 K
msdmo.dll Thu Dec 12 2002 12:14:32a A.... 13,312 13.00 K
msdtcprx.dll Fri Mar 5 2004 9:05:06p A.... 365,568 357.00 K
msdtctm.dll Fri Mar 5 2004 9:05:08p A.... 977,920 955.00 K
msdtcuiu.dll Fri Mar 5 2004 9:05:08p A.... 150,528 147.00 K
msi.dll Mon Mar 21 2005 3:00:20p A.... 2,890,240 2.75 M
msihnd.dll Mon Mar 21 2005 3:00:22p A.... 271,360 265.00 K
msimsg.dll Mon Mar 21 2005 3:00:22p A.... 884,736 864.00 K
msisip.dll Mon Mar 21 2005 3:00:22p A.... 15,360 15.00 K
msnetobj.dll Fri Jan 28 2005 1:44:28p A.... 142,336 139.00 K
mspmsnsv.dll Fri Jan 28 2005 1:44:28p A.... 25,088 24.50 K
mspmsp.dll Fri Jan 28 2005 1:44:28p A.... 173,568 169.50 K
msscp.dll Fri Jan 28 2005 1:44:28p A.... 364,784 356.23 K
msssc.dll Tue Feb 14 2006 11:48:56p A.... 44 0.04 K
msvbvm60.dll Fri Feb 28 2003 10:09:46p A.... 1,388,544 1.32 M
msvcp71.dll Wed Mar 19 2003 8:14:52p A.... 499,712 488.00 K
msvcr71.dll Sat Feb 22 2003 4:42:22a A.... 348,160 340.00 K
msvidctl.dll Fri Jul 9 2004 4:26:38a A.... 1,230,336 1.17 M
mswebdvd.dll Thu Dec 12 2002 12:14:32a A.... 324,096 316.50 K
mswmdm.dll Fri Jan 28 2005 1:44:28p A.... 315,904 308.50 K
msxml3a.dll Fri Feb 28 2003 10:09:46p A.... 24,576 24.00 K
msyuv.dll Fri Jul 9 2004 4:26:38a A.... 16,896 16.50 K
mtxoci.dll Fri Mar 5 2004 9:05:10p A.... 82,432 80.50 K
nv4_disp.dll Sat Dec 10 2005 6:06:00a A.... 3,955,456 3.77 M
nvapi.dll Sat Dec 10 2005 6:06:00a A.... 110,592 108.00 K
nvcod.dll Sat Dec 10 2005 6:06:00a A.... 35,840 35.00 K
nvcodins.dll Sat Dec 10 2005 6:06:00a A.... 35,840 35.00 K
nvcpl.dll Sat Dec 10 2005 6:06:00a A.... 7,311,360 6.97 M
nvhwvid.dll Sat Dec 10 2005 6:06:00a A.... 573,440 560.00 K
nview.dll Sat Dec 10 2005 6:06:00a A.... 1,466,368 1.40 M
nvmccs.dll Sat Dec 10 2005 6:06:00a A.... 229,376 224.00 K
nvmccsrs.dll Sat Dec 10 2005 6:06:00a A.... 45,056 44.00 K
nvmctray.dll Sat Dec 10 2005 6:06:00a A.... 86,016 84.00 K
nvnt4cpl.dll Sat Dec 10 2005 6:06:00a A.... 286,720 280.00 K
nvoglnt.dll Sat Dec 10 2005 6:06:00a A.... 5,402,624 5.15 M
nvshell.dll Sat Dec 10 2005 6:06:00a A.... 466,944 456.00 K
nvwddi.dll Sat Dec 10 2005 6:06:00a A.... 81,920 80.00 K
nvwdmcpl.dll Sat Dec 10 2005 6:06:00a A.... 1,662,976 1.59 M
nvwimg.dll Sat Dec 10 2005 6:06:00a A.... 1,019,904 996.00 K
ogg.dll Sat Oct 5 2002 12:04:18a A.... 45,056 44.00 K
oggds.dll Sun Oct 6 2002 7:42:58p A.... 237,568 232.00 K
openqu~1.dll Wed Apr 16 2003 5:40:12p A.... 389,120 380.00 K
pid.dll Thu Aug 29 2002 3:41:00a A.... 31,744 31.00 K
psisdecd.dll Fri Jul 9 2004 4:26:40a A.... 354,816 346.50 K
qasf.dll Fri Jan 28 2005 1:44:28p A.... 221,184 216.00 K
qcap.dll Thu Dec 12 2002 12:14:32a A.... 257,024 251.00 K
qdv.dll Fri Jul 9 2004 4:27:28a A.... 316,928 309.50 K
qdvd.dll Fri Jul 9 2004 4:27:28a A.... 470,528 459.50 K
qedit.dll Thu Dec 12 2002 12:14:32a A.... 1,798,144 1.71 M
qedwipes.dll Thu Dec 12 2002 12:14:32a A.... 733,184 716.00 K
qmgr.dll Thu Jul 1 2004 5:08:18p A.... 361,984 353.50 K
qmgrprxy.dll Thu Jul 1 2004 5:08:18p A.... 17,408 17.00 K
quartz.dll Fri May 30 2003 9:00:02a A.... 1,962,496 1.87 M
rewire.dll Sun Mar 12 2006 12:16:52a A.... 225,280 220.00 K
rexsha~1.dll Sun Mar 12 2006 12:16:52a A.... 233,472 228.00 K
s11thk32.dll Wed Nov 6 2002 10:23:48p A.... 49,152 48.00 K
sai0109.dll Mon Jul 26 2004 1:07:42p A.... 270,336 264.00 K
saicfg.dll Wed Jan 28 2004 9:10:56a A.... 147,456 144.00 K
saihook.dll Wed Jan 28 2004 9:20:40a A.... 45,056 44.00 K
saikick.dll Wed Jan 28 2004 9:17:16a A.... 45,056 44.00 K
shw32.dll Fri Sep 5 2003 12:07:12p A.... 118,832 116.05 K
sirenacm.dll Wed Oct 12 2005 5:11:06p A.... 118,784 116.00 K
spmsg.dll Mon Mar 21 2005 3:00:08p ..... 13,536 13.22 K
sporder.dll Wed Apr 20 2005 7:22:30p A.... 11,264 11.00 K
srrstr.dll Thu Nov 14 2002 2:42:34p A.... 218,624 213.50 K
syncor11.dll Wed Nov 6 2002 8:00:38p A.... 40,820 39.86 K
twnlib4.dll Fri Jul 9 2004 8:43:56a ..... 364,544 356.00 K
vb5db.dll Fri Feb 28 2003 10:09:46p A.... 89,360 87.27 K
vobsub.dll Wed Dec 11 2002 10:19:34a A.... 368,640 360.00 K
voltocdx.dll Fri Aug 30 2002 8:35:48p A.... 139,264 136.00 K
vorbis.dll Sat Oct 5 2002 12:04:26a A.... 188,416 184.00 K
vorbis~1.dll Sat Oct 5 2002 12:04:26a A.... 921,600 900.00 K
wbload.dll Sat Jan 22 2005 6:05:48p A.... 20,480 20.00 K
wbsys.dll Wed Feb 26 2003 8:27:44p A.... 36,864 36.00 K
wdfapi.dll Fri Jan 28 2005 1:44:28p A.... 15,872 15.50 K
winhttp.dll Thu Jul 1 2004 5:08:18p A.... 331,776 324.00 K
wmadmod.dll Fri Jan 28 2005 1:44:28p A.... 396,528 387.23 K
wmadmoe.dll Fri Jan 28 2005 1:44:28p A.... 716,288 699.50 K
wmasf.dll Fri Jan 28 2005 1:44:28p A.... 224,768 219.50 K
wmdmlog.dll Fri Jan 28 2005 1:44:28p A.... 28,160 27.50 K
wmdmps.dll Fri Jan 28 2005 1:44:28p A.... 33,792 33.00 K
wmdrmdev.dll Fri Jan 28 2005 1:44:28p A.... 335,872 328.00 K
wmdrmnet.dll Fri Jan 28 2005 1:44:28p A.... 290,816 284.00 K
wmerror.dll Fri Jan 28 2005 1:44:28p A.... 189,440 185.00 K
wmidx.dll Fri Jan 28 2005 1:44:28p A.... 150,016 146.50 K
wmnetmgr.dll Fri Jan 28 2005 1:44:28p A.... 1,027,072 1003.00 K
wmp.dll Fri Jan 28 2005 1:44:28p A.... 5,525,504 5.27 M
wmpasf.dll Fri Jan 28 2005 1:44:28p A.... 135,168 132.00 K
wmpcd.dll Fri Jan 28 2005 1:44:28p A.... 20,480 20.00 K
wmpcore.dll Fri Jan 28 2005 1:44:28p A.... 20,480 20.00 K
wmpdxm.dll Fri Jan 28 2005 1:44:28p A.... 282,624 276.00 K
wmpencen.dll Fri Jan 28 2005 1:44:28p A.... 1,594,880 1.52 M
wmploc.dll Fri Jan 28 2005 1:44:28p A.... 3,371,008 3.21 M
wmpshell.dll Fri Jan 28 2005 1:44:28p A.... 86,016 84.00 K
wmpsrcwp.dll Fri Jan 28 2005 1:44:28p A.... 175,104 171.00 K
wmpui.dll Fri Jan 28 2005 1:44:28p A.... 20,480 20.00 K
wmsdmod.dll Fri Jan 28 2005 1:44:28p A.... 774,904 756.74 K
wmsdmoe2.dll Fri Jan 28 2005 1:44:28p A.... 1,119,744 1.07 M
wmspdmod.dll Fri Jan 28 2005 1:44:28p A.... 413,944 404.24 K
wmspdmoe.dll Fri Jan 28 2005 1:44:28p A.... 940,544 918.50 K
wmv9vcm.dll Mon Jun 23 2003 2:44:36a A.... 1,415,680 1.35 M
wmvadvd.dll Fri Jan 28 2005 1:44:28p A.... 1,218,808 1.16 M
wmvadve.dll Fri Jan 28 2005 1:44:28p A.... 1,512,448 1.44 M
wmvcore.dll Fri Jan 28 2005 1:44:28p A.... 2,370,296 2.26 M
wmvdmod.dll Fri Jan 28 2005 1:44:28p A.... 895,736 874.74 K
wmvdmoe2.dll Fri Jan 28 2005 1:44:28p A.... 1,003,008 979.50 K
wpdconns.dll Fri Jan 28 2005 1:44:28p A.... 61,952 60.50 K
wpdmtp.dll Fri Jan 28 2005 1:44:28p A.... 114,176 111.50 K
wpdmtpdr.dll Fri Jan 28 2005 1:44:28p A.... 331,776 324.00 K
wpdmtpus.dll Fri Jan 28 2005 1:44:28p A.... 66,560 65.00 K
wpdsp.dll Fri Jan 28 2005 1:44:28p A.... 331,264 323.50 K
wpdtrace.dll Fri Jan 28 2005 1:44:28p A.... 10,752 10.50 K
wpd_ci.dll Fri Jan 28 2005 1:44:28p A.... 38,912 38.00 K
wstdecod.dll Fri Jul 9 2004 4:26:40a A.... 47,104 46.00 K
wuapi.dll Thu May 26 2005 4:16:30a A.... 465,176 454.27 K
wuaueng.dll Tue Aug 3 2004 2:07:38p A.... 1,081,112 1.03 M
wuaueng1.dll Thu May 26 2005 4:16:30a A.... 194,328 189.77 K
wucltui.dll Thu May 26 2005 4:16:30a A.... 127,256 124.27 K
wups.dll Thu May 26 2005 4:16:30a A.... 41,240 40.27 K
wups2.dll Thu May 26 2005 4:16:30a A.... 18,200 17.77 K
wuweb.dll Thu May 26 2005 4:16:30a A.... 173,536 169.47 K
xinput~1.dll Mon Dec 5 2005 6:07:30p A.... 61,136 59.70 K
xmlparse.dll Fri Feb 28 2003 10:09:46p A.... 36,864 36.00 K
xmltok.dll Fri Feb 28 2003 10:09:46p A.... 69,632 68.00 K
xpob2res.dll Wed Jun 30 2004 6:59:26p A.... 158,720 155.00 K

226 items found: 226 files, 0 directories.
Total of file sizes: 116,619,439 bytes 111.21 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Volume in drive C is MothahFuckinDrive...
Volume Serial Number is D8DC-6F63

Directory of C:\WINDOWS\System32

02/05/2006 09:55 PM <DIR> Microsoft
11/07/2002 12:36 AM <DIR> dllcache
0 File(s) 0 bytes
2 Dir(s) 6,019,108,864 bytes free

[Gecko]

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix, by typing 2 and then pressing enter,
then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal).
L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.
Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[InFamousKon]

ok here is the L2mfix log:

L2mfix 032106
Creating Account.
The command completed successfully.

Adding Administrative privleges.
The command completed successfully.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\System32

Killing Processes!
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!



Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WBSrv]
"Impersonate"=dword:00000000
"Logoff"="LogOut"
"DllName"="C:\\PROGRA~1\\Stardock\\OBJECT~1\\WINDOW~1\\wbsrv.dll"
"LogOn"="StartSys"
"Unlock"="Sys"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winm32]
"DllName"=hex(2):77,00,69,00,6e,00,6d,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,\
00,00
"Startup"="MemMMView7"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
"MaxWait"=dword:00000001
"secureUID"="[38552162023841402226]"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001


The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
zip warning: name not matched: dlls\*.*

zip error: Nothing to do! (backup.zip)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)



And the HiJakThisLog:


Logfile of HijackThis v1.99.1
Scan saved at 11:49:30 AM, on 11/10/2002
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\InFamousKon\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\program files\mcafee.com\mps\mcbrhlpr.dll
O2 - BHO: McAfee Privacy Service Popup Blocker - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:\program files\mcafee.com\mps\popupkiller.dll
O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [MPFEXE] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/share ... insctl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{89EAD46B-7B27-4304-960A-BC1C6B126F06}: NameServer = 85.255.113.124,85.255.112.199
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: winm32 - C:\WINDOWS\SYSTEM32\winm32.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

[Gecko]

That helped a lot, lets see if we can finish this one up.

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.
restart Windows
Reboot into safe mode:
Restart the system after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O4 - HKLM\..\Run: [Microsoft Windows Logon Process] C:\WINDOWS\winlogon.exe
O20 - Winlogon Notify: winm32 - C:\WINDOWS\SYSTEM32\winm32.dll

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' is enabled. Also make sure that Display the contents of System Folders' is checked. Remember to reset these when done.
Delete the following Files/Folders if they exist:
C:\WINDOWS\winlogon.exe

Now run KillBox and paste the below into the text box or browse to that file:
C:\WINDOWS\SYSTEM32\winm32.dll
Now put a check next to 'Delete on reboot' and on unregister dll before delete
Click on the red X, click yes to delete file on reboot, Click yes to reboot now.

After the reboot post a new hijackthis log

[InFamousKon]

Sorry Gek' but when i put it into safe mode i cant click on anything else cus their isnt anything else to click on...
it lets me get into the task manger but thats it, i cant right click on my comp cus i cant get to start menu.
do i have to turn off sys restr, can i just do all this whithout it being in safemode....
i guess maybe not,

[Gecko]

You could try it in regular mode but there’s a good chance that the trojan will not allow killbox to writing the delete on reboot routine.
You caould also try the replace file on reboot option in killbox that sometimes works.

Because it’s hooked into the winlogon (O20 - Winlogon Notify: winm32 - C:\WINDOWS\SYSTEM32\winm32.dll)
Even using the windows xp cd to boot from won’t work because you have to login to get to the repair section.

Do you have a CD burner and a windows xp cd?
If so there is a way to work around the login problem but you have to create a bootable preinstall cd.
Let me know and I’ll walk you through it.


To create the bootable preinstall cd you will first have to download

Install Bart's PE Builder and use it to build a bootable .iso file with the Windows XP CD.

Burn the ISO image with your chosen program selecting a bootable CD project

Boot the system from the bootable CD, (press F6 to installed raid drivers if needed)
You might have to edit you BIOS to make the CD the first boot device.

Once the system has boot to Bart's pe click on the Bart’s Start and select Command
Now type the following in the command window pressing enter after each line:
cd c:\windows
del winlogon.exe
cd system32
del winm32.dll
exit

Now click start > restart take out the cd and let the system reboot, you will get popups about missing files.
We will fix them with hijackthis as soon as you post a new log.