HiJack This

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2CD11BFF3C18-3339-81F4-4A8B-E24E6F31{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BFD9F2DD2F93-0BA8-9BF4-FCB9-08CFE969{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4964B1296FD5-E3FB-5DF4-6EB6-E0D5C196{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F3E618415E1E-6EBA-1C94-001C-2162A5AB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6085170864AF-DB69-EB64-71FE-C01B464E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}208F8A4F91BC-0339-3754-49CA-A2F01E6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5973C25259AD-140A-8E24-440A-0BAC0BC1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0B28900B45C3-038A-7704-FB80-7E2764B3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}223031727811-3859-0134-67D3-B663BB86{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4E8100AB1D48-F6DA-FE34-8EC7-494C81CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2E546173241B-79D8-1624-7E35-F3D08306{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97283A5964D8-3C98-4A24-E46F-F1B25757{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B67607F1D47B-EF6B-F4D4-A8D7-7FD72881{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E94D56457DF4-AD2A-3204-A6BF-10C08430{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}11DDB064AB90-9E9A-52B4-1598-87198A28{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}789B0471E8A3-CA0B-6684-CBC9-8D408B11{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD588B24D79F-1809-7C24-1606-5C316EFC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6A638D1923C1-8F0B-56C4-AC1A-79981DDB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A5501C2C037B-DFBB-E674-AA2A-2011B171{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A7305D60FCF5-EC6A-2074-7068-2BF2E1C1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3D89560AD0D0-1828-5C44-37C4-E9D5C8B6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}889846F256DB-6258-A924-E145-0B6A4552{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AAE914E43676-C7A8-D0F4-C3A1-E79C6C88{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}88838CF83AED-C67B-1614-DFDD-20EDE7BD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1186AA8A011C-4FA8-7F44-B1F9-63CF8D84{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}999400F3C7D6-B6E8-78A4-EEF1-0DF233C6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BE1D41956964-8BA8-ECD4-0AE4-4FA4FBBA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}138937517321-51D8-4CB4-ACF5-6FAD37CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D93AD7C67429-A898-D3F4-AC29-C4D7D7E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C3C88AA43475-0FCA-B2F4-E224-53EB58BC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8995D4FC3BF2-BA2B-FD94-8C56-5B246A4F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}14E4A69EA57C-0B4B-8E34-07CF-05189FC0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}77EBAE2BF4A8-23F8-61A4-9CDA-CD7545B2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D27BD622FE0E-44AA-5894-DE90-975FE013{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3C373D0752DF-34BB-8AA4-E379-90A180A2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0ED5FC300745-1A28-5314-DD5A-9EA0DA6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CA57A75E8705-FC28-E864-9F14-6E812AB7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97A7086C3CAE-22D8-D4A4-5388-4805FC94{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FCA4B55E9FAF-1FEA-89A4-6233-33DD07D8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}85E0E8314E2E-F1B8-F164-4496-C372E8FD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}324F4EBC6B5A-6FBB-2EE4-420A-3000F62F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}834C04F3FD97-2B7B-5C54-1CD6-0CED0E1D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ED19507A320E-539A-1E94-A17C-CD13BD8B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}22D9924DE068-40E8-1A14-15A5-F3E1E976{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F5C934333943-72EA-2504-20CE-B2C927CF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}47C67929A5E0-03CA-E0C4-503F-CCC211DE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C2FECD5A48BD-C4FB-46F4-F8FF-7551D08E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2FE6CC597AEE-AE28-4E54-D6C1-8543A35D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F49D9FE93508-AE4B-AB54-CB98-95F3536A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7F816E0B0765-1C09-8C94-FD9F-7901ECCF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E906D12D14BE-370A-2C64-A58B-38133BE9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5F1CF07DFD99-A7A8-1B54-33A0-1A1C633B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4234BF814236-F61A-DD84-874C-8CAF2203{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3BBF947A277E-0D79-BA14-BEFB-A245E927{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FFFA155C3B44-175B-7184-696D-1AAE6F02{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F1FA6A80F2B7-19BA-DED4-DEC8-3771FD51{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A0F5F93C4CB8-B9E8-4CD4-7A35-08FD85E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BA9C4F4AAF81-164B-5EF4-3020-31248D35{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AB8601D0918A-EEAB-AA74-0C62-1DA6EC28{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}977A16EC1D4E-1778-E0F4-B635-4524BC3A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FFC111363F94-B3DB-8AD4-1C00-0A5C2A20{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04E1C6A2BAC1-5CE9-9354-FABC-D99396A9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C9163D48DE10-DD78-ADF4-73D0-80FB67A4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7AFCCB471493-0769-A194-67D0-75B92009{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3CC5CC449FB2-CCBB-D3C4-1769-1B055588{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FE2F9D423460-BE7A-3B74-B9B4-EB10A69C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A37ECD46C490-194B-3024-789B-2C133942{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}11B16782F06A-62E9-F8B4-19AD-8E9572E0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5867F03BB6E1-A9E9-DFE4-912F-44BF39D8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0D06F5165FC5-6579-5174-6904-9AAB3871{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}23C328800213-63D9-8664-1512-28408CBC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3EC717A5E89-BEC9-0BC4-9E31-EB5CBFFD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7EBA9F4C44D9-5FDB-C974-D169-01E35E29{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}442086AF2993-6AC8-C154-9DD2-F6E0451A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0DDD50E4EE98-1539-95F4-23EC-D03BA246{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD9609389C4F-2398-59E4-6D7F-59617F0C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D280CF869567-686B-AD04-273E-A871552E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CC475FCEB458-2D4A-8AE4-3E52-1F485413{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\dnfmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E68AEE1CB52D-BC29-EF24-FAA3-45221255{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E97C8F7D59DF-77F9-F054-E484-BA50496A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}06CCF9546777-1E4A-FA94-3DBD-C03F52BE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FDF3B2FF9AE7-6CCA-1464-344E-5772850E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D914C80F334F-20AB-9B24-9A6F-54F2BF6A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}634160A47D27-450A-6064-8597-3CEEBDCF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\putesprpgd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\golmedi
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\puorgdopd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nbilbaj
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nlcalik
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ypszr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\lavinraCputeS
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmhlj.exe"=-
"dmfnd.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\DMMPS.EXE
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
* csr.exe C:\WINDOWS\System32\CSVDI.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSVDI.EXE 51,237 2006-07-01
C:\WINDOWS\SYSTEM32\DMFND.EXE 44,087 2004-08-04
C:\WINDOWS\SYSTEM32\DMMPS.EXE 44,032 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{314584F1-25E3-4EA8-A4D2-854BECF574CC}.exe
{E255178A-E372-40DA-B686-765968FC082D}.exe
{C0F71695-F7D6-4E95-8932-F4C9839069DD}.exe
{642AB30D-CE32-4F59-9351-89EE4E05DDD0}.exe
{885550B1-9671-4C3D-BBCC-2BF944CC5CC3}.exe
{F87F30F9-AA59-455C-8CF9-7B5CDF923B7D}.exe
{87F9B60F-1CEF-4D70-A5D8-478D5DC34B52}.exe
{873402CE-C54A-46A2-A681-316417A00BFD}.exe
{B59108B5-0FC1-44A8-A09A-FE7B4181BCB4}.exe
{4291521C-2F11-442C-81DB-0F76336A17BD}.exe

