This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

need help

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hello,
Keep getting the trojan.small.fb alert from Ewido and I can't get rid of it. Any help will be greatly appreciated. Here is the hyjack this log:
Logfile of HijackThis v1.99.1
Scan saved at 12:52:33 PM, on 8/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\windows\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\System32\alg.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\Larry\Desktop\Unused Desktop Shortcuts\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - C:\WINDOWS\system32\SearchTool\nsw10.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dmgzw.exe] C:\windows\system32\dmgzw.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sexyitalianbitch.spaces.msn.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119418237234
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144271674500
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://activation.sympatico.ca/wizlet/Symp…nadaActiveX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…825/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A26A92C-8D1D-4CD4-9210-112D98309493}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\..\{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.4 85.255.112.15
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A26A92C-8D1D-4CD4-9210-112D98309493}: NameServer = 85.255.115.4,85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.4 85.255.112.15
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
Welcome to the forum :wavey:

Please download FixWareout from one of these links:
Fixwareout.exe
Fixwareout.exe

Save it to your desktop.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O2 - BHO: ohb - {5ED7D3DE-6DBE-4516-8712-01B1B64B7057} - C:\WINDOWS\system32\SearchTool\nsw10.dll (file missing)

O4 - HKLM\..\Run: [dmgzw.exe] C:\windows\system32\dmgzw.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{0A26A92C-8D1D-4CD4-9210-112D98309493}: NameServer = 85.255.115.4,85.255.112.15

O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15

O17 - HKLM\System\CCS\Services\Tcpip\..\{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB}: NameServer = 85.255.115.4,85.255.112.15

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.4 85.255.112.15

O17 - HKLM\System\CS1\Services\Tcpip\..\{0A26A92C-8D1D-4CD4-9210-112D98309493}: NameServer = 85.255.115.4,85.255.112.15

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.4 85.255.112.15

Then click "Fix checked" and close Hijack This!.

* Run Fixwareout on the desktop.
* Click Next, then Install, make sure "Run fixit" is checked and click Finish.
* The fix will begin; follow the prompts.
* You will be asked to reboot your computer; please do so.
* Your system may take longer than usual to load; this is normal.
* Once the desktop loads a text will open (report.txt). We'll need that in a bit.

"Copy/paste" a new HijackThis! log file into this thread.

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

:)
Thank-you for the help Micah

Logfile of HijackThis v1.99.1
Scan saved at 5:23:09 PM, on 8/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\csrss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\windows\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\System32\alg.exe
C:\windows\system32\NOTEPAD.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\Larry\Desktop\Unused Desktop Shortcuts\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dmqte.exe] C:\windows\system32\dmqte.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sexyitalianbitch.spaces.msn.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119418237234
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144271674500
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://activation.sympatico.ca/wizlet/Symp…nadaActiveX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…825/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe


Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8CFBF1CEA019-3769-9734-15B6-83D86BE6{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\sbimd
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names…
* csr.exe C:\windows\System32\CSTVE.EXE

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSTVE.EXE 51,279 2006-08-05
C:\WINDOWS\SYSTEM32\DMIBS.EXE 62,001 2004-08-04
C:\WINDOWS\SYSTEM32\DMJYZ.EXE 62,001 2004-08-04
C:\WINDOWS\SYSTEM32\DMKRH.EXE 62,001 2004-08-04
C:\WINDOWS\SYSTEM32\DMMYP.EXE 62,001 2004-08-04
C:\WINDOWS\SYSTEM32\DMTPQ.EXE 62,001 2004-08-04

Other suspects.
Directory of C:\windows\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.
Copy the text in the following quote box into Notepad:

attrib -r -s -h C:\windows\system32\dmqte.exe
attrib -r -s -h C:\WINDOWS\SYSTEM32\CSTVE.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMIBS.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMJYZ.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMKRH.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMMYP.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMTPQ.EXE
del C:\windows\system32\dmqte.exe
del C:\WINDOWS\SYSTEM32\CSTVE.EXE
del C:\WINDOWS\SYSTEM32\DMIBS.EXE
del C:\WINDOWS\SYSTEM32\DMJYZ.EXE
del C:\WINDOWS\SYSTEM32\DMKRH.EXE
del C:\WINDOWS\SYSTEM32\DMMYP.EXE
del C:\WINDOWS\SYSTEM32\DMTPQ.EXE

Save it to your desktop as ff.bat

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll (file missing)

O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

O4 - HKLM\..\Run: [dmqte.exe] C:\windows\system32\dmqte.exe

O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15

O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

Then click "Fix checked".

Now click on Config –> Misc Tools –> Open Process Manager

In the list of processes, find explorer.exe

Click to highlight, then click "Kill Process". OK any prompts.

Your desktop will disappear, but that is normal. It will come back when you reboot.

Now, in HijackThis!, click:

Run –> browse

Browse to your desktop and click ff.bat –> open –> OK

Browse to c:\fixwareout and click Fixit.bat –> open –> OK

This will start Fixwareout again.

After the reboot, post:

1. The fixwareout report

2. A new HijackThis! log

Into this thread.
:)
Thanks! I had to re-boot in safe mode…the system would not allow me to a regular boot. I'm afraid I lost the fixwareout report. Sorry.

Logfile of HijackThis v1.99.1
Scan saved at 8:06:52 PM, on 8/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\windows\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Larry\Desktop\Unused Desktop Shortcuts\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [dmqte.exe] C:\windows\system32\dmqte.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sexyitalianbitch.spaces.msn.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119418237234
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144271674500
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://activation.sympatico.ca/wizlet/Symp…nadaActiveX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…825/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [dmqte.exe] C:\windows\system32\dmqte.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15

Then click "Fix checked" and close Hijack This!.

Delete:

c:\windows\system32\dmqte.exe <— file

Browse to c:\fixwareout, Fixit.bat

This will start Fixwareout again.

After the reboot, post:

1. The fixwareout report

2. A new HijackThis! log

Into this thread.
:)
Thanks again for all your help!

Logfile of HijackThis v1.99.1
Scan saved at 8:55:04 PM, on 8/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\windows\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\windows\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\system32\wuauclt.exe
C:\windows\system32\NOTEPAD.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\Larry\Desktop\Unused Desktop Shortcuts\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sexyitalianbitch.spaces.msn.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119418237234
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144271674500
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://activation.sympatico.ca/wizlet/Symp…nadaActiveX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…825/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe

Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names…

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.
Directory of C:\windows\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15

Then click "Fix checked" and close Hijack This!.

Reboot.

Make another log file.

If that line stays gone, you should be "good to go".

How's it running?
:unsure:

Securing Your PC After An Attack
Thanks Micah. Unfortunately, the line is still there and now I'm getting an"invalid boot.ini" on startup. I don't know if this is related, or just another headache for me…lol…

Logfile of HijackThis v1.99.1
Scan saved at 9:08:10 PM, on 8/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\windows\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\windows\system32\wuauclt.exe
C:\Documents and Settings\Larry\Desktop\Unused Desktop Shortcuts\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sexyitalianbitch.spaces.msn.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119418237234
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144271674500
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://activation.sympatico.ca/wizlet/Symp…nadaActiveX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…825/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15

Then click "Fix checked" and close Hijack This!.

Go to your control panel and open your network connections.
Select the first network adaptor listed.
Right Click on it, and select Properties.
On the "General" Tab, highlight Internet Protocol (TCP/IP)
Select "Properties"

Check the box next to "Obtain DNS server address automatically".

OK any prompts.

Reboot & post another log file.
:)
Thanks,
Logfile of HijackThis v1.99.1
Scan saved at 9:47:06 PM, on 8/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\system32\wuauclt.exe
C:\Documents and Settings\Larry\Desktop\Unused Desktop Shortcuts\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sexyitalianbitch.spaces.msn.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119418237234
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144271674500
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://activation.sympatico.ca/wizlet/Symp…nadaActiveX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…825/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
Please download/unzip this:

Registry Search by Bobbi Flekman

on regsearch.exe, and search for this:

{5C554F1F-5F21-4F19-8D80-0F223BF40552}

Make sure all the boxes are checked under "Search".

It may take a while to run, so be patient. When finished, the search results will appear in your text editor,

Paste the contents of the search results into your next post.

Still getting "boot.ini" errors?
:unsure:
Yes, I'm still getting the error. Here is the report: REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 8/18/2006 10:42:21 PM for strings: ; '{5c554f1f-5f21-4f19-8d80-0f223bf40552}' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters] ; Contents of value: ;  ymædù ymæd ymæd+ ymæd, ymæd ymæd "{5C554F1F-5F21-4F19-8D80-0F223BF40552}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,79,6d,e6,44,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 79,6d,e6,44,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,79,6d,e6,44,2b,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,79,6d,e6,44,2c,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,79,6d,e6,44,06,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,79,6d,e6,44 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\Linkage] ; Contents of value: ; \Device\NetbiosSmb ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\ 65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\ 70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,\ 30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,\ 65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,\ 2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,\ 5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,\ 32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,\ 38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,\ 44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\LanmanServer_NetbiosSmb ; \Device\LanmanServer_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\LanmanServer_NetBT_Tcpip ; \Device\LanmanServer_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\LanmanServer_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanServer_NetBT_Tcpip ; \Device\LanmanServer_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanServer_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanServer_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\ 4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\ 53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,\ 45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,\ 42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\ 76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,\ 2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,\ 34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\ 5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,\ 39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,\ 7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,\ 34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,\ 44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,\ 5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,\ 39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\Linkage] ; Contents of value: ; \Device\NetbiosSmb ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\ 65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\ 70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,\ 30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,\ 65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,\ 2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,\ 5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,\ 32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,\ 38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,\ 44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\LanmanWorkstation_NetbiosSmb ; \Device\LanmanWorkstation_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\LanmanWorkstation_NetBT_Tcpip ; \Device\LanmanWorkstation_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\LanmanWorkstation_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanWorkstation_NetBT_Tcpip ; \Device\LanmanWorkstation_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanWorkstation_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanWorkstation_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\ 74,69,6f,6e,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,\ 61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,\ 37,44,44,2d,45,31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,\ 5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,\ 54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,\ 2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,\ 63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,\ 44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,\ 34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,\ 44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,\ 4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,\ 31,2d,34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,\ 00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBIOS\Linkage] ; Contents of value: ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,\ 31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,\ 44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,\ 34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,\ 46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\ 5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,\ 2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,\ 34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\NetBIOS_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBIOS_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBIOS_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBIOS_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBIOS_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBIOS_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,\ 5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,\ 44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,\ 69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,\ 31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,\ 2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,\ 41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,\ 39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\ 7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,44,38,30,2d,\ 30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Linkage] ; Contents of value: ; \Device\Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,30,41,32,\ 36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,\ 39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\ 41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,\ 36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\ 70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,\ 32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,54,\ 63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,\ 38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,\ 31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,\ 44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,\ 34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,\ 46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\ 5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,\ 2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,\ 34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage] ; Contents of value: ; \Device\Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,30,41,32,\ 36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,\ 39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\ 41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,\ 36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\ 70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,\ 32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,54,\ 63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,\ 38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Adapters\NdisWanIp] ; Contents of value: ; Tcpip\Parameters\Interfaces\{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; Tcpip\Parameters\Interfaces\{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\ 65,72,66,61,63,65,73,5c,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,\ 44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,54,63,70,\ 69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\ 7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,\ 36,44,46,45,41,38,42,34,44,36,38,45,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\ 65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,35,43,35,35,34,46,31,\ 46,2d,35,46,32,31,2d,34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,\ 30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Dhcp\Parameters] ; Contents of value: ;  >dædù >dæd >dæd+ >dæd, >dæd >dæd "{5C554F1F-5F21-4F19-8D80-0F223BF40552}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,3e,64,e6,44,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 3e,64,e6,44,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,3e,64,e6,44,2b,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,3e,64,e6,44,2c,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,3e,64,e6,44,06,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,3e,64,e6,44 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanserver\Linkage] ; Contents of value: ; \Device\NetbiosSmb ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\ 65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\ 70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,\ 30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,\ 65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,\ 2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,\ 5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,\ 32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,\ 38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,\ 44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\LanmanServer_NetbiosSmb ; \Device\LanmanServer_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\LanmanServer_NetBT_Tcpip ; \Device\LanmanServer_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\LanmanServer_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanServer_NetBT_Tcpip ; \Device\LanmanServer_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanServer_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanServer_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\ 4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\ 53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,\ 45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,\ 42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\ 76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,\ 2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,\ 34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\ 5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,\ 39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,\ 7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,\ 34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,\ 44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,\ 5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,\ 39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\lanmanworkstation\Linkage] ; Contents of value: ; \Device\NetbiosSmb ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\ 65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\ 70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,\ 30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,\ 65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,\ 2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,\ 5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,\ 32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,\ 38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,\ 44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\LanmanWorkstation_NetbiosSmb ; \Device\LanmanWorkstation_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\LanmanWorkstation_NetBT_Tcpip ; \Device\LanmanWorkstation_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\LanmanWorkstation_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanWorkstation_NetBT_Tcpip ; \Device\LanmanWorkstation_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanWorkstation_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanWorkstation_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\ 74,69,6f,6e,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,\ 61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,\ 37,44,44,2d,45,31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,\ 5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,\ 54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,\ 2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,\ 63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,\ 44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,\ 34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,\ 44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,\ 4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,\ 31,2d,34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,\ 00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NetBIOS\Linkage] ; Contents of value: ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,\ 31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,\ 44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,\ 34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,\ 46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\ 5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,\ 2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,\ 