Clicker.FR//Generic.XFV/XKS//Collected.8.AQ

Hello people,

AVG keeps generating the names in the topic.

Please have a look at my HJT-log. I'd appreciate it very much if you would spend some time helping me get rid of this piece of software.

Logfile of HijackThis v1.97.7
Scan saved at 17:34:09, on 2006-08-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Grisoft\AVGFRE~1\avgcc.exe
C:\Program\Grisoft\AVGFRE~1\avgemc.exe
C:\Program\Microsoft Hardware\Mouse\point32.exe
C:\Program\Java\jre1.5.0_06\bin\jusched.exe
C:\Program\Winamp\winampa.exe
C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program\Personal\bin\Personal.exe
C:\Program\ewido anti-spyware 4.0\guard.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program\Personal\bin\Personal.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NVidia System Utility] "C:\Program\NVIDIA Corporation\NVIDIA System Utility\\NVSystemUtility.exe" clear
O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\Program\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Hot_Tarts_mc] C:\Program Files\Mpb\Dialers\Hot_Tarts_mc\Hot_Tarts_mc.exe /dontdial
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [dmigh.exe] C:\WINDOWS\system32\dmigh.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!ewido] "C:\Program\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [soysy.exe] C:\WINDOWS\system32\soysy.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra 'Tools' menuitem: Sun Java-konsol (HKLM)
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23FE37D5-4A58-4CDC-A3D7-6634B4975B0A}: NameServer = 85.255.114.105,85.255.112.113
O17 - HKLM\System\CCS\Services\Tcpip\..\{E605089C-8BE8-4795-B329-84D8D415961C}: NameServer = 85.255.114.105,85.255.112.113
O17 - HKLM\System\CCS\Services\Tcpip\..\{F3DF7665-4C54-43A6-B4A7-CA2DB26FDC6D}: NameServer = 85.255.114.105,85.255.112.113
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB2A31D8-0FA8-4C21-B900-69E4EEA63AF2}: NameServer = 85.255.114.105,85.255.112.113
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.105 85.255.112.113
O17 - HKLM\System\CS1\Services\Tcpip\..\{23FE37D5-4A58-4CDC-A3D7-6634B4975B0A}: NameServer = 85.255.114.105,85.255.112.113
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.105 85.255.112.113
O17 - HKLM\System\CS2\Services\Tcpip\..\{23FE37D5-4A58-4CDC-A3D7-6634B4975B0A}: NameServer = 85.255.114.105,85.255.112.113
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.105 85.255.112.113

