Clicker.Fr//Generic.xks/xfv/ytf//Collected.8.AQ

Hello folks,

seems I'm another sucker who's been infected by this infection. AVG keeps on generating the names in the topic title.

Please have a look at my HJT-log. I'd appreciate it very much if you would spent some time helping me get rid of this nasty piece of software.

Oh btw : after I bought a router last week, I removed Norton Internet security from my system and replaced it with AVG and Ewido. I see a lot of references to symantec in this log off. Is there anyone who can tell me what can be deleted of that ?

Thank you


Logfile of HijackThis v1.99.1
Scan saved at 18:00:11, on 18/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\PI Engineering\Macro Works\MacroMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.telenet.be/klanten.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{FD7B880A-7C1E-45B8-928D-4E05A47D3611}.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\system32\{FD7B880A-7C1E-45B8-928D-4E05A47D3611}.dll (file missing)
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [phucg.exe] C:\WINDOWS\system32\phucg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://games.telenet.be
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106838455765
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914…IPSUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{06D37D30-600E-46D2-964D-8DD3FDC8A88D}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CCS\Services\Tcpip\..\{4228F333-891B-4745-895D-86285D073032}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CCS\Services\Tcpip\..\{50855CBF-BC48-45DA-9FA1-59A37D7A149D}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CCS\Services\Tcpip\..\{76ED6D3C-B6C7-4D8F-9E9F-4324255E7B97}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE6E82C1-6CD3-4213-936F-BD731A51E973}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CCS\Services\Tcpip\..\{C3087A14-26B1-4B16-AA9F-30A2ACB4386A}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.83 85.255.112.127
O17 - HKLM\System\CS1\Services\Tcpip\..\{06D37D30-600E-46D2-964D-8DD3FDC8A88D}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.83 85.255.112.127
O17 - HKLM\System\CS2\Services\Tcpip\..\{06D37D30-600E-46D2-964D-8DD3FDC8A88D}: NameServer = 85.255.116.83,85.255.112.127
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.83 85.255.112.127
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

THanks for helping me out, Mica.
Sorry it took so long, but running Fixwareout reset my DNS-settings so I couldn't get back on the net.

I had switched off the computer before I read your reply and apparently the phucg.exe had renamed after reboot to rvwvt.exe. So I had that removed.

Can you provide me any feedback on all the symantec references in the HJT-log. Norton Internet Security has been removed, but lots of stuff gets left behind. Do you know if I can remove any of it ?

Okay, here are the logs :

Logfile of HijackThis v1.99.1
Scan saved at 22:35:05, on 18/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\PI Engineering\Macro Works\MacroMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [rvwvt.exe] C:\WINDOWS\system32\rvwvt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://games.telenet.be
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106838455765
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914…IPSUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE6E82C1-6CD3-4213-936F-BD731A51E973}: NameServer = 192.168.1.1,139.175.55.224
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe


Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B3633751CC19-7DD9-3714-3E5F-3E4F7C95{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AA92F416294C-253A-8D94-9BAB-D32E0B23{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}598BEE6FF53D-ED0B-F1D4-B1A7-B1FD2A09{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BFCADA5F0742-28F9-7394-6FDD-DF3C4192{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D44086E41442-8DA9-54D4-A97D-2D6B08A6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}037B1A2193D2-9DBB-7F54-3651-0FA7FB91{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8ADB299C0FA4-740B-9C54-3AF5-2E5DAA05{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}488D79967FAE-78A9-4DD4-CCBA-A893530A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0D9BE935B95F-09E9-1B64-93E3-EEDD41B0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AFE121662912-8B0A-70E4-6BC7-561BAAD5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}945F5F8947E0-515B-4A74-8D2A-215F47EC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5421A306FF8C-1629-7CB4-0CC6-6B375408{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}22D2E48360B5-84AB-A964-972B-1D2952E5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8FD23DF9A024-7B08-94A4-8D96-A1907F39{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4A274FC53299-039B-AA04-CF4D-4DC8D033{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0269C9145F51-347A-CF84-D282-BAC1977D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7E3550716B25-1F09-EE14-CF0B-12BA7101{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1C1A0035B26C-63F9-75E4-4E88-3B86598D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9736C4B8E223-77EA-2084-7BD1-91688BBD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}09F55B8C1387-856B-03A4-EA18-0E341066{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2FEA226273AD-B3FB-8554-54E9-A9B0290F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6380D2AF222E-DDEA-6314-E5CD-250ADBA5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BA3C60638CE0-CF6B-7D54-AD55-67981CB1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AE6F52377BA3-FE18-3AD4-C20F-8F1367AE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}62D4E814AA24-BE78-C384-00C7-3888EBAF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DE41344A3584-8058-F2C4-F03D-9FE415BF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9C63C25216D1-3D0B-6834-CE75-6D3AFF8B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2C36344C84B7-2B8A-B3E4-8E4B-80397002{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1F2837AE8564-3919-A934-8758-1275D86C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F329AE17839D-898A-0224-B3E5-8940F03B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}12E899C192B3-1C9B-9994-677F-B66761D0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EE7C242C2F79-4A99-4E74-EC8D-4C6CB319{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A3BC866ED2A0-8B68-9C04-9A10-0FBE4EE8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5309BE4C5C37-A06B-58C4-FD44-FCBB8C0F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4200C9F70217-4DB9-B414-AE5B-B92C257F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}977D8B89B25C-C3FB-FE64-279F-A6CFAE4D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A6049436C782-8F2B-E5E4-AA3D-765AEDBC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8AF6F4313F58-0FBA-3D94-5A49-7D8F3AC0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}687D76B93735-5B08-14A4-5DAC-E41969BA{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3B3D549F2EE9-90AB-0E34-EBB7-89B03042{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4190150BD699-5F78-B8C4-E5DA-20188372{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7D5197260093-0B09-2554-354F-B13AA7CC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}73802936CADF-3659-07E4-3F76-F7E1EDB5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7312BB48A577-719B-84D4-DB53-565CEA75{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9C8866F657B8-74EA-9CF4-4A40-4052095B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A5576770218D-70E8-9314-5A9B-1D1D6972{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1411362127A4-11C8-9CA4-8658-824F0BF2{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4F301DB2D794-A24B-52B4-3166-C7FEA498{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DC6C66950F40-1728-6344-93ED-59969533{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E14F3BD6053C-3E7B-FC14-7BDD-6D703D2A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4E1F799F6202-D2AB-9A74-9960-16C19A1F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}731455F46047-804B-4554-38C1-78FBA9F3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}092EAADD1B47-6E5B-FB04-85FA-E0411F2E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}565F982A974C-88F9-58C4-C4DF-EAF07133{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B4712C02D704-09AB-1B04-1137-B1873B1C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BF67632681EB-0559-4B84-9949-A2ACEC5E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7A6D10758A04-98B9-F7F4-0AD0-12CD377B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7F33970A43B4-5D19-A024-F7FA-EAF745AE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}57B82924244F-579B-6DD4-824E-5E3901AD{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DC7831963C40-C41B-0E44-7915-0C20FB2D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}95FC0CBF4F57-C678-A9F4-8B29-C2883166{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B53035571904-0FCB-6E44-2A03-C9D93AA5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C833728C5B78-219B-BE94-6C06-A547EB24{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1BDE1EB20B99-6CD8-14A4-1515-7AB461E7{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8B92D9A7860B-56B9-18D4-D8F2-6A4B9843{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0B720A9354E8-0D2B-2704-2387-0CB409DF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0E603C5FEF05-F9F8-6304-71A2-03F10D02{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A2F2345128AD-67FA-B514-65C1-F6280772{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EF9DEB02344B-0DFB-5424-640D-EE6D6BA6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8820081F9522-E53A-18C4-03F4-8F49FAAE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1AFB30EEBD83-8E4B-CE54-5D2D-50BA72FC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EB74697CABBF-A8B8-A694-0785-D5917A33{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}156EBA9BB6FC-F6EA-EAC4-71B0-B521426F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}45BF46CB83F4-5849-9DD4-C469-4F4F26FC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A7F584AFB6AA-BB5B-7BE4-78F5-40A3F664{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}65105C89DB9E-46A9-45C4-2F46-11938EB3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F2C9D4971987-C339-AC44-3210-66A28DD0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6D78A5DAC80C-6AF9-B154-0694-EBD59D6C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}55A76A10977C-962B-0834-079E-85CACE61{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}24734BEE6E6E-48EA-7804-5CE0-7E32F565{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CEB851F0FD23-107A-1A14-DA95-42F6FCF9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B3AEF6C1C984-F2AB-1E84-7044-ED3BE859{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0822963EAB1C-21CB-3E24-B962-3E088D0B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E3064A3F0C0C-47DA-01C4-2000-FD7B42BF{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EC869ACD00CF-5048-57C4-F0AD-19A7C966{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AF4F631C139A-DE4B-1714-FCEA-DCAA0405{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D620FFEE302C-7D09-8B64-686D-0083E78B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DE82447558E8-B97A-B9B4-E59E-86989201{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AFF790314E19-66C8-A264-1055-84A4B71C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E70FDDEB9F54-41DA-0CB4-41B4-D407FC74{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E3D245F93E8F-66A9-2DB4-CA5C-695F4022{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1AE1899AEE2E-9539-8634-37A3-5B61549D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EBF66F908710-30E9-8674-20FA-846EAB62{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D79442F4F59C-6329-7B44-8559-AC36CB73{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CF50BFB04914-B82B-DF24-A887-CF0DF8C9{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8E7899EBAFF1-D5FB-1FA4-E089-78DA1FC0{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3BD9E3366DE3-0E6B-6C14-30F6-6D8F398F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BAD7E1541E95-4949-29A4-B441-16B7EE85{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F7274B76FCE1-5C9B-6864-4CC6-6D74E357{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B9E550EF1A49-56AA-7504-2F6A-8BDB8B57{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}014207F3B46D-A4C9-6B54-6B66-142C5630{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2E68A0E35378-D27B-BB84-7A84-180B1C13{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D60A793C135A-3C6B-3364-BA59-85A6E09B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5099604620CF-9BE8-30A4-732A-BE19925A{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}035026F9C39E-B62A-91F4-36DE-E4286638{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}572BD89A9F32-1D48-A3F4-2F25-09FDD53E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}19D05D25430B-357B-5024-7CC3-B8653762{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}48BB95A65F35-FF3B-5694-6B73-FA43D146{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}55ADA65C1264-F3CB-29E4-66E2-827242B6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BD492FE3ECAC-E598-8FB4-3DB6-3428DCBE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F5BFA8F34B97-CE3A-9544-6EAA-ADAB6270{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD318DF2369B-D289-D194-0771-1781C231{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3954B3C468DE-7488-C8B4-5FA1-3E95D4A1{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1745A584042C-0539-4AA4-A74D-57F98FBB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}58F08FFF97F1-CBDA-FBD4-1B32-DDFA8E8B{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C65ACDB6BE53-33BB-2AD4-BD20-62FE6542{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}12451851CA9C-DF29-9884-B0AE-656205AC{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}72F1268B6392-9DA9-8044-6746-1C3D3180{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C1F366185012-B1F8-F474-005D-47E274C5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D08AC81B871E-E768-F254-9BF2-66AB21D5{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}76844825D78B-BAE8-7324-D38F-FEE2BA43{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AD6D36C4AB36-3958-F3C4-EFB5-8381639D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}53F41F55D323-FB2B-4A34-7F6D-C4C6A6ED{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0CD039CA8FE-E73A-2634-2FAB-8825060E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}772F983155D8-C31B-A964-62CF-0CB3291F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}36140FEA7709-A3E9-7BB4-7ECC-2E8E703E{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}31592618DD78-064B-BA64-7605-23756319{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E8AF81E2C44C-2E69-5534-3089-11DF857C{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7CF32E535F31-81A8-AE24-3BFA-E26798F3{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}294B42AE7B06-F29A-FEA4-B1F5-FC62AE39{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}585907479996-A1C9-2C84-BAEC-4E22F1DE{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}20245BAE2480-AD5A-2A34-170B-858A5C14{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B671B9558BE5-195B-E964-B86A-01BEEADB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}88EE47BECCC1-2A78-0FF4-1763-1AD5CC47{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7F11FD99235A-ADFB-5214-9D1E-CE5F34FB{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8457BF2E6540-48AB-3084-A236-1F0EF80F{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A493FEE70E49-44DA-B3A4-FB45-A745F6B8{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0B4D7BD8A210-95DA-EB44-7FD3-4B06C453{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7C63365478A0-01AA-04E4-7A57-EBFE2683{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F0C36E43AE1E-BC28-04B4-95A0-CA7B1496{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FCFC82BCA76F-F9C9-AC74-EF7C-11AE3E3D{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}138C4D018541-61FA-E284-9A97-280C6030{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht
…

Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names…
* csr.exe C:\WINDOWS\System32\CSKIK.EXE