Logfile of HijackThis v1.99.1
Scan saved at 2:59:07 AM, on 7/13/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [imcgz.exe] C:\WINDOWS\system32\imcgz.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Copy the text in the following quote box into Notepad:
Save it to where you can find it ("browsing" with the task manager) as kgb.bat.

attrib -r -s -h c:\WINDOWS\system32\{027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
del c:\WINDOWS\system32\{027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
attrib -r -s -h c:\WINDOWS\system32\{057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
del c:\WINDOWS\system32\{057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
attrib -r -s -h c:\WINDOWS\system32\{0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
del c:\WINDOWS\system32\{0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
attrib -r -s -h c:\WINDOWS\system32\{1FF9C484-DA39-4B12-81DC-25C180C68B98}.exe
del c:\WINDOWS\system32\{1FF9C484-DA39-4B12-81DC-25C180C68B98}.exe
attrib -r -s -h c:\WINDOWS\system32\{314584F1-25E3-4EA8-A4D2-854BECF574CC}.exe
del c:\WINDOWS\system32\{314584F1-25E3-4EA8-A4D2-854BECF574CC}.exe
attrib -r -s -h c:\WINDOWS\system32\{4291521C-2F11-442C-81DB-0F76336A17BD}.exe
del c:\WINDOWS\system32\{4291521C-2F11-442C-81DB-0F76336A17BD}.exe
attrib -r -s -h c:\WINDOWS\system32\{59DC70AD-00E1-44A2-AE64-C9CD2432ED5E}.exe
del c:\WINDOWS\system32\{59DC70AD-00E1-44A2-AE64-C9CD2432ED5E}.exe
attrib -r -s -h c:\WINDOWS\system32\{642AB30D-CE32-4F59-9351-89EE4E05DDD0}.exe
del c:\WINDOWS\system32\{642AB30D-CE32-4F59-9351-89EE4E05DDD0}.exe
attrib -r -s -h c:\WINDOWS\system32\{69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
del c:\WINDOWS\system32\{69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
attrib -r -s -h c:\WINDOWS\system32\{6FE3D6A3-F21E-4315-AEC4-BA6930BC6C22}.exe
del c:\WINDOWS\system32\{6FE3D6A3-F21E-4315-AEC4-BA6930BC6C22}.exe
attrib -r -s -h c:\WINDOWS\system32\{7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
del c:\WINDOWS\system32\{7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
attrib -r -s -h c:\WINDOWS\system32\{7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
del c:\WINDOWS\system32\{7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
attrib -r -s -h c:\WINDOWS\system32\{873402CE-C54A-46A2-A681-316417A00BFD}.exe
del c:\WINDOWS\system32\{873402CE-C54A-46A2-A681-316417A00BFD}.exe
attrib -r -s -h c:\WINDOWS\system32\{87F9B60F-1CEF-4D70-A5D8-478D5DC34B52}.exe
del c:\WINDOWS\system32\{87F9B60F-1CEF-4D70-A5D8-478D5DC34B52}.exe
attrib -r -s -h c:\WINDOWS\system32\{885550B1-9671-4C3D-BBCC-2BF944CC5CC3}.exe
del c:\WINDOWS\system32\{885550B1-9671-4C3D-BBCC-2BF944CC5CC3}.exe
attrib -r -s -h c:\WINDOWS\system32\{A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
del c:\WINDOWS\system32\{A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
attrib -r -s -h c:\WINDOWS\system32\{ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
del c:\WINDOWS\system32\{ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
attrib -r -s -h c:\WINDOWS\system32\{AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
del c:\WINDOWS\system32\{AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
attrib -r -s -h c:\WINDOWS\system32\{B59108B5-0FC1-44A8-A09A-FE7B4181BCB4}.exe
del c:\WINDOWS\system32\{B59108B5-0FC1-44A8-A09A-FE7B4181BCB4}.exe
attrib -r -s -h c:\WINDOWS\system32\{BFAB0CA5-29F2-48CC-A536-257FD4A1254C}.exe
del c:\WINDOWS\system32\{BFAB0CA5-29F2-48CC-A536-257FD4A1254C}.exe
attrib -r -s -h c:\WINDOWS\system32\{C0F71695-F7D6-4E95-8932-F4C9839069DD}.exe
del c:\WINDOWS\system32\{C0F71695-F7D6-4E95-8932-F4C9839069DD}.exe
attrib -r -s -h c:\WINDOWS\system32\{C3FBC837-DECC-442E-BABE-71A8FA088F40}.exe
del c:\WINDOWS\system32\{C3FBC837-DECC-442E-BABE-71A8FA088F40}.exe
attrib -r -s -h c:\WINDOWS\system32\{C5B472FC-3711-435E-A9F4-3595E73FE624}.exe
del c:\WINDOWS\system32\{C5B472FC-3711-435E-A9F4-3595E73FE624}.exe
attrib -r -s -h c:\WINDOWS\system32\{E255178A-E372-40DA-B686-765968FC082D}.exe
del c:\WINDOWS\system32\{E255178A-E372-40DA-B686-765968FC082D}.exe
attrib -r -s -h c:\WINDOWS\system32\{F5E273F5-E72B-4E6D-8062-6506F7A189CF}.exe
del c:\WINDOWS\system32\{F5E273F5-E72B-4E6D-8062-6506F7A189CF}.exe
attrib -r -s -h c:\WINDOWS\system32\{F87F30F9-AA59-455C-8CF9-7B5CDF923B7D}.exe
del c:\WINDOWS\system32\{F87F30F9-AA59-455C-8CF9-7B5CDF923B7D}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSVDI.EXE
del C:\WINDOWS\SYSTEM32\CSVDI.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMFND.EXE
del C:\WINDOWS\SYSTEM32\DMFND.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMMPS.EXE
del C:\WINDOWS\SYSTEM32\DMMPS.EXE
attrib -r -s -h C:\WINDOWS\system32\imcgz.exe
del C:\WINDOWS\system32\imcgz.exe

To eradicate this you'll need to "kill" explorer and iexplore. When explorer is killed, your desktop, start and taskbar will disappear, this is normal. So you will have to perform everything via the taskmanager.

I recommend you save these instructions in Notepad, because you are not allowed to open your browser!!

Leave the notepad file (with these instructions in it) open!!!

Run Hijackthis and leave it open!!!

Open your taskmanager by holding CTRL-ALT-DEL together
Select the "Processes" tab.
Click on "Image name" to sort them alphabetically.
Search for explorer.exe in the list, on it and choose "End process". Your desktop will disappear. This is normal. It will come back when you reboot.

Search for iexplore.exe in the list, on it and choose "End process".

Then, leave your taskmanager open!!

In HijackThis!, click scan and "fix" these entries:

O4 - HKLM\..\Run: [imcgz.exe] C:\WINDOWS\system32\imcgz.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\..\{956EB8C2-1A08-4EC5-9CF0-978B2F09E1B3}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\..\{9D6ACA2F-644D-4962-AC1E-8AE577286EBE}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\..\{F2B4E413-167E-44BD-B951-BDCF20B608FC}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

O17 - HKLM\System\CS1\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

O17 - HKLM\System\CS2\Services\Tcpip\..\{2A2728AE-1EC9-4D17-8C83-A94ED1B79139}: NameServer = 85.255.113.107,85.255.112.121

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.121

Close HijackThis!

In your taskmanager again, click the "Applications" tab.
Click 'New task'.
Click 'browse'
Below in the window, select: 'all files' next to 'files of type'

Now browse to the "kgb.bat" file saved earler, and it.

Then, browse to the fixwareout-folder present on your C:\
Open that folder and doubleclick FixIt.bat

This starts the fixwareoutfix again and will ask to reboot.

After reboot, post a new HijackThis! log together with the fixwareout log.

Also run the "ff.bat" file again, and post the results.

Logfile of HijackThis v1.99.1
Scan saved at 4:21:42 AM, on 7/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0

Directory of c:\WINDOWS\system32

Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0

Directory of c:\WINDOWS\system32

07/10/2006 07:36 AM 5,214 {027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
07/10/2006 05:08 AM 45,568 {057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
07/13/2006 04:44 AM 4,608 {09E53387-35C9-4C3D-AD8A-1958FC1FFBCA}.exe
07/10/2006 07:36 AM 45,568 {0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
07/12/2006 06:24 AM 5,214 {0E057EE0-7E19-4FF2-8E6C-85634E5D8876}.exe
07/13/2006 03:56 AM 4,608 {0F8AC063-96D5-4CCA-8D27-54027B129728}.exe
07/13/2006 03:44 AM 4,608 {18DD2772-A4FC-4DF6-AF56-E9EC5F012A51}.exe
07/13/2006 03:01 AM 4,608 {1D42F29D-1E3C-487C-9DA6-5CE405745663}.exe
07/13/2006 03:13 AM 4,608 {2496BEBC-2B89-4521-9CDD-FD2B37275325}.exe
07/13/2006 05:14 AM 4,608 {295A494F-3A7B-4657-A527-955B7A537BE6}.exe
07/13/2006 05:08 AM 4,608 {2EEB556D-CF4C-48AF-8AF1-3B403A8F6331}.exe
07/13/2006 04:38 AM 4,608 {300A164B-DD5D-4F20-A6FF-BC3EDA6CCF7D}.exe
07/13/2006 03:31 AM 4,608 {342DDD4C-8706-4DF5-ADBA-0DB62B443901}.exe
07/12/2006 06:30 AM 4,608 {346834DB-6098-4BA4-ACD2-8BAA366D3F98}.exe
07/13/2006 05:26 AM 4,608 {3A32253D-C8C1-4909-9B64-3F4B53E9DB94}.exe
07/12/2006 06:24 AM 155,648 {3AD39C41-46B9-48A5-B218-7B87DF969245}.dll
07/13/2006 03:07 AM 4,608 {3E8A1D4D-E2F1-4B91-A7AD-9AB36D1F9B43}.exe
07/13/2006 06:21 AM 4,608 {436C73A1-FF32-49DC-BF0C-2D677F8FA85B}.exe
07/13/2006 05:20 AM 4,608 {44991EFF-AED5-4450-803B-90D0D6A7DECC}.exe
07/13/2006 06:27 AM 4,608 {49AC2CD7-5BA2-49A7-A23B-B749ADAEEA56}.exe
07/13/2006 04:50 AM 4,608 {4EA0E1D4-B4BB-4AF9-8A61-AFCBB1F35ECB}.exe
07/12/2006 07:00 AM 4,608 {561121ED-C1C9-4D4F-8461-2446EB450F80}.exe
07/13/2006 05:38 AM 4,608 {5D689745-69AB-4C7D-9502-5F34B58066DF}.exe
07/12/2006 06:48 AM 4,608 {657126A4-5129-4365-A320-4716EE2FD4FF}.exe
07/13/2006 03:37 AM 4,608 {65F787AC-B96B-4FF7-AA4E-F0EB042D77F4}.exe
07/13/2006 05:32 AM 4,608 {6817964A-0B8B-4210-905F-10A522FA6558}.exe
07/13/2006 04:20 AM 4,608 {6860B3B9-E234-41F9-99A7-4A540BDF107B}.exe
07/10/2006 07:36 AM 155,648 {69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
07/12/2006 06:54 AM 4,608 {6D26C8DB-649B-4299-95E7-2A8634FC371D}.exe
07/13/2006 06:09 AM 4,608 {6DAB8E1D-B2F0-49AF-B34F-8FDDC45F1198}.exe
07/10/2006 05:08 AM 5,214 {7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
07/13/2006 06:33 AM 4,608 {719CB563-B432-4B03-8263-6B7DCE53D65B}.exe
07/12/2006 07:06 AM 4,608 {730C50CC-2C09-40C6-A1EE-57177CC668BB}.exe
07/10/2006 05:08 AM 3,117 {7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
07/13/2006 03:19 AM 4,608 {8528A950-5B41-426F-AC7B-A42D21ED7C95}.exe
07/13/2006 04:32 AM 4,608 {A5441347-FCA8-40DD-8119-CC5D9BA87B4D}.exe
07/10/2006 05:08 AM 424,718 {A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
07/10/2006 07:36 AM 424,718 {ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
07/12/2006 06:24 AM 424,718 {ACA286D7-9C36-4B39-8AA1-A3D3396F693E}.exe
07/13/2006 02:49 AM 4,608 {ADA0A7E8-490F-43D5-A6F8-25A0B4EF3B91}.exe
07/10/2006 07:36 AM 3,117 {AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
07/13/2006 02:55 AM 4,608 {B4AE0A7A-240E-4F49-8CAD-C4643106638D}.exe
07/13/2006 04:56 AM 4,608 {B5216C4A-3165-4DA0-95C4-11CE45682E24}.exe
07/13/2006 05:44 AM 4,608 {B9C335BF-AACB-4272-B638-FAC3B6D45B69}.exe
07/13/2006 04:08 AM 4,608 {BC6083A1-7456-4A1C-AE77-3DC73C44B456}.exe
07/13/2006 06:15 AM 4,608 {C4D5411E-76A9-42D3-9F68-683CFD7A7503}.exe
07/13/2006 04:26 AM 4,608 {C63DDD42-191C-40FC-818A-1CC0D96F2332}.exe
07/13/2006 03:50 AM 4,608 {C645BD61-69D1-4D8F-984F-ECDA55F152AC}.exe
07/13/2006 05:02 AM 4,608 {C64A0552-8DBB-49BD-A817-2698C4F40F16}.exe
07/12/2006 06:24 AM 45,568 {CC2FF979-A3AF-4B6C-B0D3-52652007AEED}.exe
07/13/2006 04:14 AM 4,608 {CEB86E66-B816-475F-AB1F-F097EA577A5E}.exe
07/13/2006 05:50 AM 4,608 {D5A8730C-73BC-4CC5-863A-7EA491F50FAC}.exe
07/13/2006 03:25 AM 4,608 {E871B9A5-37B7-43AA-BAE2-2A942481D4B6}.exe
07/13/2006 04:02 AM 4,608 {EBB9DA3D-9414-4BC9-81A5-057EC75A5CDF}.exe
07/13/2006 06:03 AM 4,608 {F34767C8-131B-4BD0-858A-922289EC2BF9}.exe
07/12/2006 06:36 AM 4,608 {F7233C80-0D12-4EF0-868C-181D6B473EBE}.exe
07/12/2006 06:42 AM 4,608 {F7B1F893-E053-4D19-9235-DCBBE21C0BF6}.exe
07/12/2006 06:24 AM 3,117 {FD2786B3-5DA5-4B3B-B93B-2CE9C5C53E45}.exe
58 File(s) 1,949,899 bytes
0 Dir(s) 47,455,543,296 bytes free



Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B219EAB453F0-223B-9284-37BB-0C21ACF7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}54E35C5C9EC2-B39B-B3B4-5AD5-3B6872DF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}70BC9C5A440F-835A-64B4-D03B-4B3A2447{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DEEA70025625-3D0B-C6B4-FA3A-979FF2CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6788D5E43658-C6E8-2FF4-91E7-0EE750E0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E396F6933D3A-1AA8-93B4-63C9-7D682ACA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\ckkmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}89F3D663AAB8-2DCA-4AB4-8906-BD438643{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EBE374B6D181-C868-0FE4-21D0-08C3327F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6FB0C12EBBCD-5329-91D4-350E-398F1B7F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FF4DF2EE6174-023A-5634-9215-4A621756{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D173CF4368A2-7E59-9924-B946-BD8C62D6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}08F054BE6442-1648-F4D4-9C1C-DE121165{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BB866CC77175-EE1A-6C04-90C2-CC05C037{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}19B3FE4B0A52-8F6A-5D34-F094-8E7A0ADA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D8366013464C-DAC8-94F4-E042-A7A0EA4B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}366547504EC5-6AD9-C784-C3E1-D92F24D1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}34B9F1D63BA9-DA7A-19B4-1F2E-D4D1A8E3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}52357273B2DF-DDC9-1254-98B2-CBEB6942{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}59C7DE12D24A-B7CA-F624-14B5-059A8258{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6B4D184249A2-2EAB-AA34-7B73-5A9B178E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}109344B26BD0-ABDA-5FD4-6078-C4DDD243{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4F77D240BE0F-E4AA-7FF4-B69B-CA787F56{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}15A210F5CE9E-65FA-6FD4-CF4A-2772DD81{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CA251F55ADCE-F489-F8D4-1D96-16DB546C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}827921B72045-72D8-ACC4-5D69-360CA8F0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FDC5A57CE750-5A18-9CB4-4149-D3AD9BBE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}654B44C37CD3-77EA-C1A4-6547-1A3806CB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E5A775AE790F-F1BA-F574-618B-66E68BEC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B701FDB045A4-7A99-9F14-432E-9B3B0686{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2332F69D0CC1-A818-CF04-C191-24DDD36C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D4B78AB9D5CC-9118-DD04-8ACF-7431445A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D7FCC6ADE3CB-FF6A-02F4-D5DD-B461A003{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ACBFF1CF8591-A8DA-D3C4-9C53-78335E90{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BCE53F1BBCFA-16A8-9FA4-BB4B-4D1E0AE4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}42E28654EC11-4C59-0AD4-5613-A4C6125B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}61F04F4C8962-718A-DB94-BBD8-2550A46C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1336F8A304B3-1FA8-FA84-C4FC-D655BEE2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6EB735A7B559-725A-7564-B7A3-F494A592{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CCED7A6D0D09-B308-0544-5DEA-FFE19944{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}49BD9E35B4F3-46B9-9094-1C8C-D35223A3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8556AF225A01-F509-0124-B8B0-A4697186{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FD66085B43F5-2059-D7C4-BA96-547986D5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}96B54D6B3CAF-836B-2724-BCAA-FB533C9B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CAF05F194AE7-A368-5CC4-CB37-C0378A5D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}98A33CFE6910-0199-C2D4-B002-55E28560{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9FB2CE982229-A858-0DB4-B131-8C76743F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8911F54CDDF8-F43B-FA94-0F2B-D1E8BAD6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3057A7DFC386-86F9-3D24-9A67-E1145D4C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B58AF8F776D2-C0FB-CD94-23FF-1A37C634{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}65AEEADA947B-B32A-7A94-2AB5-7DC2CA94{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B56D35ECD7B6-3628-30B4-234B-365BC917{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}73D281A268F6-8049-6734-F3A5-4F46444F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}712BB733D364-560A-A754-DA98-58B4638A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}52DA79E06DB7-8F8B-E904-6873-CE4C69B1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}925FB755F385-5739-87D4-4D6F-C4EB0AA9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D6EDCE636FF7-DBF8-A554-04C1-BFFF7CD6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}90A23D97D9D5-AED9-3174-A481-16BF9FA0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9D6F92097183-15DA-46F4-F297-B62E4057{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eno
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ruof
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
…

Microsoft ® Windows Script Host Version 5.6
Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmkkc.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
* csr.exe C:\WINDOWS\System32\CSCGG.EXE
* csr.exe C:\WINDOWS\System32\CSJVC.EXE
* csr.exe C:\WINDOWS\System32\CSQKW.EXE
* csr.exe C:\WINDOWS\System32\CSVKI.EXE

»»»»» Misc files
* thequicklink C:\WINDOWS\System32\{3AD39~1.DLL
* thequicklink C:\WINDOWS\System32\{69012~1.DLL

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSCGG.EXE 51,297 2006-07-10
C:\WINDOWS\SYSTEM32\CSJVC.EXE 51,297 2006-07-12
C:\WINDOWS\SYSTEM32\CSQKW.EXE 51,297 2006-07-07
C:\WINDOWS\SYSTEM32\CSVKI.EXE 51,297 2006-07-10
C:\WINDOWS\SYSTEM32\DMIPV.EXE 44,071 2004-08-04
C:\WINDOWS\SYSTEM32\DMJBA.EXE 44,071 2004-08-04
C:\WINDOWS\SYSTEM32\DMKKC.EXE 44,071 2004-08-04
C:\WINDOWS\SYSTEM32\DMTMB.EXE 44,071 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{3AD39C41-46B9-48A5-B218-7B87DF969245}.dll
{69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
{719CB563-B432-4B03-8263-6B7DCE53D65B}.exe
{49AC2CD7-5BA2-49A7-A23B-B749ADAEEA56}.exe
{436C73A1-FF32-49DC-BF0C-2D677F8FA85B}.exe
{C4D5411E-76A9-42D3-9F68-683CFD7A7503}.exe
{6DAB8E1D-B2F0-49AF-B34F-8FDDC45F1198}.exe
{F34767C8-131B-4BD0-858A-922289EC2BF9}.exe
{D5A8730C-73BC-4CC5-863A-7EA491F50FAC}.exe
{B9C335BF-AACB-4272-B638-FAC3B6D45B69}.exe
{5D689745-69AB-4C7D-9502-5F34B58066DF}.exe
{6817964A-0B8B-4210-905F-10A522FA6558}.exe
{3A32253D-C8C1-4909-9B64-3F4B53E9DB94}.exe
{44991EFF-AED5-4450-803B-90D0D6A7DECC}.exe
{295A494F-3A7B-4657-A527-955B7A537BE6}.exe
{2EEB556D-CF4C-48AF-8AF1-3B403A8F6331}.exe
{C64A0552-8DBB-49BD-A817-2698C4F40F16}.exe
{B5216C4A-3165-4DA0-95C4-11CE45682E24}.exe
{4EA0E1D4-B4BB-4AF9-8A61-AFCBB1F35ECB}.exe
{09E53387-35C9-4C3D-AD8A-1958FC1FFBCA}.exe
{300A164B-DD5D-4F20-A6FF-BC3EDA6CCF7D}.exe
{A5441347-FCA8-40DD-8119-CC5D9BA87B4D}.exe
{C63DDD42-191C-40FC-818A-1CC0D96F2332}.exe
{6860B3B9-E234-41F9-99A7-4A540BDF107B}.exe
{CEB86E66-B816-475F-AB1F-F097EA577A5E}.exe
{BC6083A1-7456-4A1C-AE77-3DC73C44B456}.exe
{EBB9DA3D-9414-4BC9-81A5-057EC75A5CDF}.exe
{0F8AC063-96D5-4CCA-8D27-54027B129728}.exe
{C645BD61-69D1-4D8F-984F-ECDA55F152AC}.exe
{18DD2772-A4FC-4DF6-AF56-E9EC5F012A51}.exe
{65F787AC-B96B-4FF7-AA4E-F0EB042D77F4}.exe
{342DDD4C-8706-4DF5-ADBA-0DB62B443901}.exe
{E871B9A5-37B7-43AA-BAE2-2A942481D4B6}.exe
{8528A950-5B41-426F-AC7B-A42D21ED7C95}.exe
{2496BEBC-2B89-4521-9CDD-FD2B37275325}.exe
{3E8A1D4D-E2F1-4B91-A7AD-9AB36D1F9B43}.exe
{1D42F29D-1E3C-487C-9DA6-5CE405745663}.exe
{B4AE0A7A-240E-4F49-8CAD-C4643106638D}.exe
{ADA0A7E8-490F-43D5-A6F8-25A0B4EF3B91}.exe
{730C50CC-2C09-40C6-A1EE-57177CC668BB}.exe
{561121ED-C1C9-4D4F-8461-2446EB450F80}.exe
{6D26C8DB-649B-4299-95E7-2A8634FC371D}.exe
{657126A4-5129-4365-A320-4716EE2FD4FF}.exe
{F7B1F893-E053-4D19-9235-DCBBE21C0BF6}.exe
{F7233C80-0D12-4EF0-868C-181D6B473EBE}.exe
{346834DB-6098-4BA4-ACD2-8BAA366D3F98}.exe
{ACA286D7-9C36-4B39-8AA1-A3D3396F693E}.exe
{0E057EE0-7E19-4FF2-8E6C-85634E5D8876}.exe
{CC2FF979-A3AF-4B6C-B0D3-52652007AEED}.exe
{FD2786B3-5DA5-4B3B-B93B-2CE9C5C53E45}.exe
{ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
{027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
{0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
{AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
{A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
{7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
{057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
{7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe

Copy the text in the following quote box into Notepad:
Save it to where you can find it as kgb.bat.

attrib -r -s -h C:\WINDOWS\SYSTEM32\{027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{09E53387-35C9-4C3D-AD8A-1958FC1FFBCA}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{0E057EE0-7E19-4FF2-8E6C-85634E5D8876}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{0F8AC063-96D5-4CCA-8D27-54027B129728}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{18DD2772-A4FC-4DF6-AF56-E9EC5F012A51}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{1D42F29D-1E3C-487C-9DA6-5CE405745663}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{2496BEBC-2B89-4521-9CDD-FD2B37275325}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{295A494F-3A7B-4657-A527-955B7A537BE6}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{2EEB556D-CF4C-48AF-8AF1-3B403A8F6331}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{300A164B-DD5D-4F20-A6FF-BC3EDA6CCF7D}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{342DDD4C-8706-4DF5-ADBA-0DB62B443901}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{346834DB-6098-4BA4-ACD2-8BAA366D3F98}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{3A32253D-C8C1-4909-9B64-3F4B53E9DB94}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{3AD39C41-46B9-48A5-B218-7B87DF969245}.dll
attrib -r -s -h C:\WINDOWS\SYSTEM32\{3E8A1D4D-E2F1-4B91-A7AD-9AB36D1F9B43}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{436C73A1-FF32-49DC-BF0C-2D677F8FA85B}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{44991EFF-AED5-4450-803B-90D0D6A7DECC}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{49AC2CD7-5BA2-49A7-A23B-B749ADAEEA56}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{4EA0E1D4-B4BB-4AF9-8A61-AFCBB1F35ECB}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{561121ED-C1C9-4D4F-8461-2446EB450F80}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{5D689745-69AB-4C7D-9502-5F34B58066DF}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{657126A4-5129-4365-A320-4716EE2FD4FF}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{65F787AC-B96B-4FF7-AA4E-F0EB042D77F4}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{6817964A-0B8B-4210-905F-10A522FA6558}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{6860B3B9-E234-41F9-99A7-4A540BDF107B}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
attrib -r -s -h C:\WINDOWS\SYSTEM32\{6D26C8DB-649B-4299-95E7-2A8634FC371D}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{6DAB8E1D-B2F0-49AF-B34F-8FDDC45F1198}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{719CB563-B432-4B03-8263-6B7DCE53D65B}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{730C50CC-2C09-40C6-A1EE-57177CC668BB}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{8528A950-5B41-426F-AC7B-A42D21ED7C95}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{A5441347-FCA8-40DD-8119-CC5D9BA87B4D}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{ACA286D7-9C36-4B39-8AA1-A3D3396F693E}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{ADA0A7E8-490F-43D5-A6F8-25A0B4EF3B91}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{B4AE0A7A-240E-4F49-8CAD-C4643106638D}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{B5216C4A-3165-4DA0-95C4-11CE45682E24}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{B9C335BF-AACB-4272-B638-FAC3B6D45B69}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{BC6083A1-7456-4A1C-AE77-3DC73C44B456}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{C4D5411E-76A9-42D3-9F68-683CFD7A7503}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{C63DDD42-191C-40FC-818A-1CC0D96F2332}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{C645BD61-69D1-4D8F-984F-ECDA55F152AC}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{C64A0552-8DBB-49BD-A817-2698C4F40F16}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{CC2FF979-A3AF-4B6C-B0D3-52652007AEED}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{CEB86E66-B816-475F-AB1F-F097EA577A5E}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{D5A8730C-73BC-4CC5-863A-7EA491F50FAC}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{E871B9A5-37B7-43AA-BAE2-2A942481D4B6}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{EBB9DA3D-9414-4BC9-81A5-057EC75A5CDF}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{F34767C8-131B-4BD0-858A-922289EC2BF9}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{F7233C80-0D12-4EF0-868C-181D6B473EBE}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{F7B1F893-E053-4D19-9235-DCBBE21C0BF6}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\{FD2786B3-5DA5-4B3B-B93B-2CE9C5C53E45}.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSCGG.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSJVC.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSQKW.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSVKI.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMIPV.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMJBA.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMKKC.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMTMB.EXE
del C:\WINDOWS\SYSTEM32\{027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
del C:\WINDOWS\SYSTEM32\{057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
del C:\WINDOWS\SYSTEM32\{09E53387-35C9-4C3D-AD8A-1958FC1FFBCA}.exe
del C:\WINDOWS\SYSTEM32\{0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
del C:\WINDOWS\SYSTEM32\{0E057EE0-7E19-4FF2-8E6C-85634E5D8876}.exe
del C:\WINDOWS\SYSTEM32\{0F8AC063-96D5-4CCA-8D27-54027B129728}.exe
del C:\WINDOWS\SYSTEM32\{18DD2772-A4FC-4DF6-AF56-E9EC5F012A51}.exe
del C:\WINDOWS\SYSTEM32\{1D42F29D-1E3C-487C-9DA6-5CE405745663}.exe
del C:\WINDOWS\SYSTEM32\{2496BEBC-2B89-4521-9CDD-FD2B37275325}.exe
del C:\WINDOWS\SYSTEM32\{295A494F-3A7B-4657-A527-955B7A537BE6}.exe
del C:\WINDOWS\SYSTEM32\{2EEB556D-CF4C-48AF-8AF1-3B403A8F6331}.exe
del C:\WINDOWS\SYSTEM32\{300A164B-DD5D-4F20-A6FF-BC3EDA6CCF7D}.exe
del C:\WINDOWS\SYSTEM32\{342DDD4C-8706-4DF5-ADBA-0DB62B443901}.exe
del C:\WINDOWS\SYSTEM32\{346834DB-6098-4BA4-ACD2-8BAA366D3F98}.exe
del C:\WINDOWS\SYSTEM32\{3A32253D-C8C1-4909-9B64-3F4B53E9DB94}.exe
del C:\WINDOWS\SYSTEM32\{3AD39C41-46B9-48A5-B218-7B87DF969245}.dll
del C:\WINDOWS\SYSTEM32\{3E8A1D4D-E2F1-4B91-A7AD-9AB36D1F9B43}.exe
del C:\WINDOWS\SYSTEM32\{436C73A1-FF32-49DC-BF0C-2D677F8FA85B}.exe
del C:\WINDOWS\SYSTEM32\{44991EFF-AED5-4450-803B-90D0D6A7DECC}.exe
del C:\WINDOWS\SYSTEM32\{49AC2CD7-5BA2-49A7-A23B-B749ADAEEA56}.exe
del C:\WINDOWS\SYSTEM32\{4EA0E1D4-B4BB-4AF9-8A61-AFCBB1F35ECB}.exe
del C:\WINDOWS\SYSTEM32\{561121ED-C1C9-4D4F-8461-2446EB450F80}.exe
del C:\WINDOWS\SYSTEM32\{5D689745-69AB-4C7D-9502-5F34B58066DF}.exe
del C:\WINDOWS\SYSTEM32\{657126A4-5129-4365-A320-4716EE2FD4FF}.exe
del C:\WINDOWS\SYSTEM32\{65F787AC-B96B-4FF7-AA4E-F0EB042D77F4}.exe
del C:\WINDOWS\SYSTEM32\{6817964A-0B8B-4210-905F-10A522FA6558}.exe
del C:\WINDOWS\SYSTEM32\{6860B3B9-E234-41F9-99A7-4A540BDF107B}.exe
del C:\WINDOWS\SYSTEM32\{69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
del C:\WINDOWS\SYSTEM32\{6D26C8DB-649B-4299-95E7-2A8634FC371D}.exe
del C:\WINDOWS\SYSTEM32\{6DAB8E1D-B2F0-49AF-B34F-8FDDC45F1198}.exe
del C:\WINDOWS\SYSTEM32\{7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
del C:\WINDOWS\SYSTEM32\{719CB563-B432-4B03-8263-6B7DCE53D65B}.exe
del C:\WINDOWS\SYSTEM32\{730C50CC-2C09-40C6-A1EE-57177CC668BB}.exe
del C:\WINDOWS\SYSTEM32\{7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
del C:\WINDOWS\SYSTEM32\{8528A950-5B41-426F-AC7B-A42D21ED7C95}.exe
del C:\WINDOWS\SYSTEM32\{A5441347-FCA8-40DD-8119-CC5D9BA87B4D}.exe
del C:\WINDOWS\SYSTEM32\{A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
del C:\WINDOWS\SYSTEM32\{ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
del C:\WINDOWS\SYSTEM32\{ACA286D7-9C36-4B39-8AA1-A3D3396F693E}.exe
del C:\WINDOWS\SYSTEM32\{ADA0A7E8-490F-43D5-A6F8-25A0B4EF3B91}.exe
del C:\WINDOWS\SYSTEM32\{AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
del C:\WINDOWS\SYSTEM32\{B4AE0A7A-240E-4F49-8CAD-C4643106638D}.exe
del C:\WINDOWS\SYSTEM32\{B5216C4A-3165-4DA0-95C4-11CE45682E24}.exe
del C:\WINDOWS\SYSTEM32\{B9C335BF-AACB-4272-B638-FAC3B6D45B69}.exe
del C:\WINDOWS\SYSTEM32\{BC6083A1-7456-4A1C-AE77-3DC73C44B456}.exe
del C:\WINDOWS\SYSTEM32\{C4D5411E-76A9-42D3-9F68-683CFD7A7503}.exe
del C:\WINDOWS\SYSTEM32\{C63DDD42-191C-40FC-818A-1CC0D96F2332}.exe
del C:\WINDOWS\SYSTEM32\{C645BD61-69D1-4D8F-984F-ECDA55F152AC}.exe
del C:\WINDOWS\SYSTEM32\{C64A0552-8DBB-49BD-A817-2698C4F40F16}.exe
del C:\WINDOWS\SYSTEM32\{CC2FF979-A3AF-4B6C-B0D3-52652007AEED}.exe
del C:\WINDOWS\SYSTEM32\{CEB86E66-B816-475F-AB1F-F097EA577A5E}.exe
del C:\WINDOWS\SYSTEM32\{D5A8730C-73BC-4CC5-863A-7EA491F50FAC}.exe
del C:\WINDOWS\SYSTEM32\{E871B9A5-37B7-43AA-BAE2-2A942481D4B6}.exe
del C:\WINDOWS\SYSTEM32\{EBB9DA3D-9414-4BC9-81A5-057EC75A5CDF}.exe
del C:\WINDOWS\SYSTEM32\{F34767C8-131B-4BD0-858A-922289EC2BF9}.exe
del C:\WINDOWS\SYSTEM32\{F7233C80-0D12-4EF0-868C-181D6B473EBE}.exe
del C:\WINDOWS\SYSTEM32\{F7B1F893-E053-4D19-9235-DCBBE21C0BF6}.exe
del C:\WINDOWS\SYSTEM32\{FD2786B3-5DA5-4B3B-B93B-2CE9C5C53E45}.exe
del C:\WINDOWS\SYSTEM32\CSCGG.EXE
del C:\WINDOWS\SYSTEM32\CSJVC.EXE
del C:\WINDOWS\SYSTEM32\CSQKW.EXE
del C:\WINDOWS\SYSTEM32\CSVKI.EXE
del C:\WINDOWS\SYSTEM32\DMIPV.EXE
del C:\WINDOWS\SYSTEM32\DMJBA.EXE
del C:\WINDOWS\SYSTEM32\DMKKC.EXE
del C:\WINDOWS\SYSTEM32\DMTMB.EXE

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Now "kgb.bat".

Then, browse to the fixwareout-folder present on your C:\
Open that folder and doubleclick FixIt.bat

This starts the fixwareoutfix again and will ask to reboot.

After reboot, post a new HijackThis! log together with the fixwareout log.

Also run the "ff.bat" file again, and post the results.

Fixwareout did not create a report this time but here is the others.
Thanks so much so far.

Logfile of HijackThis v1.99.1
Scan saved at 6:53:16 PM, on 7/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\carpserv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe
C:\windows\system\hpsysdrv.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
C:\Documents and Settings\Owner\Desktop\HijackThis1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msnbc.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us4nb.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [HP Display Settings] C:\Program Files\Hewlett-Packard\HP Display Settings\hpdisply.exe /s
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: SMC2635W Wireless Cardbus Adapter Utility.lnk = C:\Program Files\SMC\SMC2635W Wireless Cardbus Adapter Utility\drivers\WINXP\SMCRMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1121332788268
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1123943357781
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0

Directory of c:\WINDOWS\system32

Volume in drive C is HPNOTEBOOK
Volume Serial Number is E425-46F0

Directory of c:\WINDOWS\system32

07/10/2006 07:36 AM 5,214 {027E3E74-7404-4E5D-A0AC-7DE78FB0EA54}.exe
07/10/2006 05:08 AM 45,568 {057A5F98-F8BE-4B05-875B-8A28B3BA77B7}.exe
07/10/2006 07:36 AM 45,568 {0CC49F9B-D52A-487E-9DAF-368E1DEEDE97}.exe
07/12/2006 06:24 AM 5,214 {0E057EE0-7E19-4FF2-8E6C-85634E5D8876}.exe
07/12/2006 06:24 AM 155,648 {3AD39C41-46B9-48A5-B218-7B87DF969245}.dll
07/10/2006 07:36 AM 155,648 {69012A3B-ED73-4CBE-954C-3977DDFE561A}.dll
07/10/2006 05:08 AM 5,214 {7193D2B5-2AAC-4CBE-BB45-9F03E4228B6A}.exe
07/10/2006 05:08 AM 3,117 {7E42E9F2-DEFA-407C-A2C3-8C5E4A197B85}.exe
07/10/2006 05:08 AM 424,718 {A76942B7-F3AA-4DE7-895D-B64E2D66B0F3}.exe
07/10/2006 07:36 AM 424,718 {ABB3A6CF-CB72-4E72-9ABF-D158CF9BE4E3}.exe
07/12/2006 06:24 AM 424,718 {ACA286D7-9C36-4B39-8AA1-A3D3396F693E}.exe
07/10/2006 07:36 AM 3,117 {AEAD0F51-7DC2-47BE-B7E5-9217DBE37B2E}.exe
07/12/2006 06:24 AM 45,568 {CC2FF979-A3AF-4B6C-B0D3-52652007AEED}.exe
07/12/2006 06:24 AM 3,117 {FD2786B3-5DA5-4B3B-B93B-2CE9C5C53E45}.exe
14 File(s) 1,747,147 bytes
0 Dir(s) 47,465,791,488 bytes free