Hi Micah! Thanks for helping me out. Here follows some logs: Logfile of HijackThis v1.99.1 Scan saved at 19:29:26, on 2006-08-27 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program\ewido anti-spyware 4.0\guard.exe C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program\Grisoft\AVGFRE~1\avgcc.exe C:\Program\Grisoft\AVGFRE~1\avgemc.exe C:\Program\Microsoft Hardware\Mouse\point32.exe C:\Program\Java\jre1.5.0_06\bin\jusched.exe C:\Program\Winamp\winampa.exe C:\Program\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\RunDLL32.exe C:\Program\ewido anti-spyware 4.0\ewido.exe C:\WINDOWS\system32\ctfmon.exe C:\Program\MSN Messenger\msnmsgr.exe C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program\Personal\bin\Personal.exe C:\WINDOWS\system32\svchost.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [NVidia System Utility] "C:\Program\NVIDIA Corporation\NVIDIA System Utility\\NVSystemUtility.exe" clear O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\Program\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!ewido] "C:\Program\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKLM\..\Run: [soysy.exe] C:\WINDOWS\system32\soysy.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [NBJ] "C:\Program\Ahead\Nero BackItUp\NBJ.exe" O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll O14 - IERESET.INF: START_PAGE_URL=www.google.com O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program\Executive Software\Diskeeper\DkService.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program\ewido anti-spyware 4.0\guard.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Fixwareout ver 1.003 Last edited 8/11/2006 Post this report in the forums please Reg Entries that were deleted HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C8704664EB2F-684B-F414-3411-CC0FB42C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D931325B16B3-18EB-F264-5EEA-4B1A4255{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E09084C8E2C7-AC9A-4B84-34D4-1AD229F0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}32F91D668908-D48B-50F4-3DBB-409FE0D9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1E45FEB0F824-1369-B554-F1B0-65F9AD8D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0735FCC27B45-84C9-65E4-19A5-0F5AC39D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F1696318CBD2-6848-5664-8635-3E959A70{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C14F61222CD8-27AB-F214-FF7A-3EDBB93A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}657216CF1DCC-253A-7E04-D461-8A81F6A8{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A32A5E2819BB-A23A-0864-7FF5-4AA038D3{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AD547C5A00A5-75A9-7514-D7C7-6260C169{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F0849354F248-FDFA-57E4-F446-96F421B3{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}682885B2BAE5-AF6A-4274-79C9-DBE7DE67{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ABF138BFF1CF-718A-2A94-65DF-2E821CC7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}070C2B114FD0-F2D8-15D4-5F0A-125E4569{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8A397C01002C-EF88-9D64-48AC-1A0C37A1{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B7B22BFE3033-79B8-1BE4-7DF5-1F3D20FC{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7C5CFBA13E23-D4BA-37F4-1845-10541689{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C3C2C277AD00-362A-4184-6C8A-634FA29B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}95CD1F8AA6AC-BB49-6FD4-0718-F0659F7C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}119F007B33A9-0258-F324-46A6-06A600FF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9BDE8D861ADF-39B9-8DF4-8C67-B4CB0A90{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}62998F46B3BF-139B-0794-CCC5-F7E26A92{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EAB877881A93-5D5A-33D4-223B-FBFDEC47{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E8174089671E-0F98-66C4-6313-171708AF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1A0CC96824EE-0B9B-9154-429E-42BF57A5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8435A60933C3-C40A-0E94-D074-96C98AC6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D223361E096D-5D7B-89A4-3425-7909FC2E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0C2682A14D2E-04F8-55D4-9295-3B7EEE29{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6AA52FB3FEEB-877A-2C74-B9EC-449A03A5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A292E128CBB8-F459-4084-4E91-682A04D5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8878846698DA-7DCB-0DF4-5763-8794F026{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CFB5BCB2D44E-A499-1CF4-DDA7-D9A8F7BD{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3CEADF3FE315-A67B-2FF4-E78D-EE89048B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9D90B6A21421-048B-CAD4-3D71-67CE7F8C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}40E9DB23029F-8ECB-53D4-4416-9AAE60A4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EA233418AECF-57E9-97C4-65BE-AE103B25{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BA80B952052B-3F5B-8634-2F90-B3FCDF86{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A28406311212-B91B-E594-3623-5EAC1694{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5AA4E6044D12-EF3A-EAC4-C175-00699914{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}473FDE1A56CA-9C1A-F694-DA73-3F4BB0C8{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}88B2F0842DDD-A079-8214-5285-034D933D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B86E0675575C-FF3A-80B4-2BBF-DCD1C74A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5398A8D2BD59-DDE9-E624-6538-A0F690F1{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7E3C13D090A9-D259-BE24-5563-9BCA34CA{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9C8DDD3F114C-1369-3244-4B16-83C0135E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}85E09B29D2E3-327A-E6A4-2E43-A9130169{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A9425A6C010E-16D8-8E24-3C9A-71FF05E7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C16EAD66959B-7D18-F5E4-15B0-0D73925C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8E5E6397485E-85D8-E734-6291-A2B5C1C7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}79CE49F43C01-42D8-24E4-9CA8-D01D90DF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5A25B492C453-1239-68E4-C763-87F6788A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6918EC3968A9-6F48-A184-BC23-F42C9D5B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B0511D1844C9-E1FB-BC44-0775-FD137CF0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}662E29AC36CA-B359-BAB4-F3FF-7F04C014{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1F6026C3F296-1DFB-9854-A132-1FDB7473{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ACFC468C615B-5C1B-E3C4-CDE3-0C1F8E95{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}792EDE748A87-1D49-1A64-0BE5-679E8AB7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8895287B7126-5D08-4414-F980-A1F5B223{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0A6DCCB19901-0118-E344-5223-1EDF7537{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CD446CAA10F1-C23B-8294-0E0D-F4B36FA0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3C81E6E0665E-5249-7274-3707-FA0D9E78{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}381EFF93304F-679A-41C4-0C4E-AF335B89{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AADEFC1A6CB5-124B-FC04-F38C-50FF7F8B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D1F56F067089-4E49-2E74-08CA-F4FC69E9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}549E3A4D1E9B-1FEB-7784-2771-DC2427A0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}13F01727C33D-7B49-5324-31A1-FAEEADD8{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}16E78184F6E6-B329-5EC4-BCEE-0D4E5F2C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}396FE3E26691-78A8-DB04-B0EB-84145F84{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}90D12B1909E8-216B-AB94-3F84-F09938F9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}98BD585CD040-720B-8684-6DCF-5F13EAA3{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4A703D6CBC99-DC38-7B24-C628-97D0D9ED{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}09ED36CAF2B3-0EFA-AC94-A555-E83A5CAD{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AFFE82623290-B4E8-AAC4-9E7B-129857FE{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}514B420B0A1E-C409-FCC4-A7F4-F0F97290{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DF31F3B7D0F9-1AE8-AF44-9CEC-5846753B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B6FEB10E0EC5-CE38-A614-56AB-DF3C6070{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}81C5F3EDD955-3239-1D14-6FDF-7EB47779{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B7166831E811-7CDA-C4C4-BF87-5B8D6A1C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D14F95E72ABF-F238-AEB4-17C7-534B4D52{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DF1A7524B835-AB0A-C9F4-A4C8-BD2C1AF2{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6864B20B88A0-79A9-1E74-8126-2BF4104E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}30EE53B0D088-C85B-4A74-2FDD-6578E853{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3B29CA2711D3-061B-D784-16B3-6A490E01{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}ED4975285462-69F8-FC24-E5BC-B6D0A78D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}81E1C1D4508B-219B-B6E4-2E3C-E85B7191{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}30B0A055CF22-2D1B-B324-1B48-E1579909{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8048A8117548-A08A-8FB4-5C6B-7EE4F209{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}71BC4BDDEDCA-0A2B-4B94-FF8B-B2B8EA50{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C1EF3E920D22-2878-1634-82BE-A87F1FDC{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CC0B41EE84A6-065B-25E4-9B30-14A0FE07{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1468B030DD92-8B09-D4C4-27E6-3DE4536C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}581A991A6891-7408-8584-3012-B689FA8A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}23704B308773-05CA-AB04-D2E0-D94C1570{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1A3BEE2C2F5C-5A7A-CAA4-3758-10714D4F{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}85BF8A8C69DB-92BB-40D4-6E37-477E8912{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}77BA97BCDBD9-B2F8-8DA4-7AC7-711136F4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EA48C28A9E10-49FB-D624-3D50-9ECBBF1D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3CF9774F86C-BFBB-4B64-DCAA-948BF6D5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FF1E32F25A9C-7B38-FE94-AA77-39D9A1A4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}618F69B5A4FA-315A-F8D4-CC61-B480F707{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3E8B07B7D2BE-EEE8-0CF4-C1ED-3A874595{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E63CE6A6C1A1-7C08-2C34-3A9B-FD8C97CD{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9B7E510C7887-CDEB-AFA4-AD11-D2DBD394{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7EE0B94C75AC-4159-9F14-A444-B68874CF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F39BD3E11BE7-9B6B-4344-7F03-7EE10346{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A5B10470A1F5-D2AA-A4A4-5020-DA970F2C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9AF90FD0032A-EDF8-D814-EF37-78BAD354{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D9A7624525D3-E47B-0184-2413-E34661DF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}69DCCDCA4C7A-728B-0B14-F1EC-160EF101{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1A38641DC4D3-C6FA-6934-8137-C922FAD0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2C95954FB7FC-00BB-07F4-D76D-B46CD288{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5CB62D43DED5-9D9B-FB44-6E55-57EC51F5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}58C1F00D3666-CF4B-1694-52F4-4A178F36{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}00C709976A52-4CA9-CC04-AD0A-C010085D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9B028F0647D8-4209-1CC4-A84C-D87E64ED{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EF52F27AFCFE-919B-E3A4-7AA7-334BE713{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D64082F8B261-3C29-A634-1DAF-0EEC211D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CBD824F73D6F-BA3B-4964-49C7-672D0762{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9561CA383F28-EE0B-C2E4-BE82-3B01EC0C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E3F67E90E1BF-353A-1994-F47C-A8487C24{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}06C6E1018D17-339A-4F84-CB33-86BA05C2{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9CB9C3E2C74D-9AF8-5AB4-410B-029397EB{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2397E1D3BB07-738A-9944-8AB5-ADFBC746{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5DA7282D985E-A298-2A14-8DBC-161DEB1E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A843EBDC25BA-20EA-1594-94F9-DFB2E8B4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C138517B50D8-3168-7974-C963-B6F34A14{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}80C0CF8F34B5-061B-DD54-F386-3ED06534{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A1E4913B0425-32A8-B7A4-0FCE-413DA4B9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}204EA95FD6CC-641B-6564-1350-AB03C2B8{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C9E61CF1F287-3A4A-FEF4-B660-C5B89D86{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4599F770571F-2198-F354-DDDB-96B94352{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3BD525FFE1C-1929-C364-A19B-CB66FFE2{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}84DFDFAC8747-F098-1584-8FE8-1131ED0A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}462C1E135BB1-C848-FB14-37C7-166829F1{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}17BCC9F535A2-4E08-9EA4-37AD-71BD7CF2{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3BE00C18FE0D-D908-9544-CEB2-BA6458CB{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D16CAEC86D98-3EDA-3124-0A1D-AB532EE9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B6B69918BEC7-A0BA-ABE4-3D66-A538E18C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E37F8394D1CB-DA8B-94C4-EEB2-3959732E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}850BE946BA6F-E808-80B4-E8D3-AAC0032C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A2A433940C05-D828-0094-CC49-33137150{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C87D51494D84-794A-D784-6543-F5781F61{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0C3DA2749788-3DBB-3134-C0BF-96026657{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}79D1227F72BF-264B-9B54-7046-8BAEC102{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}800CFB7F89E7-5A9A-7A04-367C-D2C786AB{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F16B77FEF6C9-BA68-C904-DDE5-E011EEF4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}189183A2F500-B42B-3974-979D-588FA9BF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F3194C793353-92E8-0D64-9ACD-7213E251{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9D6ECF3911A2-A368-7D24-020C-F67FAAEE{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F964FFE94EA9-FA09-60A4-AFB7-27AE02DA{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}223034D7A1AB-11AA-34D4-DE6A-9828B635{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B20B3DA3CEAF-693A-3804-191D-884219A5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F39BF956A0FD-2948-5014-91BA-6E3F6614{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AC603E982D71-CCDA-EA84-078D-DA95B27A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A4CCAF5135C1-F35A-4D74-C371-EC364E25{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}39CAB930AFAC-446B-C5D4-4C63-5B63740B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}40ACEC874DCA-783A-B6C4-8FCB-8B56583E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}53F048C188F2-5789-4C94-90AD-E5B8391C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DD3673A0897C-1158-3074-C654-015CF310{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F52B02247579-AE78-E494-4896-F13497B9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CA35B5E8B650-501A-93C4-497B-773A13DE{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5FB728CD9C2D-7AEA-86E4-A8EC-35F3F1A0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}68AF93978860-81DA-FED4-B97E-7386F541{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7CD38A4F7B29-0438-CAD4-30AA-8CC85912{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FEFF440B2EBB-0BF9-C664-9097-98F1DF03{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}03B45B9582A1-4C5A-76C4-AF12-C0B23979{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}5C0C41373752-538B-3FE4-BB75-0382F990{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D5FE17F6F2B3-C4F8-F0E4-2E33-591A7C4C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E4E3F433599E-E4B9-F864-6C4F-96C3F14D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AA4CBC5F127F-4278-9A44-9A5B-D4F11D1A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6ED7C54368FC-B8F9-8BD4-2541-DAF36B9D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F22E4924D9F4-60E9-8E54-8FDA-4DAD10F7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}17C57882C41E-566B-7E74-8A49-2DC10113{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}424722A374C4-5309-DCA4-B182-E705B077{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}94C3A340A4B2-9ADB-7B24-E135-C1C159DE{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D6B92815C681-A9BA-52F4-23D6-7F96F2BA{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A57ED2DAC660-E55B-CCA4-6D30-7CC1BB5E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8D4FAF589512-E089-E424-1FF5-D29A3C61{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B2BC282387A3-86FA-9464-4806-62B49746{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}82416632A152-9FDB-6D24-F504-241F05EB{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7B771783D812-8CCA-27B4-3040-F2E38321{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8173C8FA5E0B-C52A-0714-2046-B9B26CA7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BB4131437E3C-D8F9-1E54-61C6-194A4960{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}C6A112815574-F46A-F874-592D-F80503AF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}283C7C70C23E-D268-7194-F2B2-031195A0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EA0A85564B93-1049-2D44-F8F3-147386F4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BBCE335DF498-02BA-EA24-AF3D-E16248DF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BCC5215BFF19-E9D9-5274-EDCE-A6499E71{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}53BD6E4620AF-AA4A-7ED4-CD8C-D802533F{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DCF25FE17B07-0C5A-DE44-CEF9-A5E2A9D4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}09A6D6498835-7739-3234-0038-1B7BACD4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EF35C0719F0E-8629-0DE4-247B-82176CD6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}24CB1AE4B76F-6229-1DB4-978A-214561AA{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D00E084C3362-A90B-7E94-CD1C-BC7A81E2{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7C980A9B6782-EBDB-9DA4-8298-77067A17{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}095B1BAA8301-FDF9-A3D4-DEAC-3A902C5A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0CAE3DE22107-A349-70C4-226C-82084155{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F38C31C352B0-8C08-D904-CE37-D7656D04{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CD4F7206BE00-E239-1244-A7EC-716E8867{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}268FD1D02702-BDB9-1FE4-39DC-D1080F0C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9D30787004A5-6D0B-5F84-7526-E888D304{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BFF666AAA2D0-F7BA-61C4-8008-97648E2D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}115FF2302C40-165A-13A4-3A68-54170A2A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}874E065408D6-22D8-2534-0560-5CD9A4CB{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2779C9922AD9-0539-FC44-25A1-D35AC2A7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}50328557B75A-72CB-7DC4-305F-456E1170{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}91812034950C-631B-AF54-BF3B-76CC2BE6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}77E4AF0814D8-BE88-9154-B6E5-D8AFC640{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}60BF2DBECA92-2B0B-F474-8A2E-440B4785{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9DD1C2126B74-F0EA-A834-92C2-26CA3032{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}91D17FE5DD51-9629-3B04-C440-76DA9891{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E6985277867A-72B9-4194-9D7A-CA03CC53{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B4D9658D4EA7-389B-3724-BA3C-4B9F201D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6BA4BBCD771A-BC89-36F4-AAA1-C56556A3{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FC5B12D85542-CA98-DB24-7773-D0A15A06{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}768779B1E9A4-943A-5494-92E2-0CA45FB0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}80F3A36C39AD-8A2B-AFF4-F878-5861C8E9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EF977CE34338-040A-EA24-C65C-820A3A8D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\xuxmd HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EE0EE01C1D52-FEBA-3FC4-7F84-25E685D6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}38D6DB355F04-9D6A-D704-08C3-A440DDE5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DBA3678475B7-6C58-B4E4-E682-694AC926{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E94D2CF95314-37FB-A6D4-44F6-DE0B11CE{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7E219E623B73-5D8B-9504-B218-ED7009FD{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1D3E121B2756-20B9-7A94-C5A3-35C8726A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}211825422E84-D2CA-5394-662D-DC3B26E6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E27DCA8FB94F-4C0B-5854-2AC2-31A049E1{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3C981EA01E45-1398-B384-E2A4-14A9FC2B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CE049C75FB6B-E75B-1364-493A-C9C22172{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7A77C71C6D9E-7DCA-1D74-CCDF-2C725ECA{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A6EC0A02836C-B819-3954-CEA2-93DEDD8E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1A539D5D423F-CF7B-2134-6673-09044F8B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}0062E0D64731-B3C8-7CF4-5246-EFD4D2BA{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BF63FA9BAEBF-633A-57F4-E3F8-F6ECDF92{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DFE4048E734F-09AB-26A4-7C4A-6DBB3ECF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B6D70A64B1E1-3C89-7C34-0CFA-D9F276A3{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BFD88D175EFF-DDBA-B554-F93D-118FF04E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A73827202270-913A-79B4-7A5E-AB3D3DCE{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}74206077B1B0-27C8-F454-A419-E4705840{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}13F48D81CAFB-257B-9B14-027E-97F1EB39{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4E5BDBAFBB6A-C4BB-9B34-0244-AEBBDD74{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}341D3DB83AFC-874B-7FC4-C193-3FF34B42{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4B8ED8B2B29F-A9FB-BE34-FAFD-12F5468C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}16BB511CD70B-7FAB-F6F4-2C68-EFF15C30{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FEAE4DE94BD2-F169-C034-3C0B-535781B5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}04A808AA4FC7-A3CB-1C54-1FE9-874CCD53{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}75E8D1389C25-3498-9EE4-0511-C7546817{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D36C29F5DF84-49C8-9084-A919-CC0BE97D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9653A1744845-B41B-D044-6D09-6FB8A8DC{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7F607A60111E-D298-BEB4-9B80-472BE45E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}94C03B590011-F348-D3F4-9910-E9A017FD{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}61972E7C75F8-F06B-E354-02E9-CC6F21C7{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B9CC89B199E1-801B-B4C4-1277-46A15DA5{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1F1E09F02C60-B0FB-D534-2D46-AA52D390{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EAE3B7E880CB-C56A-6684-2000-CBA0B1F6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D1446715E576-5FC8-38B4-74B1-BEA1DC2D{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6E9B0972EAEB-0A99-0BC4-ADE1-3AF04A92{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3E29E94DA7F6-AD9B-0754-EB5B-8AF267FC{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}63B9A4D9CAF0-CAEB-3FA4-6A20-B937B847{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4D796E295D44-4AA8-6584-17A9-B6EB6CA6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}966BC3549B8F-8E48-B7F4-4359-23CF1EA4{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}23FAE74DD42D-857A-1584-935B-2E849516{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}EC30FD053AC3-25CB-5554-4B5A-A53D8765{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}30FDDC7EE29D-5F3B-CD04-EAAD-379C6DA2{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7389E325C2B3-16EA-B5B4-FD02-61162BCD{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E03E9987F848-2AAA-C0E4-1A70-7BB59075{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}15846541194B-AE78-9F54-EBCE-50899379{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}9EF9EB95296C-7169-7AF4-1B54-B8DC47DF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}AFFD8133AC2D-F98B-3764-CA41-ED1CDC3B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}89B1D5969ABA-62E9-3FF4-43AE-D6B65212{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}311CFD3D06AC-740A-9484-4439-D886E242{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D0F1F7AA7C1B-A339-6B94-DEF5-F1C0E1EF{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}08F4075CF918-9A68-B204-3DD0-B57AE493{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}612D04020AB0-D1FA-3774-6F74-DBB82B67{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}309FA0469790-E2A9-C9F4-708D-F2E35635{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}E021395C160E-CE69-69F4-BEEF-7B1EB45B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}8182667608F6-28E8-E264-715E-AA0ABD3B{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CDAC5FD9BEA6-6748-5B64-0D4A-646C3295{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}2D946C571643-70AA-6214-1106-D4255E2E{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}B6195A9DE2FB-D5DA-2704-D3A7-35A8CDA6{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}BBACFA67F89C-989A-3314-908B-E37156D0{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}465C707CA88B-E7AB-EB04-B17E-86A60C5F{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}DB9E75681401-583A-3BB4-E11A-D5811B34{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}FE49A40AF3B6-ECE8-25E4-5C2F-E293A636{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}7AD36FEC3E2B-81B9-E114-5AE9-54E1A769{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}D3409B687FEB-89A9-FF64-AD41-DCE3C63A{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}4F47336130FC-6069-4BA4-FC32-875C1796{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}84819C434282-69E9-C8A4-1D44-B1844D83{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}3C94277B5A60-648B-00A4-511A-9A806C41{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1D395BBC15D0-CFD9-B724-101B-B1B1C0F9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}6C0AA08A11F0-1D9B-1624-45CE-0EB09738{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}1F3F5CFD014A-C5AA-CF24-03BF-A330066C{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}F1D1403B5CA3-5549-4F84-A509-5BBDD670{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}CDC78210756D-53DA-A124-4380-6B479DB9{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}062A8B74A6E6-1DF9-2044-9336-CB8C97A2{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\swen HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\ogol HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\eerht … Random Runs removed from HKLM "dmxux.exe"=- … PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»» Searching by size/names… * csr.exe C:\WINDOWS\System32\CSVDS.EXE »»»»» Search five digit cs, dm and jb files. This WILL/CAN also list Legit Files, Submit them at Virustotal C:\WINDOWS\SYSTEM32\CSVDS.EXE 51 261 2006-08-27 C:\WINDOWS\SYSTEM32\DMXUX.EXE 61 979 2004-08-04 Other suspects. Directory of C:\WINDOWS\system32 {2A79C8BC-6339-4402-9FD1-6E6A47B8A260}.exe {9BD974B6-0834-421A-AD35-D65701287CDC}.exe {076DDBB5-905A-48F4-9455-3AC5B3041D1F}.exe {C660033A-FB30-42FC-AA5C-A410DFC5F3F1}.exe {83790BE0-EC54-4261-B9D1-0F11A80AA0C6}.exe {9F0C1B1B-B101-427B-9DFC-0D51CBB593D1}.exe {14C608A9-A115-4A00-B846-06A5B77249C3}.exe {38D4481B-44D1-4A8C-9E96-282434C91848}.exe {6971C578-23CF-4AB4-9606-CF03163374F4}.exe {A36C3ECD-14DA-46FF-9A98-BEF786B9043D}.exe {967A1E45-9EA5-411E-9B18-B2E3CEF63DA7}.exe {636A392E-F2C5-4E52-8ECE-6B3FA04A94EF}.exe {43B1185D-A11E-4BB3-A385-10418657E9BD}.exe {F5C06A68-E71B-40BE-BA7E-B88AC707C564}.exe {0D65173E-B809-4133-A989-C98F76AFCABB}.exe {6ADC8A53-7A3D-4072-AD5D-BF2ED9A5916B}.exe {53653E2F-D807-4F9C-9A2E-0979640AF903}.exe {76B28BBD-47F6-4773-AF1D-0BA02040D216}.exe {394EA75B-0DD3-402B-86A9-819FC5704F80}.exe {242E688D-9344-4849-A047-CA60D3DFC113}.exe {21256B6D-EA34-4FF3-9E26-ABA9695D1B98}.exe {B3CDC1DE-14AC-4673-B89F-D2CA3318DFFA}.exe {FD74CD8B-45B1-4FA7-9617-C69259BE9FE9}.exe {97399805-ECBE-45F9-87EA-B49114564851}.exe {57095BB7-07A1-4E0C-AAA2-848F7899E30E}.exe {DCB26116-20DF-4B5B-AE61-3B2C523E9837}.exe {2AD6C973-DAAE-40DC-B3F5-D92EE7CDDF03}.exe {5678D35A-A5B4-4555-BC52-3CA350DF03CE}.exe {6AC6BE6B-9A71-4856-8AA4-44D592E697D4}.exe {093D25AA-64D2-435D-BF0B-06C20F90E1F1}.exe {35DCC478-9EF1-45C1-BC3A-7CF4AA808A40}.exe {5B187535-B0C3-430C-961F-2DB49ED4EAEF}.exe {0485074E-914A-454F-8C72-0B1B77060247}.exe {ECD3D3BA-E5A7-4B97-A319-07220272837A}.exe {E40FF811-D39F-455B-ABDD-FFE571D88DFB}.exe {3A672F9D-AFC0-43C7-98C3-1E1B46A07D6B}.exe {FCE3BBD6-A4C7-4A62-BA90-F437E8404EFD}.exe {29FDCE6F-8F3E-4F75-A336-FBEAB9AF36FB}.exe {27122C9C-A394-4631-B57E-B6BF57C940EC}.exe {EC11B0ED-6F44-4D6A-BF73-41359FC2D49E}.exe {629CA496-286E-4E4B-85C6-7B5748763ABD}.exe {5EDD044A-3C80-407D-A6D9-40F553BD6D83}.exe {1989AD67-044C-40B3-9269-15DD5EF71D19}.exe {2303AC62-2C29-438A-AE0F-47B6212C1DD9}.exe {046CFA8D-5E6B-4519-88EB-8D4180FA4E77}.exe {0711E654-F503-4CD7-BC27-A57B75582305}.exe {7A2CA53D-1A52-44CF-9350-9DA2299C9772}.exe {BC4A9DC5-0650-4352-8D22-6D804560E478}.exe {A2A07145-86A3-4A31-A561-04C2032FF511}.exe {D2E84679-8008-4C16-AB7F-0D2AAA666FFB}.exe {403D888E-6257-48F5-B0D6-5A40078703D9}.exe {C0F0801D-CD93-4EF1-9BDB-20720D1DF862}.exe {7688E617-CE7A-4421-932E-00EB6027F4DC}.exe {A5C209A3-CAED-4D3A-9FDF-1038AAB1B590}.exe {71A76077-8928-4AD9-BDBE-2876B9A089C7}.exe {4DCAB7B1-8300-4323-9377-5388946D6A90}.exe {17E9946A-ECDE-4725-9D9E-91FFB5125CCB}.exe {0A591130-2B2F-4917-862D-E32C07C7C382}.exe {FA30508F-D295-478F-A64F-475518211A6C}.exe {7AC62B9B-6402-4170-A25C-B0E5AF8C3718}.exe {12383E2F-0403-4B72-ACC8-218D387177B7}.exe {BE50F142-405F-42D6-BDF9-251A23661428}.exe {64794B26-6084-4649-AF68-3A783282CB2B}.exe {16C3A92D-5FF1-424E-980E-215985FAF4D8}.exe {E5BB1CC7-03D6-4ACC-B55E-066CAD2DE75A}.exe {770B507E-281B-4ACD-9035-4C473A227424}.exe {A1D11F4D-B5A9-44A9-8724-F721F5CBC4AA}.exe {D41F3C69-F4C6-468F-9B4E-E995334F3E4E}.exe {C4C7A195-33E2-4E0F-8F4C-3B2F6F71EF5D}.exe {099F2830-57BB-4EF3-B835-25737314C0C5}.exe {97932B0C-21FA-4C67-A5C4-1A2859B54B30}.exe {30FD1F89-7909-466C-9FB0-BBE2B044FFEF}.exe {21958CC8-AA03-4DAC-8340-92B7F4A83DC7}.exe {145F6837-E79B-4DEF-AD18-06887939FA86}.exe {0A1F3F53-CE8A-4E68-AEA7-D2C9DC827BF5}.exe {ED31A377-B794-4C39-A105-056B8E5B53AC}.exe {013FC510-456C-4703-8511-C7980A3763DD}.exe {C1938B5E-DA09-49C4-9875-2F881C840F35}.exe {E38565B8-BCF8-4C6B-A387-ACD478CECA04}.exe {52E463CE-173C-47D4-A53F-1C5315FACC4A}.exe {A72B59AD-D870-48AE-ADCC-17D289E306CA}.exe {4166F3E6-AB19-4105-8492-DF0A659FB93F}.exe {536B8289-A6ED-4D43-AA11-BA1A7D430322}.exe {AD20EA72-7BFA-4A06-90AF-9AE49EFF469F}.exe {EEAAF76F-C020-42D7-863A-2A1193FCE6D9}.exe {152E3127-DCA9-46D0-8E29-353397C4913F}.exe {FB9AF885-D979-4793-B24B-005F2A381981}.exe {4FEE110E-5EDD-409C-86AB-9C6FEF77B61F}.exe {BA687C2D-C763-40A7-A9A5-7E98F7BFC008}.exe {201CEAB8-6407-45B9-B462-FB27F7221D97}.exe {75662069-FB0C-4313-BBD3-8879472AD3C0}.exe {16F1875F-3456-487D-A497-48D49415D78C}.exe {05173133-94CC-4900-828D-50C049334A2A}.exe {C2300CAA-3D8E-4B08-808E-F6AB649EB058}.exe {E2379593-2BEE-4C49-B8AD-BC1D4938F73E}.exe {C81E835A-66D3-4EBA-AB0A-7CEB81996B6B}.exe {9EE235BA-D1A0-4213-ADE3-89D68CEAC61D}.exe {2FC7DB17-DA73-4AE9-80E4-2A535F9CCB71}.exe {1F928661-7C73-41BF-848C-1BB531E1C264}.exe {A0DE1311-8EF8-4851-890F-7478CAFDFD48}.exe {2EFF66BC-B91A-463C-9291-C1EFF525DB3D}.exe {25349B69-BDDD-453F-8912-F175077F9954}.exe {68D98B5C-066B-4FEF-A4A3-782F1FC16E9C}.exe {8B2C30BA-0531-4656-B146-CC6DF59AE402}.exe {43560DE3-683F-45DD-B160-5B43F8FC0C08}.exe {41A43F6B-369C-4797-8613-8D05B715831C}.exe {4B8E2BFD-9F49-4951-AE02-AB52CDBE348A}.exe {E1BED161-CBD8-41A2-892A-E589D2827AD5}.exe {647CBFDA-5BA8-4499-A837-70BB3D1E7932}.exe {BE793920-B014-4BA5-8FA9-D47C2E3C9BC9}.exe {2C50AB68-33BC-48F4-A933-71D8101E6C60}.exe {42C7848A-C74F-4991-A353-FB1E09E76F3E}.exe {C0CE10B3-28EB-4E2C-B0EE-82F383AC1659}.exe {2670D276-7C94-4694-B3AB-F6D37F428DBC}.exe {D112CEE0-FAD1-436A-92C3-162B8F28046D}.exe {317EB433-7AA7-4A3E-B919-EFCFA72F25FE}.exe {DE46E78D-C48A-4CC1-9024-8D7460F820B9}.exe {D580010C-A0DA-40CC-9AC4-25A679907C00}.exe {63F871A4-4F25-4961-B4FC-6663D00F1C85}.exe {5F15CE75-55E6-44BF-B9D9-5DED34D26BC5}.exe {882DC64B-D67D-4F70-BB00-CF7BF45959C2}.exe {0DAF229C-7318-4396-AF6C-3D4CD14683A1}.exe {101FE061-CE1F-41B0-B827-A7C4ACDCCD96}.exe {FD16643E-3142-4810-B74E-3D5254267A9D}.exe {453DAB87-73FE-418D-8FDE-A2300DF09FA9}.exe {C2F079AD-0205-4A4A-AA2D-5F1A07401B5A}.exe {64301EE7-30F7-4434-B6B9-7EB11E3DB93F}.exe {FC47886B-444A-41F9-9514-CA57C49B0EE7}.exe {493DBD2D-11DA-4AFA-BEDC-7887C015E7B9}.exe {DC79C8DF-B9A3-43C2-80C7-1A1C6A6EC36E}.exe {595478A3-DE1C-4FC0-8EEE-EB2D7B70B8E3}.exe {707F084B-16CC-4D8F-A513-AF4A5B96F816}.exe {4A1A9D93-77AA-49EF-83B7-C9A52F23E1FF}.exe {5D6FB849-AACD-46B4-BBFB-C68F4779FC3D}.exe {D1FBBCE9-05D3-426D-BF94-01E9A82C84AE}.exe {4F631117-7CA7-4AD8-8F2B-9DBDCB79AB77}.exe {2198E774-73E6-4D04-BB29-BD96C8A8FB58}.exe {F4D41701-8573-4AAC-A7A5-C5F2C2EEB3A1}.exe {0751C49D-0E2D-40BA-AC50-377803B40732}.exe {A8AF986B-2103-4858-8047-1986A199A185}.exe {C6354ED3-6E72-4C4D-90B8-29DD030B8641}.exe {70EF0A41-03B9-4E52-B560-6A48EE14B0CC}.exe {CDF1F78A-EB28-4361-8782-22D029E3FE1C}.exe {05AE8B2B-B8FF-49B4-B2A0-ACDEDDB4CB17}.exe {902F4EE7-B6C5-4BF8-A80A-8457118A8408}.exe {9099751E-84B1-423B-B1D2-22FC550A0B03}.exe {1917B58E-C3E2-4E6B-B912-B8054D1C1E18}.exe {D87A0D6B-CB5E-42CF-8F96-2645825794DE}.exe {10E094A6-3B61-487D-B160-3D1172AC92B3}.exe {358E8756-DDF2-47A4-B58C-880D0B35EE03}.exe {E4014FB2-6218-47E1-9A97-0A88B02B4686}.exe {2FA1C2DB-8C4A-4F9C-A0BA-538B4257A1FD}.exe {25D4B435-7C71-4BEA-832F-FBA27E59F41D}.exe {C1A6D8B5-78FB-4C4C-ADC7-118E1386617B}.exe {97774BE7-FDF6-41D1-9323-559DDE3F5C18}.exe {0706C3FD-BA65-416A-83EC-5CE0E01BEF6B}.exe {B3576485-CEC9-44FA-8EA1-9F0D7B3F13FD}.exe {09279F0F-4F7A-4CCF-904C-E1A0B024B415}.exe {EF758921-B7E9-4CAA-8E4B-09232628EFFA}.exe {DAC5A38E-555A-49CA-AFE0-3B2FAC63DE90}.exe {DE9D0D79-826C-42B7-83CD-99CBC6D307A4}.exe {3AAE31F5-FCD6-4868-B027-040DC585DB89}.exe {9F83990F-48F3-49BA-B612-8E9091B21D09}.exe {48F54148-BE0B-40BD-8A87-19662E3EF693}.exe {C2F5E4D0-EECB-4CE5-923B-6E6F48187E61}.exe {0A7242CD-1772-4877-BEF1-B9E1D4A3E945}.exe {9E96CF4F-AC80-47E2-94E4-980760F65F1D}.exe {B8F7FF05-C83F-40CF-B421-5BC6A1CFEDAA}.exe {98B533FA-E4C0-4C14-A976-F40339FFE183}.exe {87E9D0AF-7073-4727-9425-E5660E6E18C3}.exe {0AF63B4F-D0E0-4928-B32C-1F01AAC644DC}.exe {7357FDE1-3225-443E-8110-10991BCCD6A0}.exe {322B5F1A-089F-4144-80D5-6217B7825988}.exe {7BA8E976-5EB0-46A1-94D1-78A847EDE297}.exe {59E8F1C0-3EDC-4C3E-B1C5-B516C864CFCA}.exe {3747BDF1-231A-4589-BFD1-692F3C6206F1}.exe {410C40F7-FF3F-4BAB-953B-AC63CA92E266}.exe {0FC731DF-5770-44CB-BF1E-9C4481D1150B}.exe {B5D9C24F-32CB-481A-84F6-9A8693CE8196}.exe {A8876F78-367C-4E86-9321-354C294B52A5}.exe {FD09D10D-8AC9-4E42-8D24-10C34F94EC97}.exe {7C1C5B2A-1926-437E-8D58-E5847936E5E8}.exe {C52937D0-0B51-4E5F-81D7-B95966DAE61C}.exe {7E50FF17-A9C3-42E8-8D61-E010C6A5249A}.exe {9610319A-34E2-4A6E-A723-3E2D92B90E58}.exe {E5310C38-61B4-4423-9631-C411F3DDD8C9}.exe {AC43ACB9-3655-42EB-952D-9A090D31C3E7}.exe {1F096F0A-8356-426E-9EDD-95DB2D8A8935}.exe {A47C1DCD-FBB2-4B08-A3FF-C5755760E68B}.exe {D339D430-5825-4128-970A-DDD2480F2B88}.exe {8C0BB4F3-37AD-496F-A1C9-AC65A1EDF374}.exe {41999600-571C-4CAE-A3FE-21D4406E4AA5}.exe {4961CAE5-3263-495E-B19B-21211360482A}.exe {68FDCF3B-09F2-4368-B5F3-B250259B08AB}.exe {52B301EA-EB56-4C79-9E75-FCEA814332AE}.exe {4A06EAA9-6144-4D35-BCE8-F92032BD9E04}.exe {C8F7EC76-17D3-4DAC-B840-12412A6B09D9}.exe {B84098EE-D87E-4FF2-B76A-513EF3FDAEC3}.exe {DB7F8A9D-7ADD-4FC1-994A-E44D2BCB5BFC}.exe {620F4978-3675-4FD0-BCD7-AD8966488788}.exe {5D40A286-19E4-4804-954F-8BBC821E292A}.exe {5A30A944-CE9B-47C2-A778-BEEF3BF25AA6}.exe {92EEE7B3-5929-4D55-8F40-E2D41A2862C0}.exe {E2CF9097-5243-4A98-B7D5-D690E163322D}.exe {6CA89C69-470D-49E0-A04C-3C33906A5348}.exe {5A75FB24-E924-4519-B9B0-EE42869CC0A1}.exe {FA807171-3136-4C66-89F0-E1769804718E}.exe {74CEDFBF-B322-4D33-A5D5-39A188778BAE}.exe {29A62E7F-5CCC-4970-B931-FB3B64F89926}.exe {09A0BC4B-76C8-4FD8-9B93-FDA168D8EDB9}.exe {FF006A60-6A64-423F-8520-9A33B700F911}.exe {C7F9560F-8170-4DF6-94BB-CA6AA8F1DC59}.exe {B92AF436-A8C6-4814-A263-00DA772C2C3C}.exe {98614501-5481-4F73-AB4D-32E31ABFC5C7}.exe {CF02D3F1-5FD7-4EB1-8B97-3303EFB22B7B}.exe {1A73C0A1-CA84-46D9-88FE-C20010C793A8}.exe {9654E521-A0F5-4D51-8D2F-0DF411B2C070}.exe {7CC128E2-FD56-49A2-A817-FC1FFB831FBA}.exe {76ED7EBD-9C97-4724-A6FA-5EAB2B588286}.exe {3B124F69-644F-4E75-AFDF-842F4539480F}.exe {961C0626-7C7D-4157-9A57-5A00A5C745DA}.exe {3D830AA4-5FF7-4680-A32A-BB9182E5A23A}.exe {8A6F18A8-164D-40E7-A352-CCD1FC612756}.exe {A39BBDE3-A7FF-412F-BA72-8DC22216F41C}.exe {07A959E3-5368-4665-8486-2DBC8136961F}.exe {D93CA5F0-5A91-4E56-9C48-54B72CCF5370}.exe {D8DA9F56-0B1F-455B-9631-428F0BEF54E1}.exe {9D0EF904-BBD3-4F05-B84D-809866D19F23}.exe {0F922DA1-4D43-48B4-A9CA-7C2E8C48090E}.exe {5524A1B4-AEE5-462F-BE81-3B61B523139D}.exe »»»»» Misc files. »»»»» Checking for older varients covered by the Rem3 tool.