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSKIK.EXE 51.285 2006-08-18

Other suspects.
Directory of C:\WINDOWS\system32
{0306C082-79A9-482E-AF16-145810D4C831}.exe
{D3E3EA11-C7FE-47CA-9C9F-F67ACB28CFCF}.exe
{6941B7AC-0A59-4B40-82CB-E1EA34E63C0F}.exe
{3862EFBE-75A7-4E40-AA10-0A87456336C7}.exe
{354C60B4-3DF7-44BE-AD59-012A8DB7D4B0}.exe
{8B6F547A-54BF-4A3B-AD44-94E07EEF394A}.exe
{F08FE0F1-632A-4803-BA84-0456E2FB7548}.exe
{BF43F5EC-E1D9-4125-BFDA-A53299DF11F7}.exe
{74CC5DA1-3671-4FF0-87A2-1CCCEB74EE88}.exe
{BDAEEB10-A68B-469E-B591-5EB8559B176B}.exe
{41C5A858-B071-43A2-A5DA-0842EAB54202}.exe
{ED1F22E4-CEAB-48C2-9C1A-699974709585}.exe
{93EA26CF-5F1B-4AEF-A92F-60B7EA24B492}.exe
{3F89762E-AFB3-42EA-8A18-13F535E23FC7}.exe
{C758FD11-9803-4355-96E2-C44C2E18FA8E}.exe
{91365732-5067-46AB-B460-87DD81629513}.exe
{E307E8E2-CCE7-4BB7-9E3A-9077AEF04163}.exe
{F1923BC0-FC26-469A-B13C-8D551389F277}.exe
{E0605288-BAF2-4362-A37E-EF8AC930DC0B}.exe
{DE6A6C4C-D6F7-43A4-B2BF-323D55F14F35}.exe
{D9361838-5BFE-4C3F-8593-63BA4C63D6DA}.exe
{34AB2EEF-F83D-4237-8EAB-B87D52844867}.exe
{5D12BA66-2FB9-452F-867E-E178B18CA80D}.exe
{5C472E74-D500-474F-8F1B-210581663F1C}.exe
{0813D3C1-6476-4408-9AD9-2936B8621F27}.exe
{CA502656-EA0B-4889-92FD-C9AC15815421}.exe
{2456EF26-02DB-4DA2-BB33-35EB6BDCA56C}.exe
{B8E8AFDD-23B1-4DBF-ADBC-1F79FFF80F85}.exe
{BBF89F75-D47A-4AA4-9350-C240485A5471}.exe
{1A4D59E3-1AF5-4B8C-8847-ED864C3B4593}.exe
{132C1871-1770-491D-982D-B9632FD813DD}.exe
{0726BADA-AAE6-4459-A3EC-79B43F8AFB5F}.exe
{EBCD8243-6BD3-4BF8-895E-CACE3EF294DB}.exe
{6B242728-2E66-4E92-BC3F-4621C56ADA55}.exe
{641D34AF-37B6-4965-B3FF-53F56A59BB84}.exe
{2673568B-3CC7-4205-B753-B03452D50D91}.exe
{E35DDF90-52F2-4F3A-84D1-23F9A98DB275}.exe
{8366824E-ED63-4F19-A26B-E93C9F620530}.exe
{A52991EB-A237-4A03-8EB9-FC0264069905}.exe
{B90E6A58-95AB-4633-B6C3-A531C397A06D}.exe
{31C1B081-48A7-48BB-B72D-87353E0A86E2}.exe
{0365C241-66B6-45B6-9C4A-D64B3F702410}.exe
{75B8BDB8-A6F2-4057-AA65-94A1FE055E9B}.exe
{753E47D6-6CC4-4686-B9C5-1ECF67B4727F}.exe
{58EE7B61-144B-4A92-9494-59E1451E7DAB}.exe
{F893F8D6-6F03-41C6-B6E0-3ED6633E9DB3}.exe
{0CF1AD87-980E-4AF1-BF5D-1FFABE9987E8}.exe
{9C8FD0FC-788A-42FD-B28B-41940BFB05FC}.exe
{37BC63CA-9558-44B7-9236-C95F4F24497D}.exe
{26BAE648-AF02-4768-9E03-017809F66FBE}.exe
{D94516B5-3A73-4368-9359-E2EEA9981EA1}.exe
{2204F596-C5AC-4BD2-9A66-F8E39F542D3E}.exe
{47CF704D-4B14-4BC0-AD14-45F9BEDDF07E}.exe
{C17B4A48-5501-462A-8C66-91E413097FFA}.exe
{10298968-E95E-4B9B-A79B-8E85574428ED}.exe
{B87E3800-D686-46B8-90D7-C203EEFF026D}.exe
{5040AACD-AECF-4171-B4ED-A931C136F4FA}.exe
{669C7A91-DA0F-4C75-8405-FC00DCA968CE}.exe
{FB24B7DF-0002-4C10-AD74-C0C0F3A4603E}.exe
{B0D880E3-269B-42E3-BC12-C1BAE3692280}.exe
{958EB3DE-4407-48E1-BA2F-489C1C6FEA3B}.exe
{9FCF6F24-59AD-41A1-A701-32DF0F158BEC}.exe
{565F23E7-0EC5-4087-AE84-E6E6EEB43742}.exe
{16ECAC58-E970-4380-B269-C77901A67A55}.exe
{C6D95DBE-4960-451B-9FA6-C08CAD5A87D6}.exe
{0DD82A66-0123-44CA-933C-7891794D9C2F}.exe
{3BE83911-64F2-4C54-9A64-E9BD98C50156}.exe
{466F3A04-5F87-4EB7-B5BB-AA6BFA485F7A}.exe
{CF62F4F4-964C-4DD9-9485-4F38BC64FB54}.exe
{F624125B-0B17-4CAE-AE6F-CF6BB9ABE651}.exe
{33A7195D-5870-496A-8B8A-FBBAC79647BE}.exe
{CF27AB05-D2D5-45EC-B4E8-38DBEE03BFA1}.exe
{EAAF94F8-4F30-4C81-A35E-2259F1800288}.exe
{6AB6D6EE-D046-4245-BFD0-B44320BED9FE}.exe
{2770826F-1C56-415B-AF76-DA8215432F2A}.exe
{20D01F30-2A17-4036-8F9F-50FEF5C306E0}.exe
{FD904BC0-7832-4072-B2D0-8E4539A027B0}.exe
{3489B4A6-2F8D-4D81-9B65-B0687A9D29B8}.exe
{7E164BA7-5151-4A41-8DC6-99B02BE1EDB1}.exe
{42BE745A-60C6-49EB-B912-87B5C827338C}.exe
{5AA39D9C-30A2-44E6-BCF0-40917553035B}.exe
{6613882C-92B8-4F9A-876C-75F4FBC0CF59}.exe
{D2BF02C0-5197-44E0-B14C-04C3691387CD}.exe
{DA1093E5-E428-4DD6-B975-F44242928B75}.exe
{EA547FAE-AF7F-420A-91D5-4B34A07933F7}.exe
{B773DC21-0DA0-4F7F-9B89-40A85701D6A7}.exe
{E5CECA2A-9499-48B4-9550-BE18623676FB}.exe
{C1B3781B-7311-40B1-BA90-407D20C2174B}.exe
{33170FAE-FD4C-4C85-9F88-C479A289F565}.exe
{E2F1140E-AF58-40BF-B5E6-74B1DDAAE290}.exe
{3F9ABF87-1C83-4554-B408-74064F554137}.exe
{F1A91C61-0699-47A9-BA2D-2026F997F1E4}.exe
{A2D307D6-DDB7-41CF-B7E3-C3506DB3F41E}.exe
{33596995-DE39-4436-8271-04F05966C6CD}.exe
{894AEF7C-6613-4B25-B42A-497D2BD103F4}.exe
{2FB0F428-8568-4AC9-8C11-4A7212631141}.exe
{2796D1D1-B9A5-4139-8E07-D8120776755A}.exe
{B5902504-04A4-4FC9-AE47-8B756F6688C9}.exe
{57AEC565-35BD-4D48-B917-775A84BB2137}.exe
{5BDE1E7F-67F3-4E70-9563-FDAC63920837}.exe
{CC7AA31B-F453-4552-90B0-3900627915D7}.exe
{27388102-AD5E-4C8B-87F5-996DB0510914}.exe
{24030B98-7BBE-43E0-BA09-9EE2F945D3B3}.exe
{AB96914E-CAD5-4A41-80B5-53739B67D786}.exe
{0CA3F8D7-94A5-49D3-ABF0-85F3134F6FA8}.exe
{CBDEA567-D3AA-4E5E-B2F8-287C6349406A}.exe
{D4EAFC6A-F972-46EF-BF3C-C52B98B8D779}.exe
{F752C29B-B5EA-414B-9BD4-71207F9C0024}.exe
{F0C8BBCF-44DF-4C85-B60A-73C5C4EB9035}.exe
{8EE4EBF0-01A9-40C9-86B8-0A2DE668CB3A}.exe
{913BC6C4-D8CE-47E4-99A4-97F2C242C7EE}.exe
{0D16766B-F776-4999-B9C1-3B291C998E21}.exe
{B30F0498-5E3B-4220-A898-D93871EA923F}.exe
{C68D5721-8578-439A-9193-4658EA7382F1}.exe
{20079308-B4E8-4E3B-A8B2-7B48C44363C2}.exe
{B8FFA3D6-57EC-4386-B0D3-1D61252C36C9}.exe
{FB514EF9-D30F-4C2F-8508-4853A44314ED}.exe
{FABE8883-7C00-483C-87EB-42AA418E4D26}.exe
{EA7631F8-F02C-4DA3-81EF-3AB77325F6EA}.exe
{1BC18976-55DA-45D7-B6FC-0EC83606C3AB}.exe
{5ABDA052-DC5E-4136-AEDD-E222FA2D0836}.exe
{F0920B9A-9E45-4558-BF3B-DA372622AEF2}.exe
{660143E0-81AE-4A30-B658-7831C8B55F90}.exe
{DBB88619-1DB7-4802-AE77-322E8B4C6379}.exe
{D89568B3-88E4-4E57-9F36-C62B5300A1C1}.exe
{1017AB21-B0FC-41EE-90F1-52B6170553E7}.exe
{D7791CAB-282D-48FC-A743-15F5419C9620}.exe
{330D8CD4-D4FC-40AA-B930-99235CF472A4}.exe
{93F7091A-69D8-4A49-80B7-420A9FD32DF8}.exe
{5E2592D1-B279-469A-BA48-5B06384E2D22}.exe
{804573B6-6CC0-4BC7-9261-C8FF603A1245}.exe
{CE74F512-A2D8-47A4-B515-0E7498F5F549}.exe
{5DAAB165-7CB6-4E07-A0B8-219266121EFA}.exe
{0B14DDEE-3E39-46B1-9E90-F59B539EB9D0}.exe
{A035398A-ABCC-4DD4-9A87-EAF76997D884}.exe
{50AAD5E2-5FA3-45C9-B047-4AF0C992BDA8}.exe
{19BF7AF0-1563-45F7-BBD9-2D3912A1B730}.exe
{2914C3FD-DDF6-4937-9F82-2470F5ADACFB}.exe
{90A2DF1B-7A1B-4D1F-B0DE-D35FF6EEB895}.exe

