What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HiJack This

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I keep getting a trojan horse and also something has taken over my desktop settings, which I can't change anymore, the background is blank white with all icons highlighted, but they seem to work, and I can't do a restore anymore. Any help is welcome, thanks,
Sean007

Logfile of HijackThis v1.97.7
Scan saved at 6:31:05 AM, on 7/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [dmhlj.exe] C:\WINDOWS\system32\dmhlj.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [dmrav.exe] C:\WINDOWS\system32\dmrav.exe
O4 - HKLM\..\Run: [dhdkd.exe] C:\WINDOWS\system32\dhdkd.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc2.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
Post #3
Logfile of HijackThis v1.99.1
Scan saved at 6:11:57 AM, on 7/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [dmhlj.exe] C:\WINDOWS\system32\dmhlj.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [dmfnd.exe] C:\WINDOWS\system32\dmfnd.exe
O4 - HKLM\..\Run: [qmygh.exe] C:\WINDOWS\system32\qmygh.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #4
Please disable Teatimer, it can interfere with the cleaning process:

on the Teatimer icon in the system tray, and "Exit".

Then do this:

How to Disable Teatimer

After we have cleaned your system, please be sure to reverse this process, and re-enable Teatimer.

Your computer has been hijacked by people in the Ukraine. What you have is a Wareout infection.

85.255.112.0 - 85.255.127.255
Inhoster hosting company
OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine


Please download FixWareout from one of these links:
Fixwareout.exe
Fixwareout.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

* Save it to your desktop and run it.
* Click Next, then Install, make sure "Run fixit" is checked and click Finish.
* The fix will begin; follow the prompts.
* You will be asked to reboot your computer; please do so.
* Your system may take longer than usual to load; this is normal.
* Once the desktop loads a text will open (report.txt). We'll need that in a bit.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):
(Note: Fixwareout.exe may have removed some of these)

F2 - REG:system.ini: UserInit=userinit.exe

O4 - HKLM\..\Run: [dmhlj.exe] C:\WINDOWS\system32\dmhlj.exe

O4 - HKLM\..\Run: [dmfnd.exe] C:\WINDOWS\system32\dmfnd.exe

O4 - HKLM\..\Run: [qmygh.exe] C:\WINDOWS\system32\qmygh.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\windows\system32\dmfnd.exe <— file

c:\windows\system32\dmhlj.exe <— file

c:\windows\system32\qmygh.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

:)
Post #5
Logfile of HijackThis v1.99.1
Scan saved at 7:17:12 AM, on 7/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft

Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL

Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display

Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter

Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop

Weather\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter

Utility\drivers\WINXP\SMCRMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe

R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search

Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start

Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search

Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = http://localhost
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper -

{BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program

Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus -

{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program

Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program

Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent]

C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC]

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck]

%systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program

Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program

Files\Adobe\Photoshop Album Starter

Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [inrxu.exe] C:\WINDOWS\system32\inrxu.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather

Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program

Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe"

AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program

Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter

Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus

Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}

(WUWebControl Class) -

http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x

86/client/wuweb_site.cab?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}

(MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en

/x86/client/muweb_site.cab?1123943357781
O17 -

HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A

94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 -

HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8

AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 -

HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-B

DCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer

= 85.255.113.107 85.255.112.121
O17 -

HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A

94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer

= 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon -

C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) -

GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT,

s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) -

Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) -

Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service

(navapsvc) - Symantec Corporation - C:\Program Files\Norton

AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP -

C:\WINDOWS\system32\HPZipm12.exe





Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2CD11BFF3C18-3339-81F4-4A8B-E24E6F31{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BFD9F2DD2F93-0BA8-9BF4-FCB9-08CFE969{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4964B1296FD5-E3FB-5DF4-6EB6-E0D5C196{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F3E618415E1E-6EBA-1C94-001C-2162A5AB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6085170864AF-DB69-EB64-71FE-C01B464E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}208F8A4F91BC-0339-3754-49CA-A2F01E6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5973C25259AD-140A-8E24-440A-0BAC0BC1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0B28900B45C3-038A-7704-FB80-7E2764B3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}223031727811-3859-0134-67D3-B663BB86{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4E8100AB1D48-F6DA-FE34-8EC7-494C81CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2E546173241B-79D8-1624-7E35-F3D08306{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97283A5964D8-3C98-4A24-E46F-F1B25757{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B67607F1D47B-EF6B-F4D4-A8D7-7FD72881{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E94D56457DF4-AD2A-3204-A6BF-10C08430{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}11DDB064AB90-9E9A-52B4-1598-87198A28{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}789B0471E8A3-CA0B-6684-CBC9-8D408B11{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD588B24D79F-1809-7C24-1606-5C316EFC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6A638D1923C1-8F0B-56C4-AC1A-79981DDB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A5501C2C037B-DFBB-E674-AA2A-2011B171{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A7305D60FCF5-EC6A-2074-7068-2BF2E1C1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3D89560AD0D0-1828-5C44-37C4-E9D5C8B6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}889846F256DB-6258-A924-E145-0B6A4552{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AAE914E43676-C7A8-D0F4-C3A1-E79C6C88{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}88838CF83AED-C67B-1614-DFDD-20EDE7BD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1186AA8A011C-4FA8-7F44-B1F9-63CF8D84{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}999400F3C7D6-B6E8-78A4-EEF1-0DF233C6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BE1D41956964-8BA8-ECD4-0AE4-4FA4FBBA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}138937517321-51D8-4CB4-ACF5-6FAD37CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D93AD7C67429-A898-D3F4-AC29-C4D7D7E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C3C88AA43475-0FCA-B2F4-E224-53EB58BC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8995D4FC3BF2-BA2B-FD94-8C56-5B246A4F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}14E4A69EA57C-0B4B-8E34-07CF-05189FC0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}77EBAE2BF4A8-23F8-61A4-9CDA-CD7545B2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D27BD622FE0E-44AA-5894-DE90-975FE013{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3C373D0752DF-34BB-8AA4-E379-90A180A2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0ED5FC300745-1A28-5314-DD5A-9EA0DA6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CA57A75E8705-FC28-E864-9F14-6E812AB7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97A7086C3CAE-22D8-D4A4-5388-4805FC94{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FCA4B55E9FAF-1FEA-89A4-6233-33DD07D8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}85E0E8314E2E-F1B8-F164-4496-C372E8FD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}324F4EBC6B5A-6FBB-2EE4-420A-3000F62F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}834C04F3FD97-2B7B-5C54-1CD6-0CED0E1D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ED19507A320E-539A-1E94-A17C-CD13BD8B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}22D9924DE068-40E8-1A14-15A5-F3E1E976{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F5C934333943-72EA-2504-20CE-B2C927CF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}47C67929A5E0-03CA-E0C4-503F-CCC211DE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C2FECD5A48BD-C4FB-46F4-F8FF-7551D08E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2FE6CC597AEE-AE28-4E54-D6C1-8543A35D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F49D9FE93508-AE4B-AB54-CB98-95F3536A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7F816E0B0765-1C09-8C94-FD9F-7901ECCF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E906D12D14BE-370A-2C64-A58B-38133BE9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5F1CF07DFD99-A7A8-1B54-33A0-1A1C633B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4234BF814236-F61A-DD84-874C-8CAF2203{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3BBF947A277E-0D79-BA14-BEFB-A245E927{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FFFA155C3B44-175B-7184-696D-1AAE6F02{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F1FA6A80F2B7-19BA-DED4-DEC8-3771FD51{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A0F5F93C4CB8-B9E8-4CD4-7A35-08FD85E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BA9C4F4AAF81-164B-5EF4-3020-31248D35{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AB8601D0918A-EEAB-AA74-0C62-1DA6EC28{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}977A16EC1D4E-1778-E0F4-B635-4524BC3A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FFC111363F94-B3DB-8AD4-1C00-0A5C2A20{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04E1C6A2BAC1-5CE9-9354-FABC-D99396A9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C9163D48DE10-DD78-ADF4-73D0-80FB67A4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7AFCCB471493-0769-A194-67D0-75B92009{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3CC5CC449FB2-CCBB-D3C4-1769-1B055588{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FE2F9D423460-BE7A-3B74-B9B4-EB10A69C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A37ECD46C490-194B-3024-789B-2C133942{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}11B16782F06A-62E9-F8B4-19AD-8E9572E0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5867F03BB6E1-A9E9-DFE4-912F-44BF39D8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0D06F5165FC5-6579-5174-6904-9AAB3871{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}23C328800213-63D9-8664-1512-28408CBC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3EC717A5E89-BEC9-0BC4-9E31-EB5CBFFD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7EBA9F4C44D9-5FDB-C974-D169-01E35E29{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}442086AF2993-6AC8-C154-9DD2-F6E0451A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0DDD50E4EE98-1539-95F4-23EC-D03BA246{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD9609389C4F-2398-59E4-6D7F-59617F0C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D280CF869567-686B-AD04-273E-A871552E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CC475FCEB458-2D4A-8AE4-3E52-1F485413{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\dnfmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E68AEE1CB52D-BC29-EF24-FAA3-45221255{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E97C8F7D59DF-77F9-F054-E484-BA50496A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}06CCF9546777-1E4A-FA94-3DBD-C03F52BE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FDF3B2FF9AE7-6CCA-1464-344E-5772850E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D914C80F334F-20AB-9B24-9A6F-54F2BF6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}634160A47D27-450A-6064-8597-3CEEBDCF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\golmedi
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\puorgdopd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nbilbaj
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nlcalik
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmhlj.exe"=-
"dmfnd.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\DMMPS.EXE
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
* csr.exe C:\WINDOWS\System32\CSVDI.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSVDI.EXE 51,237 2006-07-01
C:\WINDOWS\SYSTEM32\DMFND.EXE 44,087 2004-08-04
C:\WINDOWS\SYSTEM32\DMMPS.EXE 44,032 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{314584F1-25E3-4EA8-A4D2-854BECF574CC}.exe
{E255178A-E372-40DA-B686-765968FC082D}.exe
{C0F71695-F7D6-4E95-8932-F4C9839069DD}.exe
{642AB30D-CE32-4F59-9351-89EE4E05DDD0}.exe
{885550B1-9671-4C3D-BBCC-2BF944CC5CC3}.exe
{F87F30F9-AA59-455C-8CF9-7B5CDF923B7D}.exe
{87F9B60F-1CEF-4D70-A5D8-478D5DC34B52}.exe
{873402CE-C54A-46A2-A681-316417A00BFD}.exe
{B59108B5-0FC1-44A8-A09A-FE7B4181BCB4}.exe
{4291521C-2F11-442C-81DB-0F76336A17BD}.exe
Post #7
Sure, here it is, Thanks


Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2CD11BFF3C18-3339-81F4-4A8B-E24E6F31{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BFD9F2DD2F93-0BA8-9BF4-FCB9-08CFE969{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4964B1296FD5-E3FB-5DF4-6EB6-E0D5C196{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F3E618415E1E-6EBA-1C94-001C-2162A5AB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6085170864AF-DB69-EB64-71FE-C01B464E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}208F8A4F91BC-0339-3754-49CA-A2F01E6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5973C25259AD-140A-8E24-440A-0BAC0BC1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0B28900B45C3-038A-7704-FB80-7E2764B3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}223031727811-3859-0134-67D3-B663BB86{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4E8100AB1D48-F6DA-FE34-8EC7-494C81CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2E546173241B-79D8-1624-7E35-F3D08306{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97283A5964D8-3C98-4A24-E46F-F1B25757{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B67607F1D47B-EF6B-F4D4-A8D7-7FD72881{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E94D56457DF4-AD2A-3204-A6BF-10C08430{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}11DDB064AB90-9E9A-52B4-1598-87198A28{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}789B0471E8A3-CA0B-6684-CBC9-8D408B11{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD588B24D79F-1809-7C24-1606-5C316EFC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6A638D1923C1-8F0B-56C4-AC1A-79981DDB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A5501C2C037B-DFBB-E674-AA2A-2011B171{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A7305D60FCF5-EC6A-2074-7068-2BF2E1C1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3D89560AD0D0-1828-5C44-37C4-E9D5C8B6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}889846F256DB-6258-A924-E145-0B6A4552{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AAE914E43676-C7A8-D0F4-C3A1-E79C6C88{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}88838CF83AED-C67B-1614-DFDD-20EDE7BD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1186AA8A011C-4FA8-7F44-B1F9-63CF8D84{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}999400F3C7D6-B6E8-78A4-EEF1-0DF233C6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BE1D41956964-8BA8-ECD4-0AE4-4FA4FBBA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}138937517321-51D8-4CB4-ACF5-6FAD37CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D93AD7C67429-A898-D3F4-AC29-C4D7D7E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C3C88AA43475-0FCA-B2F4-E224-53EB58BC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8995D4FC3BF2-BA2B-FD94-8C56-5B246A4F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}14E4A69EA57C-0B4B-8E34-07CF-05189FC0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}77EBAE2BF4A8-23F8-61A4-9CDA-CD7545B2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D27BD622FE0E-44AA-5894-DE90-975FE013{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3C373D0752DF-34BB-8AA4-E379-90A180A2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0ED5FC300745-1A28-5314-DD5A-9EA0DA6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CA57A75E8705-FC28-E864-9F14-6E812AB7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97A7086C3CAE-22D8-D4A4-5388-4805FC94{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FCA4B55E9FAF-1FEA-89A4-6233-33DD07D8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}85E0E8314E2E-F1B8-F164-4496-C372E8FD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}324F4EBC6B5A-6FBB-2EE4-420A-3000F62F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}834C04F3FD97-2B7B-5C54-1CD6-0CED0E1D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ED19507A320E-539A-1E94-A17C-CD13BD8B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}22D9924DE068-40E8-1A14-15A5-F3E1E976{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F5C934333943-72EA-2504-20CE-B2C927CF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}47C67929A5E0-03CA-E0C4-503F-CCC211DE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C2FECD5A48BD-C4FB-46F4-F8FF-7551D08E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2FE6CC597AEE-AE28-4E54-D6C1-8543A35D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F49D9FE93508-AE4B-AB54-CB98-95F3536A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7F816E0B0765-1C09-8C94-FD9F-7901ECCF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E906D12D14BE-370A-2C64-A58B-38133BE9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5F1CF07DFD99-A7A8-1B54-33A0-1A1C633B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4234BF814236-F61A-DD84-874C-8CAF2203{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3BBF947A277E-0D79-BA14-BEFB-A245E927{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FFFA155C3B44-175B-7184-696D-1AAE6F02{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F1FA6A80F2B7-19BA-DED4-DEC8-3771FD51{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A0F5F93C4CB8-B9E8-4CD4-7A35-08FD85E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BA9C4F4AAF81-164B-5EF4-3020-31248D35{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AB8601D0918A-EEAB-AA74-0C62-1DA6EC28{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}977A16EC1D4E-1778-E0F4-B635-4524BC3A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FFC111363F94-B3DB-8AD4-1C00-0A5C2A20{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04E1C6A2BAC1-5CE9-9354-FABC-D99396A9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C9163D48DE10-DD78-ADF4-73D0-80FB67A4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7AFCCB471493-0769-A194-67D0-75B92009{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3CC5CC449FB2-CCBB-D3C4-1769-1B055588{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FE2F9D423460-BE7A-3B74-B9B4-EB10A69C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A37ECD46C490-194B-3024-789B-2C133942{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}11B16782F06A-62E9-F8B4-19AD-8E9572E0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5867F03BB6E1-A9E9-DFE4-912F-44BF39D8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0D06F5165FC5-6579-5174-6904-9AAB3871{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}23C328800213-63D9-8664-1512-28408CBC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3EC717A5E89-BEC9-0BC4-9E31-EB5CBFFD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7EBA9F4C44D9-5FDB-C974-D169-01E35E29{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}442086AF2993-6AC8-C154-9DD2-F6E0451A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0DDD50E4EE98-1539-95F4-23EC-D03BA246{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD9609389C4F-2398-59E4-6D7F-59617F0C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D280CF869567-686B-AD04-273E-A871552E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CC475FCEB458-2D4A-8AE4-3E52-1F485413{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\dnfmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E68AEE1CB52D-BC29-EF24-FAA3-45221255{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E97C8F7D59DF-77F9-F054-E484-BA50496A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}06CCF9546777-1E4A-FA94-3DBD-C03F52BE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FDF3B2FF9AE7-6CCA-1464-344E-5772850E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D914C80F334F-20AB-9B24-9A6F-54F2BF6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}634160A47D27-450A-6064-8597-3CEEBDCF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\golmedi
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\puorgdopd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nbilbaj
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nlcalik
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmhlj.exe"=-
"dmfnd.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\DMMPS.EXE
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
* csr.exe C:\WINDOWS\System32\CSVDI.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSVDI.EXE 51,237 2006-07-01
C:\WINDOWS\SYSTEM32\DMFND.EXE 44,087 2004-08-04
C:\WINDOWS\SYSTEM32\DMMPS.EXE 44,032 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{314584F1-25E3-4EA8-A4D2-854BECF574CC}.exe
{E255178A-E372-40DA-B686-765968FC082D}.exe
{C0F71695-F7D6-4E95-8932-F4C9839069DD}.exe
{642AB30D-CE32-4F59-9351-89EE4E05DDD0}.exe
{885550B1-9671-4C3D-BBCC-2BF944CC5CC3}.exe
{F87F30F9-AA59-455C-8CF9-7B5CDF923B7D}.exe
{87F9B60F-1CEF-4D70-A5D8-478D5DC34B52}.exe
{873402CE-C54A-46A2-A681-316417A00BFD}.exe
{B59108B5-0FC1-44A8-A09A-FE7B4181BCB4}.exe
{4291521C-2F11-442C-81DB-0F76336A17BD}.exe



Logfile of HijackThis v1.99.1
Scan saved at 7:17:12 AM, on 7/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [inrxu.exe] C:\WINDOWS\system32\inrxu.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #8
Please disable Teatimer, it can interfere with the cleaning process:

on the Teatimer icon in the system tray, and "Exit"

Then do this:

How to Disable Teatimer

After we have cleaned your system, please be sure to reverse this process, and re-enable Teatimer.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [inrxu.exe] C:\WINDOWS\system32\inrxu.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\windows\system32\inrxu.exe <— file

C:\WINDOWS\SYSTEM32\CSVDI.EXE <— file

C:\WINDOWS\SYSTEM32\DMFND.EXE <— file

C:\WINDOWS\SYSTEM32\DMMPS.EXE <— file

C:\WINDOWS\SYSTEM32\{314584F1-25E3-4EA8-A4D2-854BECF574CC}.exe <— file

C:\WINDOWS\SYSTEM32\{E255178A-E372-40DA-B686-765968FC082D}.exe <— file

C:\WINDOWS\SYSTEM32\{C0F71695-F7D6-4E95-8932-F4C9839069DD}.exe <— file

C:\WINDOWS\SYSTEM32\{642AB30D-CE32-4F59-9351-89EE4E05DDD0}.exe <— file

C:\WINDOWS\SYSTEM32\{885550B1-9671-4C3D-BBCC-2BF944CC5CC3}.exe <— file

C:\WINDOWS\SYSTEM32\{F87F30F9-AA59-455C-8CF9-7B5CDF923B7D}.exe <— file

C:\WINDOWS\SYSTEM32\{87F9B60F-1CEF-4D70-A5D8-478D5DC34B52}.exe <— file

C:\WINDOWS\SYSTEM32\{873402CE-C54A-46A2-A681-316417A00BFD}.exe <— file

C:\WINDOWS\SYSTEM32\{B59108B5-0FC1-44A8-A09A-FE7B4181BCB4}.exe <— file

C:\WINDOWS\SYSTEM32\{4291521C-2F11-442C-81DB-0F76336A17BD}.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread. :)
Post #9
Logfile of HijackThis v1.99.1
Scan saved at 7:03:58 AM, on 7/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [nenes.exe] C:\WINDOWS\system32\nenes.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
Post #10
Download Blacklight Beta from here:
Blacklight Beta

Hit I accept. It will take you to download page.

Download blbeta.exe and save it to the Desktop.

Once saved… double click blbeta.exe to install the program.

Click accept agreement and Click scan

This application may cause a warning from your antivirus. Let it load.

Wait for it to finish.

If it displays any items…don't do anything with them yet. Just hit exit (close)

It will drop a log on Desktop that starts with fsbl….(big number)

Post that log.
:)
Post #11
This is the error I get when trying to go to that site, and I searched the site for that program and sttill couldn't find it. A system error reading a resource occured! Server error 404
Post #13
07/09/06 05:09:47 [Info]: BlackLight Engine 1.0.42 initialized 07/09/06 05:09:47 [Info]: OS: 5.1 build 2600 (Service Pack 2) 07/09/06 05:09:47 [Note]: 7019 4 07/09/06 05:09:47 [Note]: 7005 0 07/09/06 05:09:53 [Note]: 7006 0 07/09/06 05:09:53 [Note]: 7011 1396 07/09/06 05:09:54 [Note]: 7026 0 07/09/06 05:09:54 [Note]: 7026 0 07/09/06 05:10:23 [Note]: FSRAW library version 1.7.1019 07/09/06 05:13:00 [Info]: Hidden file: c:\WINDOWS\system32\cswjo.exe 07/09/06 05:13:00 [Note]: 7002 32 07/09/06 05:13:00 [Note]: 7003 1 07/09/06 05:13:00 [Note]: 10002 1 07/09/06 05:13:02 [Info]: Hidden file: c:\WINDOWS\system32\dmxxy.exe 07/09/06 05:13:02 [Note]: 7002 32 07/09/06 05:13:02 [Note]: 7003 1 07/09/06 05:13:02 [Note]: 10002 1 07/09/06 05:13:10 [Info]: Hidden file: c:\WINDOWS\system32\{020F9556-A324-4C9D-9729-D4770136B0CB}.exe 07/09/06 05:13:10 [Note]: 7002 5 07/09/06 05:13:10 [Note]: 7003 1 07/09/06 05:13:10 [Note]: 10002 1 07/09/06 05:13:11 [Info]: Hidden file: c:\WINDOWS\system32\{1236FA4D-34FB-40AB-B6E1-FC579FE02558}.exe 07/09/06 05:13:11 [Note]: 7002 5 07/09/06 05:13:11 [Note]: 7003 1 07/09/06 05:13:11 [Note]: 10002 1 07/09/06 05:13:11 [Info]: Hidden file: c:\WINDOWS\system32\{15E9693C-AC2A-4B76-B9C0-33BC368504A3}.exe 07/09/06 05:13:11 [Note]: 7002 5 07/09/06 05:13:11 [Note]: 7003 1 07/09/06 05:13:11 [Note]: 10002 1 07/09/06 05:13:13 [Info]: Hidden file: c:\WINDOWS\system32\{1BA07900-4850-44A9-8E67-7FD5C371026F}.exe 07/09/06 05:13:13 [Note]: 7002 5 07/09/06 05:13:13 [Note]: 7003 1 07/09/06 05:13:13 [Note]: 10002 1 07/09/06 05:13:14 [Info]: Hidden file: c:\WINDOWS\system32\{2068B8B3-98C1-4D3A-A004-5691F65D78CD}.exe 07/09/06 05:13:14 [Note]: 7002 5 07/09/06 05:13:14 [Note]: 7003 1 07/09/06 05:13:14 [Note]: 10002 1 07/09/06 05:13:15 [Info]: Hidden file: c:\WINDOWS\system32\{231DD987-7E5B-40B7-9653-9F538A949D8C}.exe 07/09/06 05:13:15 [Note]: 10002 1 07/09/06 05:13:15 [Info]: Hidden file: c:\WINDOWS\system32\{39AA45F6-7349-4EF2-9024-D97A8D407F83}.exe 07/09/06 05:13:15 [Note]: 7002 5 07/09/06 05:13:15 [Note]: 7003 1 07/09/06 05:13:15 [Note]: 10002 1 07/09/06 05:13:16 [Info]: Hidden file: c:\WINDOWS\system32\{40ED4BB0-8A30-4232-AAA3-7A2BE9A3354D}.exe 07/09/06 05:13:16 [Note]: 7002 5 07/09/06 05:13:16 [Note]: 7003 1 07/09/06 05:13:16 [Note]: 10002 1 07/09/06 05:13:17 [Info]: Hidden file: c:\WINDOWS\system32\{515F1187-16D5-48D4-8BFC-B9E61E9E7733}.exe 07/09/06 05:13:17 [Note]: 7002 5 07/09/06 05:13:17 [Note]: 7003 1 07/09/06 05:13:17 [Note]: 10002 1 07/09/06 05:13:18 [Info]: Hidden file: c:\WINDOWS\system32\{61D5C641-4256-4150-B4CF-CAA0690C6DC3}.exe 07/09/06 05:13:18 [Note]: 7002 5 07/09/06 05:13:18 [Note]: 7003 1 07/09/06 05:13:18 [Note]: 10002 1 07/09/06 05:13:19 [Info]: Hidden file: c:\WINDOWS\system32\{635D4BB7-7B44-4240-9311-7C4A736987DB}.exe 07/09/06 05:13:19 [Note]: 7002 5 07/09/06 05:13:19 [Note]: 7003 1 07/09/06 05:13:19 [Note]: 10002 1 07/09/06 05:13:21 [Info]: Hidden file: c:\WINDOWS\system32\{6BF5373A-3BA6-4965-B2F2-CB945572DFDF}.exe 07/09/06 05:13:21 [Note]: 7002 5 07/09/06 05:13:21 [Note]: 7003 1 07/09/06 05:13:21 [Note]: 10002 1 07/09/06 05:13:22 [Info]: Hidden file: c:\WINDOWS\system32\{6E8854F7-BD77-4A26-BB30-7190E7FA0ACE}.exe 07/09/06 05:13:22 [Note]: 7002 5 07/09/06 05:13:22 [Note]: 7003 1 07/09/06 05:13:22 [Note]: 10002 1 07/09/06 05:13:22 [Info]: Hidden file: c:\WINDOWS\system32\{BDCEACA3-4B9A-4620-AF93-08FB9A855882}.exe 07/09/06 05:13:22 [Note]: 10002 1 07/09/06 05:13:24 [Info]: Hidden file: c:\WINDOWS\system32\{C6BA7FB9-9485-4E56-8161-2E3B685174A4}.exe 07/09/06 05:13:24 [Note]: 7002 5 07/09/06 05:13:24 [Note]: 7003 1 07/09/06 05:13:24 [Note]: 10002 1 07/09/06 05:13:25 [Info]: Hidden file: c:\WINDOWS\system32\{CD8168E7-E561-4CAD-BC24-6D8250493AE4}.exe 07/09/06 05:13:25 [Note]: 7002 5 07/09/06 05:13:25 [Note]: 7003 1 07/09/06 05:13:25 [Note]: 10002 1 07/09/06 05:13:26 [Info]: Hidden file: c:\WINDOWS\system32\{D1AABA36-3086-4B93-A4CA-1B9ED6B286F2}.exe 07/09/06 05:13:26 [Note]: 7002 5 07/09/06 05:13:26 [Note]: 7003 1 07/09/06 05:13:26 [Note]: 10002 1 07/09/06 05:13:26 [Info]: Hidden file: c:\WINDOWS\system32\{E2BEABE7-FA9A-4D1E-900B-CB3F0FF1D98F}.exe 07/09/06 05:13:26 [Note]: 10002 1 07/09/06 05:13:27 [Info]: Hidden file: c:\WINDOWS\system32\{E4279BFA-1229-48DD-B84E-135D1C178A79}.exe 07/09/06 05:13:27 [Note]: 10002 1 07/09/06 05:13:28 [Info]: Hidden file: c:\WINDOWS\system32\{E8FD65CA-0F57-4C64-BC5C-3D7A5B25D65C}.exe 07/09/06 05:13:28 [Note]: 7002 5 07/09/06 05:13:28 [Note]: 7003 1 07/09/06 05:13:28 [Note]: 10002 1 07/09/06 05:13:29 [Info]: Hidden file: c:\WINDOWS\system32\{E9A7C61D-566A-4BAC-A4DB-77BDDEFD07F2}.exe 07/09/06 05:13:29 [Note]: 7002 5 07/09/06 05:13:29 [Note]: 7003 1 07/09/06 05:13:29 [Note]: 10002 1 07/09/06 05:13:29 [Info]: Hidden file: c:\WINDOWS\system32\{9345CD80-AB68-4486-8F9B-DFCD6E3F744F}.exe 07/09/06 05:13:29 [Note]: 7002 5 07/09/06 05:13:29 [Note]: 7003 1 07/09/06 05:13:29 [Note]: 10002 1 07/09/06 05:13:29 [Info]: Hidden file: c:\WINDOWS\system32\{93E6EC3F-1BEF-4745-BE02-FCD3AB935444}.exe 07/09/06 05:13:30 [Note]: 7002 5 07/09/06 05:13:30 [Note]: 7003 1 07/09/06 05:13:30 [Note]: 10002 1 07/09/06 05:13:30 [Info]: Hidden file: c:\WINDOWS\system32\{94452A2E-A7DC-407F-A952-0961953FFE1D}.exe 07/09/06 05:13:30 [Note]: 7002 5 07/09/06 05:13:30 [Note]: 7003 1 07/09/06 05:13:30 [Note]: 10002 1 07/09/06 05:13:31 [Info]: Hidden file: c:\WINDOWS\system32\{AB34B74C-1C0E-4B49-BACA-A6A1D7CF1D3F}.exe 07/09/06 05:13:31 [Note]: 7002 5 07/09/06 05:13:31 [Note]: 7003 1 07/09/06 05:13:31 [Note]: 10002 1 07/09/06 05:13:32 [Info]: Hidden file: c:\WINDOWS\system32\{AC5A2EFC-8F2F-4244-8128-536AC1C222F0}.exe 07/09/06 05:13:32 [Note]: 7002 5 07/09/06 05:13:32 [Note]: 7003 1 07/09/06 05:13:32 [Note]: 10002 1 07/09/06 05:13:32 [Info]: Hidden file: c:\WINDOWS\system32\{B63398E1-2032-45CE-AE67-AB1E2F563645}.exe 07/09/06 05:13:32 [Note]: 7002 5 07/09/06 05:13:32 [Note]: 7003 1 07/09/06 05:13:32 [Note]: 10002 1 07/09/06 05:13:33 [Info]: Hidden file: c:\WINDOWS\system32\{B795B7EC-2658-470B-ABF7-A750970E39F0}.exe 07/09/06 05:13:33 [Note]: 7002 5 07/09/06 05:13:33 [Note]: 7003 1 07/09/06 05:13:33 [Note]: 10002 1 07/09/06 05:13:33 [Info]: Hidden file: c:\WINDOWS\system32\{B807C9FF-9F9F-4C18-9AE8-987FFC7AB2EA}.exe 07/09/06 05:13:33 [Note]: 7002 5 07/09/06 05:13:33 [Note]: 7003 1 07/09/06 05:13:33 [Note]: 10002 1 07/09/06 05:13:34 [Info]: Hidden file: c:\WINDOWS\system32\{BB2C845E-27B8-46B0-82D2-57F1426D386F}.exe 07/09/06 05:13:35 [Note]: 7002 5 07/09/06 05:13:35 [Note]: 7003 1 07/09/06 05:13:35 [Note]: 10002 1 07/09/06 05:13:35 [Info]: Hidden file: c:\WINDOWS\system32\{EB255ED4-469F-4295-B3BF-5221AFC02DB5}.exe 07/09/06 05:13:35 [Note]: 7002 5 07/09/06 05:13:35 [Note]: 7003 1 07/09/06 05:13:35 [Note]: 10002 1 07/09/06 05:13:36 [Info]: Hidden file: c:\WINDOWS\system32\{ED9B4695-9EDB-4F0D-822F-91128C60D3BD}.exe 07/09/06 05:13:36 [Note]: 7002 5 07/09/06 05:13:36 [Note]: 7003 1 07/09/06 05:13:36 [Note]: 10002 1 07/09/06 05:13:36 [Info]: Hidden file: c:\WINDOWS\system32\{F48FA274-667E-40F6-BF11-42EDDC582726}.exe 07/09/06 05:13:36 [Note]: 7002 5 07/09/06 05:13:36 [Note]: 7003 1 07/09/06 05:13:36 [Note]: 10002 1 07/09/06 05:13:37 [Info]: Hidden file: c:\WINDOWS\system32\{F4E4C85C-498A-4A1F-90D7-C93794537FB3}.exe 07/09/06 05:13:37 [Note]: 7002 5 07/09/06 05:13:37 [Note]: 7003 1 07/09/06 05:13:37 [Note]: 10002 1 07/09/06 05:13:38 [Info]: Hidden file: c:\WINDOWS\system32\{FB55BF09-0EBE-4755-9925-81F8194A97A1}.exe 07/09/06 05:13:38 [Note]: 7002 5 07/09/06 05:13:38 [Note]: 7003 1 07/09/06 05:13:38 [Note]: 10002 1 07/09/06 05:13:39 [Info]: Hidden file: c:\WINDOWS\system32\{FC7BCF4F-1C70-4ACF-B219-ABA3F5C00B7C}.exe 07/09/06 05:13:39 [Note]: 7002 5 07/09/06 05:13:39 [Note]: 7003 1 07/09/06 05:13:39 [Note]: 10002 1 07/09/06 05:13:39 [Info]: Hidden file: c:\WINDOWS\system32\{FD2D210F-8E7C-418B-93E6-287C336F78F0}.exe 07/09/06 05:13:39 [Note]: 7002 5 07/09/06 05:13:39 [Note]: 7003 1 07/09/06 05:13:39 [Note]: 10002 1 07/09/06 05:13:39 [Info]: Hidden file: c:\WINDOWS\system32\{FD944622-BEA1-488F-B009-50EA1ABE2B41}.exe 07/09/06 05:13:40 [Note]: 7002 5 07/09/06 05:13:40 [Note]: 7003 1 07/09/06 05:13:40 [Note]: 10002 1 07/09/06 05:20:17 [Error]: 6019 0
Post #14
To be honest, I'm asking a few others to "peek" at this. If this is a "rootkit", we have a dilemma. We can try to eliminate it. The only problem with that is since it's a "rootkit", we can't be positive we kill it all. There still may be remnants lurking. Or you can reformat your C: drive. Which course of action would you prefer? :unsure:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI