Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Aurora help


  • Please log in to reply

#16
jbrown7441

jbrown7441

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
In the meantime, can you tell me if you can see these files on your PC please?

C:\DOCUME~1\jbrown\LOCALS~1\Temp\GATXKBZI.exe
C:\DOCUME~1\jbrown\LOCALS~1\Temp\GLNHHZOO.exe
C:\DOCUME~1\jbrown\LOCALS~1\Temp\XWC.exe


YES these items were found on my computer. I am proceeding with your fix at this time, sorry I couldn't get to this computer until now.
  • 0

Advertisements


#17
jbrown7441

jbrown7441

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
All right, done & done. I don't know how you guys decipher all this stuff, but good luck. :tazz:

********
11:52 AM: |··· Start of Session, Tuesday, October 04, 2005 ···|
11:52 AM: Spy Sweeper started
11:52 AM: Sweep initiated using definitions version 545
11:52 AM: Starting Memory Sweep
11:53 AM: Memory Sweep Complete, Elapsed Time: 00:00:41
11:53 AM: Starting Registry Sweep
11:53 AM: Registry Sweep Complete, Elapsed Time:00:00:08
11:53 AM: Starting Cookie Sweep
11:53 AM: Found Spy Cookie: 2o7.net cookie
11:53 AM: jbrown@2o7[2].txt (ID = 1957)
11:53 AM: Found Spy Cookie: apmebf cookie
11:53 AM: jbrown@apmebf[2].txt (ID = 2229)
11:53 AM: Found Spy Cookie: qksrv cookie
11:53 AM: jbrown@qksrv[2].txt (ID = 3213)
11:53 AM: Found Spy Cookie: falkag cookie
11:53 AM: system@as-us.falkag[1].txt (ID = 2650)
11:53 AM: Found Spy Cookie: ask cookie
11:53 AM: system@ask[1].txt (ID = 2245)
11:53 AM: Found Spy Cookie: bluestreak cookie
11:53 AM: system@bluestreak[2].txt (ID = 2314)
11:53 AM: Found Spy Cookie: burstnet cookie
11:53 AM: system@burstnet[2].txt (ID = 2336)
11:53 AM: Found Spy Cookie: enhance cookie
11:53 AM: system@c.enhance[1].txt (ID = 2614)
11:53 AM: Found Spy Cookie: casalemedia cookie
11:53 AM: system@casalemedia[1].txt (ID = 2354)
11:53 AM: Found Spy Cookie: ru4 cookie
11:53 AM: system@edge.ru4[1].txt (ID = 3269)
11:53 AM: Found Spy Cookie: exitexchange cookie
11:53 AM: system@exitexchange[2].txt (ID = 2633)
11:53 AM: Found Spy Cookie: findwhat cookie
11:53 AM: system@findwhat[1].txt (ID = 2674)
11:53 AM: Found Spy Cookie: videodome cookie
11:53 AM: system@g6publish.videodome[1].txt (ID = 3639)
11:53 AM: Found Spy Cookie: hypertracker.com cookie
11:53 AM: system@hypertracker[1].txt (ID = 2817)
11:53 AM: Found Spy Cookie: mygeek cookie
11:53 AM: system@mygeek[1].txt (ID = 3041)
11:53 AM: Found Spy Cookie: paypopup cookie
11:53 AM: system@paypopup[2].txt (ID = 3119)
11:53 AM: Found Spy Cookie: overture cookie
11:53 AM: system@perf.overture[1].txt (ID = 3106)
11:53 AM: Found Spy Cookie: questionmarket cookie
11:53 AM: system@questionmarket[1].txt (ID = 3217)
11:53 AM: Found Spy Cookie: realmedia cookie
11:53 AM: system@realmedia[1].txt (ID = 3235)
11:53 AM: Found Spy Cookie: rednova cookie
11:53 AM: system@rednova[1].txt (ID = 3245)
11:53 AM: Found Spy Cookie: server.iad.liveperson cookie
11:53 AM: system@server.iad.liveperson[2].txt (ID = 3341)
11:53 AM: Found Spy Cookie: statcounter cookie
11:53 AM: system@statcounter[2].txt (ID = 3447)
11:53 AM: Found Spy Cookie: tickle cookie
11:53 AM: system@tickle[2].txt (ID = 3529)
11:53 AM: Found Spy Cookie: trafficmp cookie
11:53 AM: system@trafficmp[2].txt (ID = 3581)
11:53 AM: Found Spy Cookie: tribalfusion cookie
11:53 AM: system@tribalfusion[1].txt (ID = 3589)
11:53 AM: system@videodome[1].txt (ID = 3638)
11:53 AM: Found Spy Cookie: burstbeacon cookie
11:53 AM: system@www.burstbeacon[2].txt (ID = 2335)
11:53 AM: system@www.rednova[1].txt (ID = 3246)
11:53 AM: Found Spy Cookie: redzip cookie
11:53 AM: system@www.redzip[2].txt (ID = 3250)
11:53 AM: system@as-us.falkag[1].txt (ID = 2650)
11:53 AM: system@ask[1].txt (ID = 2245)
11:53 AM: system@bluestreak[2].txt (ID = 2314)
11:53 AM: system@burstnet[2].txt (ID = 2336)
11:53 AM: system@c.enhance[1].txt (ID = 2614)
11:53 AM: system@casalemedia[1].txt (ID = 2354)
11:53 AM: system@edge.ru4[1].txt (ID = 3269)
11:53 AM: system@exitexchange[2].txt (ID = 2633)
11:53 AM: system@findwhat[1].txt (ID = 2674)
11:53 AM: system@g6publish.videodome[1].txt (ID = 3639)
11:53 AM: system@hypertracker[1].txt (ID = 2817)
11:53 AM: system@mygeek[1].txt (ID = 3041)
11:53 AM: system@paypopup[2].txt (ID = 3119)
11:53 AM: system@perf.overture[1].txt (ID = 3106)
11:53 AM: system@questionmarket[1].txt (ID = 3217)
11:53 AM: system@realmedia[1].txt (ID = 3235)
11:53 AM: system@rednova[1].txt (ID = 3245)
11:53 AM: system@server.iad.liveperson[2].txt (ID = 3341)
11:53 AM: system@statcounter[2].txt (ID = 3447)
11:53 AM: system@tickle[2].txt (ID = 3529)
11:53 AM: system@trafficmp[2].txt (ID = 3581)
11:53 AM: system@tribalfusion[1].txt (ID = 3589)
11:53 AM: system@videodome[1].txt (ID = 3638)
11:53 AM: system@www.burstbeacon[2].txt (ID = 2335)
11:53 AM: system@www.rednova[1].txt (ID = 3246)
11:53 AM: system@www.redzip[2].txt (ID = 3250)
11:53 AM: Cookie Sweep Complete, Elapsed Time: 00:00:02
11:53 AM: Starting File Sweep
12:01 PM: File Sweep Complete, Elapsed Time: 00:08:26
12:01 PM: Full Sweep has completed. Elapsed time 00:09:21
12:01 PM: Traces Found: 55
12:03 PM: Removal process initiated
12:03 PM: Quarantining All Traces: 2o7.net cookie
12:03 PM: Quarantining All Traces: apmebf cookie
12:03 PM: Quarantining All Traces: qksrv cookie
12:03 PM: Quarantining All Traces: falkag cookie
12:03 PM: Quarantining All Traces: ask cookie
12:03 PM: Quarantining All Traces: bluestreak cookie
12:03 PM: Quarantining All Traces: burstnet cookie
12:03 PM: Quarantining All Traces: enhance cookie
12:03 PM: Quarantining All Traces: casalemedia cookie
12:03 PM: Quarantining All Traces: ru4 cookie
12:03 PM: Quarantining All Traces: exitexchange cookie
12:03 PM: Quarantining All Traces: findwhat cookie
12:03 PM: Quarantining All Traces: videodome cookie
12:03 PM: Quarantining All Traces: hypertracker.com cookie
12:03 PM: Quarantining All Traces: mygeek cookie
12:03 PM: Quarantining All Traces: paypopup cookie
12:03 PM: Quarantining All Traces: overture cookie
12:03 PM: Quarantining All Traces: questionmarket cookie
12:03 PM: Quarantining All Traces: realmedia cookie
12:03 PM: Quarantining All Traces: rednova cookie
12:03 PM: Quarantining All Traces: server.iad.liveperson cookie
12:03 PM: Quarantining All Traces: statcounter cookie
12:03 PM: Quarantining All Traces: tickle cookie
12:03 PM: Quarantining All Traces: trafficmp cookie
12:03 PM: Quarantining All Traces: tribalfusion cookie
12:03 PM: Quarantining All Traces: burstbeacon cookie
12:03 PM: Quarantining All Traces: redzip cookie
12:03 PM: Removal process completed. Elapsed time 00:00:04
********
4:52 PM: |··· Start of Session, Wednesday, September 28, 2005 ···|