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.

Copy the text in the following quote box into Notepad:

attrib -r -s -h c:\WINDOWS\SYSTEM32\rvwvt.exe
attrib -r -s -h c:\WINDOWS\SYSTEM32\CSKIK.EXE
attrib -r -s -h c:\WINDOWS\system32\{0306C082-79A9-482E-AF16-145810D4C831}.exe
attrib -r -s -h c:\WINDOWS\system32\{D3E3EA11-C7FE-47CA-9C9F-F67ACB28CFCF}.exe
attrib -r -s -h c:\WINDOWS\system32\{6941B7AC-0A59-4B40-82CB-E1EA34E63C0F}.exe
attrib -r -s -h c:\WINDOWS\system32\{3862EFBE-75A7-4E40-AA10-0A87456336C7}.exe
attrib -r -s -h c:\WINDOWS\system32\{354C60B4-3DF7-44BE-AD59-012A8DB7D4B0}.exe
attrib -r -s -h c:\WINDOWS\system32\{8B6F547A-54BF-4A3B-AD44-94E07EEF394A}.exe
attrib -r -s -h c:\WINDOWS\system32\{F08FE0F1-632A-4803-BA84-0456E2FB7548}.exe
attrib -r -s -h c:\WINDOWS\system32\{BF43F5EC-E1D9-4125-BFDA-A53299DF11F7}.exe
attrib -r -s -h c:\WINDOWS\system32\{74CC5DA1-3671-4FF0-87A2-1CCCEB74EE88}.exe
attrib -r -s -h c:\WINDOWS\system32\{BDAEEB10-A68B-469E-B591-5EB8559B176B}.exe
attrib -r -s -h c:\WINDOWS\system32\{41C5A858-B071-43A2-A5DA-0842EAB54202}.exe
attrib -r -s -h c:\WINDOWS\system32\{ED1F22E4-CEAB-48C2-9C1A-699974709585}.exe
attrib -r -s -h c:\WINDOWS\system32\{93EA26CF-5F1B-4AEF-A92F-60B7EA24B492}.exe
attrib -r -s -h c:\WINDOWS\system32\{3F89762E-AFB3-42EA-8A18-13F535E23FC7}.exe
attrib -r -s -h c:\WINDOWS\system32\{C758FD11-9803-4355-96E2-C44C2E18FA8E}.exe
attrib -r -s -h c:\WINDOWS\system32\{91365732-5067-46AB-B460-87DD81629513}.exe
attrib -r -s -h c:\WINDOWS\system32\{E307E8E2-CCE7-4BB7-9E3A-9077AEF04163}.exe
attrib -r -s -h c:\WINDOWS\system32\{F1923BC0-FC26-469A-B13C-8D551389F277}.exe
attrib -r -s -h c:\WINDOWS\system32\{E0605288-BAF2-4362-A37E-EF8AC930DC0B}.exe
attrib -r -s -h c:\WINDOWS\system32\{DE6A6C4C-D6F7-43A4-B2BF-323D55F14F35}.exe
attrib -r -s -h c:\WINDOWS\system32\{D9361838-5BFE-4C3F-8593-63BA4C63D6DA}.exe
attrib -r -s -h c:\WINDOWS\system32\{34AB2EEF-F83D-4237-8EAB-B87D52844867}.exe
attrib -r -s -h c:\WINDOWS\system32\{5D12BA66-2FB9-452F-867E-E178B18CA80D}.exe
attrib -r -s -h c:\WINDOWS\system32\{5C472E74-D500-474F-8F1B-210581663F1C}.exe
attrib -r -s -h c:\WINDOWS\system32\{0813D3C1-6476-4408-9AD9-2936B8621F27}.exe
attrib -r -s -h c:\WINDOWS\system32\{CA502656-EA0B-4889-92FD-C9AC15815421}.exe
attrib -r -s -h c:\WINDOWS\system32\{2456EF26-02DB-4DA2-BB33-35EB6BDCA56C}.exe
attrib -r -s -h c:\WINDOWS\system32\{B8E8AFDD-23B1-4DBF-ADBC-1F79FFF80F85}.exe
attrib -r -s -h c:\WINDOWS\system32\{BBF89F75-D47A-4AA4-9350-C240485A5471}.exe
attrib -r -s -h c:\WINDOWS\system32\{1A4D59E3-1AF5-4B8C-8847-ED864C3B4593}.exe
attrib -r -s -h c:\WINDOWS\system32\{132C1871-1770-491D-982D-B9632FD813DD}.exe
attrib -r -s -h c:\WINDOWS\system32\{0726BADA-AAE6-4459-A3EC-79B43F8AFB5F}.exe
attrib -r -s -h c:\WINDOWS\system32\{EBCD8243-6BD3-4BF8-895E-CACE3EF294DB}.exe
attrib -r -s -h c:\WINDOWS\system32\{6B242728-2E66-4E92-BC3F-4621C56ADA55}.exe
attrib -r -s -h c:\WINDOWS\system32\{641D34AF-37B6-4965-B3FF-53F56A59BB84}.exe
attrib -r -s -h c:\WINDOWS\system32\{2673568B-3CC7-4205-B753-B03452D50D91}.exe
attrib -r -s -h c:\WINDOWS\system32\{E35DDF90-52F2-4F3A-84D1-23F9A98DB275}.exe
attrib -r -s -h c:\WINDOWS\system32\{8366824E-ED63-4F19-A26B-E93C9F620530}.exe
attrib -r -s -h c:\WINDOWS\system32\{A52991EB-A237-4A03-8EB9-FC0264069905}.exe
attrib -r -s -h c:\WINDOWS\system32\{B90E6A58-95AB-4633-B6C3-A531C397A06D}.exe
attrib -r -s -h c:\WINDOWS\system32\{31C1B081-48A7-48BB-B72D-87353E0A86E2}.exe
attrib -r -s -h c:\WINDOWS\system32\{0365C241-66B6-45B6-9C4A-D64B3F702410}.exe
attrib -r -s -h c:\WINDOWS\system32\{75B8BDB8-A6F2-4057-AA65-94A1FE055E9B}.exe
attrib -r -s -h c:\WINDOWS\system32\{753E47D6-6CC4-4686-B9C5-1ECF67B4727F}.exe
attrib -r -s -h c:\WINDOWS\system32\{58EE7B61-144B-4A92-9494-59E1451E7DAB}.exe
attrib -r -s -h c:\WINDOWS\system32\{F893F8D6-6F03-41C6-B6E0-3ED6633E9DB3}.exe
attrib -r -s -h c:\WINDOWS\system32\{0CF1AD87-980E-4AF1-BF5D-1FFABE9987E8}.exe
attrib -r -s -h c:\WINDOWS\system32\{9C8FD0FC-788A-42FD-B28B-41940BFB05FC}.exe
attrib -r -s -h c:\WINDOWS\system32\{37BC63CA-9558-44B7-9236-C95F4F24497D}.exe
attrib -r -s -h c:\WINDOWS\system32\{26BAE648-AF02-4768-9E03-017809F66FBE}.exe
attrib -r -s -h c:\WINDOWS\system32\{D94516B5-3A73-4368-9359-E2EEA9981EA1}.exe
attrib -r -s -h c:\WINDOWS\system32\{2204F596-C5AC-4BD2-9A66-F8E39F542D3E}.exe
attrib -r -s -h c:\WINDOWS\system32\{47CF704D-4B14-4BC0-AD14-45F9BEDDF07E}.exe
attrib -r -s -h c:\WINDOWS\system32\{C17B4A48-5501-462A-8C66-91E413097FFA}.exe
attrib -r -s -h c:\WINDOWS\system32\{10298968-E95E-4B9B-A79B-8E85574428ED}.exe
attrib -r -s -h c:\WINDOWS\system32\{B87E3800-D686-46B8-90D7-C203EEFF026D}.exe
attrib -r -s -h c:\WINDOWS\system32\{5040AACD-AECF-4171-B4ED-A931C136F4FA}.exe
attrib -r -s -h c:\WINDOWS\system32\{669C7A91-DA0F-4C75-8405-FC00DCA968CE}.exe
attrib -r -s -h c:\WINDOWS\system32\{FB24B7DF-0002-4C10-AD74-C0C0F3A4603E}.exe
attrib -r -s -h c:\WINDOWS\system32\{B0D880E3-269B-42E3-BC12-C1BAE3692280}.exe
attrib -r -s -h c:\WINDOWS\system32\{958EB3DE-4407-48E1-BA2F-489C1C6FEA3B}.exe
attrib -r -s -h c:\WINDOWS\system32\{9FCF6F24-59AD-41A1-A701-32DF0F158BEC}.exe
attrib -r -s -h c:\WINDOWS\system32\{565F23E7-0EC5-4087-AE84-E6E6EEB43742}.exe
attrib -r -s -h c:\WINDOWS\system32\{16ECAC58-E970-4380-B269-C77901A67A55}.exe
attrib -r -s -h c:\WINDOWS\system32\{C6D95DBE-4960-451B-9FA6-C08CAD5A87D6}.exe
attrib -r -s -h c:\WINDOWS\system32\{0DD82A66-0123-44CA-933C-7891794D9C2F}.exe
attrib -r -s -h c:\WINDOWS\system32\{3BE83911-64F2-4C54-9A64-E9BD98C50156}.exe
attrib -r -s -h c:\WINDOWS\system32\{466F3A04-5F87-4EB7-B5BB-AA6BFA485F7A}.exe
attrib -r -s -h c:\WINDOWS\system32\{CF62F4F4-964C-4DD9-9485-4F38BC64FB54}.exe
attrib -r -s -h c:\WINDOWS\system32\{F624125B-0B17-4CAE-AE6F-CF6BB9ABE651}.exe
attrib -r -s -h c:\WINDOWS\system32\{33A7195D-5870-496A-8B8A-FBBAC79647BE}.exe
attrib -r -s -h c:\WINDOWS\system32\{CF27AB05-D2D5-45EC-B4E8-38DBEE03BFA1}.exe
attrib -r -s -h c:\WINDOWS\system32\{EAAF94F8-4F30-4C81-A35E-2259F1800288}.exe
attrib -r -s -h c:\WINDOWS\system32\{6AB6D6EE-D046-4245-BFD0-B44320BED9FE}.exe
attrib -r -s -h c:\WINDOWS\system32\{2770826F-1C56-415B-AF76-DA8215432F2A}.exe
attrib -r -s -h c:\WINDOWS\system32\{20D01F30-2A17-4036-8F9F-50FEF5C306E0}.exe
attrib -r -s -h c:\WINDOWS\system32\{FD904BC0-7832-4072-B2D0-8E4539A027B0}.exe
attrib -r -s -h c:\WINDOWS\system32\{3489B4A6-2F8D-4D81-9B65-B0687A9D29B8}.exe
attrib -r -s -h c:\WINDOWS\system32\{7E164BA7-5151-4A41-8DC6-99B02BE1EDB1}.exe
attrib -r -s -h c:\WINDOWS\system32\{42BE745A-60C6-49EB-B912-87B5C827338C}.exe
attrib -r -s -h c:\WINDOWS\system32\{5AA39D9C-30A2-44E6-BCF0-40917553035B}.exe
attrib -r -s -h c:\WINDOWS\system32\{6613882C-92B8-4F9A-876C-75F4FBC0CF59}.exe
attrib -r -s -h c:\WINDOWS\system32\{D2BF02C0-5197-44E0-B14C-04C3691387CD}.exe
attrib -r -s -h c:\WINDOWS\system32\{DA1093E5-E428-4DD6-B975-F44242928B75}.exe
attrib -r -s -h c:\WINDOWS\system32\{EA547FAE-AF7F-420A-91D5-4B34A07933F7}.exe
attrib -r -s -h c:\WINDOWS\system32\{B773DC21-0DA0-4F7F-9B89-40A85701D6A7}.exe
attrib -r -s -h c:\WINDOWS\system32\{E5CECA2A-9499-48B4-9550-BE18623676FB}.exe
attrib -r -s -h c:\WINDOWS\system32\{C1B3781B-7311-40B1-BA90-407D20C2174B}.exe
attrib -r -s -h c:\WINDOWS\system32\{33170FAE-FD4C-4C85-9F88-C479A289F565}.exe
attrib -r -s -h c:\WINDOWS\system32\{E2F1140E-AF58-40BF-B5E6-74B1DDAAE290}.exe
attrib -r -s -h c:\WINDOWS\system32\{3F9ABF87-1C83-4554-B408-74064F554137}.exe
attrib -r -s -h c:\WINDOWS\system32\{F1A91C61-0699-47A9-BA2D-2026F997F1E4}.exe
attrib -r -s -h c:\WINDOWS\system32\{A2D307D6-DDB7-41CF-B7E3-C3506DB3F41E}.exe
attrib -r -s -h c:\WINDOWS\system32\{33596995-DE39-4436-8271-04F05966C6CD}.exe
attrib -r -s -h c:\WINDOWS\system32\{894AEF7C-6613-4B25-B42A-497D2BD103F4}.exe
attrib -r -s -h c:\WINDOWS\system32\{2FB0F428-8568-4AC9-8C11-4A7212631141}.exe
attrib -r -s -h c:\WINDOWS\system32\{2796D1D1-B9A5-4139-8E07-D8120776755A}.exe
attrib -r -s -h c:\WINDOWS\system32\{B5902504-04A4-4FC9-AE47-8B756F6688C9}.exe
attrib -r -s -h c:\WINDOWS\system32\{57AEC565-35BD-4D48-B917-775A84BB2137}.exe
attrib -r -s -h c:\WINDOWS\system32\{5BDE1E7F-67F3-4E70-9563-FDAC63920837}.exe
attrib -r -s -h c:\WINDOWS\system32\{CC7AA31B-F453-4552-90B0-3900627915D7}.exe
attrib -r -s -h c:\WINDOWS\system32\{27388102-AD5E-4C8B-87F5-996DB0510914}.exe
attrib -r -s -h c:\WINDOWS\system32\{24030B98-7BBE-43E0-BA09-9EE2F945D3B3}.exe
attrib -r -s -h c:\WINDOWS\system32\{AB96914E-CAD5-4A41-80B5-53739B67D786}.exe
attrib -r -s -h c:\WINDOWS\system32\{0CA3F8D7-94A5-49D3-ABF0-85F3134F6FA8}.exe
attrib -r -s -h c:\WINDOWS\system32\{CBDEA567-D3AA-4E5E-B2F8-287C6349406A}.exe
attrib -r -s -h c:\WINDOWS\system32\{D4EAFC6A-F972-46EF-BF3C-C52B98B8D779}.exe
attrib -r -s -h c:\WINDOWS\system32\{F752C29B-B5EA-414B-9BD4-71207F9C0024}.exe
attrib -r -s -h c:\WINDOWS\system32\{F0C8BBCF-44DF-4C85-B60A-73C5C4EB9035}.exe
attrib -r -s -h c:\WINDOWS\system32\{8EE4EBF0-01A9-40C9-86B8-0A2DE668CB3A}.exe
attrib -r -s -h c:\WINDOWS\system32\{913BC6C4-D8CE-47E4-99A4-97F2C242C7EE}.exe
attrib -r -s -h c:\WINDOWS\system32\{0D16766B-F776-4999-B9C1-3B291C998E21}.exe
attrib -r -s -h c:\WINDOWS\system32\{B30F0498-5E3B-4220-A898-D93871EA923F}.exe
attrib -r -s -h c:\WINDOWS\system32\{C68D5721-8578-439A-9193-4658EA7382F1}.exe
attrib -r -s -h c:\WINDOWS\system32\{20079308-B4E8-4E3B-A8B2-7B48C44363C2}.exe
attrib -r -s -h c:\WINDOWS\system32\{B8FFA3D6-57EC-4386-B0D3-1D61252C36C9}.exe
attrib -r -s -h c:\WINDOWS\system32\{FB514EF9-D30F-4C2F-8508-4853A44314ED}.exe
attrib -r -s -h c:\WINDOWS\system32\{FABE8883-7C00-483C-87EB-42AA418E4D26}.exe
attrib -r -s -h c:\WINDOWS\system32\{EA7631F8-F02C-4DA3-81EF-3AB77325F6EA}.exe
attrib -r -s -h c:\WINDOWS\system32\{1BC18976-55DA-45D7-B6FC-0EC83606C3AB}.exe
attrib -r -s -h c:\WINDOWS\system32\{5ABDA052-DC5E-4136-AEDD-E222FA2D0836}.exe
attrib -r -s -h c:\WINDOWS\system32\{F0920B9A-9E45-4558-BF3B-DA372622AEF2}.exe
attrib -r -s -h c:\WINDOWS\system32\{660143E0-81AE-4A30-B658-7831C8B55F90}.exe
attrib -r -s -h c:\WINDOWS\system32\{DBB88619-1DB7-4802-AE77-322E8B4C6379}.exe
attrib -r -s -h c:\WINDOWS\system32\{D89568B3-88E4-4E57-9F36-C62B5300A1C1}.exe
attrib -r -s -h c:\WINDOWS\system32\{1017AB21-B0FC-41EE-90F1-52B6170553E7}.exe
attrib -r -s -h c:\WINDOWS\system32\{D7791CAB-282D-48FC-A743-15F5419C9620}.exe
attrib -r -s -h c:\WINDOWS\system32\{330D8CD4-D4FC-40AA-B930-99235CF472A4}.exe
attrib -r -s -h c:\WINDOWS\system32\{93F7091A-69D8-4A49-80B7-420A9FD32DF8}.exe
attrib -r -s -h c:\WINDOWS\system32\{5E2592D1-B279-469A-BA48-5B06384E2D22}.exe
attrib -r -s -h c:\WINDOWS\system32\{804573B6-6CC0-4BC7-9261-C8FF603A1245}.exe
attrib -r -s -h c:\WINDOWS\system32\{CE74F512-A2D8-47A4-B515-0E7498F5F549}.exe
attrib -r -s -h c:\WINDOWS\system32\{5DAAB165-7CB6-4E07-A0B8-219266121EFA}.exe
attrib -r -s -h c:\WINDOWS\system32\{0B14DDEE-3E39-46B1-9E90-F59B539EB9D0}.exe
attrib -r -s -h c:\WINDOWS\system32\{A035398A-ABCC-4DD4-9A87-EAF76997D884}.exe
attrib -r -s -h c:\WINDOWS\system32\{50AAD5E2-5FA3-45C9-B047-4AF0C992BDA8}.exe
attrib -r -s -h c:\WINDOWS\system32\{19BF7AF0-1563-45F7-BBD9-2D3912A1B730}.exe
attrib -r -s -h c:\WINDOWS\system32\{2914C3FD-DDF6-4937-9F82-2470F5ADACFB}.exe
attrib -r -s -h c:\WINDOWS\system32\{90A2DF1B-7A1B-4D1F-B0DE-D35FF6EEB895}.exe
del c:\WINDOWS\SYSTEM32\rvwvt.exe
del c:\WINDOWS\SYSTEM32\CSKIK.EXE
del c:\WINDOWS\system32\{0306C082-79A9-482E-AF16-145810D4C831}.exe
del c:\WINDOWS\system32\{D3E3EA11-C7FE-47CA-9C9F-F67ACB28CFCF}.exe
del c:\WINDOWS\system32\{6941B7AC-0A59-4B40-82CB-E1EA34E63C0F}.exe
del c:\WINDOWS\system32\{3862EFBE-75A7-4E40-AA10-0A87456336C7}.exe
del c:\WINDOWS\system32\{354C60B4-3DF7-44BE-AD59-012A8DB7D4B0}.exe
del c:\WINDOWS\system32\{8B6F547A-54BF-4A3B-AD44-94E07EEF394A}.exe
del c:\WINDOWS\system32\{F08FE0F1-632A-4803-BA84-0456E2FB7548}.exe
del c:\WINDOWS\system32\{BF43F5EC-E1D9-4125-BFDA-A53299DF11F7}.exe
del c:\WINDOWS\system32\{74CC5DA1-3671-4FF0-87A2-1CCCEB74EE88}.exe
del c:\WINDOWS\system32\{BDAEEB10-A68B-469E-B591-5EB8559B176B}.exe
del c:\WINDOWS\system32\{41C5A858-B071-43A2-A5DA-0842EAB54202}.exe
del c:\WINDOWS\system32\{ED1F22E4-CEAB-48C2-9C1A-699974709585}.exe
del c:\WINDOWS\system32\{93EA26CF-5F1B-4AEF-A92F-60B7EA24B492}.exe
del c:\WINDOWS\system32\{3F89762E-AFB3-42EA-8A18-13F535E23FC7}.exe
del c:\WINDOWS\system32\{C758FD11-9803-4355-96E2-C44C2E18FA8E}.exe
del c:\WINDOWS\system32\{91365732-5067-46AB-B460-87DD81629513}.exe
del c:\WINDOWS\system32\{E307E8E2-CCE7-4BB7-9E3A-9077AEF04163}.exe
del c:\WINDOWS\system32\{F1923BC0-FC26-469A-B13C-8D551389F277}.exe
del c:\WINDOWS\system32\{E0605288-BAF2-4362-A37E-EF8AC930DC0B}.exe
del c:\WINDOWS\system32\{DE6A6C4C-D6F7-43A4-B2BF-323D55F14F35}.exe
del c:\WINDOWS\system32\{D9361838-5BFE-4C3F-8593-63BA4C63D6DA}.exe
del c:\WINDOWS\system32\{34AB2EEF-F83D-4237-8EAB-B87D52844867}.exe
del c:\WINDOWS\system32\{5D12BA66-2FB9-452F-867E-E178B18CA80D}.exe
del c:\WINDOWS\system32\{5C472E74-D500-474F-8F1B-210581663F1C}.exe
del c:\WINDOWS\system32\{0813D3C1-6476-4408-9AD9-2936B8621F27}.exe
del c:\WINDOWS\system32\{CA502656-EA0B-4889-92FD-C9AC15815421}.exe
del c:\WINDOWS\system32\{2456EF26-02DB-4DA2-BB33-35EB6BDCA56C}.exe
del c:\WINDOWS\system32\{B8E8AFDD-23B1-4DBF-ADBC-1F79FFF80F85}.exe
del c:\WINDOWS\system32\{BBF89F75-D47A-4AA4-9350-C240485A5471}.exe
del c:\WINDOWS\system32\{1A4D59E3-1AF5-4B8C-8847-ED864C3B4593}.exe
del c:\WINDOWS\system32\{132C1871-1770-491D-982D-B9632FD813DD}.exe
del c:\WINDOWS\system32\{0726BADA-AAE6-4459-A3EC-79B43F8AFB5F}.exe
del c:\WINDOWS\system32\{EBCD8243-6BD3-4BF8-895E-CACE3EF294DB}.exe
del c:\WINDOWS\system32\{6B242728-2E66-4E92-BC3F-4621C56ADA55}.exe
del c:\WINDOWS\system32\{641D34AF-37B6-4965-B3FF-53F56A59BB84}.exe
del c:\WINDOWS\system32\{2673568B-3CC7-4205-B753-B03452D50D91}.exe
del c:\WINDOWS\system32\{E35DDF90-52F2-4F3A-84D1-23F9A98DB275}.exe
del c:\WINDOWS\system32\{8366824E-ED63-4F19-A26B-E93C9F620530}.exe
del c:\WINDOWS\system32\{A52991EB-A237-4A03-8EB9-FC0264069905}.exe
del c:\WINDOWS\system32\{B90E6A58-95AB-4633-B6C3-A531C397A06D}.exe
del c:\WINDOWS\system32\{31C1B081-48A7-48BB-B72D-87353E0A86E2}.exe
del c:\WINDOWS\system32\{0365C241-66B6-45B6-9C4A-D64B3F702410}.exe
del c:\WINDOWS\system32\{75B8BDB8-A6F2-4057-AA65-94A1FE055E9B}.exe
del c:\WINDOWS\system32\{753E47D6-6CC4-4686-B9C5-1ECF67B4727F}.exe
del c:\WINDOWS\system32\{58EE7B61-144B-4A92-9494-59E1451E7DAB}.exe
del c:\WINDOWS\system32\{F893F8D6-6F03-41C6-B6E0-3ED6633E9DB3}.exe
del c:\WINDOWS\system32\{0CF1AD87-980E-4AF1-BF5D-1FFABE9987E8}.exe
del c:\WINDOWS\system32\{9C8FD0FC-788A-42FD-B28B-41940BFB05FC}.exe
del c:\WINDOWS\system32\{37BC63CA-9558-44B7-9236-C95F4F24497D}.exe
del c:\WINDOWS\system32\{26BAE648-AF02-4768-9E03-017809F66FBE}.exe
del c:\WINDOWS\system32\{D94516B5-3A73-4368-9359-E2EEA9981EA1}.exe
del c:\WINDOWS\system32\{2204F596-C5AC-4BD2-9A66-F8E39F542D3E}.exe
del c:\WINDOWS\system32\{47CF704D-4B14-4BC0-AD14-45F9BEDDF07E}.exe
del c:\WINDOWS\system32\{C17B4A48-5501-462A-8C66-91E413097FFA}.exe
del c:\WINDOWS\system32\{10298968-E95E-4B9B-A79B-8E85574428ED}.exe
del c:\WINDOWS\system32\{B87E3800-D686-46B8-90D7-C203EEFF026D}.exe
del c:\WINDOWS\system32\{5040AACD-AECF-4171-B4ED-A931C136F4FA}.exe
del c:\WINDOWS\system32\{669C7A91-DA0F-4C75-8405-FC00DCA968CE}.exe
del c:\WINDOWS\system32\{FB24B7DF-0002-4C10-AD74-C0C0F3A4603E}.exe
del c:\WINDOWS\system32\{B0D880E3-269B-42E3-BC12-C1BAE3692280}.exe
del c:\WINDOWS\system32\{958EB3DE-4407-48E1-BA2F-489C1C6FEA3B}.exe
del c:\WINDOWS\system32\{9FCF6F24-59AD-41A1-A701-32DF0F158BEC}.exe
