Can't get rid of Clicker.FR

Hi,
I am new here as I have not had to deal with a Trojan before. recently got some browser hijackers and then three trojans "Clicker.FR", "Generic.XFV" and "Generic.XKS". AVG Antivirus stops them but can't get rid of them. My HijackThis log file is below. I have already uninstalled a "Kill and Clean" program which suddenly appeared in my system. Would appreciate any help in cleaning up…..

Logfile of HijackThis v1.99.1
Scan saved at 10:21:02 PM, on 10/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\CPal\CPBrWtch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Documents and Settings\Admin\Application Data\Map Maker\MMManager.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\CPal\CPal.exe
C:\Utils\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/redire…;lc=0809&ac
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.presario.net/scripts/redirec…rch&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirec…rch&ap=b204
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.presario.net/scripts/redirec…rch&ap=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redire…;lc=0809&ac
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {520ee3f6-05ab-4aeb-930e-d898de2d351c} - C:\WINDOWS\system32\crtblr.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Piolet Toolbar Helper - {9F17C005-7BF0-4f13-8473-F3C3D2619DBD} - C:\Program Files\Piolet Toolbar\v2.0.0.5\Piolet_Toolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Piolet Toolbar - {6A41F582-CC0E-402a-A16D-A32ABA3043CE} - C:\Program Files\Piolet Toolbar\v2.0.0.5\Piolet_Toolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Admin\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Cookie Pal] "C:\Program Files\CPal\CPBrWtch.exe"
O4 - HKLM\..\Run: [uhlmy.exe] C:\WINDOWS\system32\uhlmy.exe
O4 - HKCU\..\Run: [TClockEx] C:\Utils\TclockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - Startup: SunClock5.lnk = C:\Documents and Settings\Admin\Application Data\Map Maker\MMManager.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3EF75030-91B5-4665-96D9-3BA36C08DF7B}: NameServer = 85.255.116.68,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{7F97F95F-9350-41BF-9BF8-ED65C4888326}: NameServer = 85.255.116.68,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{98CDD97B-1CAE-4A9E-A24B-9D37091E4964}: NameServer = 85.255.116.68,85.255.112.100
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.68 85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.68 85.255.112.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: crtblr - crtblr.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Thanks for the response. I followed the instructions with the results as below…

The assistance is greatly appreciated…..

Logfile of HijackThis v1.99.1
Scan saved at 10:38:59 PM, on 11/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\CPal\CPBrWtch.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Documents and Settings\Admin\Application Data\Map Maker\MMManager.exe
C:\Utils\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirec…rch&ap=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redire…;lc=0809&ac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Piolet Toolbar Helper - {9F17C005-7BF0-4f13-8473-F3C3D2619DBD} - C:\Program Files\Piolet Toolbar\v2.0.0.5\Piolet_Toolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Piolet Toolbar - {6A41F582-CC0E-402a-A16D-A32ABA3043CE} - C:\Program Files\Piolet Toolbar\v2.0.0.5\Piolet_Toolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Admin\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Cookie Pal] "C:\Program Files\CPal\CPBrWtch.exe"
O4 - HKLM\..\Run: [oaosw.exe] C:\WINDOWS\system32\oaosw.exe
O4 - HKCU\..\Run: [TClockEx] C:\Utils\TclockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SunClock5.lnk = C:\Documents and Settings\Admin\Application Data\Map Maker\MMManager.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3EF75030-91B5-4665-96D9-3BA36C08DF7B}: NameServer = 85.255.116.68,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{7F97F95F-9350-41BF-9BF8-ED65C4888326}: NameServer = 85.255.116.68,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{98CDD97B-1CAE-4A9E-A24B-9D37091E4964}: NameServer = 85.255.116.68,85.255.112.100
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.68 85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.68 85.255.112.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe


FixWareout Report :-


Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}317C60EAD4A7-995B-93D4-DFAC-31167BE5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}97EDDCE4943E-4AA8-95C4-A59A-2B604BB2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A2C21AA6DE5D-9DE9-B8B4-7F14-2EAB7751{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}73872549F95C-4EBB-D3F4-7132-0D444D9A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8961BA84198C-96C9-D6B4-90A8-0A3562D9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C9D1091DEDBF-59C9-9C34-49EF-E53E2815{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DF460BA25337-17A9-BE74-BA1F-664A189A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9000E9B8C4A3-D12A-E934-7912-3A613E20{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8501F71EF7FE-CA59-51E4-BFFD-11AC33E2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4CDB264B2729-F798-34A4-1EF1-B9413218{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}699CAD1F5C91-6778-1D64-3200-50179D58{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}810944555D7D-34AB-CC14-14B6-7D62A7C2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ED95923AA96B-9668-ABE4-E996-4BF774A6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8E4E97D0CC03-46BB-3454-40C6-4EE16A05{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2BD9356BA170-D23A-5FA4-04A8-FBE4C8D5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}204BF59AF293-D7F8-A1B4-6C41-18DED00F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0AF3C2956AEA-6679-5724-ADDE-031EEFFB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F05F9F580611-882B-8214-4AF9-4E64E2EB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}57E062AA2180-6939-79E4-31BA-EE1EE46B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}023E02AE0005-9C3A-DFF4-FE37-410BE8C0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FA997FFDDFBB-98E9-5C54-7759-8FEFC474{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8BBA06C4EDCD-15E8-5DE4-68BB-D5AD97EF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E74BCE9A9057-598A-1E34-DC00-35172E02{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}474599E3239B-D4B8-80B4-570A-4C4367C0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}434378C653FE-DC58-C124-C92F-6399455D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}221401F47AB7-E7E9-4C04-4797-A25D839A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2EED1F894F9D-6708-DB54-D84C-AA65D8F2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F979FD667B8E-2A9A-5B14-84FA-84C2E338{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}48723C6E7903-6F6A-DCA4-709F-0886269D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2BE621420B25-DD68-A9A4-2C31-169630B7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E69D10B32E50-F8B8-FB34-D346-17D73E68{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}195AFA818D1B-E0D8-27F4-E174-C0984D6C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CCDAA5E5B179-CFF8-4964-8D83-D382B745{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}365F8E94AA0A-80DA-AEF4-3221-94E721FC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}82F453DEC2D9-5E9A-D574-196A-F7F18844{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5498EF90DC91-B3AA-4624-4FBF-F3A26B12{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A6B5402986FE-F109-8F34-C4D6-33680F4A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}49AD7A252D68-28A8-A544-0723-03E10ED6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}949EEC34B71A-68FB-F2E4-A1C9-587261F9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}03DD1B132F2A-4BBB-7E44-A419-4CDB706A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}75ED2446715A-FC28-C084-B356-4A12C11F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}827C565CE1ED-0B78-5E24-B03F-6C991EB2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6F7109897050-7458-2BE4-CD40-C825EB4E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C1311A644E6F-6EE8-CC04-29FA-1760D855{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FB19229836B2-DDA9-9504-C572-AE730A9D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}78A5100D92FA-19FA-B394-F086-40B4761F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0C92660E08D3-9658-D714-F832-5426FB35{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}302DCFAEDA70-572B-4664-8E51-D65D3C32{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F23031D2D666-8249-0864-A87A-B3FB6FBA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}811A1BC5E629-1029-1764-DD0B-F1199DFF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E278936C4993-C8D8-18C4-5A86-F4A2661F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2EBD542C4433-DEE9-4FE4-5A57-5CAD3167{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BE124CB34151-C619-94F4-989D-C6A987B7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0F954B9CC25-90B9-9604-5CA5-23938704{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6A2210A98F3E-93DA-3CD4-093A-6A855CBB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BD5A197A78CC-1D6B-8244-02D9-C437DF01{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}56CC9BAA06BC-F558-0AF4-D744-389554C4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}72DBE7F81A67-8698-D324-3F82-B4D98D50{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}365A77979D9C-B618-DE84-21AD-56FD0D1D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6B31BFCC17FB-EE99-3D64-53CF-FF4A38F4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}064150355BD1-9C2A-6004-443C-B27D5151{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DAF2FBA7D4C9-9238-B8A4-2660-5D0B5E9D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BC1DAAD7CC42-95B9-6724-420B-C79FF0AF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}37923D7EBD0E-1908-9A24-C712-FD87004F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8F2D587736CF-D3B8-4714-B980-806AA3E7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}99E3FEAA9D90-E408-2194-7C8C-B26FC3CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CF69F1BAB7FD-5F8B-C7A4-C34D-DFD8D683{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1B00D98E8121-E949-5424-5516-35A1F3B4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}71D4CBC4B8C2-C889-CC94-44E6-6C641ACC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2E371476748E-F5E9-6854-82F5-BCD5B33B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6FCBFFA4B1DD-981A-7EF4-9245-1282F8C4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}12C88E9EEB0A-C838-87A4-5479-42F2529F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}648B87F5C286-CBD8-1BC4-E048-724D8E3F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7D5D183CC958-C47A-1A44-17A1-F449B991{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A5E0197B30E9-FF7B-EDB4-9E77-2E302A9F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}59D8FB76FD93-8C1A-0CB4-82F0-AC977E2E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D012486FA458-39FA-0344-749C-1ED90165{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7769058B8DF5-AAEA-5024-198F-4563E089{