Copy the text in the following quote box into Notepad:

attrib -r -s -h C:\WINDOWS\SYSTEM32\CSVDS.EXE
attrib -r -s -h C:\WINDOWS\SYSTEM32\DMXUX.EXE
attrib -r -s -h C:\WINDOWS\system32\soysy.exe
attrib -r -s -h C:\WINDOWS\system32\{2A79C8BC-6339-4402-9FD1-6E6A47B8A260}.exe
attrib -r -s -h C:\WINDOWS\system32\{9BD974B6-0834-421A-AD35-D65701287CDC}.exe
attrib -r -s -h C:\WINDOWS\system32\{076DDBB5-905A-48F4-9455-3AC5B3041D1F}.exe
attrib -r -s -h C:\WINDOWS\system32\{C660033A-FB30-42FC-AA5C-A410DFC5F3F1}.exe
attrib -r -s -h C:\WINDOWS\system32\{83790BE0-EC54-4261-B9D1-0F11A80AA0C6}.exe
attrib -r -s -h C:\WINDOWS\system32\{9F0C1B1B-B101-427B-9DFC-0D51CBB593D1}.exe
attrib -r -s -h C:\WINDOWS\system32\{14C608A9-A115-4A00-B846-06A5B77249C3}.exe
attrib -r -s -h C:\WINDOWS\system32\{38D4481B-44D1-4A8C-9E96-282434C91848}.exe
attrib -r -s -h C:\WINDOWS\system32\{6971C578-23CF-4AB4-9606-CF03163374F4}.exe
attrib -r -s -h C:\WINDOWS\system32\{A36C3ECD-14DA-46FF-9A98-BEF786B9043D}.exe
attrib -r -s -h C:\WINDOWS\system32\{967A1E45-9EA5-411E-9B18-B2E3CEF63DA7}.exe
attrib -r -s -h C:\WINDOWS\system32\{636A392E-F2C5-4E52-8ECE-6B3FA04A94EF}.exe
attrib -r -s -h C:\WINDOWS\system32\{43B1185D-A11E-4BB3-A385-10418657E9BD}.exe
attrib -r -s -h C:\WINDOWS\system32\{F5C06A68-E71B-40BE-BA7E-B88AC707C564}.exe
attrib -r -s -h C:\WINDOWS\system32\{0D65173E-B809-4133-A989-C98F76AFCABB}.exe
attrib -r -s -h C:\WINDOWS\system32\{6ADC8A53-7A3D-4072-AD5D-BF2ED9A5916B}.exe
attrib -r -s -h C:\WINDOWS\system32\{53653E2F-D807-4F9C-9A2E-0979640AF903}.exe
attrib -r -s -h C:\WINDOWS\system32\{76B28BBD-47F6-4773-AF1D-0BA02040D216}.exe
attrib -r -s -h C:\WINDOWS\system32\{394EA75B-0DD3-402B-86A9-819FC5704F80}.exe
attrib -r -s -h C:\WINDOWS\system32\{242E688D-9344-4849-A047-CA60D3DFC113}.exe
attrib -r -s -h C:\WINDOWS\system32\{21256B6D-EA34-4FF3-9E26-ABA9695D1B98}.exe
attrib -r -s -h C:\WINDOWS\system32\{B3CDC1DE-14AC-4673-B89F-D2CA3318DFFA}.exe
attrib -r -s -h C:\WINDOWS\system32\{FD74CD8B-45B1-4FA7-9617-C69259BE9FE9}.exe
attrib -r -s -h C:\WINDOWS\system32\{97399805-ECBE-45F9-87EA-B49114564851}.exe
attrib -r -s -h C:\WINDOWS\system32\{57095BB7-07A1-4E0C-AAA2-848F7899E30E}.exe
attrib -r -s -h C:\WINDOWS\system32\{DCB26116-20DF-4B5B-AE61-3B2C523E9837}.exe
attrib -r -s -h C:\WINDOWS\system32\{2AD6C973-DAAE-40DC-B3F5-D92EE7CDDF03}.exe
attrib -r -s -h C:\WINDOWS\system32\{5678D35A-A5B4-4555-BC52-3CA350DF03CE}.exe
attrib -r -s -h C:\WINDOWS\system32\{6AC6BE6B-9A71-4856-8AA4-44D592E697D4}.exe
attrib -r -s -h C:\WINDOWS\system32\{093D25AA-64D2-435D-BF0B-06C20F90E1F1}.exe
attrib -r -s -h C:\WINDOWS\system32\{35DCC478-9EF1-45C1-BC3A-7CF4AA808A40}.exe
attrib -r -s -h C:\WINDOWS\system32\{5B187535-B0C3-430C-961F-2DB49ED4EAEF}.exe
attrib -r -s -h C:\WINDOWS\system32\{0485074E-914A-454F-8C72-0B1B77060247}.exe
attrib -r -s -h C:\WINDOWS\system32\{ECD3D3BA-E5A7-4B97-A319-07220272837A}.exe
attrib -r -s -h C:\WINDOWS\system32\{E40FF811-D39F-455B-ABDD-FFE571D88DFB}.exe
attrib -r -s -h C:\WINDOWS\system32\{3A672F9D-AFC0-43C7-98C3-1E1B46A07D6B}.exe
attrib -r -s -h C:\WINDOWS\system32\{FCE3BBD6-A4C7-4A62-BA90-F437E8404EFD}.exe
attrib -r -s -h C:\WINDOWS\system32\{29FDCE6F-8F3E-4F75-A336-FBEAB9AF36FB}.exe
attrib -r -s -h C:\WINDOWS\system32\{27122C9C-A394-4631-B57E-B6BF57C940EC}.exe
attrib -r -s -h C:\WINDOWS\system32\{EC11B0ED-6F44-4D6A-BF73-41359FC2D49E}.exe
attrib -r -s -h C:\WINDOWS\system32\{629CA496-286E-4E4B-85C6-7B5748763ABD}.exe
attrib -r -s -h C:\WINDOWS\system32\{5EDD044A-3C80-407D-A6D9-40F553BD6D83}.exe
attrib -r -s -h C:\WINDOWS\system32\{1989AD67-044C-40B3-9269-15DD5EF71D19}.exe
attrib -r -s -h C:\WINDOWS\system32\{2303AC62-2C29-438A-AE0F-47B6212C1DD9}.exe
attrib -r -s -h C:\WINDOWS\system32\{046CFA8D-5E6B-4519-88EB-8D4180FA4E77}.exe
attrib -r -s -h C:\WINDOWS\system32\{0711E654-F503-4CD7-BC27-A57B75582305}.exe
attrib -r -s -h C:\WINDOWS\system32\{7A2CA53D-1A52-44CF-9350-9DA2299C9772}.exe
attrib -r -s -h C:\WINDOWS\system32\{BC4A9DC5-0650-4352-8D22-6D804560E478}.exe
attrib -r -s -h C:\WINDOWS\system32\{A2A07145-86A3-4A31-A561-04C2032FF511}.exe
attrib -r -s -h C:\WINDOWS\system32\{D2E84679-8008-4C16-AB7F-0D2AAA666FFB}.exe
attrib -r -s -h C:\WINDOWS\system32\{403D888E-6257-48F5-B0D6-5A40078703D9}.exe
attrib -r -s -h C:\WINDOWS\system32\{C0F0801D-CD93-4EF1-9BDB-20720D1DF862}.exe
attrib -r -s -h C:\WINDOWS\system32\{7688E617-CE7A-4421-932E-00EB6027F4DC}.exe
attrib -r -s -h C:\WINDOWS\system32\{A5C209A3-CAED-4D3A-9FDF-1038AAB1B590}.exe
attrib -r -s -h C:\WINDOWS\system32\{71A76077-8928-4AD9-BDBE-2876B9A089C7}.exe
attrib -r -s -h C:\WINDOWS\system32\{4DCAB7B1-8300-4323-9377-5388946D6A90}.exe
attrib -r -s -h C:\WINDOWS\system32\{17E9946A-ECDE-4725-9D9E-91FFB5125CCB}.exe
attrib -r -s -h C:\WINDOWS\system32\{0A591130-2B2F-4917-862D-E32C07C7C382}.exe
attrib -r -s -h C:\WINDOWS\system32\{FA30508F-D295-478F-A64F-475518211A6C}.exe
attrib -r -s -h C:\WINDOWS\system32\{7AC62B9B-6402-4170-A25C-B0E5AF8C3718}.exe
attrib -r -s -h C:\WINDOWS\system32\{12383E2F-0403-4B72-ACC8-218D387177B7}.exe
attrib -r -s -h C:\WINDOWS\system32\{BE50F142-405F-42D6-BDF9-251A23661428}.exe
attrib -r -s -h C:\WINDOWS\system32\{64794B26-6084-4649-AF68-3A783282CB2B}.exe
attrib -r -s -h C:\WINDOWS\system32\{16C3A92D-5FF1-424E-980E-215985FAF4D8}.exe
attrib -r -s -h C:\WINDOWS\system32\{E5BB1CC7-03D6-4ACC-B55E-066CAD2DE75A}.exe
attrib -r -s -h C:\WINDOWS\system32\{770B507E-281B-4ACD-9035-4C473A227424}.exe
attrib -r -s -h C:\WINDOWS\system32\{A1D11F4D-B5A9-44A9-8724-F721F5CBC4AA}.exe
attrib -r -s -h C:\WINDOWS\system32\{D41F3C69-F4C6-468F-9B4E-E995334F3E4E}.exe
attrib -r -s -h C:\WINDOWS\system32\{C4C7A195-33E2-4E0F-8F4C-3B2F6F71EF5D}.exe
attrib -r -s -h C:\WINDOWS\system32\{099F2830-57BB-4EF3-B835-25737314C0C5}.exe
attrib -r -s -h C:\WINDOWS\system32\{97932B0C-21FA-4C67-A5C4-1A2859B54B30}.exe
attrib -r -s -h C:\WINDOWS\system32\{30FD1F89-7909-466C-9FB0-BBE2B044FFEF}.exe
attrib -r -s -h C:\WINDOWS\system32\{21958CC8-AA03-4DAC-8340-92B7F4A83DC7}.exe
attrib -r -s -h C:\WINDOWS\system32\{145F6837-E79B-4DEF-AD18-06887939FA86}.exe
attrib -r -s -h C:\WINDOWS\system32\{0A1F3F53-CE8A-4E68-AEA7-D2C9DC827BF5}.exe
attrib -r -s -h C:\WINDOWS\system32\{ED31A377-B794-4C39-A105-056B8E5B53AC}.exe
attrib -r -s -h C:\WINDOWS\system32\{013FC510-456C-4703-8511-C7980A3763DD}.exe
attrib -r -s -h C:\WINDOWS\system32\{C1938B5E-DA09-49C4-9875-2F881C840F35}.exe
attrib -r -s -h C:\WINDOWS\system32\{E38565B8-BCF8-4C6B-A387-ACD478CECA04}.exe
attrib -r -s -h C:\WINDOWS\system32\{52E463CE-173C-47D4-A53F-1C5315FACC4A}.exe
attrib -r -s -h C:\WINDOWS\system32\{A72B59AD-D870-48AE-ADCC-17D289E306CA}.exe
attrib -r -s -h C:\WINDOWS\system32\{4166F3E6-AB19-4105-8492-DF0A659FB93F}.exe
attrib -r -s -h C:\WINDOWS\system32\{536B8289-A6ED-4D43-AA11-BA1A7D430322}.exe
attrib -r -s -h C:\WINDOWS\system32\{AD20EA72-7BFA-4A06-90AF-9AE49EFF469F}.exe
attrib -r -s -h C:\WINDOWS\system32\{EEAAF76F-C020-42D7-863A-2A1193FCE6D9}.exe
attrib -r -s -h C:\WINDOWS\system32\{152E3127-DCA9-46D0-8E29-353397C4913F}.exe
attrib -r -s -h C:\WINDOWS\system32\{FB9AF885-D979-4793-B24B-005F2A381981}.exe
attrib -r -s -h C:\WINDOWS\system32\{4FEE110E-5EDD-409C-86AB-9C6FEF77B61F}.exe
attrib -r -s -h C:\WINDOWS\system32\{BA687C2D-C763-40A7-A9A5-7E98F7BFC008}.exe
attrib -r -s -h C:\WINDOWS\system32\{201CEAB8-6407-45B9-B462-FB27F7221D97}.exe
attrib -r -s -h C:\WINDOWS\system32\{75662069-FB0C-4313-BBD3-8879472AD3C0}.exe
attrib -r -s -h C:\WINDOWS\system32\{16F1875F-3456-487D-A497-48D49415D78C}.exe
attrib -r -s -h C:\WINDOWS\system32\{05173133-94CC-4900-828D-50C049334A2A}.exe
attrib -r -s -h C:\WINDOWS\system32\{C2300CAA-3D8E-4B08-808E-F6AB649EB058}.exe
attrib -r -s -h C:\WINDOWS\system32\{E2379593-2BEE-4C49-B8AD-BC1D4938F73E}.exe
attrib -r -s -h C:\WINDOWS\system32\{C81E835A-66D3-4EBA-AB0A-7CEB81996B6B}.exe
attrib -r -s -h C:\WINDOWS\system32\{9EE235BA-D1A0-4213-ADE3-89D68CEAC61D}.exe
attrib -r -s -h C:\WINDOWS\system32\{2FC7DB17-DA73-4AE9-80E4-2A535F9CCB71}.exe
attrib -r -s -h C:\WINDOWS\system32\{1F928661-7C73-41BF-848C-1BB531E1C264}.exe
attrib -r -s -h C:\WINDOWS\system32\{A0DE1311-8EF8-4851-890F-7478CAFDFD48}.exe
attrib -r -s -h C:\WINDOWS\system32\{2EFF66BC-B91A-463C-9291-C1EFF525DB3D}.exe
attrib -r -s -h C:\WINDOWS\system32\{25349B69-BDDD-453F-8912-F175077F9954}.exe
attrib -r -s -h C:\WINDOWS\system32\{68D98B5C-066B-4FEF-A4A3-782F1FC16E9C}.exe
attrib -r -s -h C:\WINDOWS\system32\{8B2C30BA-0531-4656-B146-CC6DF59AE402}.exe
attrib -r -s -h C:\WINDOWS\system32\{43560DE3-683F-45DD-B160-5B43F8FC0C08}.exe