4:52 PM: Spy Sweeper started
4:52 PM: Sweep initiated using definitions version 545
4:52 PM: Starting Memory Sweep
4:52 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:52 PM: Found Trojan Horse: lzio
4:52 PM: Detected running threat: C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe (ID = 48)
4:52 PM: HKLM\Software\Microsoft\Windows\CurrentVersion\Run || guycrm (ID = 0)
4:54 PM: Memory Sweep Complete, Elapsed Time: 00:02:36
4:54 PM: Starting Registry Sweep
4:54 PM: Registry Sweep Complete, Elapsed Time:00:00:06
4:54 PM: Starting Cookie Sweep
4:55 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
4:55 PM: Starting File Sweep
5:03 PM: Warning: Failed to read file "c:\documents and settings\jbrown\local settings\temp\~dfc074.tmp". System Error. Code: 32.
The process cannot access the file because it is being used by another process
5:03 PM: File Sweep Complete, Elapsed Time: 00:08:04
5:03 PM: Full Sweep has completed. Elapsed time 00:10:52
5:03 PM: Traces Found: 2
5:03 PM: Removal process initiated
5:03 PM: Quarantining All Traces: lzio
5:03 PM: Removal process completed. Elapsed time 00:00:26
10:17 AM: Warning: Failed to check file "c:\windows\system32\fhlpnxy\guycrm.exe". Cannot open file "c:\windows\system32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:22 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:24 AM: Spy Installation Shield: found: Trojan Horse: lzio, version 1.0.0.0 -- Execution Denied
10:24 AM: Spy Installation Shield: found: Trojan Horse: lzio, version 1.0.0.0 -- Execution Denied
11:13 AM: Processing Startup Alerts
11:13 AM: Removed Startup entry: babfk
11:13 AM: Processing Internet Explorer Favorites Alerts
11:13 AM: Allowed IE Favorite: Hydrogen sulfide (EHC 19, 1981)
11:17 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:23 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:26 AM: Processing Internet Explorer Favorites Alerts
11:26 AM: Allowed IE Favorite: Support.Dell.com
11:26 AM: Allowed IE Favorite: Gigabuys
11:26 AM: Allowed IE Favorite: Dell Auction
11:26 AM: Allowed IE Favorite: Dell
11:26 AM: Allowed IE Favorite: Jan's VW-Car-Racing Page
11:29 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:35 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:40 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:46 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:52 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:58 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:03 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:09 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:14 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:20 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:26 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:31 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:37 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:43 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:48 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:54 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:00 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:05 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:11 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:17 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:22 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:28 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:33 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:39 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:45 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:50 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:56 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:02 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:07 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:13 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:19 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:24 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:30 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:36 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:42 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:47 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:53 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:59 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:04 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:10 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:16 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:22 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:28 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:33 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:39 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:45 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:51 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:56 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:02 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:08 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:14 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:20 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:25 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:31 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:37 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:42 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:48 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:53 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:58 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:04 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:09 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:16 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:22 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:28 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:34 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:39 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:45 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:51 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:57 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:02 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:08 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:14 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:19 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:25 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:31 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:36 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:42 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:48 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:54 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
6:59 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:05 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:11 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:16 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:22 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:28 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:34 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:39 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:45 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:51 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
7:56 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:02 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:08 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:14 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:19 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:25 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:31 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:36 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:42 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:48 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:54 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
8:59 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:05 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:11 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:16 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:22 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:28 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:33 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:39 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:45 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:51 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
9:56 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:02 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:08 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:13 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:19 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:25 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:31 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:36 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:42 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:48 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:53 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
10:59 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:05 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:11 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:16 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:22 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:28 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:33 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:39 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:45 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:51 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
11:56 PM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:02 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:08 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:13 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:19 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:25 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:31 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:36 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:42 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:48 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:53 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
12:59 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:05 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:11 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:16 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:22 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:28 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:33 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:39 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:45 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:51 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
1:56 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:02 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:08 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:14 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:20 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:25 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:31 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:37 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:43 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:48 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
2:54 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:00 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:05 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:11 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:17 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:23 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:28 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:34 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:40 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:46 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:51 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
3:57 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:03 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:08 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:14 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:20 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:26 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:31 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:37 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:43 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:49 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
4:54 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:00 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:06 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:11 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:17 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:23 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:29 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:34 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:40 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:46 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". The process cannot access the file because it is being used by another process
5:52 AM: Warning: Failed to check file "C:\WINDOWS\SYSTEM32\fhlpnxy\guycrm.exe". Cannot open file "C:\WINDOWS\SYSTEM32\fhlpnxy\gu
  • 0

#18
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
HI there :)

[bleep], I must have missed something, its still in there :tazz: :) :)

Ok, did you have any problems when you were running the fixes? Any error messages? Have you got anything disabled from starting through msconfig?

Can you please give me a fresh safe mode startup list and a fresh screenshot of the non PnP devices please? Ill start again.
  • 0

#19
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
Hi There

One of my colleagues has suugested another analysis tool to use.

Please go HERE
  • Scroll down the page
  • Download the "Registry Search Tool"
  • Unzip RegSrch.zip to the desktop
  • Double click on RegSrch.vbs
    If you get a warning from your Anti-Virus please ignore it and allow this to run.
  • When it starts, you will be prompted to enter a search phrase.
  • Please enter this:


    guycrm.exe

  • Click OK, it will disappear and won't look as if it's doing anything. When it's done searching, a prompt will come up saying how many instances it found. Click OK, and a notepad will open up. Please copy the contents of that notepad and paste it here.
This little bugger can run but it cant hide forever. :tazz:
  • 0

#20
jbrown7441

jbrown7441

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
I didn't get anything weird happening when I tried the fixes.

Here are the three posts you asked for, and I will run the Regsrch.vbs you asked and post the same two logs again. I ran the safemode startup list and screen shot of non PnP devices before running the Regsrch.vbs. Do you want me to give you those two items after running teh Regsrch.vbs as well? :tazz:


______________________


StartupList report, 10/5/2005, 8:42:37 AM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\jbrown\Desktop\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\jbrown\Desktop\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\jbrown\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Acrobat Speed Launcher.lnk = ?
AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
HPAiODevice(hp officejet g series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet g series\Bin\hpoavn07.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

Shell folders Common AltStartup:
*Folder not found*


User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
DVDLauncher = "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
Acrobat Assistant 7.0 = "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
(Default) =
HPAIO_PrintFolderMgr = C:\WINDOWS\System32\spool\DRIVERS\W32X86\hpoopm07.exe
ISUSPM Startup = C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
ISUSScheduler = "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
Microsoft Works Update Detection = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
ccApp = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
vptray = C:\PROGRA~1\SYMANT~2\VPTray.exe
gcasServ = "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
cplkm = C:\WINDOWS\system32\kxpqfx\cplkm.exe
THGuard = "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
SpySweeper = "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
guycrm = C:\WINDOWS\system32\fhlpnxy\guycrm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
services32 = C:\Program Files\Common Files\Windows\mc-110-12-0000079.exe
H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\AutoCADScriptFile\shell\open\command

(Default) = "C:\WINDOWS\system32\notepad.exe" "%1"

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

[{8b15971b-5355-4c82-8c07-7e181ea07608}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Download Program Files:

[CKAVWebScan Object]
InProcServer32 = C:\WINDOWS\system32\Kaspersky Lab\Kaspersky On-line Scanner\kavwebscan.dll
CODEBASE = http://www.kaspersky...can_unicode.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\LegitCheckControl.DLL
CODEBASE = http://go.microsoft....k/?linkid=39204