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}881AA312C7E3-180A-1064-DBC9-879A0DF8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}81D49FD64C89-021A-56E4-41F9-4210D7F8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BBE25EF4094E-8B99-A114-E8B1-6C9D508D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2D75C9956FC4-AC3A-63D4-1B2C-DC2E039B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F29DB619EC1C-6478-2DF4-965C-4BFE9807{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}023B24120C6C-3E3A-E634-F209-36DEE6C8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C7AEB85BE4E6-0ECA-5354-0C66-3A316D88{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0DFFBE0DF42-F9E9-BCF4-745F-6358F88C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}42D07377AABE-1DE8-A3D4-DB0F-7FF21871{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7E50C4685E8C-3B19-F534-F731-8C68D7A5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5EC2B7D2E5FB-924B-6224-A913-521ACBF5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}349A604EAF32-E70B-2AC4-4509-51690C2D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F2C8D8437618-B378-32C4-BD41-F5D56BAE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3DE2EF6909C-E678-3E04-90A0-298E9ED4{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0C50563B6299-6E18-ECA4-A2E3-8F29D463{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6AF8C78824ED-0F8B-0234-C642-551FFEBF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DC96EA812FA5-1858-B5B4-6DCE-F256EB8F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1486EAA48D17-E45A-6F24-9147-01BB74B1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E30259739FAF-2209-31E4-E82A-06C18B49{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F9614ED63735-79DB-7CD4-7E86-9B3447B3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D642652B1695-5CCA-5DB4-83EC-357DFC05{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2F734B26FA5D-D89B-DA44-48E7-99911EBF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}36863E146E6F-F459-CAD4-A922-F5373CBF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}93CE31E12928-BF58-67F4-D6BA-8CFE72D5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B3AF2CE67E69-DDB8-5A84-5865-F83F86B0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\noxmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\evif
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmxon.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…
* csr.exe C:\WINDOWS\System32\CSSHG.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSSHG.EXE 51,292 2006-08-09
C:\WINDOWS\SYSTEM32\DMXON.EXE 61,960 2004-08-04
Other suspects
Directory of C:\WINDOWS\system32
{0B68F38F-5685-48A5-8BDD-96E76EC2FA3B}.exe
{5D27EFC8-AB6D-4F76-85FB-82921E13EC39}.exe
{FBC3735F-229A-4DAC-954F-F6E641E36863}.exe
{FBE11999-7E84-44AD-B98D-D5AF62B437F2}.exe
{50CFD753-CE38-4BD5-ACC5-5961B256246D}.exe
{3B7443B9-68E7-4DC7-BD97-53736DE4169F}.exe
{94B81C60-A28E-4E13-9022-FAF93795203E}.exe
{1B47BB10-7419-42F6-A54E-71D84AAE6841}.exe
{F8BE652F-ECD6-4B5B-8581-5AF218AE69CD}.exe
{FBEFF155-246C-4320-B8F0-DE42887C8FA6}.exe
{364D92F8-3E2A-4ACE-81E6-9926B36505C0}.exe
{4DE9E892-0A09-40E3-876E-C9096FE2ED3D}.exe
{EAB65D5F-14DB-4C23-873B-8167348D8C2F}.exe
{D2C09615-9054-4CA2-B07E-23FAE406A943}.exe
{5FBCA125-319A-4226-B429-BF5E2D7B2CE5}.exe
{5A7D86C8-137F-435F-91B3-C8E5864C05E7}.exe
{17812FF7-F0BD-4D3A-8ED1-EBAA77370D24}.exe
{C88F8536-F547-4FCB-9E9F-24FD0EBFFD0B}.exe
{88D613A3-66C0-4535-ACE0-6E4EB58BEA7C}.exe
{8C6EED63-902F-436E-A3E3-C6C02142B320}.exe
{7089EFB4-C569-4FD2-8746-C1CE916BD92F}.exe
{B930E2CD-C2B1-4D36-A3CA-4CF6599C57D2}.exe
{D805D9C6-1B8E-411A-99B8-E4904FE52EBB}.exe
{8F7D0124-9F14-4E65-A120-98C46DF94D18}.exe
{8FD0A978-9CBD-4601-A081-3E7C213AA188}.exe
{980E3654-F891-4205-AEAA-5FD8B8509677}.exe
{56109DE1-C947-4430-AF93-854AF684210D}.exe
{E2E779CA-0F28-4BC0-A1C8-39DF67BF8D95}.exe
{F9A203E2-77E9-4BDE-B7FF-9E03B7910E5A}.exe
{199B944F-1A71-44A1-A74C-859CC381D5D7}.exe
{F3E8D427-840E-4CB1-8DBC-682C5F78B846}.exe
{F9252F24-9745-4A78-838C-A0BEE9E88C21}.exe
{4C8F2821-5429-4FE7-A189-DD1B4AFFBCF6}.exe
{B33B5DCB-5F28-4586-9E5F-E847674173E2}.exe
{CCA146C6-6E44-49CC-988C-2C8B4CBC4D17}.exe
{4B3F1A53-6155-4245-949E-1218E89D00B1}.exe
{386D8DFD-D43C-4A7C-B8F5-DF7BAB1F96FC}.exe
{CC3CF62B-C8C7-4912-804E-09D9AAEF3E99}.exe
{7E3AA608-089B-4174-8B3D-FC637785D2F8}.exe
{F40078DF-217C-42A9-8091-E0DBE7D32973}.exe
{FA0FF97C-B024-4276-9B59-24CC7DAAD1CB}.exe
{D9E5B0D5-0662-4A8B-8329-9C4D7ABF2FAD}.exe
{1515D72B-C344-4006-A2C9-1DB553051460}.exe
{4F83A4FF-FC35-46D3-99EE-BF71CCFB13B6}.exe
{D1D0DF65-DA12-48ED-816B-C9D97977A563}.exe
{05D89D4B-28F3-423D-8968-76A18F7EBD27}.exe
{4C455983-447D-4FA0-855F-CB60AAB9CC65}.exe
{10FD734C-9D20-4428-B6D1-CC87A791A5DB}.exe
{BBC558A6-A390-4DC3-AD39-E3F89A0122A6}.exe
{40783932-5AC5-4069-9B09-52CC9B459F0B}.exe
{7B789A6C-D989-4F49-916C-15143BC421EB}.exe
{7613DAC5-75A5-4EF4-9EED-3344C245DBE2}.exe
{F1662A4F-68A5-4C81-8D8C-3994C639872E}.exe
{FFD9911F-B0DD-4671-9201-926E5CB1A118}.exe
{ABF6BF3B-A78A-4680-9428-666D2D13032F}.exe
{23C3D56D-15E8-4664-B275-07ADEAFCD203}.exe
{53BF6245-238F-417D-8569-3D80E06629C0}.exe
{F1674B04-680F-493B-AF91-AF29D0015A87}.exe
{D9A037EA-275C-4059-9ADD-2B63892291BF}.exe
{558D0671-AF92-40CC-8EE6-F6E446A1131C}.exe
{E4BE528C-04DC-4EB2-8547-0507989017F6}.exe
{2BE199C6-F30B-42E5-87B0-DE1EC565C728}.exe
{F11C21A4-653B-480C-82CF-A5176442DE57}.exe
{A607BDC4-914A-44E7-BBB4-A2F231B1DD30}.exe
{9F162785-9C1A-4E2F-BF86-A17B43CEE949}.exe
{6DE01E30-3270-445A-8A82-86D252A7DA94}.exe
{A4F08633-6D4C-43F8-901F-EF6892045B6A}.exe
{21B62A3F-FBF4-4264-AA3B-19CD09FE8945}.exe
{44881F7F-A691-475D-A9E5-9D2CED354F28}.exe
{CF127E49-1223-4FEA-AD08-A0AA49E8F563}.exe
{547B283D-38D8-4694-8FFC-971B5E5AADCC}.exe
{C6D4890C-471E-4F72-8D0E-B1D818AFA591}.exe
{86E37D71-643D-43BF-8B8F-05E23B01D96E}.exe
{7B036961-13C2-4A9A-86DD-52B024126EB2}.exe
{D9626880-F907-4ACD-A6F6-3097E6C32784}.exe
{833E2C48-AF48-41B5-A9A2-E8B766DF979F}.exe
{2F8D56AA-C48D-45BD-8076-D9F498F1DEE2}.exe
{D5549936-F29C-421C-85CD-EF356C873434}.exe
{0C7634C4-A075-4B08-8B4D-B9323E995474}.exe
{20E27153-00CD-43E1-A895-7509A9ECB47E}.exe
{FE79DA5D-BB86-4ED5-8E51-DCDE4C60ABB8}.exe
{474CFEF8-9577-45C5-9E89-BBFDDFF799AF}.exe
{0C8EB014-73EF-4FFD-A3C9-5000EA20E320}.exe
{B64EE1EE-AB13-4E97-9396-0812AA260E75}.exe
{BE2E46E4-9FA4-4128-B288-116085F9F50F}.exe
{BFFEE130-EDDA-4275-9766-AEA6592C3FA0}.exe
{F00DED81-14C6-4B1A-8F7D-392FA95FB402}.exe
{5D8C4EBF-8A40-4AF5-A32D-071AB6539DB2}.exe
{50A61EE4-6C04-4543-BB64-30CC0D79E4E8}.exe
{6A477FB4-699E-4EBA-8669-B69AA32959DE}.exe
{2C7A26D7-6B41-41CC-BA43-D7D555449018}.exe
{85D97105-0023-46D1-8776-19C5F1DAC996}.exe
{8123149B-1FE1-4A43-897F-9272B462BDC4}.exe
{2E33CA11-DFFB-4E15-95AC-EF7FE17F1058}.exe
{02E316A3-2197-439E-A21D-3A4C8B9E0009}.exe
{A981A466-F1AB-47EB-9A71-73352AB064FD}.exe
{5182E35E-FE94-43C9-9C95-FBDED1901D9C}.exe
{9D2653A0-8A09-4B6D-9C69-C89148AB1698}.exe
{A9D444D0-2317-4F3D-BBE4-C59F94527837}.exe
{1577BAE2-41F7-4B8B-9ED9-D5ED6AA12C2A}.exe
{2BB406B2-A95A-4C59-8AA4-E3494ECDDE79}.exe