del c:\WINDOWS\system32\{565F23E7-0EC5-4087-AE84-E6E6EEB43742}.exe
del c:\WINDOWS\system32\{16ECAC58-E970-4380-B269-C77901A67A55}.exe
del c:\WINDOWS\system32\{C6D95DBE-4960-451B-9FA6-C08CAD5A87D6}.exe
del c:\WINDOWS\system32\{0DD82A66-0123-44CA-933C-7891794D9C2F}.exe
del c:\WINDOWS\system32\{3BE83911-64F2-4C54-9A64-E9BD98C50156}.exe
del c:\WINDOWS\system32\{466F3A04-5F87-4EB7-B5BB-AA6BFA485F7A}.exe
del c:\WINDOWS\system32\{CF62F4F4-964C-4DD9-9485-4F38BC64FB54}.exe
del c:\WINDOWS\system32\{F624125B-0B17-4CAE-AE6F-CF6BB9ABE651}.exe
del c:\WINDOWS\system32\{33A7195D-5870-496A-8B8A-FBBAC79647BE}.exe
del c:\WINDOWS\system32\{CF27AB05-D2D5-45EC-B4E8-38DBEE03BFA1}.exe
del c:\WINDOWS\system32\{EAAF94F8-4F30-4C81-A35E-2259F1800288}.exe
del c:\WINDOWS\system32\{6AB6D6EE-D046-4245-BFD0-B44320BED9FE}.exe
del c:\WINDOWS\system32\{2770826F-1C56-415B-AF76-DA8215432F2A}.exe
del c:\WINDOWS\system32\{20D01F30-2A17-4036-8F9F-50FEF5C306E0}.exe
del c:\WINDOWS\system32\{FD904BC0-7832-4072-B2D0-8E4539A027B0}.exe
del c:\WINDOWS\system32\{3489B4A6-2F8D-4D81-9B65-B0687A9D29B8}.exe
del c:\WINDOWS\system32\{7E164BA7-5151-4A41-8DC6-99B02BE1EDB1}.exe
del c:\WINDOWS\system32\{42BE745A-60C6-49EB-B912-87B5C827338C}.exe
del c:\WINDOWS\system32\{5AA39D9C-30A2-44E6-BCF0-40917553035B}.exe
del c:\WINDOWS\system32\{6613882C-92B8-4F9A-876C-75F4FBC0CF59}.exe
del c:\WINDOWS\system32\{D2BF02C0-5197-44E0-B14C-04C3691387CD}.exe
del c:\WINDOWS\system32\{DA1093E5-E428-4DD6-B975-F44242928B75}.exe
del c:\WINDOWS\system32\{EA547FAE-AF7F-420A-91D5-4B34A07933F7}.exe
del c:\WINDOWS\system32\{B773DC21-0DA0-4F7F-9B89-40A85701D6A7}.exe
del c:\WINDOWS\system32\{E5CECA2A-9499-48B4-9550-BE18623676FB}.exe
del c:\WINDOWS\system32\{C1B3781B-7311-40B1-BA90-407D20C2174B}.exe
del c:\WINDOWS\system32\{33170FAE-FD4C-4C85-9F88-C479A289F565}.exe
del c:\WINDOWS\system32\{E2F1140E-AF58-40BF-B5E6-74B1DDAAE290}.exe
del c:\WINDOWS\system32\{3F9ABF87-1C83-4554-B408-74064F554137}.exe
del c:\WINDOWS\system32\{F1A91C61-0699-47A9-BA2D-2026F997F1E4}.exe
del c:\WINDOWS\system32\{A2D307D6-DDB7-41CF-B7E3-C3506DB3F41E}.exe
del c:\WINDOWS\system32\{33596995-DE39-4436-8271-04F05966C6CD}.exe
del c:\WINDOWS\system32\{894AEF7C-6613-4B25-B42A-497D2BD103F4}.exe
del c:\WINDOWS\system32\{2FB0F428-8568-4AC9-8C11-4A7212631141}.exe
del c:\WINDOWS\system32\{2796D1D1-B9A5-4139-8E07-D8120776755A}.exe
del c:\WINDOWS\system32\{B5902504-04A4-4FC9-AE47-8B756F6688C9}.exe
del c:\WINDOWS\system32\{57AEC565-35BD-4D48-B917-775A84BB2137}.exe
del c:\WINDOWS\system32\{5BDE1E7F-67F3-4E70-9563-FDAC63920837}.exe
del c:\WINDOWS\system32\{CC7AA31B-F453-4552-90B0-3900627915D7}.exe
del c:\WINDOWS\system32\{27388102-AD5E-4C8B-87F5-996DB0510914}.exe
del c:\WINDOWS\system32\{24030B98-7BBE-43E0-BA09-9EE2F945D3B3}.exe
del c:\WINDOWS\system32\{AB96914E-CAD5-4A41-80B5-53739B67D786}.exe
del c:\WINDOWS\system32\{0CA3F8D7-94A5-49D3-ABF0-85F3134F6FA8}.exe
del c:\WINDOWS\system32\{CBDEA567-D3AA-4E5E-B2F8-287C6349406A}.exe
del c:\WINDOWS\system32\{D4EAFC6A-F972-46EF-BF3C-C52B98B8D779}.exe
del c:\WINDOWS\system32\{F752C29B-B5EA-414B-9BD4-71207F9C0024}.exe
del c:\WINDOWS\system32\{F0C8BBCF-44DF-4C85-B60A-73C5C4EB9035}.exe
del c:\WINDOWS\system32\{8EE4EBF0-01A9-40C9-86B8-0A2DE668CB3A}.exe
del c:\WINDOWS\system32\{913BC6C4-D8CE-47E4-99A4-97F2C242C7EE}.exe
del c:\WINDOWS\system32\{0D16766B-F776-4999-B9C1-3B291C998E21}.exe
del c:\WINDOWS\system32\{B30F0498-5E3B-4220-A898-D93871EA923F}.exe
del c:\WINDOWS\system32\{C68D5721-8578-439A-9193-4658EA7382F1}.exe
del c:\WINDOWS\system32\{20079308-B4E8-4E3B-A8B2-7B48C44363C2}.exe
del c:\WINDOWS\system32\{B8FFA3D6-57EC-4386-B0D3-1D61252C36C9}.exe
del c:\WINDOWS\system32\{FB514EF9-D30F-4C2F-8508-4853A44314ED}.exe
del c:\WINDOWS\system32\{FABE8883-7C00-483C-87EB-42AA418E4D26}.exe
del c:\WINDOWS\system32\{EA7631F8-F02C-4DA3-81EF-3AB77325F6EA}.exe
del c:\WINDOWS\system32\{1BC18976-55DA-45D7-B6FC-0EC83606C3AB}.exe
del c:\WINDOWS\system32\{5ABDA052-DC5E-4136-AEDD-E222FA2D0836}.exe
del c:\WINDOWS\system32\{F0920B9A-9E45-4558-BF3B-DA372622AEF2}.exe
del c:\WINDOWS\system32\{660143E0-81AE-4A30-B658-7831C8B55F90}.exe
del c:\WINDOWS\system32\{DBB88619-1DB7-4802-AE77-322E8B4C6379}.exe
del c:\WINDOWS\system32\{D89568B3-88E4-4E57-9F36-C62B5300A1C1}.exe
del c:\WINDOWS\system32\{1017AB21-B0FC-41EE-90F1-52B6170553E7}.exe
del c:\WINDOWS\system32\{D7791CAB-282D-48FC-A743-15F5419C9620}.exe
del c:\WINDOWS\system32\{330D8CD4-D4FC-40AA-B930-99235CF472A4}.exe
del c:\WINDOWS\system32\{93F7091A-69D8-4A49-80B7-420A9FD32DF8}.exe
del c:\WINDOWS\system32\{5E2592D1-B279-469A-BA48-5B06384E2D22}.exe
del c:\WINDOWS\system32\{804573B6-6CC0-4BC7-9261-C8FF603A1245}.exe
del c:\WINDOWS\system32\{CE74F512-A2D8-47A4-B515-0E7498F5F549}.exe
del c:\WINDOWS\system32\{5DAAB165-7CB6-4E07-A0B8-219266121EFA}.exe
del c:\WINDOWS\system32\{0B14DDEE-3E39-46B1-9E90-F59B539EB9D0}.exe
del c:\WINDOWS\system32\{A035398A-ABCC-4DD4-9A87-EAF76997D884}.exe
del c:\WINDOWS\system32\{50AAD5E2-5FA3-45C9-B047-4AF0C992BDA8}.exe
del c:\WINDOWS\system32\{19BF7AF0-1563-45F7-BBD9-2D3912A1B730}.exe
del c:\WINDOWS\system32\{2914C3FD-DDF6-4937-9F82-2470F5ADACFB}.exe
del c:\WINDOWS\system32\{90A2DF1B-7A1B-4D1F-B0DE-D35FF6EEB895}.exe

Save it to your desktop as ff.bat

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [rvwvt.exe] C:\WINDOWS\system32\rvwvt.exe

Then click "Fix checked".

Now click on Config –> Misc Tools –> Open Process Manager

In the list of processes, find explorer.exe

Click to highlight, then click "Kill Process". OK any prompts.

Your desktop will disappear, but that is normal. It will come back when you reboot.

Now, in HijackThis!, click:

Run –> browse

Browse to your desktop and click ff.bat –> open –> OK

Browse to c:\fixwareout and click Fixit.bat –> open –> OK

This will start Fixwareout again.

After the reboot, post:

1. The fixwareout report

2. A new HijackThis! log

Into this thread.


P.S. - When the infection is gone, we'll remove the unwanted Norton items.

Hi mate.

Here's the result of my actions :

Had to kill two processes named explorer.exe

Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
…

Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names…

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.
Directory of C:\WINDOWS\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.








Logfile of HijackThis v1.99.1
Scan saved at 1:24:05, on 19/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\PI Engineering\Macro Works\MacroMgr.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://games.telenet.be
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106838455765
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914…IPSUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE6E82C1-6CD3-4213-936F-BD731A51E973}: NameServer = 192.168.1.1,139.175.55.224
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Hi Micah,

done all that, and I must say it's lookin' very very good.

Thank you very much for fixing my problem. I will donate in the next few days, you can count on it.

Here's the log :

Logfile of HijackThis v1.99.1
Scan saved at 1:45:21, on 19/08/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Home Cinema\PowerCinema\PCMService.exe
C:\Program Files\AGEIA Technologies\TrayIcon.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\PI Engineering\Macro Works\MacroMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://pac.telenet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Keyboard Status] C:\PROGRA~1\Medion Tools\KeyStat\KeyStat.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\FlatBed\HotKey.exe
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Home Cinema\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [AGEIA PhysX SysTray] C:\Program Files\AGEIA Technologies\TrayIcon.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com/
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: http://games.telenet.be
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1106838455765
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://as.photoprintit.de/ips-opdata/74914…IPSUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE6E82C1-6CD3-4213-936F-BD731A51E973}: NameServer = 192.168.1.1,139.175.55.224
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe