warning spybot takes key out of xp

[gates318]

these are not only the bad files but heres another fact
after testing over 100 programs adding and removing them to find out whats causing xp to loose its product keys i found the culpite its spybot its erasing the product keys in xps registery and after rebooting you have 3 days to install a new product key ive had to call microsoft for a new key 3 times already as i told support its up to you to get all the bugs in spybot out
not us so in fact this would have cost me 325 canadian at 75 dollars a pop to get a new key so beware folks spybot has its major issues and is not to be trusted


Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
cgmctl32.dll Mon 16 Jan 2006 22:31:06 ..S.R 234,136 228.65 K
ckl3d32.dll Sat 31 Dec 2005 12:42:08 ..S.R 234,942 229.43 K
cmdlin~1.dll Fri 9 Dec 2005 20:53:22 A.... 43,520 42.50 K
cpyptdlg.dll Sun 22 Jan 2006 9:58:46 ..S.R 235,429 229.91 K
djcdll.dll Tue 10 Jan 2006 16:33:08 ..S.R 237,208 231.65 K
dmound3d.dll Tue 10 Jan 2006 16:33:04 ..S.R 236,902 231.35 K
dn4u01~1.dll Sat 28 Jan 2006 11:01:02 ..S.R 235,429 229.91 K
dn8o01~1.dll Mon 16 Jan 2006 21:57:04 ..S.R 236,257 230.72 K
duauth.dll Fri 30 Dec 2005 13:23:08 ..S.R 234,942 229.43 K
dyband.dll Sat 14 Jan 2006 17:26:40 ..S.R 234,265 228.77 K
enpml1~1.dll Mon 16 Jan 2006 19:26:28 ..S.R 236,070 230.54 K
eoccmn.dll Tue 10 Jan 2006 16:33:02 ..S.R 237,208 231.65 K
ewentlog.dll Mon 16 Jan 2006 16:43:36 ..S.R 234,265 228.77 K
f8l02i~1.dll Sat 28 Jan 2006 17:54:12 ..S.R 234,267 228.77 K
fpnu03~1.dll Wed 21 Dec 2005 20:59:40 A.... 235,895 230.36 K
gbcoll~1.dll Tue 24 Jan 2006 16:57:10 ..S.R 237,316 231.75 K
gccoll~1.dll Tue 15 Nov 2005 12:12:08 A.... 126,680 123.71 K
gcunco~1.dll Tue 15 Nov 2005 12:12:06 A.... 95,448 93.21 K
gdi32.dll Mon 2 Jan 2006 22:38:04 A.... 260,608 254.50 K
hashlib.dll Tue 15 Nov 2005 12:12:08 A.... 117,976 115.21 K
hjacti~1.dll Fri 6 Jan 2006 17:13:28 ..S.R 237,208 231.65 K
hr4u05~1.dll Tue 10 Jan 2006 16:33:04 ..S.R 233,720 228.24 K
hrn005~1.dll Wed 4 Jan 2006 21:45:58 ..S.R 236,957 231.40 K
i006la~1.dll Tue 10 Jan 2006 16:33:08 ..S.R 234,048 228.56 K
ir66l5~1.dll Mon 16 Jan 2006 21:54:56 ..S.R 234,899 229.39 K
ir82l5~1.dll Sat 14 Jan 2006 17:25:38 ..S.R 236,902 231.35 K
irssvcs.dll Sat 28 Jan 2006 10:16:00 ..S.R 235,429 229.91 K
j8l40i~1.dll Mon 16 Jan 2006 18:26:36 ..S.R 234,265 228.77 K
jt4407~1.dll Tue 17 Jan 2006 18:39:26 ..S.R 235,429 229.91 K
k244lc~1.dll Sat 7 Jan 2006 15:08:40 ..S.R 237,208 231.65 K
kldlv1.dll Wed 25 Jan 2006 16:55:22 ..S.R 235,429 229.91 K
legitc~1.dll Fri 4 Nov 2005 16:27:24 A.... 534,280 521.76 K
lnmsp10n.dll Mon 23 Jan 2006 16:33:52 ..S.R 237,316 231.75 K
lnscr10n.dll Wed 11 Jan 2006 16:40:02 ..S.R 236,902 231.35 K
lqfil10n.dll Mon 26 Dec 2005 18:14:12 ..S.R 234,942 229.43 K
lxbmp13n.dll Tue 10 Jan 2006 17:34:54 ..S.R 236,902 231.35 K
meiseq.dll Fri 30 Dec 2005 12:38:40 ..S.R 235,297 229.78 K
mhdart.dll Fri 27 Jan 2006 16:46:40 ..S.R 237,316 231.75 K
mncndmgr.dll Thu 29 Dec 2005 12:06:34 ..S.R 235,297 229.78 K
msctl32.dll Wed 21 Dec 2005 9:11:50 A.... 42,496 41.50 K
mshtml.dll Tue 22 Nov 2005 16:49:10 A.... 2,700,288 2.57 M
mv6ml9~1.dll Fri 27 Jan 2006 18:17:40 ..S.R 237,316 231.75 K
mvhtmler.dll Wed 28 Dec 2005 12:09:56 ..S.R 234,942 229.43 K
n0r20a~1.dll Sun 15 Jan 2006 21:51:28 ..S.R 234,265 228.77 K
n0r2la~1.dll Thu 26 Jan 2006 21:45:00 ..S.R 235,429 229.91 K
n44s0e~1.dll Mon 16 Jan 2006 22:34:06 ..S.R 234,136 228.65 K
nbtid.dll Fri 30 Dec 2005 18:34:10 ..S.R 234,942 229.43 K
ngth.dll Wed 4 Jan 2006 21:54:16 ..S.R 236,902 231.35 K
p68qlg~1.dll Mon 16 Jan 2006 22:05:04 ..S.R 235,876 230.35 K
q2nu0c~1.dll Sat 31 Dec 2005 15:41:12 ..S.R 234,942 229.43 K
rmstls.dll Thu 12 Jan 2006 16:53:38 ..S.R 233,985 228.50 K
s32evnt1.dll Tue 3 Jan 2006 15:31:44 A.... 91,904 89.75 K
sdobject.dll Tue 27 Dec 2005 12:19:26 ..S.R 235,297 229.78 K
sllgntfy.dll Mon 16 Jan 2006 19:34:52 ..S.R 234,899 229.39 K
spmevnt1.dll Wed 21 Dec 2005 19:04:50 ..S.R 234,942 229.43 K
sznike.dll Sat 7 Jan 2006 13:41:20 ..S.R 236,902 231.35 K
ttpiperf.dll Sat 28 Jan 2006 17:54:12 ..S.R 235,429 229.91 K
uohisapi.dll Fri 13 Jan 2006 16:32:52 ..S.R 234,265 228.77 K
wannls.dll Mon 26 Dec 2005 20:44:54 ..S.R 234,942 229.43 K
whnsta.dll Fri 13 Jan 2006 20:40:38 ..S.R 236,902 231.35 K
wlaueng1.dll Thu 26 Jan 2006 16:45:56 ..S.R 237,316 231.75 K
wwpcore.dll Fri 6 Jan 2006 16:31:36 ..S.R 236,902 231.35 K
wyn32spl.dll Mon 16 Jan 2006 22:23:16 ..S.R 235,876 230.35 K

63 items found: 63 files (53 H/S), 0 directories.
Total of file sizes: 16,739,604 bytes 15.96 M
Locate .tmp files:

C:\WINDOWS\SYSTEM32\
atmtdd~1.tmp Wed 21 Dec 2005 21:01:06 A.... 0 0.00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 0 bytes 0.00 K
**********************************************************************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is ACEB-A95C

Directory of C:\WINDOWS\System32

28/01/2006 17:54 235,429 tTpiperf.dll
28/01/2006 17:54 234,267 f8l02i3mg8.dll
28/01/2006 11:01 235,429 dn4u01h9e.dll
28/01/2006 10:15 235,429 iRssvcs.dll
27/01/2006 18:17 237,316 mv6ml9j11.dll
27/01/2006 16:46 237,316 mhdart.dll
26/01/2006 21:44 235,429 n0r2la9o1d.dll
26/01/2006 16:45 237,316 wlaueng1.dll
25/01/2006 16:55 235,429 kldlv1.dll
24/01/2006 16:57 237,316 GBCollection.dll
23/01/2006 16:33 237,316 lnmsp10N.dll
22/01/2006 09:58 235,429 cpyptdlg.dll
17/01/2006 18:39 235,429 jt4407hqe.dll
16/01/2006 22:34 234,136 n44s0eh7eh4.dll
16/01/2006 22:31 234,136 cgmctl32.dll
16/01/2006 22:23 235,876 wyn32spl.dll
16/01/2006 22:05 235,876 p68qlgl516q.dll
16/01/2006 21:57 236,257 dn8o01l3e.dll
16/01/2006 21:54 234,899 ir66l5js1.dll
16/01/2006 19:34 234,899 sllgntfy.dll
16/01/2006 19:26 236,070 enpml1711.dll
16/01/2006 18:26 234,265 j8l40i3qe8.dll
16/01/2006 16:43 234,265 ewentlog.dll
15/01/2006 21:51 234,265 n0r20a9oed.dll
14/01/2006 17:26 234,265 dyband.dll
14/01/2006 17:25 236,902 ir82l5lo1.dll
13/01/2006 20:40 236,902 whnsta.dll
13/01/2006 16:35 <DIR> dllcache
13/01/2006 16:32 234,265 uohisapi.dll
12/01/2006 16:53 233,985 rMstls.dll
11/01/2006 16:40 236,902 lnscr10N.dll
10/01/2006 17:34 236,902 lxbmp13n.dll
10/01/2006 16:33 237,208 djcdll.dll
10/01/2006 16:33 234,048 i006lads1d06.dll
10/01/2006 16:33 236,902 dmound3d.dll
10/01/2006 16:33 233,720 hr4u05h9e.dll
10/01/2006 16:33 237,208 eoccmn.dll
07/01/2006 15:08 237,208 k244lchq1f4e.dll
07/01/2006 13:41 236,902 sznike.dll
06/01/2006 17:13 237,208 HJActiveX.dll
06/01/2006 16:31 236,902 wwpcore.dll
04/01/2006 21:54 236,902 ngth.dll
04/01/2006 21:45 236,957 hrn0055me.dll
31/12/2005 15:41 234,942 q2nu0c59ef.dll
31/12/2005 12:42 234,942 ckl3d32.dll
30/12/2005 18:34 234,942 nbtid.dll
30/12/2005 13:23 234,942 duauth.dll
30/12/2005 12:38 235,297 meiseq.dll
29/12/2005 12:06 235,297 mncndmgr.dll
28/12/2005 12:09 234,942 mvhtmler.dll
27/12/2005 12:19 235,297 sdobject.dll
26/12/2005 20:44 234,942 wannls.dll
26/12/2005 18:14 234,942 lqfil10N.DLL
21/12/2005 19:04 234,942 SPMEVNT1.DLL
08/06/2004 23:18 <DIR> Microsoft
53 File(s) 12,490,509 bytes
2 Dir(s) 10,518,302,720 bytes free[/QUOTE]

[tashi]

gates318.
I split off your post where you copied a member's L2mfix log and then posted it back into original poster's topic in the malware forum.
Edit: removed incorrect url, had a browser burp.- tashi
Malware forum rules stickied here:
Before you post a log (http://forums.spybot.info/showthread.php?t=288)

Regards.

[md usa spybot fan]

gates318:

I’m sorry to hear about you problem with your XP product key.

I am not sure what the file listings that you provided represent. I do not recognize the listing that you labeled "Files Found are not all bad files". Can you explain were that listing came from?

Can you also explain when the product key was deleted from the registry. If it was during a Spybot-S&D scan/fix, can you provide the Fixes.yymmdd-hhmm log from when the problem occurred?

By default here are two Checks.yymmdd-hhmm logs produced during a scan. The second Checks.yymmdd-hhmm has the details of what the scan found. A Fixes.yymmdd-hhmm log is produced if you fix or attempt to fix something.

To post the Fixes.yymmdd-hhmm log from the scan/fix there are two methods:
Method 1:
Go into Spybot > Mode > Advanced mode > Tools > View Reports > View Pervious reports. Look for the last Fixes.yymmdd-hhmm file from the scan/fix before you had the problem. Open it. Right click > Select all. Right click > Copy. Paste to the post.
Method 2
The Checks.yymmdd-hhmm and Fixes.yymmdd-hhmm files are stored in the following folders:
Windows 95 or 98:
C:\Windows\Application Data\Spybot - Search & Destroy\Logs
Windows ME:
C:\Windows\All Users\Application Data\Spybot - Search & Destroy\Logs
Windows NT, 2000 or XP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs
Using Windows Explorer, navigate to the correct Fixes.yymmdd-hhmm file. Double click on it and it should open with Notepad. Copy and paste into the post.

[LonnyRJones]

SSD fan
Did you notice this ?

Tashi
I split off your post where you copied a member's L2mfix log and then posted it back into original poster's topic in the malware forum.

[md usa spybot fan]

Lonny:

I'm just a little slow today.

I saw tashi's note but didn't understand it since the link (http://forums.spybot.info/showthread.php?p=9821#post9821) pointed back to this thread. I got it now, it's a piece of the L2mfix log posted by SomersetDave (http://forums.spybot.info/member.php?u=3307) in the following thread:
command service
http://forums.spybot.info/showthread.php?t=2066
However, now I'm even more confused about what the listing represents in regard to the allegation that Spybot deleted the product key.