Copy the text in the following quote box into Notepad:

attrib -r -s -h C:\WINDOWS\system32\oaosw.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSSHG.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMXON.EXE
attrib -r -s -h c:\windows\system32\{0B68F38F-5685-48A5-8BDD-96E76EC2FA3B}.exe
attrib -r -s -h c:\windows\system32\{5D27EFC8-AB6D-4F76-85FB-82921E13EC39}.exe
attrib -r -s -h c:\windows\system32\{FBC3735F-229A-4DAC-954F-F6E641E36863}.exe
attrib -r -s -h c:\windows\system32\{FBE11999-7E84-44AD-B98D-D5AF62B437F2}.exe
attrib -r -s -h c:\windows\system32\{50CFD753-CE38-4BD5-ACC5-5961B256246D}.exe
attrib -r -s -h c:\windows\system32\{3B7443B9-68E7-4DC7-BD97-53736DE4169F}.exe
attrib -r -s -h c:\windows\system32\{94B81C60-A28E-4E13-9022-FAF93795203E}.exe
attrib -r -s -h c:\windows\system32\{1B47BB10-7419-42F6-A54E-71D84AAE6841}.exe
attrib -r -s -h c:\windows\system32\{F8BE652F-ECD6-4B5B-8581-5AF218AE69CD}.exe
attrib -r -s -h c:\windows\system32\{FBEFF155-246C-4320-B8F0-DE42887C8FA6}.exe
attrib -r -s -h c:\windows\system32\{364D92F8-3E2A-4ACE-81E6-9926B36505C0}.exe
attrib -r -s -h c:\windows\system32\{4DE9E892-0A09-40E3-876E-C9096FE2ED3D}.exe
attrib -r -s -h c:\windows\system32\{EAB65D5F-14DB-4C23-873B-8167348D8C2F}.exe
attrib -r -s -h c:\windows\system32\{D2C09615-9054-4CA2-B07E-23FAE406A943}.exe
attrib -r -s -h c:\windows\system32\{5FBCA125-319A-4226-B429-BF5E2D7B2CE5}.exe
attrib -r -s -h c:\windows\system32\{5A7D86C8-137F-435F-91B3-C8E5864C05E7}.exe
attrib -r -s -h c:\windows\system32\{17812FF7-F0BD-4D3A-8ED1-EBAA77370D24}.exe
attrib -r -s -h c:\windows\system32\{C88F8536-F547-4FCB-9E9F-24FD0EBFFD0B}.exe
attrib -r -s -h c:\windows\system32\{88D613A3-66C0-4535-ACE0-6E4EB58BEA7C}.exe
attrib -r -s -h c:\windows\system32\{8C6EED63-902F-436E-A3E3-C6C02142B320}.exe
attrib -r -s -h c:\windows\system32\{7089EFB4-C569-4FD2-8746-C1CE916BD92F}.exe
attrib -r -s -h c:\windows\system32\{B930E2CD-C2B1-4D36-A3CA-4CF6599C57D2}.exe
attrib -r -s -h c:\windows\system32\{D805D9C6-1B8E-411A-99B8-E4904FE52EBB}.exe
attrib -r -s -h c:\windows\system32\{8F7D0124-9F14-4E65-A120-98C46DF94D18}.exe
attrib -r -s -h c:\windows\system32\{8FD0A978-9CBD-4601-A081-3E7C213AA188}.exe
attrib -r -s -h c:\windows\system32\{980E3654-F891-4205-AEAA-5FD8B8509677}.exe
attrib -r -s -h c:\windows\system32\{56109DE1-C947-4430-AF93-854AF684210D}.exe
attrib -r -s -h c:\windows\system32\{E2E779CA-0F28-4BC0-A1C8-39DF67BF8D95}.exe
attrib -r -s -h c:\windows\system32\{F9A203E2-77E9-4BDE-B7FF-9E03B7910E5A}.exe
attrib -r -s -h c:\windows\system32\{199B944F-1A71-44A1-A74C-859CC381D5D7}.exe
attrib -r -s -h c:\windows\system32\{F3E8D427-840E-4CB1-8DBC-682C5F78B846}.exe
attrib -r -s -h c:\windows\system32\{F9252F24-9745-4A78-838C-A0BEE9E88C21}.exe
attrib -r -s -h c:\windows\system32\{4C8F2821-5429-4FE7-A189-DD1B4AFFBCF6}.exe
attrib -r -s -h c:\windows\system32\{B33B5DCB-5F28-4586-9E5F-E847674173E2}.exe
attrib -r -s -h c:\windows\system32\{CCA146C6-6E44-49CC-988C-2C8B4CBC4D17}.exe
attrib -r -s -h c:\windows\system32\{4B3F1A53-6155-4245-949E-1218E89D00B1}.exe
attrib -r -s -h c:\windows\system32\{386D8DFD-D43C-4A7C-B8F5-DF7BAB1F96FC}.exe
attrib -r -s -h c:\windows\system32\{CC3CF62B-C8C7-4912-804E-09D9AAEF3E99}.exe
attrib -r -s -h c:\windows\system32\{7E3AA608-089B-4174-8B3D-FC637785D2F8}.exe
attrib -r -s -h c:\windows\system32\{F40078DF-217C-42A9-8091-E0DBE7D32973}.exe
attrib -r -s -h c:\windows\system32\{FA0FF97C-B024-4276-9B59-24CC7DAAD1CB}.exe
attrib -r -s -h c:\windows\system32\{D9E5B0D5-0662-4A8B-8329-9C4D7ABF2FAD}.exe
attrib -r -s -h c:\windows\system32\{1515D72B-C344-4006-A2C9-1DB553051460}.exe
attrib -r -s -h c:\windows\system32\{4F83A4FF-FC35-46D3-99EE-BF71CCFB13B6}.exe
attrib -r -s -h c:\windows\system32\{D1D0DF65-DA12-48ED-816B-C9D97977A563}.exe