attrib -r -s -h C:\WINDOWS\system32\{41A43F6B-369C-4797-8613-8D05B715831C}.exe
attrib -r -s -h C:\WINDOWS\system32\{4B8E2BFD-9F49-4951-AE02-AB52CDBE348A}.exe
attrib -r -s -h C:\WINDOWS\system32\{E1BED161-CBD8-41A2-892A-E589D2827AD5}.exe
attrib -r -s -h C:\WINDOWS\system32\{647CBFDA-5BA8-4499-A837-70BB3D1E7932}.exe
attrib -r -s -h C:\WINDOWS\system32\{BE793920-B014-4BA5-8FA9-D47C2E3C9BC9}.exe
attrib -r -s -h C:\WINDOWS\system32\{2C50AB68-33BC-48F4-A933-71D8101E6C60}.exe
attrib -r -s -h C:\WINDOWS\system32\{42C7848A-C74F-4991-A353-FB1E09E76F3E}.exe
attrib -r -s -h C:\WINDOWS\system32\{C0CE10B3-28EB-4E2C-B0EE-82F383AC1659}.exe
attrib -r -s -h C:\WINDOWS\system32\{2670D276-7C94-4694-B3AB-F6D37F428DBC}.exe
attrib -r -s -h C:\WINDOWS\system32\{D112CEE0-FAD1-436A-92C3-162B8F28046D}.exe
attrib -r -s -h C:\WINDOWS\system32\{317EB433-7AA7-4A3E-B919-EFCFA72F25FE}.exe
attrib -r -s -h C:\WINDOWS\system32\{DE46E78D-C48A-4CC1-9024-8D7460F820B9}.exe
attrib -r -s -h C:\WINDOWS\system32\{D580010C-A0DA-40CC-9AC4-25A679907C00}.exe
attrib -r -s -h C:\WINDOWS\system32\{63F871A4-4F25-4961-B4FC-6663D00F1C85}.exe
attrib -r -s -h C:\WINDOWS\system32\{5F15CE75-55E6-44BF-B9D9-5DED34D26BC5}.exe
attrib -r -s -h C:\WINDOWS\system32\{882DC64B-D67D-4F70-BB00-CF7BF45959C2}.exe
attrib -r -s -h C:\WINDOWS\system32\{0DAF229C-7318-4396-AF6C-3D4CD14683A1}.exe
attrib -r -s -h C:\WINDOWS\system32\{101FE061-CE1F-41B0-B827-A7C4ACDCCD96}.exe
attrib -r -s -h C:\WINDOWS\system32\{FD16643E-3142-4810-B74E-3D5254267A9D}.exe
attrib -r -s -h C:\WINDOWS\system32\{453DAB87-73FE-418D-8FDE-A2300DF09FA9}.exe
attrib -r -s -h C:\WINDOWS\system32\{C2F079AD-0205-4A4A-AA2D-5F1A07401B5A}.exe
attrib -r -s -h C:\WINDOWS\system32\{64301EE7-30F7-4434-B6B9-7EB11E3DB93F}.exe
attrib -r -s -h C:\WINDOWS\system32\{FC47886B-444A-41F9-9514-CA57C49B0EE7}.exe
attrib -r -s -h C:\WINDOWS\system32\{493DBD2D-11DA-4AFA-BEDC-7887C015E7B9}.exe
attrib -r -s -h C:\WINDOWS\system32\{DC79C8DF-B9A3-43C2-80C7-1A1C6A6EC36E}.exe
attrib -r -s -h C:\WINDOWS\system32\{595478A3-DE1C-4FC0-8EEE-EB2D7B70B8E3}.exe
attrib -r -s -h C:\WINDOWS\system32\{707F084B-16CC-4D8F-A513-AF4A5B96F816}.exe
attrib -r -s -h C:\WINDOWS\system32\{4A1A9D93-77AA-49EF-83B7-C9A52F23E1FF}.exe
attrib -r -s -h C:\WINDOWS\system32\{5D6FB849-AACD-46B4-BBFB-C68F4779FC3D}.exe
attrib -r -s -h C:\WINDOWS\system32\{D1FBBCE9-05D3-426D-BF94-01E9A82C84AE}.exe
attrib -r -s -h C:\WINDOWS\system32\{4F631117-7CA7-4AD8-8F2B-9DBDCB79AB77}.exe
attrib -r -s -h C:\WINDOWS\system32\{2198E774-73E6-4D04-BB29-BD96C8A8FB58}.exe
attrib -r -s -h C:\WINDOWS\system32\{F4D41701-8573-4AAC-A7A5-C5F2C2EEB3A1}.exe
attrib -r -s -h C:\WINDOWS\system32\{0751C49D-0E2D-40BA-AC50-377803B40732}.exe
attrib -r -s -h C:\WINDOWS\system32\{A8AF986B-2103-4858-8047-1986A199A185}.exe
attrib -r -s -h C:\WINDOWS\system32\{C6354ED3-6E72-4C4D-90B8-29DD030B8641}.exe
attrib -r -s -h C:\WINDOWS\system32\{70EF0A41-03B9-4E52-B560-6A48EE14B0CC}.exe
attrib -r -s -h C:\WINDOWS\system32\{CDF1F78A-EB28-4361-8782-22D029E3FE1C}.exe
attrib -r -s -h C:\WINDOWS\system32\{05AE8B2B-B8FF-49B4-B2A0-ACDEDDB4CB17}.exe
attrib -r -s -h C:\WINDOWS\system32\{902F4EE7-B6C5-4BF8-A80A-8457118A8408}.exe
attrib -r -s -h C:\WINDOWS\system32\{9099751E-84B1-423B-B1D2-22FC550A0B03}.exe
attrib -r -s -h C:\WINDOWS\system32\{1917B58E-C3E2-4E6B-B912-B8054D1C1E18}.exe
attrib -r -s -h C:\WINDOWS\system32\{D87A0D6B-CB5E-42CF-8F96-2645825794DE}.exe
attrib -r -s -h C:\WINDOWS\system32\{10E094A6-3B61-487D-B160-3D1172AC92B3}.exe
attrib -r -s -h C:\WINDOWS\system32\{358E8756-DDF2-47A4-B58C-880D0B35EE03}.exe
attrib -r -s -h C:\WINDOWS\system32\{E4014FB2-6218-47E1-9A97-0A88B02B4686}.exe
attrib -r -s -h C:\WINDOWS\system32\{2FA1C2DB-8C4A-4F9C-A0BA-538B4257A1FD}.exe
attrib -r -s -h C:\WINDOWS\system32\{25D4B435-7C71-4BEA-832F-FBA27E59F41D}.exe
attrib -r -s -h C:\WINDOWS\system32\{C1A6D8B5-78FB-4C4C-ADC7-118E1386617B}.exe
attrib -r -s -h C:\WINDOWS\system32\{97774BE7-FDF6-41D1-9323-559DDE3F5C18}.exe
attrib -r -s -h C:\WINDOWS\system32\{0706C3FD-BA65-416A-83EC-5CE0E01BEF6B}.exe
attrib -r -s -h C:\WINDOWS\system32\{B3576485-CEC9-44FA-8EA1-9F0D7B3F13FD}.exe
attrib -r -s -h C:\WINDOWS\system32\{09279F0F-4F7A-4CCF-904C-E1A0B024B415}.exe
attrib -r -s -h C:\WINDOWS\system32\{EF758921-B7E9-4CAA-8E4B-09232628EFFA}.exe
attrib -r -s -h C:\WINDOWS\system32\{DAC5A38E-555A-49CA-AFE0-3B2FAC63DE90}.exe
attrib -r -s -h C:\WINDOWS\system32\{DE9D0D79-826C-42B7-83CD-99CBC6D307A4}.exe
attrib -r -s -h C:\WINDOWS\system32\{3AAE31F5-FCD6-4868-B027-040DC585DB89}.exe
attrib -r -s -h C:\WINDOWS\system32\{9F83990F-48F3-49BA-B612-8E9091B21D09}.exe
attrib -r -s -h C:\WINDOWS\system32\{48F54148-BE0B-40BD-8A87-19662E3EF693}.exe
attrib -r -s -h C:\WINDOWS\system32\{C2F5E4D0-EECB-4CE5-923B-6E6F48187E61}.exe
attrib -r -s -h C:\WINDOWS\system32\{0A7242CD-1772-4877-BEF1-B9E1D4A3E945}.exe
attrib -r -s -h C:\WINDOWS\system32\{9E96CF4F-AC80-47E2-94E4-980760F65F1D}.exe
attrib -r -s -h C:\WINDOWS\system32\{B8F7FF05-C83F-40CF-B421-5BC6A1CFEDAA}.exe
attrib -r -s -h C:\WINDOWS\system32\{98B533FA-E4C0-4C14-A976-F40339FFE183}.exe
attrib -r -s -h C:\WINDOWS\system32\{87E9D0AF-7073-4727-9425-E5660E6E18C3}.exe
attrib -r -s -h C:\WINDOWS\system32\{0AF63B4F-D0E0-4928-B32C-1F01AAC644DC}.exe
attrib -r -s -h C:\WINDOWS\system32\{7357FDE1-3225-443E-8110-10991BCCD6A0}.exe
attrib -r -s -h C:\WINDOWS\system32\{322B5F1A-089F-4144-80D5-6217B7825988}.exe
attrib -r -s -h C:\WINDOWS\system32\{7BA8E976-5EB0-46A1-94D1-78A847EDE297}.exe
attrib -r -s -h C:\WINDOWS\system32\{59E8F1C0-3EDC-4C3E-B1C5-B516C864CFCA}.exe
attrib -r -s -h C:\WINDOWS\system32\{3747BDF1-231A-4589-BFD1-692F3C6206F1}.exe
attrib -r -s -h C:\WINDOWS\system32\{410C40F7-FF3F-4BAB-953B-AC63CA92E266}.exe
attrib -r -s -h C:\WINDOWS\system32\{0FC731DF-5770-44CB-BF1E-9C4481D1150B}.exe
attrib -r -s -h C:\WINDOWS\system32\{B5D9C24F-32CB-481A-84F6-9A8693CE8196}.exe
attrib -r -s -h C:\WINDOWS\system32\{A8876F78-367C-4E86-9321-354C294B52A5}.exe
attrib -r -s -h C:\WINDOWS\system32\{FD09D10D-8AC9-4E42-8D24-10C34F94EC97}.exe
attrib -r -s -h C:\WINDOWS\system32\{7C1C5B2A-1926-437E-8D58-E5847936E5E8}.exe
attrib -r -s -h C:\WINDOWS\system32\{C52937D0-0B51-4E5F-81D7-B95966DAE61C}.exe
attrib -r -s -h C:\WINDOWS\system32\{7E50FF17-A9C3-42E8-8D61-E010C6A5249A}.exe
attrib -r -s -h C:\WINDOWS\system32\{9610319A-34E2-4A6E-A723-3E2D92B90E58}.exe
attrib -r -s -h C:\WINDOWS\system32\{E5310C38-61B4-4423-9631-C411F3DDD8C9}.exe
attrib -r -s -h C:\WINDOWS\system32\{AC43ACB9-3655-42EB-952D-9A090D31C3E7}.exe
attrib -r -s -h C:\WINDOWS\system32\{1F096F0A-8356-426E-9EDD-95DB2D8A8935}.exe
attrib -r -s -h C:\WINDOWS\system32\{A47C1DCD-FBB2-4B08-A3FF-C5755760E68B}.exe
attrib -r -s -h C:\WINDOWS\system32\{D339D430-5825-4128-970A-DDD2480F2B88}.exe
attrib -r -s -h C:\WINDOWS\system32\{8C0BB4F3-37AD-496F-A1C9-AC65A1EDF374}.exe
attrib -r -s -h C:\WINDOWS\system32\{41999600-571C-4CAE-A3FE-21D4406E4AA5}.exe
attrib -r -s -h C:\WINDOWS\system32\{4961CAE5-3263-495E-B19B-21211360482A}.exe
attrib -r -s -h C:\WINDOWS\system32\{68FDCF3B-09F2-4368-B5F3-B250259B08AB}.exe
attrib -r -s -h C:\WINDOWS\system32\{52B301EA-EB56-4C79-9E75-FCEA814332AE}.exe
attrib -r -s -h C:\WINDOWS\system32\{4A06EAA9-6144-4D35-BCE8-F92032BD9E04}.exe
attrib -r -s -h C:\WINDOWS\system32\{C8F7EC76-17D3-4DAC-B840-12412A6B09D9}.exe
attrib -r -s -h C:\WINDOWS\system32\{B84098EE-D87E-4FF2-B76A-513EF3FDAEC3}.exe
attrib -r -s -h C:\WINDOWS\system32\{DB7F8A9D-7ADD-4FC1-994A-E44D2BCB5BFC}.exe
attrib -r -s -h C:\WINDOWS\system32\{620F4978-3675-4FD0-BCD7-AD8966488788}.exe
attrib -r -s -h C:\WINDOWS\system32\{5D40A286-19E4-4804-954F-8BBC821E292A}.exe
attrib -r -s -h C:\WINDOWS\system32\{5A30A944-CE9B-47C2-A778-BEEF3BF25AA6}.exe
attrib -r -s -h C:\WINDOWS\system32\{92EEE7B3-5929-4D55-8F40-E2D41A2862C0}.exe
attrib -r -s -h C:\WINDOWS\system32\{E2CF9097-5243-4A98-B7D5-D690E163322D}.exe
attrib -r -s -h C:\WINDOWS\system32\{6CA89C69-470D-49E0-A04C-3C33906A5348}.exe
attrib -r -s -h C:\WINDOWS\system32\{5A75FB24-E924-4519-B9B0-EE42869CC0A1}.exe
attrib -r -s -h C:\WINDOWS\system32\{FA807171-3136-4C66-89F0-E1769804718E}.exe
attrib -r -s -h C:\WINDOWS\system32\{74CEDFBF-B322-4D33-A5D5-39A188778BAE}.exe
attrib -r -s -h C:\WINDOWS\system32\{29A62E7F-5CCC-4970-B931-FB3B64F89926}.exe
attrib -r -s -h C:\WINDOWS\system32\{09A0BC4B-76C8-4FD8-9B93-FDA168D8EDB9}.exe
attrib -r -s -h C:\WINDOWS\system32\{FF006A60-6A64-423F-8520-9A33B700F911}.exe
attrib -r -s -h C:\WINDOWS\system32\{C7F9560F-8170-4DF6-94BB-CA6AA8F1DC59}.exe
attrib -r -s -h C:\WINDOWS\system32\{B92AF436-A8C6-4814-A263-00DA772C2C3C}.exe
attrib -r -s -h C:\WINDOWS\system32\{98614501-5481-4F73-AB4D-32E31ABFC5C7}.exe
attrib -r -s -h C:\WINDOWS\system32\{CF02D3F1-5FD7-4EB1-8B97-3303EFB22B7B}.exe
attrib -r -s -h C:\WINDOWS\system32\{1A73C0A1-CA84-46D9-88FE-C20010C793A8}.exe
attrib -r -s -h C:\WINDOWS\system32\{9654E521-A0F5-4D51-8D2F-0DF411B2C070}.exe
attrib -r -s -h C:\WINDOWS\system32\{7CC128E2-FD56-49A2-A817-FC1FFB831FBA}.exe
attrib -r -s -h C:\WINDOWS\system32\{76ED7EBD-9C97-4724-A6FA-5EAB2B588286}.exe
attrib -r -s -h C:\WINDOWS\system32\{3B124F69-644F-4E75-AFDF-842F4539480F}.exe
attrib -r -s -h C:\WINDOWS\system32\{961C0626-7C7D-4157-9A57-5A00A5C745DA}.exe
attrib -r -s -h C:\WINDOWS\system32\{3D830AA4-5FF7-4680-A32A-BB9182E5A23A}.exe
attrib -r -s -h C:\WINDOWS\system32\{8A6F18A8-164D-40E7-A352-CCD1FC612756}.exe
attrib -r -s -h C:\WINDOWS\system32\{A39BBDE3-A7FF-412F-BA72-8DC22216F41C}.exe
attrib -r -s -h C:\WINDOWS\system32\{07A959E3-5368-4665-8486-2DBC8136961F}.exe
attrib -r -s -h C:\WINDOWS\system32\{D93CA5F0-5A91-4E56-9C48-54B72CCF5370}.exe
attrib -r -s -h C:\WINDOWS\system32\{D8DA9F56-0B1F-455B-9631-428F0BEF54E1}.exe
attrib -r -s -h C:\WINDOWS\system32\{9D0EF904-BBD3-4F05-B84D-809866D19F23}.exe
attrib -r -s -h C:\WINDOWS\system32\{0F922DA1-4D43-48B4-A9CA-7C2E8C48090E}.exe
attrib -r -s -h C:\WINDOWS\system32\{5524A1B4-AEE5-462F-BE81-3B61B523139D}.exe
del C:\WINDOWS\SYSTEM32\CSVDS.EXE
del C:\WINDOWS\SYSTEM32\DMXUX.EXE
del C:\WINDOWS\system32\soysy.exe
del C:\WINDOWS\system32\{2A79C8BC-6339-4402-9FD1-6E6A47B8A260}.exe
del C:\WINDOWS\system32\{9BD974B6-0834-421A-AD35-D65701287CDC}.exe
del C:\WINDOWS\system32\{076DDBB5-905A-48F4-9455-3AC5B3041D1F}.exe
del C:\WINDOWS\system32\{C660033A-FB30-42FC-AA5C-A410DFC5F3F1}.exe
del C:\WINDOWS\system32\{83790BE0-EC54-4261-B9D1-0F11A80AA0C6}.exe
del C:\WINDOWS\system32\{9F0C1B1B-B101-427B-9DFC-0D51CBB593D1}.exe
del C:\WINDOWS\system32\{14C608A9-A115-4A00-B846-06A5B77249C3}.exe
del C:\WINDOWS\system32\{38D4481B-44D1-4A8C-9E96-282434C91848}.exe
del C:\WINDOWS\system32\{6971C578-23CF-4AB4-9606-CF03163374F4}.exe
del C:\WINDOWS\system32\{A36C3ECD-14DA-46FF-9A98-BEF786B9043D}.exe
del C:\WINDOWS\system32\{967A1E45-9EA5-411E-9B18-B2E3CEF63DA7}.exe
del C:\WINDOWS\system32\{636A392E-F2C5-4E52-8ECE-6B3FA04A94EF}.exe
del C:\WINDOWS\system32\{43B1185D-A11E-4BB3-A385-10418657E9BD}.exe
del C:\WINDOWS\system32\{F5C06A68-E71B-40BE-BA7E-B88AC707C564}.exe
del C:\WINDOWS\system32\{0D65173E-B809-4133-A989-C98F76AFCABB}.exe
del C:\WINDOWS\system32\{6ADC8A53-7A3D-4072-AD5D-BF2ED9A5916B}.exe
del C:\WINDOWS\system32\{53653E2F-D807-4F9C-9A2E-0979640AF903}.exe
del C:\WINDOWS\system32\{76B28BBD-47F6-4773-AF1D-0BA02040D216}.exe
del C:\WINDOWS\system32\{394EA75B-0DD3-402B-86A9-819FC5704F80}.exe
del C:\WINDOWS\system32\{242E688D-9344-4849-A047-CA60D3DFC113}.exe
del C:\WINDOWS\system32\{21256B6D-EA34-4FF3-9E26-ABA9695D1B98}.exe
del C:\WINDOWS\system32\{B3CDC1DE-14AC-4673-B89F-D2CA3318DFFA}.exe
del C:\WINDOWS\system32\{FD74CD8B-45B1-4FA7-9617-C69259BE9FE9}.exe
del C:\WINDOWS\system32\{97399805-ECBE-45F9-87EA-B49114564851}.exe
del C:\WINDOWS\system32\{57095BB7-07A1-4E0C-AAA2-848F7899E30E}.exe
del C:\WINDOWS\system32\{DCB26116-20DF-4B5B-AE61-3B2C523E9837}.exe
del C:\WINDOWS\system32\{2AD6C973-DAAE-40DC-B3F5-D92EE7CDDF03}.exe
del C:\WINDOWS\system32\{5678D35A-A5B4-4555-BC52-3CA350DF03CE}.exe
del C:\WINDOWS\system32\{6AC6BE6B-9A71-4856-8AA4-44D592E697D4}.exe
del C:\WINDOWS\system32\{093D25AA-64D2-435D-BF0B-06C20F90E1F1}.exe
del C:\WINDOWS\system32\{35DCC478-9EF1-45C1-BC3A-7CF4AA808A40}.exe
del C:\WINDOWS\system32\{5B187535-B0C3-430C-961F-2DB49ED4EAEF}.exe
del C:\WINDOWS\system32\{0485074E-914A-454F-8C72-0B1B77060247}.exe
del C:\WINDOWS\system32\{ECD3D3BA-E5A7-4B97-A319-07220272837A}.exe
del C:\WINDOWS\system32\{E40FF811-D39F-455B-ABDD-FFE571D88DFB}.exe
del C:\WINDOWS\system32\{3A672F9D-AFC0-43C7-98C3-1E1B46A07D6B}.exe
del C:\WINDOWS\system32\{FCE3BBD6-A4C7-4A62-BA90-F437E8404EFD}.exe
del C:\WINDOWS\system32\{29FDCE6F-8F3E-4F75-A336-FBEAB9AF36FB}.exe
del C:\WINDOWS\system32\{27122C9C-A394-4631-B57E-B6BF57C940EC}.exe
del C:\WINDOWS\system32\{EC11B0ED-6F44-4D6A-BF73-41359FC2D49E}.exe
del C:\WINDOWS\system32\{629CA496-286E-4E4B-85C6-7B5748763ABD}.exe
del C:\WINDOWS\system32\{5EDD044A-3C80-407D-A6D9-40F553BD6D83}.exe
del C:\WINDOWS\system32\{1989AD67-044C-40B3-9269-15DD5EF71D19}.exe
del C:\WINDOWS\system32\{2303AC62-2C29-438A-AE0F-47B6212C1DD9}.exe
del C:\WINDOWS\system32\{046CFA8D-5E6B-4519-88EB-8D4180FA4E77}.exe
del C:\WINDOWS\system32\{0711E654-F503-4CD7-BC27-A57B75582305}.exe
del C:\WINDOWS\system32\{7A2CA53D-1A52-44CF-9350-9DA2299C9772}.exe
del C:\WINDOWS\system32\{BC4A9DC5-0650-4352-8D22-6D804560E478}.exe
del C:\WINDOWS\system32\{A2A07145-86A3-4A31-A561-04C2032FF511}.exe
del C:\WINDOWS\system32\{D2E84679-8008-4C16-AB7F-0D2AAA666FFB}.exe
del C:\WINDOWS\system32\{403D888E-6257-48F5-B0D6-5A40078703D9}.exe
del C:\WINDOWS\system32\{C0F0801D-CD93-4EF1-9BDB-20720D1DF862}.exe
del C:\WINDOWS\system32\{7688E617-CE7A-4421-932E-00EB6027F4DC}.exe
del C:\WINDOWS\system32\{A5C209A3-CAED-4D3A-9FDF-1038AAB1B590}.exe
del C:\WINDOWS\system32\{71A76077-8928-4AD9-BDBE-2876B9A089C7}.exe
del C:\WINDOWS\system32\{4DCAB7B1-8300-4323-9377-5388946D6A90}.exe
del C:\WINDOWS\system32\{17E9946A-ECDE-4725-9D9E-91FFB5125CCB}.exe
del C:\WINDOWS\system32\{0A591130-2B2F-4917-862D-E32C07C7C382}.exe
del C:\WINDOWS\system32\{FA30508F-D295-478F-A64F-475518211A6C}.exe
del C:\WINDOWS\system32\{7AC62B9B-6402-4170-A25C-B0E5AF8C3718}.exe
del C:\WINDOWS\system32\{12383E2F-0403-4B72-ACC8-218D387177B7}.exe
del C:\WINDOWS\system32\{BE50F142-405F-42D6-BDF9-251A23661428}.exe
del C:\WINDOWS\system32\{64794B26-6084-4649-AF68-3A783282CB2B}.exe
del C:\WINDOWS\system32\{16C3A92D-5FF1-424E-980E-215985FAF4D8}.exe
del C:\WINDOWS\system32\{E5BB1CC7-03D6-4ACC-B55E-066CAD2DE75A}.exe
del C:\WINDOWS\system32\{770B507E-281B-4ACD-9035-4C473A227424}.exe
del C:\WINDOWS\system32\{A1D11F4D-B5A9-44A9-8724-F721F5CBC4AA}.exe
del C:\WINDOWS\system32\{D41F3C69-F4C6-468F-9B4E-E995334F3E4E}.exe
del C:\WINDOWS\system32\{C4C7A195-33E2-4E0F-8F4C-3B2F6F71EF5D}.exe
del C:\WINDOWS\system32\{099F2830-57BB-4EF3-B835-25737314C0C5}.exe
del C:\WINDOWS\system32\{97932B0C-21FA-4C67-A5C4-1A2859B54B30}.exe
del C:\WINDOWS\system32\{30FD1F89-7909-466C-9FB0-BBE2B044FFEF}.exe
del C:\WINDOWS\system32\{21958CC8-AA03-4DAC-8340-92B7F4A83DC7}.exe
del C:\WINDOWS\system32\{145F6837-E79B-4DEF-AD18-06887939FA86}.exe
del C:\WINDOWS\system32\{0A1F3F53-CE8A-4E68-AEA7-D2C9DC827BF5}.exe
del C:\WINDOWS\system32\{ED31A377-B794-4C39-A105-056B8E5B53AC}.exe
del C:\WINDOWS\system32\{013FC510-456C-4703-8511-C7980A3763DD}.exe
del C:\WINDOWS\system32\{C1938B5E-DA09-49C4-9875-2F881C840F35}.exe
del C:\WINDOWS\system32\{E38565B8-BCF8-4C6B-A387-ACD478CECA04}.exe
del C:\WINDOWS\system32\{52E463CE-173C-47D4-A53F-1C5315FACC4A}.exe
del C:\WINDOWS\system32\{A72B59AD-D870-48AE-ADCC-17D289E306CA}.exe
del C:\WINDOWS\system32\{4166F3E6-AB19-4105-8492-DF0A659FB93F}.exe
del C:\WINDOWS\system32\{536B8289-A6ED-4D43-AA11-BA1A7D430322}.exe
del C:\WINDOWS\system32\{AD20EA72-7BFA-4A06-90AF-9AE49EFF469F}.exe
del C:\WINDOWS\system32\{EEAAF76F-C020-42D7-863A-2A1193FCE6D9}.exe
del C:\WINDOWS\system32\{152E3127-DCA9-46D0-8E29-353397C4913F}.exe
del C:\WINDOWS\system32\{FB9AF885-D979-4793-B24B-005F2A381981}.exe
del C:\WINDOWS\system32\{4FEE110E-5EDD-409C-86AB-9C6FEF77B61F}.exe
del C:\WINDOWS\system32\{BA687C2D-C763-40A7-A9A5-7E98F7BFC008}.exe
del C:\WINDOWS\system32\{201CEAB8-6407-45B9-B462-FB27F7221D97}.exe
del C:\WINDOWS\system32\{75662069-FB0C-4313-BBD3-8879472AD3C0}.exe
del C:\WINDOWS\system32\{16F1875F-3456-487D-A497-48D49415D78C}.exe
del C:\WINDOWS\system32\{05173133-94CC-4900-828D-50C049334A2A}.exe
del C:\WINDOWS\system32\{C2300CAA-3D8E-4B08-808E-F6AB649EB058}.exe
del C:\WINDOWS\system32\{E2379593-2BEE-4C49-B8AD-BC1D4938F73E}.exe
del C:\WINDOWS\system32\{C81E835A-66D3-4EBA-AB0A-7CEB81996B6B}.exe
del C:\WINDOWS\system32\{9EE235BA-D1A0-4213-ADE3-89D68CEAC61D}.exe
del C:\WINDOWS\system32\{2FC7DB17-DA73-4AE9-80E4-2A535F9CCB71}.exe
del C:\WINDOWS\system32\{1F928661-7C73-41BF-848C-1BB531E1C264}.exe
del C:\WINDOWS\system32\{A0DE1311-8EF8-4851-890F-7478CAFDFD48}.exe
del C:\WINDOWS\system32\{2EFF66BC-B91A-463C-9291-C1EFF525DB3D}.exe
del C:\WINDOWS\system32\{25349B69-BDDD-453F-8912-F175077F9954}.exe
del C:\WINDOWS\system32\{68D98B5C-066B-4FEF-A4A3-782F1FC16E9C}.exe
del C:\WINDOWS\system32\{8B2C30BA-0531-4656-B146-CC6DF59AE402}.exe
del C:\WINDOWS\system32\{43560DE3-683F-45DD-B160-5B43F8FC0C08}.exe
del C:\WINDOWS\system32\{41A43F6B-369C-4797-8613-8D05B715831C}.exe
del C:\WINDOWS\system32\{4B8E2BFD-9F49-4951-AE02-AB52CDBE348A}.exe
del C:\WINDOWS\system32\{E1BED161-CBD8-41A2-892A-E589D2827AD5}.exe
del C:\WINDOWS\system32\{647CBFDA-5BA8-4499-A837-70BB3D1E7932}.exe
del C:\WINDOWS\system32\{BE793920-B014-4BA5-8FA9-D47C2E3C9BC9}.exe
del C:\WINDOWS\system32\{2C50AB68-33BC-48F4-A933-71D8101E6C60}.exe
del C:\WINDOWS\system32\{42C7848A-C74F-4991-A353-FB1E09E76F3E}.exe
del C:\WINDOWS\system32\{C0CE10B3-28EB-4E2C-B0EE-82F383AC1659}.exe
del C:\WINDOWS\system32\{2670D276-7C94-4694-B3AB-F6D37F428DBC}.exe
del C:\WINDOWS\system32\{D112CEE0-FAD1-436A-92C3-162B8F28046D}.exe
del C:\WINDOWS\system32\{317EB433-7AA7-4A3E-B919-EFCFA72F25FE}.exe
del C:\WINDOWS\system32\{DE46E78D-C48A-4CC1-9024-8D7460F820B9}.exe
del C:\WINDOWS\system32\{D580010C-A0DA-40CC-9AC4-25A679907C00}.exe
del C:\WINDOWS\system32\{63F871A4-4F25-4961-B4FC-6663D00F1C85}.exe
del C:\WINDOWS\system32\{5F15CE75-55E6-44BF-B9D9-5DED34D26BC5}.exe
del C:\WINDOWS\system32\{882DC64B-D67D-4F70-BB00-CF7BF45959C2}.exe
del C:\WINDOWS\system32\{0DAF229C-7318-4396-AF6C-3D4CD14683A1}.exe
del C:\WINDOWS\system32\{101FE061-CE1F-41B0-B827-A7C4ACDCCD96}.exe
del C:\WINDOWS\system32\{FD16643E-3142-4810-B74E-3D5254267A9D}.exe
del C:\WINDOWS\system32\{453DAB87-73FE-418D-8FDE-A2300DF09FA9}.exe
del C:\WINDOWS\system32\{C2F079AD-0205-4A4A-AA2D-5F1A07401B5A}.exe
del C:\WINDOWS\system32\{64301EE7-30F7-4434-B6B9-7EB11E3DB93F}.exe
del C:\WINDOWS\system32\{FC47886B-444A-41F9-9514-CA57C49B0EE7}.exe
del C:\WINDOWS\system32\{493DBD2D-11DA-4AFA-BEDC-7887C015E7B9}.exe
del C:\WINDOWS\system32\{DC79C8DF-B9A3-43C2-80C7-1A1C6A6EC36E}.exe
del C:\WINDOWS\system32\{595478A3-DE1C-4FC0-8EEE-EB2D7B70B8E3}.exe
del C:\WINDOWS\system32\{707F084B-16CC-4D8F-A513-AF4A5B96F816}.exe
del C:\WINDOWS\system32\{4A1A9D93-77AA-49EF-83B7-C9A52F23E1FF}.exe
del C:\WINDOWS\system32\{5D6FB849-AACD-46B4-BBFB-C68F4779FC3D}.exe
del C:\WINDOWS\system32\{D1FBBCE9-05D3-426D-BF94-01E9A82C84AE}.exe
del C:\WINDOWS\system32\{4F631117-7CA7-4AD8-8F2B-9DBDCB79AB77}.exe
del C:\WINDOWS\system32\{2198E774-73E6-4D04-BB29-BD96C8A8FB58}.exe
del C:\WINDOWS\system32\{F4D41701-8573-4AAC-A7A5-C5F2C2EEB3A1}.exe
del C:\WINDOWS\system32\{0751C49D-0E2D-40BA-AC50-377803B40732}.exe
del C:\WINDOWS\system32\{A8AF986B-2103-4858-8047-1986A199A185}.exe
del C:\WINDOWS\system32\{C6354ED3-6E72-4C4D-90B8-29DD030B8641}.exe
del C:\WINDOWS\system32\{70EF0A41-03B9-4E52-B560-6A48EE14B0CC}.exe
del C:\WINDOWS\system32\{CDF1F78A-EB28-4361-8782-22D029E3FE1C}.exe
del C:\WINDOWS\system32\{05AE8B2B-B8FF-49B4-B2A0-ACDEDDB4CB17}.exe
del C:\WINDOWS\system32\{902F4EE7-B6C5-4BF8-A80A-8457118A8408}.exe
del C:\WINDOWS\system32\{9099751E-84B1-423B-B1D2-22FC550A0B03}.exe
del C:\WINDOWS\system32\{1917B58E-C3E2-4E6B-B912-B8054D1C1E18}.exe
del C:\WINDOWS\system32\{D87A0D6B-CB5E-42CF-8F96-2645825794DE}.exe
del C:\WINDOWS\system32\{10E094A6-3B61-487D-B160-3D1172AC92B3}.exe
del C:\WINDOWS\system32\{358E8756-DDF2-47A4-B58C-880D0B35EE03}.exe
del C:\WINDOWS\system32\{E4014FB2-6218-47E1-9A97-0A88B02B4686}.exe
del C:\WINDOWS\system32\{2FA1C2DB-8C4A-4F9C-A0BA-538B4257A1FD}.exe
del C:\WINDOWS\system32\{25D4B435-7C71-4BEA-832F-FBA27E59F41D}.exe
del C:\WINDOWS\system32\{C1A6D8B5-78FB-4C4C-ADC7-118E1386617B}.exe
del C:\WINDOWS\system32\{97774BE7-FDF6-41D1-9323-559DDE3F5C18}.exe
del C:\WINDOWS\system32\{0706C3FD-BA65-416A-83EC-5CE0E01BEF6B}.exe
del C:\WINDOWS\system32\{B3576485-CEC9-44FA-8EA1-9F0D7B3F13FD}.exe
del C:\WINDOWS\system32\{09279F0F-4F7A-4CCF-904C-E1A0B024B415}.exe
del C:\WINDOWS\system32\{EF758921-B7E9-4CAA-8E4B-09232628EFFA}.exe
del C:\WINDOWS\system32\{DAC5A38E-555A-49CA-AFE0-3B2FAC63DE90}.exe
del C:\WINDOWS\system32\{DE9D0D79-826C-42B7-83CD-99CBC6D307A4}.exe
del C:\WINDOWS\system32\{3AAE31F5-FCD6-4868-B027-040DC585DB89}.exe
del C:\WINDOWS\system32\{9F83990F-48F3-49BA-B612-8E9091B21D09}.exe
del C:\WINDOWS\system32\{48F54148-BE0B-40BD-8A87-19662E3EF693}.exe
del C:\WINDOWS\system32\{C2F5E4D0-EECB-4CE5-923B-6E6F48187E61}.exe
del C:\WINDOWS\system32\{0A7242CD-1772-4877-BEF1-B9E1D4A3E945}.exe
del C:\WINDOWS\system32\{9E96CF4F-AC80-47E2-94E4-980760F65F1D}.exe
del C:\WINDOWS\system32\{B8F7FF05-C83F-40CF-B421-5BC6A1CFEDAA}.exe
del C:\WINDOWS\system32\{98B533FA-E4C0-4C14-A976-F40339FFE183}.exe
del C:\WINDOWS\system32\{87E9D0AF-7073-4727-9425-E5660E6E18C3}.exe
del C:\WINDOWS\system32\{0AF63B4F-D0E0-4928-B32C-1F01AAC644DC}.exe
del C:\WINDOWS\system32\{7357FDE1-3225-443E-8110-10991BCCD6A0}.exe
del C:\WINDOWS\system32\{322B5F1A-089F-4144-80D5-6217B7825988}.exe
del C:\WINDOWS\system32\{7BA8E976-5EB0-46A1-94D1-78A847EDE297}.exe
del C:\WINDOWS\system32\{59E8F1C0-3EDC-4C3E-B1C5-B516C864CFCA}.exe
del C:\WINDOWS\system32\{3747BDF1-231A-4589-BFD1-692F3C6206F1}.exe
del C:\WINDOWS\system32\{410C40F7-FF3F-4BAB-953B-AC63CA92E266}.exe
del C:\WINDOWS\system32\{0FC731DF-5770-44CB-BF1E-9C4481D1150B}.exe
del C:\WINDOWS\system32\{B5D9C24F-32CB-481A-84F6-9A8693CE8196}.exe
del C:\WINDOWS\system32\{A8876F78-367C-4E86-9321-354C294B52A5}.exe
del C:\WINDOWS\system32\{FD09D10D-8AC9-4E42-8D24-10C34F94EC97}.exe
del C:\WINDOWS\system32\{7C1C5B2A-1926-437E-8D58-E5847936E5E8}.exe
del C:\WINDOWS\system32\{C52937D0-0B51-4E5F-81D7-B95966DAE61C}.exe
del C:\WINDOWS\system32\{7E50FF17-A9C3-42E8-8D61-E010C6A5249A}.exe
del C:\WINDOWS\system32\{9610319A-34E2-4A6E-A723-3E2D92B90E58}.exe
del C:\WINDOWS\system32\{E5310C38-61B4-4423-9631-C411F3DDD8C9}.exe
del C:\WINDOWS\system32\{AC43ACB9-3655-42EB-952D-9A090D31C3E7}.exe
del C:\WINDOWS\system32\{1F096F0A-8356-426E-9EDD-95DB2D8A8935}.exe
del C:\WINDOWS\system32\{A47C1DCD-FBB2-4B08-A3FF-C5755760E68B}.exe
del C:\WINDOWS\system32\{D339D430-5825-4128-970A-DDD2480F2B88}.exe
del C:\WINDOWS\system32\{8C0BB4F3-37AD-496F-A1C9-AC65A1EDF374}.exe
del C:\WINDOWS\system32\{41999600-571C-4CAE-A3FE-21D4406E4AA5}.exe
del C:\WINDOWS\system32\{4961CAE5-3263-495E-B19B-21211360482A}.exe
del C:\WINDOWS\system32\{68FDCF3B-09F2-4368-B5F3-B250259B08AB}.exe
del C:\WINDOWS\system32\{52B301EA-EB56-4C79-9E75-FCEA814332AE}.exe
del C:\WINDOWS\system32\{4A06EAA9-6144-4D35-BCE8-F92032BD9E04}.exe
del C:\WINDOWS\system32\{C8F7EC76-17D3-4DAC-B840-12412A6B09D9}.exe
del C:\WINDOWS\system32\{B84098EE-D87E-4FF2-B76A-513EF3FDAEC3}.exe
del C:\WINDOWS\system32\{DB7F8A9D-7ADD-4FC1-994A-E44D2BCB5BFC}.exe
del C:\WINDOWS\system32\{620F4978-3675-4FD0-BCD7-AD8966488788}.exe
del C:\WINDOWS\system32\{5D40A286-19E4-4804-954F-8BBC821E292A}.exe
del C:\WINDOWS\system32\{5A30A944-CE9B-47C2-A778-BEEF3BF25AA6}.exe
del C:\WINDOWS\system32\{92EEE7B3-5929-4D55-8F40-E2D41A2862C0}.exe
del C:\WINDOWS\system32\{E2CF9097-5243-4A98-B7D5-D690E163322D}.exe
del C:\WINDOWS\system32\{6CA89C69-470D-49E0-A04C-3C33906A5348}.exe
del C:\WINDOWS\system32\{5A75FB24-E924-4519-B9B0-EE42869CC0A1}.exe
del C:\WINDOWS\system32\{FA807171-3136-4C66-89F0-E1769804718E}.exe
del C:\WINDOWS\system32\{74CEDFBF-B322-4D33-A5D5-39A188778BAE}.exe
del C:\WINDOWS\system32\{29A62E7F-5CCC-4970-B931-FB3B64F89926}.exe
del C:\WINDOWS\system32\{09A0BC4B-76C8-4FD8-9B93-FDA168D8EDB9}.exe
del C:\WINDOWS\system32\{FF006A60-6A64-423F-8520-9A33B700F911}.exe
del C:\WINDOWS\system32\{C7F9560F-8170-4DF6-94BB-CA6AA8F1DC59}.exe
del C:\WINDOWS\system32\{B92AF436-A8C6-4814-A263-00DA772C2C3C}.exe
del C:\WINDOWS\system32\{98614501-5481-4F73-AB4D-32E31ABFC5C7}.exe
del C:\WINDOWS\system32\{CF02D3F1-5FD7-4EB1-8B97-3303EFB22B7B}.exe
del C:\WINDOWS\system32\{1A73C0A1-CA84-46D9-88FE-C20010C793A8}.exe
del C:\WINDOWS\system32\{9654E521-A0F5-4D51-8D2F-0DF411B2C070}.exe
del C:\WINDOWS\system32\{7CC128E2-FD56-49A2-A817-FC1FFB831FBA}.exe
del C:\WINDOWS\system32\{76ED7EBD-9C97-4724-A6FA-5EAB2B588286}.exe
del C:\WINDOWS\system32\{3B124F69-644F-4E75-AFDF-842F4539480F}.exe
del C:\WINDOWS\system32\{961C0626-7C7D-4157-9A57-5A00A5C745DA}.exe
del C:\WINDOWS\system32\{3D830AA4-5FF7-4680-A32A-BB9182E5A23A}.exe
del C:\WINDOWS\system32\{8A6F18A8-164D-40E7-A352-CCD1FC612756}.exe
del C:\WINDOWS\system32\{A39BBDE3-A7FF-412F-BA72-8DC22216F41C}.exe
del C:\WINDOWS\system32\{07A959E3-5368-4665-8486-2DBC8136961F}.exe
del C:\WINDOWS\system32\{D93CA5F0-5A91-4E56-9C48-54B72CCF5370}.exe
del C:\WINDOWS\system32\{D8DA9F56-0B1F-455B-9631-428F0BEF54E1}.exe
del C:\WINDOWS\system32\{9D0EF904-BBD3-4F05-B84D-809866D19F23}.exe
del C:\WINDOWS\system32\{0F922DA1-4D43-48B4-A9CA-7C2E8C48090E}.exe
del C:\WINDOWS\system32\{5524A1B4-AEE5-462F-BE81-3B61B523139D}.exe

Save it to your desktop as ff.bat

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [hlsfn.exe] C:\WINNT\system32\hlsfn.exe

Then click "Fix checked".

Now in HijackThis! click on Config –> Misc Tools –> Open Process Manager

In the list of processes, find explorer.exe

Click to highlight, then click "Kill Process". OK any prompts.

Your desktop will disappear, but that is normal. It will come back when you reboot.

Now, in HijackThis!, click:

Run –> browse

Browse to your desktop and click ff.bat –> open –> OK

Browse to c:\fixwareout and click Fixit.bat –> open –> OK

This will start Fixwareout again.

After the reboot, post:

1. The fixwareout report

2. A new HijackThis! log

Into this thread.

Allright, I did as told.

I was unable to find this item in the list:

O4 - HKLM\..\Run: [hlsfn.exe] C:\WINNT\system32\hlsfn.exe

Also, when I killed explorer.exe the desktop disappeared, but it popped right back up after a few seconds.

I went ahead with the other instructions though.


Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
…

Random Runs removed from HKLM
…

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names…

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.
Directory of C:\WINDOWS\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.



Logfile of HijackThis v1.99.1
Scan saved at 21:16:52, on 2006-08-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program\ewido anti-spyware 4.0\guard.exe
C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Grisoft\AVGFRE~1\avgcc.exe
C:\Program\Grisoft\AVGFRE~1\avgemc.exe
C:\Program\Microsoft Hardware\Mouse\point32.exe
C:\Program\Java\jre1.5.0_06\bin\jusched.exe
C:\Program\Winamp\winampa.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program\ewido anti-spyware 4.0\ewido.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\msnmsgr.exe
C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program\Personal\bin\Personal.exe
C:\WINDOWS\system32\svchost.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NVidia System Utility] "C:\Program\NVIDIA Corporation\NVIDIA System Utility\\NVSystemUtility.exe" clear
O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\Program\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!ewido] "C:\Program\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [soysy.exe] C:\WINDOWS\system32\soysy.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program\Executive Software\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program\ewido anti-spyware 4.0\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Okay,

When I pressed the little red button in killbox I got this error message:

PendingFileRenameOperations Registry Data has been Removed by External Process!

here is current HiJackThis log:


Logfile of HijackThis v1.99.1
Scan saved at 23:17:05, on 2006-08-27
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program\Grisoft\AVGFRE~1\avgcc.exe
C:\Program\Grisoft\AVGFRE~1\avgemc.exe
C:\Program\Microsoft Hardware\Mouse\point32.exe
C:\Program\Java\jre1.5.0_06\bin\jusched.exe
C:\Program\Winamp\winampa.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\RunDLL32.exe
C:\Program\ewido anti-spyware 4.0\guard.exe
C:\Program\ewido anti-spyware 4.0\ewido.exe
C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\msnmsgr.exe
C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program\Personal\bin\Personal.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\01.02.4000.1001\sv\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [NVidia System Utility] "C:\Program\NVIDIA Corporation\NVIDIA System Utility\\NVSystemUtility.exe" clear
O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\Program\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!ewido] "C:\Program\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [NBJ] "C:\Program\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_06\bin\ssv.dll
O14 - IERESET.INF: START_PAGE_URL=www.google.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program\Executive Software\Diskeeper\DkService.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program\ewido anti-spyware 4.0\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe