Spyware / Malware / Virus Removal

tried self help, but still not working.

3 min read

Looking for the outcome? Ask AI

allnight33 Topic Starter

Post #1August 7, 2006, 10:21 PM UTC

I have recently downloaded a virus that added another search engine underneath the one I already use. I managed to get rid of that, but am still getting a "virus detection" from the virus protection I use. It acts like the "blackworm" virus. Here is my log. Please advise me in what I can do. THANKS IN ADVANCE!!!

Logfile of HijackThis v1.99.1
Scan saved at 6:09:12 PM, on 8/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Robert Brown\Local Settings\Temp\Temporary Directory 6 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cleveland.com/browns
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BoundRec] Trayz.exe
O4 - HKLM\..\Run: [pizda] msag.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [eanth_critical_update_alert] C:\PROGRA~1\ACCELE~1\ANTI-V~1\EANTH_~1.EXE /Startup
O4 - HKLM\..\Run: [ssweeper] SpyElim.exe
O4 - HKLM\..\Run: [prgsys0984] NSYSCPLSTR.exe
O4 - HKLM\..\Run: [ckfnb.exe] C:\WINDOWS\System32\ckfnb.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [forces_elite] MNTP.exe
O4 - HKCU\..\Run: [porka_] DTOURS.exe
O4 - HKCU\..\Run: [Trayz] Serviceprocess.exe
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - HKCU\..\Run: [MsNetHelper] xwiz.exe
O4 - HKCU\..\Run: [utsgmon] gabber.exe
O4 - HKCU\..\Run: [dePloy] StatusCheck.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1DD81666-F3AD-11D3-BA86-00500487B4EC} (WonSearchX Control) - http://www.investors.com/member/ocx/WonSearchX.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{0111159D-522F-42EC-837D-01E4F851C7A4}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A2E27B9-9B2B-459E-BE09-3E7EC4BDD4DC}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{9FDC6097-55D4-4B7C-97F0-1B96C484C9E8}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.118 85.255.112.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{0111159D-522F-42EC-837D-01E4F851C7A4}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.118 85.255.112.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{0111159D-522F-42EC-837D-01E4F851C7A4}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.118 85.255.112.100
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Micah_6:8

Post #2August 7, 2006, 10:40 PM UTC

Welcome to the forum

Go to "Add/Remove Programs" and uninstall:

KillAndClean

Reboot and post a new HijackThis! log into this thread.

allnight33

Post #3August 7, 2006, 10:45 PM UTC last edited August 7, 2006, 10:53 PM UTC

Thanks for your fast response. Unfortunately, I did not see "kill and Clean" in the add/remove. I thought that I already removed it to be honest. I downloaded "smit" and here is the log. Thanks again SmitFraudFix v2.81 Scan done at 18:34:23.35, Mon 08/07/2006 Run from C:\Documents and Settings\Robert Brown\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT Fix ran in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\kl.exe FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Robert Brown\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ROBERT~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys ! »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Micah_6:8

Post #4August 7, 2006, 10:58 PM UTC

You don't have a Smithfraud infection.

You have a "Wareout" infection. And probably the new type that can be a little tricky to remove.

I'll know for sure after your next post.

Please make a PERMANANT folder for Hijack This!

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. MOVE (drag-and-drop) HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

Please download FixWareout from one of these links:
Fixwareout.exe
Fixwareout.exe

Save it to your desktop.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O1 - Hosts: localhost 127.0.0.1

O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)

O4 - HKLM\..\Run: [BoundRec] Trayz.exe

O4 - HKLM\..\Run: [pizda] msag.exe

O4 - HKLM\..\Run: [ssweeper] SpyElim.exe

O4 - HKLM\..\Run: [prgsys0984] NSYSCPLSTR.exe

O4 - HKLM\..\Run: [ckfnb.exe] C:\WINDOWS\System32\ckfnb.exe

O4 - HKCU\..\Run: [forces_elite] MNTP.exe

O4 - HKCU\..\Run: [porka_] DTOURS.exe

O4 - HKCU\..\Run: [Trayz] Serviceprocess.exe

O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"

O4 - HKCU\..\Run: [MsNetHelper] xwiz.exe

O4 - HKCU\..\Run: [utsgmon] gabber.exe

O4 - HKCU\..\Run: [dePloy] StatusCheck.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{0111159D-522F-42EC-837D-01E4F851C7A4}: NameServer = 85.255.113.118,85.255.112.100

O17 - HKLM\System\CCS\Services\Tcpip\..\{9A2E27B9-9B2B-459E-BE09-3E7EC4BDD4DC}: NameServer = 85.255.113.118,85.255.112.100

O17 - HKLM\System\CCS\Services\Tcpip\..\{9FDC6097-55D4-4B7C-97F0-1B96C484C9E8}: NameServer = 85.255.113.118,85.255.112.100

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.118 85.255.112.100

O17 - HKLM\System\CS1\Services\Tcpip\..\{0111159D-522F-42EC-837D-01E4F851C7A4}: NameServer = 85.255.113.118,85.255.112.100

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.118 85.255.112.100

O17 - HKLM\System\CS2\Services\Tcpip\..\{0111159D-522F-42EC-837D-01E4F851C7A4}: NameServer = 85.255.113.118,85.255.112.100

Then click "Fix checked" and close Hijack This!.

* Run Fixwareout on the desktop.
* Click Next, then Install, make sure "Run fixit" is checked and click Finish.
* The fix will begin; follow the prompts.
* You will be asked to reboot your computer; please do so.
* Your system may take longer than usual to load; this is normal.
* Once the desktop loads a text will open (report.txt). We'll need that in a bit.

After the reboot, "copy/paste" a new log file into this thread.

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

allnight33

Post #5August 8, 2006, 12:00 AM UTC last edited August 8, 2006, 12:19 AM UTC

THANKS AGAIN FOR YOUR HELP!!! LET ME KNOW IF I DID NOT INCLUDE ANYTHING OR IF THERE IS ANYTHING ELSE YOU WOULD LIKE TO SEE…
NEW:

Logfile of HijackThis v1.99.1
Scan saved at 7:53:01 PM, on 8/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZENG09.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Documents and Settings\Robert Brown\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cleveland.com/browns
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [eanth_critical_update_alert] C:\PROGRA~1\ACCELE~1\ANTI-V~1\EANTH_~1.EXE /Startup
O4 - HKLM\..\Run: [ckfnb.exe] C:\WINDOWS\System32\ckfnb.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1DD81666-F3AD-11D3-BA86-00500487B4EC} (WonSearchX Control) - http://www.investors.com/member/ocx/WonSearchX.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Here is this…

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4D131A329617-11D9-BBD4-99D7-4B364DD6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D7AAE717819A-2A4B-ACD4-6BD2-730B68EB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6D37C3CF1265-DC2A-1644-0DC4-C46FF607{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9F24348DDEC0-3069-3CF4-158F-330B23B3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D35D55B67F1C-A939-4ED4-21C5-3CE9469E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0F2A185B0CDC-8349-7064-6869-BB35BF15{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D7C3A67F1679-A1AB-0FE4-050E-E0A47687{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}596BE4CA304A-B229-D874-E1CC-8F2F8BB2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F9D24068DDB6-24F8-7714-4D29-C44CE3D0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A9F54BBB2AE1-6EEB-B6F4-E091-D68562AB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04B9EF717531-28DA-ED34-F4B9-D315F6DD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0FC9C1403E7-EEBB-1554-B5CD-B375CE78{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DA1B6AB5ADEF-F4CB-C754-7130-08AAF966{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}67FD3B304930-8E2B-9A94-AB9E-731E785E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8E9A083AE4B5-A988-4654-C88A-72AE9107{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}042A50ED95ED-722A-1404-AF50-B9CDF744{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F59EC281AC2D-3A5A-63E4-879F-79163411{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EEFA25E4626A-5C3B-68A4-BFB4-987B7ECF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DCE3041A2B0A-0F49-3DB4-B827-6B2971C9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B289F2666CC9-8BE8-7EC4-1831-D9F3F505{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}70C5492CA0D6-A44A-B414-7BCF-BE909DA9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}622C35C82032-39AB-3F44-D55C-20C97B33{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F608486D3EB6-F8BA-0394-13BD-4EFEE4DC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2301F0789ADE-D018-17A4-69C2-C3979414{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4C42CE7AEC74-4FAA-71C4-F3C3-C9C4A9F4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}064549B91E28-869B-51F4-5AC7-845948D2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9F7EB7838E2F-06D9-B624-E162-70ED0483{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B649BBE74E25-0E38-4254-A448-5A131C25{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E5D0B97AA7EA-5FAA-0244-FCDD-BAD0BBD8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D672B1250A05-50FA-02A4-61E5-BC1907CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}56BF2E22E2F4-9EB8-9124-34C6-93B76324{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}261509A9AFE9-3909-ACD4-7F30-9FAF7AE0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3098CEA9683-F398-C994-8E6D-F5D4AA93{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7A78F6288EB6-A70B-C084-D499-7532E4B8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}258DBBFD4F3F-D99A-5114-E079-B7B19613{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2EB04E6BE53F-30E8-5764-93C2-5562D031{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F05A1EBA3267-932A-0364-1A76-19E49E0E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}76F63159969B-9E8A-5E64-177D-8B5870CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}99A0C92947F6-86DB-C5D4-36F2-7971A0E5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C65E63447E35-A049-CCB4-6F14-B976D4CE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7AE1AB24151D-43E8-5B74-9E5B-0E029A89{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CF5D0A562B68-3028-C2B4-E434-049E671D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}74C745EFB453-1939-F164-067F-60514209{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}32D28B5C41DA-802B-8964-6EC7-4C2078D4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4DAF4A378749-9EC9-8044-B7DF-E3916900{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}336442C68046-AF9A-7C14-0CDB-2DE766E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F7486C93A38E-960A-0054-D762-8D1A41F3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DAA8DF7583A1-671A-A484-6972-600BA38D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D6CED76C346E-7558-B3C4-F423-02849550{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5C33052839DC-2199-E504-5781-04863A2D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}506A8C879869-BEFA-13C4-5C62-D2A5E96C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CDE4353AE179-9A2B-4604-DCBB-C3A4CC4C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8CBEB99A16E1-482A-3EC4-8B4D-D87437FE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DA8A2178EA2E-EAFB-A4F4-7DD1-FB87FCC4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}693D1CE56C8E-3098-3C84-AB7E-18B4FF88{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\ylomd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}51B3EB1DE650-F248-5A64-059D-0863CEF4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}465BCF730F30-B8CA-8E44-3977-C0A79AAC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}302FF47A87EA-9329-43C4-8E6E-F76AA131{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8DC5079C21DC-137B-F464-562F-8E1F5343{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DA2662C8783A-FDCA-8E74-128B-9F0826F3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1D1CCFA78104-096A-5674-F334-151ADB33{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3FF97ABFDA2E-EF1A-6C04-E789-B218B4F7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CE0BF51D4AE0-AD98-A0E4-9E30-EAE39547{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0BD92B78BDC2-517A-F344-6B82-1D0CB8A3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}825D44A4ADF6-057A-73D4-8270-33789850{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9A1DFE98C46B-F9EB-B264-35B0-E8E7BA82{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3DE44867437-84FB-8404-578E-4DB10885{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7D28ABB02B49-6F99-0F84-E3E5-5FF30924{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}295D59A100D8-0E69-C774-DAFE-D18D2C36{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7BBE08D7A7FD-F648-C484-AFC5-3ED0BA0C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1712911E6216-614B-FB84-1251-760FFF79{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5190C54F49D2-3E89-24E4-FE52-80E93766{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}88D76E40B0C7-4269-D3F4-829F-A959A9A1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4DA4E844BD88-26AA-BA34-0689-794D6CBA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7410B9E27673-0E38-9BC4-DE55-778AB8B4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}59B8308F98E8-25CB-0114-A566-D07D3D42{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F0AFD094CBF4-98B9-FEF4-4F65-F611E577{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8F580A1EEA14-C15B-BDC4-153F-1B875725{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2763DF897866-4D7A-5224-7691-57554B97{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FBE8D440F35F-543A-9D54-DCDD-38EE7A94{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}465DEAFB3BF7-9329-2414-6A1B-5E692571{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D085236BB2D6-7C5B-5444-7CFA-862C3250{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3CCF2F8B3B46-7E8A-C624-7F8D-952B538E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BE546DDC4A62-D7DB-5824-144B-2D7C61AD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4EC3D0CF68A8-E9D9-67B4-CF2B-735AE59B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F8EF920D8FE0-04AA-2BE4-5C18-FACE3CDE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E2B793CB9CE6-ACA9-16D4-3E55-1C3D0B74{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C4DAEFF9C8AB-8699-29D4-BB85-DCBC21DA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9306AF928855-3489-D5E4-3385-43B80AE3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6B68D33ED573-6329-19E4-66BE-71A641BD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5099BB7BF97E-AC8A-3914-1AB2-C01E7897{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F99029DB55AF-3CCA-F704-2C92-A348E8C1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0DE5C07C7B36-16B9-5E74-A961-21E119B8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}43FB12C5E7B4-70B9-B9F4-B085-B36FBBD3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8B3DEA5B659B-4B49-CD74-7D3C-E1CDE399{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DECA2331D072-CEEA-8ED4-BAB1-60E6BE3C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5798719FCD78-BCD9-CC74-667D-B00095C4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD83D0E80A5B-35C8-AEF4-62CE-2E62022D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}02D3506FA7DA-E4F9-FA64-E548-03412B17{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3C0600C1735A-1CD9-2BB4-29BB-8033F5B1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7BD91F668659-C609-8404-5F27-86BF05B4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}31AD7C75B9F7-3CF9-F844-D472-9626C794{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CFB94AB548DE-C069-21B4-53C9-B20813B3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmoly.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
* csr.exe C:\WINDOWS\System32\CSJJQ.EXE

»»»»» Misc files
* thequicklink C:\WINDOWS\System32\{A9141~1.DLL

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSJJQ.EXE 51,285 2006-08-07
C:\WINDOWS\SYSTEM32\DMOLY.EXE 62,000 2001-08-23
Other suspects
Directory of C:\WINDOWS\system32
{A91418B8-F060-4199-8349-7D665AF578E5}.dll
{3B31802B-9C35-4B12-960C-ED845BA49BFC}.exe
{497C6269-274D-448F-9FC3-7F9B57C7DA13}.exe
{4B50FB68-72F5-4048-906C-956866F19DB7}.exe
{1B5F3308-BB92-4BB2-9DC1-A5371C0060C3}.exe
{71B21430-845E-46AF-9F4E-AD7AF6053D20}.exe
{D22026E2-EC26-4FEA-8C53-B5A08E0D38DD}.exe
{4C59000B-D766-47CC-9DCB-87DCF9178975}.exe
{C3EB6E06-1BAB-4DE8-AEEC-270D1332ACED}.exe
{993EDC1E-C3D7-47DC-94B4-B956B5AED3B8}.exe
{3DBBF63B-580B-4F9B-9B07-4B7E5C21BF34}.exe
{8B911E12-169A-47E5-9B61-63B7C70C5ED0}.exe
{1C8E843A-29C2-407F-ACC3-FA55BD92099F}.exe
{7987E10C-2BA1-4193-A8CA-E79FB7BB9905}.exe
{DB146A17-EB66-4E91-9236-375DE33D86B6}.exe
{3EA08B34-5833-4E5D-9843-558829FA6039}.exe
{AD12CBCD-58BB-4D92-9968-BA8C9FFEAD4C}.exe
{47B0D3C1-55E3-4D61-9ACA-6EC9BC397B2E}.exe
{EDC3ECAF-81C5-4EB2-AA40-0EF8D029FE8F}.exe
{B95EA537-B2FC-4B76-9D9E-8A86FC0D3CE4}.exe
{DA16C7D2-B441-4285-BD7D-26A4CDD645EB}.exe
{E835B259-D8F7-426C-A8E7-64B3B8F2FCC3}.exe
{0523C268-AFC7-4445-B5C7-6D2BB632580D}.exe
{175296E5-B1A6-4142-9239-7FB3BFAED564}.exe
{49A7EE83-DDCD-45D9-A345-F53F044D8EBF}.exe
{79B45575-1967-4225-A7D4-668798FD3672}.exe
{527578B1-F351-4CDB-B51C-41AEE1A085F8}.exe
{775E116F-56F4-4FEF-9B89-4FBC490DFA0F}.exe
{24D3D70D-665A-4110-BC52-8E89F8038B95}.exe
{4B8BA877-55ED-4CB9-83E0-37672E9B0147}.exe
{ABC6D497-9860-43AB-AA62-88DB448E4AD4}.exe
{1A9A959A-F928-4F3D-9624-7C0B04E67D88}.exe
{66739E08-25EF-4E42-98E3-2D94F45C0915}.exe
{97FFF067-1521-48BF-B416-6126E1192171}.exe
{C0AB0DE3-5CFA-484C-846F-DF7A7D80EBB7}.exe
{63C2D81D-EFAD-477C-96E0-8D001A95D592}.exe
{42903FF5-5E3E-48F0-99F6-94B20BBA82D7}.exe
{58801BD4-E875-4048-BF48-73476844ED3D}.exe
{28AB7E8E-0B53-462B-BE9F-B64C89EFD1A9}.exe
{05898733-0728-4D37-A750-6FDA4A44D528}.exe
{3A8BC0D1-28B6-443F-A715-2CDB87B29DB0}.exe
{74593EAE-03E9-4E0A-89DA-0EA4D15FB0EC}.exe
{7F4B812B-987E-40C6-A1FE-E2ADFBA79FF3}.exe
{33BDA151-433F-4765-A690-40187AFCC1D1}.exe
{3F6280F9-B821-47E8-ACDF-A3878C2662AD}.exe
{3435F1E8-F265-464F-B731-CD12C9705CD8}.exe
{131AA67F-E6E8-4C34-9239-AE78A74FF203}.exe
{CAA97A0C-7793-44E8-AC8B-03F037FCB564}.exe
{4FEC3680-D950-46A5-842F-056ED1BE3B15}.exe
{88FF4B81-E7BA-48C3-8903-E8C65EC1D396}.exe
{4CCF78BF-1DD7-4F4A-BFAE-E2AE8712A8AD}.exe
{EF73478D-D4B8-4CE3-A284-1E61A99BEBC8}.exe
{C4CC4A3C-BBCD-4064-B2A9-971EA3534EDC}.exe
{C69E5A2D-26C5-4C31-AFEB-968978C8A605}.exe
{D2A36840-1875-405E-9912-CD93825033C5}.exe
{05594820-324F-4C3B-8557-E643C67DEC6D}.exe
{D83AB006-2796-484A-A176-1A3857FD8AAD}.exe
{3F14A1D8-267D-4500-A069-E83A39C6847F}.exe
{2E667ED2-BDC0-41C7-A9FA-64086C244633}.exe
{0096193E-FD7B-4408-9CE9-947873A4FAD4}.exe
{4D8702C4-7CE6-4698-B208-AD14C5B82D23}.exe
{90241506-F760-461F-9391-354BFE547C47}.exe
{D176E940-434E-4B2C-8203-86B265A0D5FC}.exe
{98A920E0-B5E9-47B5-8E34-D15142BA1EA7}.exe
{EC4D679B-41F6-4BCC-940A-53E74436E56C}.exe
{5E0A1797-2F63-4D5C-BD68-6F74929C0A99}.exe
{CC0785B8-D771-46E5-A8E9-B96995136F67}.exe
{E0E94E91-67A1-4630-A239-7623ABE1A50F}.exe
{130D2655-2C39-4675-8E03-F35EB6E40BE2}.exe
{31691B7B-970E-4115-A99D-F3F4DFBBD852}.exe
{8B4E2357-994D-480C-B07A-6BE8826F87A7}.exe
{39AA4D5F-D6E8-499C-893F-3869AEC8903D}.exe
{0EA7FAF9-03F7-4DCA-9093-9EFA9A905162}.exe
{42367B39-6C43-4219-8BE9-4F2E22E2FB65}.exe
{CC7091CB-5E16-4A20-AF05-50A0521B276D}.exe
{8DBB0DAB-DDCF-4420-AAF5-AE7AA79B0D5E}.exe
{52C131A5-844A-4524-83E0-52E47EBB946B}.exe
{3840DE07-261E-426B-9D60-F2E8387BE7F9}.exe
{2D849548-7CA5-4F15-B968-82E19B945460}.exe
{4F9A4C9C-3C3F-4C17-AAF4-47CEA7EC24C4}.exe
{4149793C-2C96-4A71-810D-EDA9870F1032}.exe
{CD4EEFE4-DB31-4930-AB8F-6BE3D684806F}.exe
{33B79C02-C55D-44F3-BA93-23028C53C226}.exe
{9AD909EB-FCB7-414B-A44A-6D0AC2945C07}.exe
{505F3F9D-1381-4CE7-8EB8-9CC6662F982B}.exe
{9C1792B6-728B-4BD3-94F0-A0B2A1403ECD}.exe
{FCE7B789-4BFB-4A86-B3C5-A6264E52AFEE}.exe
{11436197-F978-4E36-A5A3-D2CA182CE95F}.exe
{447FDC9B-05FA-4041-A227-DE59DE05A240}.exe
{7019EA27-A88C-4564-889A-5B4EA380A9E8}.exe
{E587E137-E9BA-49A9-B2E8-039403B3DF76}.exe
{669FAA80-0317-457C-BC4F-FEDA5BA6B1AD}.exe
{87EC573B-DC5B-4551-BBEE-7E3041C9CF0B}.exe
{DD6F513D-9B4F-43DE-AD82-135717FE9B40}.exe
{BA26586D-190E-4F6B-BEE6-1EA2BBB45F9A}.exe
{0D3EC44C-92D4-4177-8F42-6BDD86042D9F}.exe
{2BB8F2F8-CC1E-478D-922B-A403AC4EB695}.exe
{51FB53BB-9686-4607-9438-CDC0B581A2F0}.exe
{E9649EC3-5C12-4DE4-939A-C1F76B55D53D}.exe
{3B32B033-F851-4FC3-9603-0CEDD84342F9}.exe
{706FF64C-4CD0-4461-A2CD-5621FC3C73D6}.exe
{BE86B037-2DB6-4DCA-B4A2-A918717EAA7D}.exe

Micah_6:8

Post #6August 8, 2006, 12:17 AM UTC

Yep… You've got the "difficult" one present….

Copy the text in the following quote box into Notepad:

attrib -r -s -h c:\WINDOWS\System32\ckfnb.exe
attrib -r -s -h c:\WINDOWS\SYSTEM32\CSJJQ.EXE
attrib -r -s -h c:\WINDOWS\SYSTEM32\DMOLY.EXE
attrib -r -s -h c:\WINDOWS\system32\{A91418B8-F060-4199-8349-7D665AF578E5}.dll
attrib -r -s -h c:\WINDOWS\system32\{3B31802B-9C35-4B12-960C-ED845BA49BFC}.exe
attrib -r -s -h c:\WINDOWS\system32\{497C6269-274D-448F-9FC3-7F9B57C7DA13}.exe
attrib -r -s -h c:\WINDOWS\system32\{4B50FB68-72F5-4048-906C-956866F19DB7}.exe
attrib -r -s -h c:\WINDOWS\system32\{1B5F3308-BB92-4BB2-9DC1-A5371C0060C3}.exe
attrib -r -s -h c:\WINDOWS\system32\{71B21430-845E-46AF-9F4E-AD7AF6053D20}.exe
attrib -r -s -h c:\WINDOWS\system32\{D22026E2-EC26-4FEA-8C53-B5A08E0D38DD}.exe
attrib -r -s -h c:\WINDOWS\system32\{4C59000B-D766-47CC-9DCB-87DCF9178975}.exe
attrib -r -s -h c:\WINDOWS\system32\{C3EB6E06-1BAB-4DE8-AEEC-270D1332ACED}.exe
attrib -r -s -h c:\WINDOWS\system32\{993EDC1E-C3D7-47DC-94B4-B956B5AED3B8}.exe
attrib -r -s -h c:\WINDOWS\system32\{3DBBF63B-580B-4F9B-9B07-4B7E5C21BF34}.exe
attrib -r -s -h c:\WINDOWS\system32\{8B911E12-169A-47E5-9B61-63B7C70C5ED0}.exe
attrib -r -s -h c:\WINDOWS\system32\{1C8E843A-29C2-407F-ACC3-FA55BD92099F}.exe
attrib -r -s -h c:\WINDOWS\system32\{7987E10C-2BA1-4193-A8CA-E79FB7BB9905}.exe
attrib -r -s -h c:\WINDOWS\system32\{DB146A17-EB66-4E91-9236-375DE33D86B6}.exe
attrib -r -s -h c:\WINDOWS\system32\{3EA08B34-5833-4E5D-9843-558829FA6039}.exe
attrib -r -s -h c:\WINDOWS\system32\{AD12CBCD-58BB-4D92-9968-BA8C9FFEAD4C}.exe
attrib -r -s -h c:\WINDOWS\system32\{47B0D3C1-55E3-4D61-9ACA-6EC9BC397B2E}.exe
attrib -r -s -h c:\WINDOWS\system32\{EDC3ECAF-81C5-4EB2-AA40-0EF8D029FE8F}.exe
attrib -r -s -h c:\WINDOWS\system32\{B95EA537-B2FC-4B76-9D9E-8A86FC0D3CE4}.exe
attrib -r -s -h c:\WINDOWS\system32\{DA16C7D2-B441-4285-BD7D-26A4CDD645EB}.exe
attrib -r -s -h c:\WINDOWS\system32\{E835B259-D8F7-426C-A8E7-64B3B8F2FCC3}.exe
attrib -r -s -h c:\WINDOWS\system32\{0523C268-AFC7-4445-B5C7-6D2BB632580D}.exe
attrib -r -s -h c:\WINDOWS\system32\{175296E5-B1A6-4142-9239-7FB3BFAED564}.exe
attrib -r -s -h c:\WINDOWS\system32\{49A7EE83-DDCD-45D9-A345-F53F044D8EBF}.exe
attrib -r -s -h c:\WINDOWS\system32\{79B45575-1967-4225-A7D4-668798FD3672}.exe
attrib -r -s -h c:\WINDOWS\system32\{527578B1-F351-4CDB-B51C-41AEE1A085F8}.exe
attrib -r -s -h c:\WINDOWS\system32\{775E116F-56F4-4FEF-9B89-4FBC490DFA0F}.exe
attrib -r -s -h c:\WINDOWS\system32\{24D3D70D-665A-4110-BC52-8E89F8038B95}.exe
attrib -r -s -h c:\WINDOWS\system32\{4B8BA877-55ED-4CB9-83E0-37672E9B0147}.exe
attrib -r -s -h c:\WINDOWS\system32\{ABC6D497-9860-43AB-AA62-88DB448E4AD4}.exe
attrib -r -s -h c:\WINDOWS\system32\{1A9A959A-F928-4F3D-9624-7C0B04E67D88}.exe
attrib -r -s -h c:\WINDOWS\system32\{66739E08-25EF-4E42-98E3-2D94F45C0915}.exe
attrib -r -s -h c:\WINDOWS\system32\{97FFF067-1521-48BF-B416-6126E1192171}.exe
attrib -r -s -h c:\WINDOWS\system32\{C0AB0DE3-5CFA-484C-846F-DF7A7D80EBB7}.exe
attrib -r -s -h c:\WINDOWS\system32\{63C2D81D-EFAD-477C-96E0-8D001A95D592}.exe
attrib -r -s -h c:\WINDOWS\system32\{42903FF5-5E3E-48F0-99F6-94B20BBA82D7}.exe
attrib -r -s -h c:\WINDOWS\system32\{58801BD4-E875-4048-BF48-73476844ED3D}.exe
attrib -r -s -h c:\WINDOWS\system32\{28AB7E8E-0B53-462B-BE9F-B64C89EFD1A9}.exe
attrib -r -s -h c:\WINDOWS\system32\{05898733-0728-4D37-A750-6FDA4A44D528}.exe
attrib -r -s -h c:\WINDOWS\system32\{3A8BC0D1-28B6-443F-A715-2CDB87B29DB0}.exe
attrib -r -s -h c:\WINDOWS\system32\{74593EAE-03E9-4E0A-89DA-0EA4D15FB0EC}.exe
attrib -r -s -h c:\WINDOWS\system32\{7F4B812B-987E-40C6-A1FE-E2ADFBA79FF3}.exe
attrib -r -s -h c:\WINDOWS\system32\{33BDA151-433F-4765-A690-40187AFCC1D1}.exe
attrib -r -s -h c:\WINDOWS\system32\{3F6280F9-B821-47E8-ACDF-A3878C2662AD}.exe
attrib -r -s -h c:\WINDOWS\system32\{3435F1E8-F265-464F-B731-CD12C9705CD8}.exe
attrib -r -s -h c:\WINDOWS\system32\{131AA67F-E6E8-4C34-9239-AE78A74FF203}.exe
attrib -r -s -h c:\WINDOWS\system32\{CAA97A0C-7793-44E8-AC8B-03F037FCB564}.exe
attrib -r -s -h c:\WINDOWS\system32\{4FEC3680-D950-46A5-842F-056ED1BE3B15}.exe
attrib -r -s -h c:\WINDOWS\system32\{88FF4B81-E7BA-48C3-8903-E8C65EC1D396}.exe
attrib -r -s -h c:\WINDOWS\system32\{4CCF78BF-1DD7-4F4A-BFAE-E2AE8712A8AD}.exe
attrib -r -s -h c:\WINDOWS\system32\{EF73478D-D4B8-4CE3-A284-1E61A99BEBC8}.exe
attrib -r -s -h c:\WINDOWS\system32\{C4CC4A3C-BBCD-4064-B2A9-971EA3534EDC}.exe
attrib -r -s -h c:\WINDOWS\system32\{C69E5A2D-26C5-4C31-AFEB-968978C8A605}.exe
attrib -r -s -h c:\WINDOWS\system32\{D2A36840-1875-405E-9912-CD93825033C5}.exe
attrib -r -s -h c:\WINDOWS\system32\{05594820-324F-4C3B-8557-E643C67DEC6D}.exe
attrib -r -s -h c:\WINDOWS\system32\{D83AB006-2796-484A-A176-1A3857FD8AAD}.exe
attrib -r -s -h c:\WINDOWS\system32\{3F14A1D8-267D-4500-A069-E83A39C6847F}.exe
attrib -r -s -h c:\WINDOWS\system32\{2E667ED2-BDC0-41C7-A9FA-64086C244633}.exe
attrib -r -s -h c:\WINDOWS\system32\{0096193E-FD7B-4408-9CE9-947873A4FAD4}.exe
attrib -r -s -h c:\WINDOWS\system32\{4D8702C4-7CE6-4698-B208-AD14C5B82D23}.exe
attrib -r -s -h c:\WINDOWS\system32\{90241506-F760-461F-9391-354BFE547C47}.exe
attrib -r -s -h c:\WINDOWS\system32\{D176E940-434E-4B2C-8203-86B265A0D5FC}.exe
attrib -r -s -h c:\WINDOWS\system32\{98A920E0-B5E9-47B5-8E34-D15142BA1EA7}.exe
attrib -r -s -h c:\WINDOWS\system32\{EC4D679B-41F6-4BCC-940A-53E74436E56C}.exe
attrib -r -s -h c:\WINDOWS\system32\{5E0A1797-2F63-4D5C-BD68-6F74929C0A99}.exe
attrib -r -s -h c:\WINDOWS\system32\{CC0785B8-D771-46E5-A8E9-B96995136F67}.exe
attrib -r -s -h c:\WINDOWS\system32\{E0E94E91-67A1-4630-A239-7623ABE1A50F}.exe
attrib -r -s -h c:\WINDOWS\system32\{130D2655-2C39-4675-8E03-F35EB6E40BE2}.exe
attrib -r -s -h c:\WINDOWS\system32\{31691B7B-970E-4115-A99D-F3F4DFBBD852}.exe
attrib -r -s -h c:\WINDOWS\system32\{8B4E2357-994D-480C-B07A-6BE8826F87A7}.exe
attrib -r -s -h c:\WINDOWS\system32\{39AA4D5F-D6E8-499C-893F-3869AEC8903D}.exe
attrib -r -s -h c:\WINDOWS\system32\{0EA7FAF9-03F7-4DCA-9093-9EFA9A905162}.exe
attrib -r -s -h c:\WINDOWS\system32\{42367B39-6C43-4219-8BE9-4F2E22E2FB65}.exe
attrib -r -s -h c:\WINDOWS\system32\{CC7091CB-5E16-4A20-AF05-50A0521B276D}.exe
attrib -r -s -h c:\WINDOWS\system32\{8DBB0DAB-DDCF-4420-AAF5-AE7AA79B0D5E}.exe
attrib -r -s -h c:\WINDOWS\system32\{52C131A5-844A-4524-83E0-52E47EBB946B}.exe
attrib -r -s -h c:\WINDOWS\system32\{3840DE07-261E-426B-9D60-F2E8387BE7F9}.exe
attrib -r -s -h c:\WINDOWS\system32\{2D849548-7CA5-4F15-B968-82E19B945460}.exe
attrib -r -s -h c:\WINDOWS\system32\{4F9A4C9C-3C3F-4C17-AAF4-47CEA7EC24C4}.exe
attrib -r -s -h c:\WINDOWS\system32\{4149793C-2C96-4A71-810D-EDA9870F1032}.exe
attrib -r -s -h c:\WINDOWS\system32\{CD4EEFE4-DB31-4930-AB8F-6BE3D684806F}.exe
attrib -r -s -h c:\WINDOWS\system32\{33B79C02-C55D-44F3-BA93-23028C53C226}.exe
attrib -r -s -h c:\WINDOWS\system32\{9AD909EB-FCB7-414B-A44A-6D0AC2945C07}.exe
attrib -r -s -h c:\WINDOWS\system32\{505F3F9D-1381-4CE7-8EB8-9CC6662F982B}.exe
attrib -r -s -h c:\WINDOWS\system32\{9C1792B6-728B-4BD3-94F0-A0B2A1403ECD}.exe
attrib -r -s -h c:\WINDOWS\system32\{FCE7B789-4BFB-4A86-B3C5-A6264E52AFEE}.exe
attrib -r -s -h c:\WINDOWS\system32\{11436197-F978-4E36-A5A3-D2CA182CE95F}.exe
attrib -r -s -h c:\WINDOWS\system32\{447FDC9B-05FA-4041-A227-DE59DE05A240}.exe
attrib -r -s -h c:\WINDOWS\system32\{7019EA27-A88C-4564-889A-5B4EA380A9E8}.exe
attrib -r -s -h c:\WINDOWS\system32\{E587E137-E9BA-49A9-B2E8-039403B3DF76}.exe
attrib -r -s -h c:\WINDOWS\system32\{669FAA80-0317-457C-BC4F-FEDA5BA6B1AD}.exe
attrib -r -s -h c:\WINDOWS\system32\{87EC573B-DC5B-4551-BBEE-7E3041C9CF0B}.exe
attrib -r -s -h c:\WINDOWS\system32\{DD6F513D-9B4F-43DE-AD82-135717FE9B40}.exe
attrib -r -s -h c:\WINDOWS\system32\{BA26586D-190E-4F6B-BEE6-1EA2BBB45F9A}.exe
attrib -r -s -h c:\WINDOWS\system32\{0D3EC44C-92D4-4177-8F42-6BDD86042D9F}.exe
attrib -r -s -h c:\WINDOWS\system32\{2BB8F2F8-CC1E-478D-922B-A403AC4EB695}.exe
attrib -r -s -h c:\WINDOWS\system32\{51FB53BB-9686-4607-9438-CDC0B581A2F0}.exe
attrib -r -s -h c:\WINDOWS\system32\{E9649EC3-5C12-4DE4-939A-C1F76B55D53D}.exe
attrib -r -s -h c:\WINDOWS\system32\{3B32B033-F851-4FC3-9603-0CEDD84342F9}.exe
attrib -r -s -h c:\WINDOWS\system32\{706FF64C-4CD0-4461-A2CD-5621FC3C73D6}.exe
attrib -r -s -h c:\WINDOWS\system32\{BE86B037-2DB6-4DCA-B4A2-A918717EAA7D}.exe
del c:\WINDOWS\System32\ckfnb.exe
del c:\WINDOWS\SYSTEM32\CSJJQ.EXE
del c:\WINDOWS\SYSTEM32\DMOLY.EXE
del c:\WINDOWS\system32\{A91418B8-F060-4199-8349-7D665AF578E5}.dll
del c:\WINDOWS\system32\{3B31802B-9C35-4B12-960C-ED845BA49BFC}.exe
del c:\WINDOWS\system32\{497C6269-274D-448F-9FC3-7F9B57C7DA13}.exe
del c:\WINDOWS\system32\{4B50FB68-72F5-4048-906C-956866F19DB7}.exe
del c:\WINDOWS\system32\{1B5F3308-BB92-4BB2-9DC1-A5371C0060C3}.exe
del c:\WINDOWS\system32\{71B21430-845E-46AF-9F4E-AD7AF6053D20}.exe
del c:\WINDOWS\system32\{D22026E2-EC26-4FEA-8C53-B5A08E0D38DD}.exe
del c:\WINDOWS\system32\{4C59000B-D766-47CC-9DCB-87DCF9178975}.exe
del c:\WINDOWS\system32\{C3EB6E06-1BAB-4DE8-AEEC-270D1332ACED}.exe
del c:\WINDOWS\system32\{993EDC1E-C3D7-47DC-94B4-B956B5AED3B8}.exe
del c:\WINDOWS\system32\{3DBBF63B-580B-4F9B-9B07-4B7E5C21BF34}.exe
del c:\WINDOWS\system32\{8B911E12-169A-47E5-9B61-63B7C70C5ED0}.exe
del c:\WINDOWS\system32\{1C8E843A-29C2-407F-ACC3-FA55BD92099F}.exe
del c:\WINDOWS\system32\{7987E10C-2BA1-4193-A8CA-E79FB7BB9905}.exe
del c:\WINDOWS\system32\{DB146A17-EB66-4E91-9236-375DE33D86B6}.exe
del c:\WINDOWS\system32\{3EA08B34-5833-4E5D-9843-558829FA6039}.exe
del c:\WINDOWS\system32\{AD12CBCD-58BB-4D92-9968-BA8C9FFEAD4C}.exe
del c:\WINDOWS\system32\{47B0D3C1-55E3-4D61-9ACA-6EC9BC397B2E}.exe
del c:\WINDOWS\system32\{EDC3ECAF-81C5-4EB2-AA40-0EF8D029FE8F}.exe
del c:\WINDOWS\system32\{B95EA537-B2FC-4B76-9D9E-8A86FC0D3CE4}.exe
del c:\WINDOWS\system32\{DA16C7D2-B441-4285-BD7D-26A4CDD645EB}.exe
del c:\WINDOWS\system32\{E835B259-D8F7-426C-A8E7-64B3B8F2FCC3}.exe
del c:\WINDOWS\system32\{0523C268-AFC7-4445-B5C7-6D2BB632580D}.exe
del c:\WINDOWS\system32\{175296E5-B1A6-4142-9239-7FB3BFAED564}.exe
del c:\WINDOWS\system32\{49A7EE83-DDCD-45D9-A345-F53F044D8EBF}.exe
del c:\WINDOWS\system32\{79B45575-1967-4225-A7D4-668798FD3672}.exe
del c:\WINDOWS\system32\{527578B1-F351-4CDB-B51C-41AEE1A085F8}.exe
del c:\WINDOWS\system32\{775E116F-56F4-4FEF-9B89-4FBC490DFA0F}.exe
del c:\WINDOWS\system32\{24D3D70D-665A-4110-BC52-8E89F8038B95}.exe
del c:\WINDOWS\system32\{4B8BA877-55ED-4CB9-83E0-37672E9B0147}.exe
del c:\WINDOWS\system32\{ABC6D497-9860-43AB-AA62-88DB448E4AD4}.exe
del c:\WINDOWS\system32\{1A9A959A-F928-4F3D-9624-7C0B04E67D88}.exe
del c:\WINDOWS\system32\{66739E08-25EF-4E42-98E3-2D94F45C0915}.exe
del c:\WINDOWS\system32\{97FFF067-1521-48BF-B416-6126E1192171}.exe
del c:\WINDOWS\system32\{C0AB0DE3-5CFA-484C-846F-DF7A7D80EBB7}.exe
del c:\WINDOWS\system32\{63C2D81D-EFAD-477C-96E0-8D001A95D592}.exe
del c:\WINDOWS\system32\{42903FF5-5E3E-48F0-99F6-94B20BBA82D7}.exe
del c:\WINDOWS\system32\{58801BD4-E875-4048-BF48-73476844ED3D}.exe
del c:\WINDOWS\system32\{28AB7E8E-0B53-462B-BE9F-B64C89EFD1A9}.exe
del c:\WINDOWS\system32\{05898733-0728-4D37-A750-6FDA4A44D528}.exe
del c:\WINDOWS\system32\{3A8BC0D1-28B6-443F-A715-2CDB87B29DB0}.exe
del c:\WINDOWS\system32\{74593EAE-03E9-4E0A-89DA-0EA4D15FB0EC}.exe
del c:\WINDOWS\system32\{7F4B812B-987E-40C6-A1FE-E2ADFBA79FF3}.exe
del c:\WINDOWS\system32\{33BDA151-433F-4765-A690-40187AFCC1D1}.exe
del c:\WINDOWS\system32\{3F6280F9-B821-47E8-ACDF-A3878C2662AD}.exe
del c:\WINDOWS\system32\{3435F1E8-F265-464F-B731-CD12C9705CD8}.exe
del c:\WINDOWS\system32\{131AA67F-E6E8-4C34-9239-AE78A74FF203}.exe
del c:\WINDOWS\system32\{CAA97A0C-7793-44E8-AC8B-03F037FCB564}.exe
del c:\WINDOWS\system32\{4FEC3680-D950-46A5-842F-056ED1BE3B15}.exe
del c:\WINDOWS\system32\{88FF4B81-E7BA-48C3-8903-E8C65EC1D396}.exe
del c:\WINDOWS\system32\{4CCF78BF-1DD7-4F4A-BFAE-E2AE8712A8AD}.exe
del c:\WINDOWS\system32\{EF73478D-D4B8-4CE3-A284-1E61A99BEBC8}.exe
del c:\WINDOWS\system32\{C4CC4A3C-BBCD-4064-B2A9-971EA3534EDC}.exe
del c:\WINDOWS\system32\{C69E5A2D-26C5-4C31-AFEB-968978C8A605}.exe
del c:\WINDOWS\system32\{D2A36840-1875-405E-9912-CD93825033C5}.exe
del c:\WINDOWS\system32\{05594820-324F-4C3B-8557-E643C67DEC6D}.exe
del c:\WINDOWS\system32\{D83AB006-2796-484A-A176-1A3857FD8AAD}.exe
del c:\WINDOWS\system32\{3F14A1D8-267D-4500-A069-E83A39C6847F}.exe
del c:\WINDOWS\system32\{2E667ED2-BDC0-41C7-A9FA-64086C244633}.exe
del c:\WINDOWS\system32\{0096193E-FD7B-4408-9CE9-947873A4FAD4}.exe
del c:\WINDOWS\system32\{4D8702C4-7CE6-4698-B208-AD14C5B82D23}.exe
del c:\WINDOWS\system32\{90241506-F760-461F-9391-354BFE547C47}.exe
del c:\WINDOWS\system32\{D176E940-434E-4B2C-8203-86B265A0D5FC}.exe
del c:\WINDOWS\system32\{98A920E0-B5E9-47B5-8E34-D15142BA1EA7}.exe
del c:\WINDOWS\system32\{EC4D679B-41F6-4BCC-940A-53E74436E56C}.exe
del c:\WINDOWS\system32\{5E0A1797-2F63-4D5C-BD68-6F74929C0A99}.exe
del c:\WINDOWS\system32\{CC0785B8-D771-46E5-A8E9-B96995136F67}.exe
del c:\WINDOWS\system32\{E0E94E91-67A1-4630-A239-7623ABE1A50F}.exe
del c:\WINDOWS\system32\{130D2655-2C39-4675-8E03-F35EB6E40BE2}.exe
del c:\WINDOWS\system32\{31691B7B-970E-4115-A99D-F3F4DFBBD852}.exe
del c:\WINDOWS\system32\{8B4E2357-994D-480C-B07A-6BE8826F87A7}.exe
del c:\WINDOWS\system32\{39AA4D5F-D6E8-499C-893F-3869AEC8903D}.exe
del c:\WINDOWS\system32\{0EA7FAF9-03F7-4DCA-9093-9EFA9A905162}.exe
del c:\WINDOWS\system32\{42367B39-6C43-4219-8BE9-4F2E22E2FB65}.exe
del c:\WINDOWS\system32\{CC7091CB-5E16-4A20-AF05-50A0521B276D}.exe
del c:\WINDOWS\system32\{8DBB0DAB-DDCF-4420-AAF5-AE7AA79B0D5E}.exe
del c:\WINDOWS\system32\{52C131A5-844A-4524-83E0-52E47EBB946B}.exe
del c:\WINDOWS\system32\{3840DE07-261E-426B-9D60-F2E8387BE7F9}.exe
del c:\WINDOWS\system32\{2D849548-7CA5-4F15-B968-82E19B945460}.exe
del c:\WINDOWS\system32\{4F9A4C9C-3C3F-4C17-AAF4-47CEA7EC24C4}.exe
del c:\WINDOWS\system32\{4149793C-2C96-4A71-810D-EDA9870F1032}.exe
del c:\WINDOWS\system32\{CD4EEFE4-DB31-4930-AB8F-6BE3D684806F}.exe
del c:\WINDOWS\system32\{33B79C02-C55D-44F3-BA93-23028C53C226}.exe
del c:\WINDOWS\system32\{9AD909EB-FCB7-414B-A44A-6D0AC2945C07}.exe
del c:\WINDOWS\system32\{505F3F9D-1381-4CE7-8EB8-9CC6662F982B}.exe
del c:\WINDOWS\system32\{9C1792B6-728B-4BD3-94F0-A0B2A1403ECD}.exe
del c:\WINDOWS\system32\{FCE7B789-4BFB-4A86-B3C5-A6264E52AFEE}.exe
del c:\WINDOWS\system32\{11436197-F978-4E36-A5A3-D2CA182CE95F}.exe
del c:\WINDOWS\system32\{447FDC9B-05FA-4041-A227-DE59DE05A240}.exe
del c:\WINDOWS\system32\{7019EA27-A88C-4564-889A-5B4EA380A9E8}.exe
del c:\WINDOWS\system32\{E587E137-E9BA-49A9-B2E8-039403B3DF76}.exe
del c:\WINDOWS\system32\{669FAA80-0317-457C-BC4F-FEDA5BA6B1AD}.exe
del c:\WINDOWS\system32\{87EC573B-DC5B-4551-BBEE-7E3041C9CF0B}.exe
del c:\WINDOWS\system32\{DD6F513D-9B4F-43DE-AD82-135717FE9B40}.exe
del c:\WINDOWS\system32\{BA26586D-190E-4F6B-BEE6-1EA2BBB45F9A}.exe
del c:\WINDOWS\system32\{0D3EC44C-92D4-4177-8F42-6BDD86042D9F}.exe
del c:\WINDOWS\system32\{2BB8F2F8-CC1E-478D-922B-A403AC4EB695}.exe
del c:\WINDOWS\system32\{51FB53BB-9686-4607-9438-CDC0B581A2F0}.exe
del c:\WINDOWS\system32\{E9649EC3-5C12-4DE4-939A-C1F76B55D53D}.exe
del c:\WINDOWS\system32\{3B32B033-F851-4FC3-9603-0CEDD84342F9}.exe
del c:\WINDOWS\system32\{706FF64C-4CD0-4461-A2CD-5621FC3C73D6}.exe
del c:\WINDOWS\system32\{BE86B037-2DB6-4DCA-B4A2-A918717EAA7D}.exe

Save it to your desktop as ff.bat

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O1 - Hosts: localhost 127.0.0.1

O4 - HKLM\..\Run: [ckfnb.exe] C:\WINDOWS\System32\ckfnb.exe

Then click "Fix checked".

Now click on Config –> Misc Tools –> Open Process Manager

In the list of processes, find explorer.exe

Click to highlight, then click "Kill Process". OK any prompts.

Your desktop will disappear, but that is normal. It will come back when you reboot.

Now, in HijackThis!, click:

Run –> browse

Browse to your desktop and click ff.bat –> open –> OK

Browse c:\fixwareout click Fixit.bat –> open –> OK

This will start Fixwareout again.

After the reboot, post:

1. The fixwareout report

2. A new HijackThis! log

Into this thread.

allnight33

Post #7August 8, 2006, 12:44 AM UTC

Now, in HijackThis!, click: Run –> browse You lost me here. where is this prompt?

Micah_6:8

Post #8August 8, 2006, 12:55 AM UTC

Run is on the same window in HijackThis! when you kill explorer.exe

allnight33

Post #9August 8, 2006, 1:17 AM UTC

here we go…

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32

Logfile of HijackThis v1.99.1
Scan saved at 9:09:26 PM, on 8/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Robert Brown\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cleveland.com/browns
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [eanth_critical_update_alert] C:\PROGRA~1\ACCELE~1\ANTI-V~1\EANTH_~1.EXE /Startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr.com/install/download/tgctlcm.cab
O16 - DPF: {1DD81666-F3AD-11D3-BA86-00500487B4EC} (WonSearchX Control) - http://www.investors.com/member/ocx/WonSearchX.ocx
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion…ctor/WebAAS.cab
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Micah_6:8

Post #10August 8, 2006, 1:25 AM UTC

You did a good job.

No more malware seems to be present.

This software is not recommended:

O4 - HKLM\..\Run: [eanth_critical_update_alert] C:\PROGRA~1\ACCELE~1\ANTI-V~1\EANTH_~1.EXE /Startup

And your Java needs an update.

The latest version out is jre1.5.0_07
(May be 6)

You should remove previous versions via "Add/Remove Programs" before updating.

jre1.5.0_07 update link
(May be 6)

How's the machine running now?

Securing Your PC After An Attack

allnight33

Post #11August 8, 2006, 1:59 AM UTC

Micah_6:8, Everything is running better than expected. You did a GREAT job. I owe you….. THANKS!!!!!!!!!!!!!!!!!!!!!

Micah_6:8

Post #12August 8, 2006, 2:04 AM UTC

YOU did all the work….

Thank you for choosing TomCoyote for your malware removal solutions.

M68

Securing Your PC After An Attack

Micah_6:8

Post #13August 8, 2006, 2:39 AM UTC

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

tried self help, but still not working.

✨ Ask AI

Ask AI