attrib -r -s -h c:\windows\system32\{05D89D4B-28F3-423D-8968-76A18F7EBD27}.exe
attrib -r -s -h c:\windows\system32\{4C455983-447D-4FA0-855F-CB60AAB9CC65}.exe
attrib -r -s -h c:\windows\system32\{10FD734C-9D20-4428-B6D1-CC87A791A5DB}.exe
attrib -r -s -h c:\windows\system32\{BBC558A6-A390-4DC3-AD39-E3F89A0122A6}.exe
attrib -r -s -h c:\windows\system32\{40783932-5AC5-4069-9B09-52CC9B459F0B}.exe
attrib -r -s -h c:\windows\system32\{7B789A6C-D989-4F49-916C-15143BC421EB}.exe
attrib -r -s -h c:\windows\system32\{7613DAC5-75A5-4EF4-9EED-3344C245DBE2}.exe
attrib -r -s -h c:\windows\system32\{F1662A4F-68A5-4C81-8D8C-3994C639872E}.exe
attrib -r -s -h c:\windows\system32\{FFD9911F-B0DD-4671-9201-926E5CB1A118}.exe
attrib -r -s -h c:\windows\system32\{ABF6BF3B-A78A-4680-9428-666D2D13032F}.exe
attrib -r -s -h c:\windows\system32\{23C3D56D-15E8-4664-B275-07ADEAFCD203}.exe
attrib -r -s -h c:\windows\system32\{53BF6245-238F-417D-8569-3D80E06629C0}.exe
attrib -r -s -h c:\windows\system32\{F1674B04-680F-493B-AF91-AF29D0015A87}.exe
attrib -r -s -h c:\windows\system32\{D9A037EA-275C-4059-9ADD-2B63892291BF}.exe
attrib -r -s -h c:\windows\system32\{558D0671-AF92-40CC-8EE6-F6E446A1131C}.exe
attrib -r -s -h c:\windows\system32\{E4BE528C-04DC-4EB2-8547-0507989017F6}.exe
attrib -r -s -h c:\windows\system32\{2BE199C6-F30B-42E5-87B0-DE1EC565C728}.exe
attrib -r -s -h c:\windows\system32\{F11C21A4-653B-480C-82CF-A5176442DE57}.exe
attrib -r -s -h c:\windows\system32\{A607BDC4-914A-44E7-BBB4-A2F231B1DD30}.exe
attrib -r -s -h c:\windows\system32\{9F162785-9C1A-4E2F-BF86-A17B43CEE949}.exe
attrib -r -s -h c:\windows\system32\{6DE01E30-3270-445A-8A82-86D252A7DA94}.exe
attrib -r -s -h c:\windows\system32\{A4F08633-6D4C-43F8-901F-EF6892045B6A}.exe
attrib -r -s -h c:\windows\system32\{21B62A3F-FBF4-4264-AA3B-19CD09FE8945}.exe
attrib -r -s -h c:\windows\system32\{44881F7F-A691-475D-A9E5-9D2CED354F28}.exe
attrib -r -s -h c:\windows\system32\{CF127E49-1223-4FEA-AD08-A0AA49E8F563}.exe
attrib -r -s -h c:\windows\system32\{547B283D-38D8-4694-8FFC-971B5E5AADCC}.exe
attrib -r -s -h c:\windows\system32\{C6D4890C-471E-4F72-8D0E-B1D818AFA591}.exe
attrib -r -s -h c:\windows\system32\{86E37D71-643D-43BF-8B8F-05E23B01D96E}.exe
attrib -r -s -h c:\windows\system32\{7B036961-13C2-4A9A-86DD-52B024126EB2}.exe
attrib -r -s -h c:\windows\system32\{D9626880-F907-4ACD-A6F6-3097E6C32784}.exe
attrib -r -s -h c:\windows\system32\{833E2C48-AF48-41B5-A9A2-E8B766DF979F}.exe
attrib -r -s -h c:\windows\system32\{2F8D56AA-C48D-45BD-8076-D9F498F1DEE2}.exe
attrib -r -s -h c:\windows\system32\{D5549936-F29C-421C-85CD-EF356C873434}.exe
attrib -r -s -h c:\windows\system32\{0C7634C4-A075-4B08-8B4D-B9323E995474}.exe
attrib -r -s -h c:\windows\system32\{20E27153-00CD-43E1-A895-7509A9ECB47E}.exe
attrib -r -s -h c:\windows\system32\{FE79DA5D-BB86-4ED5-8E51-DCDE4C60ABB8}.exe
attrib -r -s -h c:\windows\system32\{474CFEF8-9577-45C5-9E89-BBFDDFF799AF}.exe
attrib -r -s -h c:\windows\system32\{0C8EB014-73EF-4FFD-A3C9-5000EA20E320}.exe
attrib -r -s -h c:\windows\system32\{B64EE1EE-AB13-4E97-9396-0812AA260E75}.exe
attrib -r -s -h c:\windows\system32\{BE2E46E4-9FA4-4128-B288-116085F9F50F}.exe
attrib -r -s -h c:\windows\system32\{BFFEE130-EDDA-4275-9766-AEA6592C3FA0}.exe
attrib -r -s -h c:\windows\system32\{F00DED81-14C6-4B1A-8F7D-392FA95FB402}.exe
attrib -r -s -h c:\windows\system32\{5D8C4EBF-8A40-4AF5-A32D-071AB6539DB2}.exe
attrib -r -s -h c:\windows\system32\{50A61EE4-6C04-4543-BB64-30CC0D79E4E8}.exe
attrib -r -s -h c:\windows\system32\{6A477FB4-699E-4EBA-8669-B69AA32959DE}.exe
attrib -r -s -h c:\windows\system32\{2C7A26D7-6B41-41CC-BA43-D7D555449018}.exe
attrib -r -s -h c:\windows\system32\{85D97105-0023-46D1-8776-19C5F1DAC996}.exe
attrib -r -s -h c:\windows\system32\{8123149B-1FE1-4A43-897F-9272B462BDC4}.exe
attrib -r -s -h c:\windows\system32\{2E33CA11-DFFB-4E15-95AC-EF7FE17F1058}.exe
attrib -r -s -h c:\windows\system32\{02E316A3-2197-439E-A21D-3A4C8B9E0009}.exe
attrib -r -s -h c:\windows\system32\{A981A466-F1AB-47EB-9A71-73352AB064FD}.exe
attrib -r -s -h c:\windows\system32\{5182E35E-FE94-43C9-9C95-FBDED1901D9C}.exe
attrib -r -s -h c:\windows\system32\{9D2653A0-8A09-4B6D-9C69-C89148AB1698}.exe
attrib -r -s -h c:\windows\system32\{A9D444D0-2317-4F3D-BBE4-C59F94527837}.exe
attrib -r -s -h c:\windows\system32\{1577BAE2-41F7-4B8B-9ED9-D5ED6AA12C2A}.exe
attrib -r -s -h c:\windows\system32\{2BB406B2-A95A-4C59-8AA4-E3494ECDDE79}.exe
del C:\WINDOWS\system32\oaosw.exe
del C:\WINDOWS\SYSTEM32\CSSHG.EXE
del C:\WINDOWS\SYSTEM32\DMXON.EXE
del c:\windows\system32\{0B68F38F-5685-48A5-8BDD-96E76EC2FA3B}.exe
del c:\windows\system32\{5D27EFC8-AB6D-4F76-85FB-82921E13EC39}.exe
del c:\windows\system32\{FBC3735F-229A-4DAC-954F-F6E641E36863}.exe
del c:\windows\system32\{FBE11999-7E84-44AD-B98D-D5AF62B437F2}.exe
del c:\windows\system32\{50CFD753-CE38-4BD5-ACC5-5961B256246D}.exe
del c:\windows\system32\{3B7443B9-68E7-4DC7-BD97-53736DE4169F}.exe
del c:\windows\system32\{94B81C60-A28E-4E13-9022-FAF93795203E}.exe
del c:\windows\system32\{1B47BB10-7419-42F6-A54E-71D84AAE6841}.exe
del c:\windows\system32\{F8BE652F-ECD6-4B5B-8581-5AF218AE69CD}.exe
del c:\windows\system32\{FBEFF155-246C-4320-B8F0-DE42887C8FA6}.exe
del c:\windows\system32\{364D92F8-3E2A-4ACE-81E6-9926B36505C0}.exe
del c:\windows\system32\{4DE9E892-0A09-40E3-876E-C9096FE2ED3D}.exe
del c:\windows\system32\{EAB65D5F-14DB-4C23-873B-8167348D8C2F}.exe
del c:\windows\system32\{D2C09615-9054-4CA2-B07E-23FAE406A943}.exe
del c:\windows\system32\{5FBCA125-319A-4226-B429-BF5E2D7B2CE5}.exe
del c:\windows\system32\{5A7D86C8-137F-435F-91B3-C8E5864C05E7}.exe
del c:\windows\system32\{17812FF7-F0BD-4D3A-8ED1-EBAA77370D24}.exe
del c:\windows\system32\{C88F8536-F547-4FCB-9E9F-24FD0EBFFD0B}.exe
del c:\windows\system32\{88D613A3-66C0-4535-ACE0-6E4EB58BEA7C}.exe
del c:\windows\system32\{8C6EED63-902F-436E-A3E3-C6C02142B320}.exe
del c:\windows\system32\{7089EFB4-C569-4FD2-8746-C1CE916BD92F}.exe
del c:\windows\system32\{B930E2CD-C2B1-4D36-A3CA-4CF6599C57D2}.exe
del c:\windows\system32\{D805D9C6-1B8E-411A-99B8-E4904FE52EBB}.exe
del c:\windows\system32\{8F7D0124-9F14-4E65-A120-98C46DF94D18}.exe
del c:\windows\system32\{8FD0A978-9CBD-4601-A081-3E7C213AA188}.exe
del c:\windows\system32\{980E3654-F891-4205-AEAA-5FD8B8509677}.exe
del c:\windows\system32\{56109DE1-C947-4430-AF93-854AF684210D}.exe
del c:\windows\system32\{E2E779CA-0F28-4BC0-A1C8-39DF67BF8D95}.exe
del c:\windows\system32\{F9A203E2-77E9-4BDE-B7FF-9E03B7910E5A}.exe
del c:\windows\system32\{199B944F-1A71-44A1-A74C-859CC381D5D7}.exe
del c:\windows\system32\{F3E8D427-840E-4CB1-8DBC-682C5F78B846}.exe
del c:\windows\system32\{F9252F24-9745-4A78-838C-A0BEE9E88C21}.exe
del c:\windows\system32\{4C8F2821-5429-4FE7-A189-DD1B4AFFBCF6}.exe
del c:\windows\system32\{B33B5DCB-5F28-4586-9E5F-E847674173E2}.exe
del c:\windows\system32\{CCA146C6-6E44-49CC-988C-2C8B4CBC4D17}.exe
del c:\windows\system32\{4B3F1A53-6155-4245-949E-1218E89D00B1}.exe
del c:\windows\system32\{386D8DFD-D43C-4A7C-B8F5-DF7BAB1F96FC}.exe
del c:\windows\system32\{CC3CF62B-C8C7-4912-804E-09D9AAEF3E99}.exe
del c:\windows\system32\{7E3AA608-089B-4174-8B3D-FC637785D2F8}.exe
del c:\windows\system32\{F40078DF-217C-42A9-8091-E0DBE7D32973}.exe
del c:\windows\system32\{FA0FF97C-B024-4276-9B59-24CC7DAAD1CB}.exe
del c:\windows\system32\{D9E5B0D5-0662-4A8B-8329-9C4D7ABF2FAD}.exe
del c:\windows\system32\{1515D72B-C344-4006-A2C9-1DB553051460}.exe
del c:\windows\system32\{4F83A4FF-FC35-46D3-99EE-BF71CCFB13B6}.exe
del c:\windows\system32\{D1D0DF65-DA12-48ED-816B-C9D97977A563}.exe
del c:\windows\system32\{05D89D4B-28F3-423D-8968-76A18F7EBD27}.exe
del c:\windows\system32\{4C455983-447D-4FA0-855F-CB60AAB9CC65}.exe
del c:\windows\system32\{10FD734C-9D20-4428-B6D1-CC87A791A5DB}.exe
del c:\windows\system32\{BBC558A6-A390-4DC3-AD39-E3F89A0122A6}.exe
del c:\windows\system32\{40783932-5AC5-4069-9B09-52CC9B459F0B}.exe
del c:\windows\system32\{7B789A6C-D989-4F49-916C-15143BC421EB}.exe
del c:\windows\system32\{7613DAC5-75A5-4EF4-9EED-3344C245DBE2}.exe
del c:\windows\system32\{F1662A4F-68A5-4C81-8D8C-3994C639872E}.exe
del c:\windows\system32\{FFD9911F-B0DD-4671-9201-926E5CB1A118}.exe
del c:\windows\system32\{ABF6BF3B-A78A-4680-9428-666D2D13032F}.exe
del c:\windows\system32\{23C3D56D-15E8-4664-B275-07ADEAFCD203}.exe
del c:\windows\system32\{53BF6245-238F-417D-8569-3D80E06629C0}.exe
del c:\windows\system32\{F1674B04-680F-493B-AF91-AF29D0015A87}.exe
del c:\windows\system32\{D9A037EA-275C-4059-9ADD-2B63892291BF}.exe
del c:\windows\system32\{558D0671-AF92-40CC-8EE6-F6E446A1131C}.exe
del c:\windows\system32\{E4BE528C-04DC-4EB2-8547-0507989017F6}.exe
del c:\windows\system32\{2BE199C6-F30B-42E5-87B0-DE1EC565C728}.exe
del c:\windows\system32\{F11C21A4-653B-480C-82CF-A5176442DE57}.exe
del c:\windows\system32\{A607BDC4-914A-44E7-BBB4-A2F231B1DD30}.exe
del c:\windows\system32\{9F162785-9C1A-4E2F-BF86-A17B43CEE949}.exe
del c:\windows\system32\{6DE01E30-3270-445A-8A82-86D252A7DA94}.exe
del c:\windows\system32\{A4F08633-6D4C-43F8-901F-EF6892045B6A}.exe
del c:\windows\system32\{21B62A3F-FBF4-4264-AA3B-19CD09FE8945}.exe
del c:\windows\system32\{44881F7F-A691-475D-A9E5-9D2CED354F28}.exe
del c:\windows\system32\{CF127E49-1223-4FEA-AD08-A0AA49E8F563}.exe
del c:\windows\system32\{547B283D-38D8-4694-8FFC-971B5E5AADCC}.exe
del c:\windows\system32\{C6D4890C-471E-4F72-8D0E-B1D818AFA591}.exe
del c:\windows\system32\{86E37D71-643D-43BF-8B8F-05E23B01D96E}.exe
del c:\windows\system32\{7B036961-13C2-4A9A-86DD-52B024126EB2}.exe
del c:\windows\system32\{D9626880-F907-4ACD-A6F6-3097E6C32784}.exe
del c:\windows\system32\{833E2C48-AF48-41B5-A9A2-E8B766DF979F}.exe
del c:\windows\system32\{2F8D56AA-C48D-45BD-8076-D9F498F1DEE2}.exe
del c:\windows\system32\{D5549936-F29C-421C-85CD-EF356C873434}.exe
del c:\windows\system32\{0C7634C4-A075-4B08-8B4D-B9323E995474}.exe
del c:\windows\system32\{20E27153-00CD-43E1-A895-7509A9ECB47E}.exe
del c:\windows\system32\{FE79DA5D-BB86-4ED5-8E51-DCDE4C60ABB8}.exe
del c:\windows\system32\{474CFEF8-9577-45C5-9E89-BBFDDFF799AF}.exe
del c:\windows\system32\{0C8EB014-73EF-4FFD-A3C9-5000EA20E320}.exe
del c:\windows\system32\{B64EE1EE-AB13-4E97-9396-0812AA260E75}.exe
del c:\windows\system32\{BE2E46E4-9FA4-4128-B288-116085F9F50F}.exe
del c:\windows\system32\{BFFEE130-EDDA-4275-9766-AEA6592C3FA0}.exe
del c:\windows\system32\{F00DED81-14C6-4B1A-8F7D-392FA95FB402}.exe
del c:\windows\system32\{5D8C4EBF-8A40-4AF5-A32D-071AB6539DB2}.exe
del c:\windows\system32\{50A61EE4-6C04-4543-BB64-30CC0D79E4E8}.exe
del c:\windows\system32\{6A477FB4-699E-4EBA-8669-B69AA32959DE}.exe
del c:\windows\system32\{2C7A26D7-6B41-41CC-BA43-D7D555449018}.exe
del c:\windows\system32\{85D97105-0023-46D1-8776-19C5F1DAC996}.exe
del c:\windows\system32\{8123149B-1FE1-4A43-897F-9272B462BDC4}.exe
del c:\windows\system32\{2E33CA11-DFFB-4E15-95AC-EF7FE17F1058}.exe
del c:\windows\system32\{02E316A3-2197-439E-A21D-3A4C8B9E0009}.exe
del c:\windows\system32\{A981A466-F1AB-47EB-9A71-73352AB064FD}.exe
del c:\windows\system32\{5182E35E-FE94-43C9-9C95-FBDED1901D9C}.exe
del c:\windows\system32\{9D2653A0-8A09-4B6D-9C69-C89148AB1698}.exe
del c:\windows\system32\{A9D444D0-2317-4F3D-BBE4-C59F94527837}.exe
del c:\windows\system32\{1577BAE2-41F7-4B8B-9ED9-D5ED6AA12C2A}.exe
del c:\windows\system32\{2BB406B2-A95A-4C59-8AA4-E3494ECDDE79}.exe

Save it to your desktop as ff.bat

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [oaosw.exe] C:\WINDOWS\system32\oaosw.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{3EF75030-91B5-4665-96D9-3BA36C08DF7B}: NameServer = 85.255.116.68,85.255.112.100

O17 - HKLM\System\CCS\Services\Tcpip\..\{7F97F95F-9350-41BF-9BF8-ED65C4888326}: NameServer = 85.255.116.68,85.255.112.100

O17 - HKLM\System\CCS\Services\Tcpip\..\{98CDD97B-1CAE-4A9E-A24B-9D37091E4964}: NameServer = 85.255.116.68,85.255.112.100

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.68 85.255.112.100

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.68 85.255.112.100

Then click "Fix checked".

Now, in HijackThis! click on Config –> Misc Tools –> Open Process Manager

In the list of processes, find explorer.exe

Click to highlight, then click "Kill Process". OK any prompts.

Your desktop will disappear, but that is normal. It will come back when you reboot.

Now, in HijackThis!, click:

Run –> browse

Browse to your desktop and click ff.bat –> open –> OK

Browse to c:\fixwareout click Fixit.bat –> open –> OK

This will start Fixwareout again.

After the reboot, post:

1. The fixwareout report

2. A new HijackThis! log

Into this thread.

To me this now looks clean…..??

Logfile of HijackThis v1.99.1
Scan saved at 6:59:07 AM, on 12/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\CPal\CPBrWtch.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Documents and Settings\Admin\Application Data\Map Maker\MMManager.exe
C:\Utils\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirec…rch&ap=b204
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://desktop.presario.net/scripts/redire…;lc=0809&ac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Piolet Toolbar Helper - {9F17C005-7BF0-4f13-8473-F3C3D2619DBD} - C:\Program Files\Piolet Toolbar\v2.0.0.5\Piolet_Toolbar.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Piolet Toolbar - {6A41F582-CC0E-402a-A16D-A32ABA3043CE} - C:\Program Files\Piolet Toolbar\v2.0.0.5\Piolet_Toolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [UIUCU] C:\DOCUME~1\Admin\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP -S
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Cookie Pal] "C:\Program Files\CPal\CPBrWtch.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Utils\TclockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SunClock5.lnk = C:\Documents and Settings\Admin\Application Data\Map Maker\MMManager.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: HP Configuration Interface Service (HPConfig) - Hewlett-Packard - C:\WINDOWS\system32\HPConfig.exe
O23 - Service: HPWirelessMgr - Hewlett-Packard Co. - C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

FixWareOut Report also looks clean…

Fixwareout ver 1.003
Last edited 07/1/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is legitimate

»»»»» Search by size and names…

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
Other suspects
Directory of C:\WINDOWS\system32