34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\NetBIOS_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBIOS_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBIOS_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBIOS_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBIOS_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBIOS_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,\ 5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,\ 44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,\ 69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,\ 31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,\ 2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,\ 41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,\ 39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\ 7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,44,38,30,2d,\ 30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NetBT\Linkage] ; Contents of value: ; \Device\Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,30,41,32,\ 36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,\ 39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\ 41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,\ 36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\ 70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,\ 32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,54,\ 63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,\ 38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,\ 31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,\ 44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,\ 34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,\ 46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\ 5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,\ 2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,\ 34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NetBT\Parameters\Interfaces\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552}] [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Linkage] ; Contents of value: ; \Device\Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,30,41,32,\ 36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,\ 39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\ 41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,\ 36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\ 70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,\ 32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,54,\ 63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,\ 38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Adapters\NdisWanIp] ; Contents of value: ; Tcpip\Parameters\Interfaces\{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; Tcpip\Parameters\Interfaces\{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\ 65,72,66,61,63,65,73,5c,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,\ 44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,54,63,70,\ 69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\ 7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,\ 36,44,46,45,41,38,42,34,44,36,38,45,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\ 65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,35,43,35,35,34,46,31,\ 46,2d,35,46,32,31,2d,34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,\ 30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters] ; Contents of value: ;  ymædù ymæd ymæd+ ymæd, ymæd ymæd "{5C554F1F-5F21-4F19-8D80-0F223BF40552}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,79,6d,e6,44,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 79,6d,e6,44,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,79,6d,e6,44,2b,\ 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,79,6d,e6,44,2c,00,00,00,00,00,\ 00,00,00,00,00,00,00,00,00,00,79,6d,e6,44,06,00,00,00,00,00,00,00,00,00,00,\ 00,00,00,00,00,79,6d,e6,44 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Linkage] ; Contents of value: ; \Device\NetbiosSmb ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\ 65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\ 70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,\ 30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,\ 65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,\ 2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,\ 5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,\ 32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,\ 38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,\ 44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\LanmanServer_NetbiosSmb ; \Device\LanmanServer_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\LanmanServer_NetBT_Tcpip ; \Device\LanmanServer_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\LanmanServer_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanServer_NetBT_Tcpip ; \Device\LanmanServer_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanServer_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanServer_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanServer_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\ 4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\ 53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,\ 45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,\ 42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\ 76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,\ 2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,\ 34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\ 5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,\ 39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,\ 7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,\ 34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,\ 44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,\ 5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,\ 39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Linkage] ; Contents of value: ; \Device\NetbiosSmb ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\ 65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\ 70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,\ 30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,\ 65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,\ 2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,\ 5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,\ 32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,\ 38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,\ 44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\LanmanWorkstation_NetbiosSmb ; \Device\LanmanWorkstation_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} \Device\LanmanWorkstation_NetBT_Tcpip ; \Device\LanmanWorkstation_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\LanmanWorkstation_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanWorkstation_NetBT_Tcpip ; \Device\LanmanWorkstation_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\LanmanWorkstation_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanWorkstation_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\LanmanWorkstation_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\ 74,69,6f,6e,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,\ 61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\ 70,69,70,5f,7b,42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,\ 37,44,44,2d,45,31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,\ 5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,\ 54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,\ 2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,\ 63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,\ 44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,\ 34,35,39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,\ 44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,\ 4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,\ 31,2d,34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,\ 00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage] ; Contents of value: ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,\ 31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,\ 44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,\ 34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,\ 46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\ 5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,\ 2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,\ 34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\NetBIOS_NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBIOS_NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBIOS_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBIOS_NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBIOS_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBIOS_NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBIOS_NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,\ 5f,54,63,70,69,70,5f,7b,42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,\ 44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,\ 69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,\ 31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,34,\ 2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,\ 41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,\ 39,38,2d,42,39,32,32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\ 7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,38,44,38,30,2d,\ 30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Linkage] ; Contents of value: ; \Device\Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,30,41,32,\ 36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,\ 39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\ 41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,\ 36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\ 70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,\ 32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,54,\ 63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,\ 38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 ; Contents of value: ; \Device\NetBT_Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\NetBT_Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\NetBT_Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\NetBT_Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\ 42,38,34,42,39,45,36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,\ 31,45,30,45,33,42,46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\ 54,5f,54,63,70,69,70,5f,7b,30,41,32,36,41,39,32,43,2d,38,44,31,44,2d,34,43,\ 44,34,2d,39,32,31,30,2d,31,31,32,44,39,38,33,30,39,34,39,33,7d,00,5c,44,65,\ 76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,41,45,44,34,43,35,35,\ 34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,\ 46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\ 5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,\ 2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\ 74,42,54,5f,54,63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,\ 34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage] ; Contents of value: ; \Device\Tcpip_{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB} ; \Device\Tcpip_{0A26A92C-8D1D-4CD4-9210-112D98309493} \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; \Device\Tcpip_{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; \Device\Tcpip_{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,42,38,34,42,39,45,\ 36,46,2d,45,30,30,45,2d,34,45,46,44,2d,42,37,44,44,2d,45,31,45,30,45,33,42,\ 46,44,43,45,42,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,30,41,32,\ 36,41,39,32,43,2d,38,44,31,44,2d,34,43,44,34,2d,39,32,31,30,2d,31,31,32,44,\ 39,38,33,30,39,34,39,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\ 41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,44,35,2d,39,39,46,36,2d,37,\ 36,39,45,42,45,41,46,46,41,32,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\ 70,5f,7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,\ 32,2d,36,44,46,45,41,38,42,34,44,36,38,45,7d,00,5c,44,65,76,69,63,65,5c,54,\ 63,70,69,70,5f,7b,35,43,35,35,34,46,31,46,2d,35,46,32,31,2d,34,46,31,39,2d,\ 38,44,38,30,2d,30,46,32,32,33,42,46,34,30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\NdisWanIp] ; Contents of value: ; Tcpip\Parameters\Interfaces\{AED4C554-AA94-4CD5-99F6-769EBEAFFA23} ; Tcpip\Parameters\Interfaces\{A5DF2951-8B57-4598-B922-6DFEA8B4D68E} Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552} ; "IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\ 65,72,66,61,63,65,73,5c,7b,41,45,44,34,43,35,35,34,2d,41,41,39,34,2d,34,43,\ 44,35,2d,39,39,46,36,2d,37,36,39,45,42,45,41,46,46,41,32,33,7d,00,54,63,70,\ 69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\ 7b,41,35,44,46,32,39,35,31,2d,38,42,35,37,2d,34,35,39,38,2d,42,39,32,32,2d,\ 36,44,46,45,41,38,42,34,44,36,38,45,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\ 65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,35,43,35,35,34,46,31,\ 46,2d,35,46,32,31,2d,34,46,31,39,2d,38,44,38,30,2d,30,46,32,32,33,42,46,34,\ 30,35,35,32,7d,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{5C554F1F-5F21-4F19-8D80-0F223BF40552}] ; End Of The Log…
Open your network connections (as stated before).

Change your "Preferred" and "Alternate" DNS servers to:

Preferred: 4.2.2.1

Alternate: 4.2.2.6

Reboot and post a new log file.

Copy the text in the following quote box into Notepad:

type c:\boot.ini > files.txt
notepad files.txt


Save it to your desktop as ff.bat

CLOSE NOTEPAD!!!

Now, the ff.bat file on the desktop. A Notepad window will open up.

Please paste it's contents into your next post.
Hey Micah, You're working overtime!
When I opened up the ff.bat file, there was nothing in notepad to copy. There were no abnormalities in the cmd.exe window….is this common?
Here is the hijack report:

Logfile of HijackThis v1.99.1
Scan saved at 11:47:54 PM, on 8/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\windows\system32\spoolsv.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\windows\system32\svchost.exe
C:\windows\system32\wuauclt.exe
C:\Documents and Settings\Larry\Desktop\Unused Desktop Shortcuts\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=566…ER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O14 - IERESET.INF: START_PAGE_URL=http://www.mdg.ca
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://sexyitalianbitch.spaces.msn.com//Ph…ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1119418237234
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1144271674500
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://data6.archives.ca/mrsidi_cab/MrSIDI.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://activation.sympatico.ca/wizlet/Symp…nadaActiveX.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…825/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5C554F1F-5F21-4F19-8D80-0F223BF40552}: NameServer = 85.255.115.4 85.255.112.15
O17 - HKLM\System\CCS\Services\Tcpip\..\{B84B9E6F-E00E-4EFD-B7DD-E1E0E3BFDCEB}: NameServer = 4.2.2.1,4.2.2.6
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\windows\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\windows\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\windows\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD File System Service (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI