Help With Log Programs Keep On Coming Back

I keep getting the same files coming back over and over. Run all of the spybot applications, in fact it removes the preinmpp.exe, but comes back at each restart of my computer. Stuff just takes over and pop up after pop up when I go to a new website. getting alittle frustrated.

here is my hijack this log:

StartupList report, 11/30/2004, 4:38:56 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\GPLAYER\My Documents\hijackthis\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ActivCard\accoca.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Connected\CBRegCap.EXE
C:\Program Files\Connected\CBlaunch.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\HPQ\CUSTOM~1\hibserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\Program Files\Common Files\ActivCard\acautoreg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\EAB\EABSERVR.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
C:\WINDOWS\System32\ltmsg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Compaq\Hotkey Software\hkss.exe
C:\WINDOWS\System32\pyukxbbm.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Jabber\Messenger\JabberMessenger.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Connected\CBSysTray.exe
C:\Documents and Settings\GPLAYER\My Documents\hijackthis\HijackThis.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\GPLAYER\Start Menu\Programs\Startup]
Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

eabconfg.cpl = C:\Program Files\Compaq\EAB\EABSERVR.EXE /Start
AdaptecDirectCD = C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
IDA = C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
ATIModeChange = Ati2mdxx.exe
LTWinModem1 = ltmsg.exe 9
ChkAdmin = C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
TgCmdHPSupport = "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
hkss = C:\Program Files\Compaq\Hotkey Software\hkss.exe
SmcService = C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
pqaheci = C:\WINDOWS\System32\pyukxbbm.exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
vptray = C:\PROGRA~1\SYMANT~1\VPTray.exe
QuickPassword = C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
satmat = C:\WINDOWS\satmat.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
Jabber Messenger = C:\Program Files\Jabber\Messenger\JabberMessenger.exe -hidden
Jawa32 = C:\WINDOWS\jawa32.exe
AIM = C:\Program Files\AIM\aim.exe -cnetwait.odl
SpySweeper = "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /1
SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670}
(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

————————————————–

Enumerating Task Scheduler jobs:

IDA{07A2D605-F561-11D1-BEE5-AC785AC8CD4E}000.job
IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}000.job
IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}001.job
IDA{884F3959-E5F7-11D1-9B15-080009F878E4}000.job
IDA{E1B2A4DD-AE06-4B97-9B55-8E8F1348E7FB}000.job

————————————————–

Enumerating Download Program Files:

[MetaStreamCtl Class]
InProcServer32 = C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
CODEBASE = https://components.viewpoint.com/MTSInstall…1903/model.html

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://fpdownload.macromedia.com/get/shock…director/sw.cab

[Executive Viewer Web Control (English)]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\evctrlen.ocx
CODEBASE = https://boi1331.boise.itc.hp.com/pnl/EV/evctrlen.cab

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.1\DART_8002.dll
CODEBASE = http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\DART_8002.dll
CODEBASE = http://dart10.atl.hp.com:8001/VB/Package/DART_8002.CAB

[EPUImageControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\EPUWalcontrol.dll
CODEBASE = http://tools.ebayimg.com/eps/wl/activex/EP…ol_v1-0-3-9.cab

[Executive Viewer Web Client 5.1 (English)]
InProcServer32 = C:\WINDOWS\DOWNLO~1\EVCTRL~1.OCX
CODEBASE = https://vcceosrpro.cce.hp.com/OSRMRPTG/asp/evctrl5en.cab

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.3\DART_8002.dll
CODEBASE = http://dart12.atl.hp.com:8001/VB/Package/DART_8002.CAB

[MSN Money Charting]
InProcServer32 = C:\Program Files\Microsoft Money 2005\MNYCoreFiles\portstub.dll
CODEBASE = http://moneycentral.msn.com/cabs/pmupdate2.exe

[DART_7001.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\DART_7001.dll
CODEBASE = http://dart12.atl.hp.com:7003/VB/Package/DART_7001.CAB

[DART_7001.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.3\DART_7001.dll
CODEBASE = http://dart10.atl.hp.com:7001/VB/Package/DART_7001.CAB

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa…ash/swflash.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE = https://mci.webex.com/client/v_mywebex-mcip…bex/ieatgpc.cab

[ERPageAddin Class]
InProcServer32 = C:\Program Files\eRoom 6\ERAddIn.ocx
CODEBASE = https://eroom1.external.hp.com/eroomsetup/client.cab

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.2\DART_8002.dll
CODEBASE = http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

————————————————–
End of report, 9,499 bytes
Report generated in 0.080 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


Here is my startup log.

StartupList report, 11/30/2004, 4:38:56 PM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\GPLAYER\My Documents\hijackthis\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ActivCard\accoca.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Connected\CBRegCap.EXE
C:\Program Files\Connected\CBlaunch.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\HPQ\CUSTOM~1\hibserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\Program Files\Common Files\ActivCard\acautoreg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\EAB\EABSERVR.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
C:\WINDOWS\System32\ltmsg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Compaq\Hotkey Software\hkss.exe
C:\WINDOWS\System32\pyukxbbm.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Jabber\Messenger\JabberMessenger.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Connected\CBSysTray.exe
C:\Documents and Settings\GPLAYER\My Documents\hijackthis\HijackThis.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\GPLAYER\Start Menu\Programs\Startup]
Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

eabconfg.cpl = C:\Program Files\Compaq\EAB\EABSERVR.EXE /Start
AdaptecDirectCD = C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
IDA = C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
ATIModeChange = Ati2mdxx.exe
LTWinModem1 = ltmsg.exe 9
ChkAdmin = C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
TgCmdHPSupport = "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
hkss = C:\Program Files\Compaq\Hotkey Software\hkss.exe
SmcService = C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
pqaheci = C:\WINDOWS\System32\pyukxbbm.exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
vptray = C:\PROGRA~1\SYMANT~1\VPTray.exe
QuickPassword = C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
satmat = C:\WINDOWS\satmat.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
Jabber Messenger = C:\Program Files\Jabber\Messenger\JabberMessenger.exe -hidden
Jawa32 = C:\WINDOWS\jawa32.exe
AIM = C:\Program Files\AIM\aim.exe -cnetwait.odl
SpySweeper = "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /1
SpybotSD TeaTimer = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670}
(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

————————————————–

Enumerating Task Scheduler jobs:

IDA{07A2D605-F561-11D1-BEE5-AC785AC8CD4E}000.job
IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}000.job
IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}001.job
IDA{884F3959-E5F7-11D1-9B15-080009F878E4}000.job
IDA{E1B2A4DD-AE06-4B97-9B55-8E8F1348E7FB}000.job

————————————————–

Enumerating Download Program Files:

[MetaStreamCtl Class]
InProcServer32 = C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
CODEBASE = https://components.viewpoint.com/MTSInstall…1903/model.html

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://fpdownload.macromedia.com/get/shock…director/sw.cab

[Executive Viewer Web Control (English)]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\evctrlen.ocx
CODEBASE = https://boi1331.boise.itc.hp.com/pnl/EV/evctrlen.cab

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.1\DART_8002.dll
CODEBASE = http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\DART_8002.dll
CODEBASE = http://dart10.atl.hp.com:8001/VB/Package/DART_8002.CAB

[EPUImageControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\EPUWalcontrol.dll
CODEBASE = http://tools.ebayimg.com/eps/wl/activex/EP…ol_v1-0-3-9.cab

[Executive Viewer Web Client 5.1 (English)]
InProcServer32 = C:\WINDOWS\DOWNLO~1\EVCTRL~1.OCX
CODEBASE = https://vcceosrpro.cce.hp.com/OSRMRPTG/asp/evctrl5en.cab

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.3\DART_8002.dll
CODEBASE = http://dart12.atl.hp.com:8001/VB/Package/DART_8002.CAB

[MSN Money Charting]
InProcServer32 = C:\Program Files\Microsoft Money 2005\MNYCoreFiles\portstub.dll
CODEBASE = http://moneycentral.msn.com/cabs/pmupdate2.exe

[DART_7001.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\DART_7001.dll
CODEBASE = http://dart12.atl.hp.com:7003/VB/Package/DART_7001.CAB

[DART_7001.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.3\DART_7001.dll
CODEBASE = http://dart10.atl.hp.com:7001/VB/Package/DART_7001.CAB

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/shockwa…ash/swflash.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE = https://mci.webex.com/client/v_mywebex-mcip…bex/ieatgpc.cab

[ERPageAddin Class]
InProcServer32 = C:\Program Files\eRoom 6\ERAddIn.ocx
CODEBASE = https://eroom1.external.hp.com/eroomsetup/client.cab

[DART_8002.DART_C]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.2\DART_8002.dll
CODEBASE = http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

————————————————–
End of report, 9,499 bytes
Report generated in 0.080 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


Thanks for the help!

Here is the file as requested.

Thank you for your help

Logfile of HijackThis v1.98.2
Scan saved at 9:40:43 AM, on 12/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ActivCard\accoca.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Connected\CBRegCap.EXE
C:\Program Files\Connected\CBlaunch.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\HPQ\CUSTOM~1\hibserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\Program Files\Common Files\ActivCard\acautoreg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\EAB\EABSERVR.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
C:\WINDOWS\System32\ltmsg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Compaq\Hotkey Software\hkss.exe
C:\WINDOWS\System32\pyukxbbm.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Jabber\Messenger\JabberMessenger.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Connected\CBSysTray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\GPLAYER\My Documents\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://athp.hp.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://athp.hp.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://athp.hp.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Hewlett-Packard
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://autocache.hp.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = web-proxy.boi.hp.com:8088
R3 - Default URLSearchHook is missing
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [IDA] C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [TgCmdHPSupport] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /nosystray
O4 - HKLM\..\Run: [hkss] C:\Program Files\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [pqaheci] C:\WINDOWS\System32\pyukxbbm.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickPassword] C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
O4 - HKLM\..\Run: [satmat] C:\WINDOWS\satmat.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Jabber Messenger] C:\Program Files\Jabber\Messenger\JabberMessenger.exe -hidden
O4 - HKCU\..\Run: [Jawa32] C:\WINDOWS\jawa32.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://athp.hp.com
O15 - Trusted Zone: http://ie.config.asia.compaq.com
O15 - Trusted Zone: http://ie.config.eur.compaq.com
O15 - Trusted Zone: http://ie.config.im.hou.compaq.com
O15 - Trusted Zone: http://ie.config.jp.compaq.com
O15 - Trusted Zone: http://autoconfig.cpqcorp.net
O15 - Trusted Zone: http://ie.config.ecom.dec.com
O15 - Trusted Zone: http://ie.config.tandem.com
O16 - DPF: HPVC component - http://vrm10.win2000.hpe-learning.com/hpvc…onent401131.cab
O16 - DPF: HPVC resources - http://vrm10.win2000.hpe-learning.com/hpvc…ources40147.cab
O16 - DPF: HPVC signed - http://vrm10.win2000.hpe-learning.com/hpvc…signed40139.cab
O16 - DPF: HPVC support - http://vrm10.win2000.hpe-learning.com/hpvc…support4016.cab
O16 - DPF: HPVC vminfo - https://vrm06.win2000.hpe-learning.com/room…ents/vminfo.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall…1903/model.html
O16 - DPF: {1BAC1200-0BBE-499A-A9E9-5F334DBC8E89} (Executive Viewer Web Control (English)) - https://boi1331.boise.itc.hp.com/pnl/EV/evctrlen.cab
O16 - DPF: {27F08E0C-3238-4979-B678-D798623EDD30} (DART_8002.DART_C) - http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB
O16 - DPF: {29970940-1B90-4024-8127-FD07B901A9E0} (DART_8002.DART_C) - http://dart10.atl.hp.com:8001/VB/Package/DART_8002.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…ol_v1-0-3-9.cab
O16 - DPF: {5BAC1200-0BBE-499A-A9E9-5F334DBC8E89} (Executive Viewer Web Client 5.1 (English)) - https://vcceosrpro.cce.hp.com/OSRMRPTG/asp/evctrl5en.cab
O16 - DPF: {5F8AE0CA-9852-46A8-B615-791C7278409C} (DART_8002.DART_C) - http://dart12.atl.hp.com:8001/VB/Package/DART_8002.CAB
O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupdate2.exe
O16 - DPF: {97A70991-6E12-42EF-A317-E5F781B0DF2E} (DART_7001.DART_C) - http://dart12.atl.hp.com:7003/VB/Package/DART_7001.CAB
O16 - DPF: {A15CC63F-44E6-4772-B166-EAC71FCDA1C3} (DART_7001.DART_C) - http://dart10.atl.hp.com:7001/VB/Package/DART_7001.CAB
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://mci.webex.com/client/v_mywebex-mcip…bex/ieatgpc.cab
O16 - DPF: {E876D003-BCDE-11D3-9131-000094B61529} (ERPageAddin Class) - https://eroom1.external.hp.com/eroomsetup/client.cab
O16 - DPF: {F95C2952-5485-46B5-A430-6CE4BA99874B} (DART_8002.DART_C) - http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = americas.cpqcorp.net
O17 - HKLM\Software\..\Telephony: DomainName = americas.cpqcorp.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = americas.cpqcorp.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = AMERICAS.cpqcorp.net,AMERICAS.hpqcorp.net,hpqcorp.net,cpqcorp.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = AMERICAS.cpqcorp.net,AMERICAS.hpqcorp.net,hpqcorp.net,cpqcorp.net

Did as instructed. PYUKXBBM.exe did show up under Norton Corporate virus scan as a adware program (a downloader). That process is also stopped when trying to run the symantec Adware.Binet remover- which did nothing. I believe that is because the Adware.Binet loades itself in the system restore files. I turned this function off!

How my computer was behaving prior to this scan… At launch it would load all of these programs in my temp folders - preinmpp.exe, thnall1l.exe, satmat, etc.. Then anytime I would open up an internet explorer window, a pop up would occur that would be based upon the URL I typed. So if I went to a school website, an ad would popup for university of phoenix. Go to my companies homepage, a computer ad would pop up. Every URL I typed, another window would open with a similar site.

Here is my log:

Logfile of HijackThis v1.98.2
Scan saved at 10:15:52 AM, on 12/2/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SSA\smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ActivCard\accoca.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Connected\CBRegCap.EXE
C:\Program Files\Connected\CBlaunch.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\PROGRA~1\HPQ\CUSTOM~1\hibserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\Program Files\Common Files\ActivCard\acautoreg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Compaq\EAB\EABSERVR.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
C:\WINDOWS\System32\ltmsg.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\Compaq\Hotkey Software\hkss.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Jabber\Messenger\JabberMessenger.exe
C:\Program Files\AIM\aim.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Connected\CBSysTray.exe
C:\Documents and Settings\GPLAYER\My Documents\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://athp.hp.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://athp.hp.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://athp.hp.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Hewlett-Packard
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://autocache.hp.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = web-proxy.boi.hp.com:8088
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EABSERVR.EXE /Start
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [IDA] C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [hkss] C:\Program Files\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SSA\smc.exe -startgui
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickPassword] C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Jabber Messenger] C:\Program Files\Jabber\Messenger\JabberMessenger.exe -hidden
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: Connected TaskBar Icon.LNK = C:\Program Files\Connected\CBSysTray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://athp.hp.com
O15 - Trusted Zone: http://ie.config.asia.compaq.com
O15 - Trusted Zone: http://ie.config.eur.compaq.com
O15 - Trusted Zone: http://ie.config.im.hou.compaq.com
O15 - Trusted Zone: http://ie.config.jp.compaq.com
O15 - Trusted Zone: http://autoconfig.cpqcorp.net
O15 - Trusted Zone: http://ie.config.ecom.dec.com
O15 - Trusted Zone: http://ie.config.tandem.com
O16 - DPF: HPVC component - http://vrm10.win2000.hpe-learning.com/hpvc…onent401131.cab
O16 - DPF: HPVC resources - http://vrm10.win2000.hpe-learning.com/hpvc…ources40147.cab
O16 - DPF: HPVC signed - http://vrm10.win2000.hpe-learning.com/hpvc…signed40139.cab
O16 - DPF: HPVC support - http://vrm10.win2000.hpe-learning.com/hpvc…support4016.cab
O16 - DPF: HPVC vminfo - https://vrm06.win2000.hpe-learning.com/room…ents/vminfo.cab
O16 - DPF: {1BAC1200-0BBE-499A-A9E9-5F334DBC8E89} (Executive Viewer Web Control (English)) - https://boi1331.boise.itc.hp.com/pnl/EV/evctrlen.cab
O16 - DPF: {27F08E0C-3238-4979-B678-D798623EDD30} (DART_8002.DART_C) - http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB
O16 - DPF: {29970940-1B90-4024-8127-FD07B901A9E0} (DART_8002.DART_C) - http://dart10.atl.hp.com:8001/VB/Package/DART_8002.CAB
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…ol_v1-0-3-9.cab
O16 - DPF: {5BAC1200-0BBE-499A-A9E9-5F334DBC8E89} (Executive Viewer Web Client 5.1 (English)) - https://vcceosrpro.cce.hp.com/OSRMRPTG/asp/evctrl5en.cab
O16 - DPF: {5F8AE0CA-9852-46A8-B615-791C7278409C} (DART_8002.DART_C) - http://dart12.atl.hp.com:8001/VB/Package/DART_8002.CAB
O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupdate2.exe
O16 - DPF: {97A70991-6E12-42EF-A317-E5F781B0DF2E} (DART_7001.DART_C) - http://dart12.atl.hp.com:7003/VB/Package/DART_7001.CAB
O16 - DPF: {A15CC63F-44E6-4772-B166-EAC71FCDA1C3} (DART_7001.DART_C) - http://dart10.atl.hp.com:7001/VB/Package/DART_7001.CAB
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://mci.webex.com/client/v_mywebex-mcip…bex/ieatgpc.cab
O16 - DPF: {E876D003-BCDE-11D3-9131-000094B61529} (ERPageAddin Class) - https://eroom1.external.hp.com/eroomsetup/client.cab
O16 - DPF: {F95C2952-5485-46B5-A430-6CE4BA99874B} (DART_8002.DART_C) - http://dart12.atl.hp.com:8003/VB/Package/DART_8002.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = americas.cpqcorp.net
O17 - HKLM\Software\..\Telephony: DomainName = americas.cpqcorp.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = americas.cpqcorp.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = AMERICAS.cpqcorp.net,AMERICAS.hpqcorp.net,hpqcorp.net,cpqcorp.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = AMERICAS.cpqcorp.net,AMERICAS.hpqcorp.net,hpqcorp.net,cpqcorp.net