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.micros...ntent/opuc2.cab

[{56336BCB-3D8A-11D6-A00B-0050DA18DE71}]
CODEBASE = http://software-dl.r...tzip/RdxIE2.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
CODEBASE = http://a840.g.akamai...all/xscan53.cab


[Java Plug-in 1.5.0_04]
InProcServer32 = C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
CODEBASE = http://java.sun.com/...indows-i586.cab

[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
CODEBASE = http://messenger.msn...pDownloader.cab

[Java Plug-in 1.4.2_03]
InProcServer32 = C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
CODEBASE = http://java.sun.com/...indows-i586.cab

[Java Plug-in 1.5.0_02]
InProcServer32 = C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
CODEBASE = http://java.sun.com/...indows-i586.cab

[Java Plug-in 1.5.0_04]
InProcServer32 = C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
CODEBASE = http://java.sun.com/...indows-i586.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\macromed\flash\Flash.ocx
CODEBASE = http://download.macr...ash/swflash.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE = https://mathsoft.web...ent/ieatgpc.cab

[QDiagHUpdateObj Class]
InProcServer32 = C:\WINDOWS\system32\qdiagh.ocx
CODEBASE = http://h30043.www3.h.../qdiagh.cab?326

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

abp480n5: system32\DRIVERS\ABP480N5.SYS (system)
Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Adobe LM Service: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)
adpu160m: system32\DRIVERS\adpu160m.sys (system)
aeaudio: system32\drivers\aeaudio.sys (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
Intel AGP Bus Filter: system32\DRIVERS\agp440.sys (system)
Compaq AGP Bus Filter: system32\DRIVERS\agpCPQ.sys (system)
Aha154x: system32\DRIVERS\aha154x.sys (system)
aic78u2: system32\DRIVERS\aic78u2.sys (system)
aic78xx: system32\DRIVERS\aic78xx.sys (system)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
AliIde: system32\DRIVERS\aliide.sys (system)
ALI AGP Bus Filter: system32\DRIVERS\alim1541.sys (system)
AMD AGP Bus Filter Driver: system32\DRIVERS\amdagp.sys (system)
amsint: system32\DRIVERS\amsint.sys (system)
aokxlhk: \??\C:\WINDOWS\system32\jsjdflb\aokxlhk (manual start)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
asc: system32\DRIVERS\asc.sys (system)
asc3350p: system32\DRIVERS\asc3350p.sys (system)
asc3550: system32\DRIVERS\asc3550.sys (system)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
Ati HotKey Poller: %SystemRoot%\system32\Ati2evxx.exe (autostart)
ati2mtag: system32\DRIVERS\ati2mtag.sys (manual start)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
Autodesk Licensing Service: "C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe" (manual start)
Broadcom NetXtreme 57xx Gigabit Controller: system32\DRIVERS\b57xp32.sys (manual start)
Belarc SMBios Access: \SystemRoot\System32\Drivers\BANTExt.sys (system)
Broadcom ASF IP monitoring service v6.0.4: C:\WINDOWS\system32\basfipm.exe (autostart)
BASFND: \??\C:\WINDOWS\system32\Drivers\BASFND.sys (autostart)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
cbidf: system32\DRIVERS\cbidf2k.sys (system)
Symantec Event Manager: "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" (autostart)
Symantec Password Validation: "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe" (manual start)
Symantec Settings Manager: "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" (autostart)
cd20xrnt: system32\DRIVERS\cd20xrnt.sys (system)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
CmdIde: system32\DRIVERS\cmdide.sys (system)
Command Service: C:\WINDOWS\amJyb3du\command.exe (autostart)
COM+ System Application: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cpqarray: system32\DRIVERS\cpqarray.sys (system)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
CWShredder Service: c:\program files\InterMute\SpySubtract\CWShredder.exe service (autostart)
dac2w2k: system32\DRIVERS\dac2w2k.sys (system)
dac960nt: system32\DRIVERS\dac960nt.sys (system)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
Symantec AntiVirus Definition Watcher: "C:\Program Files\Symantec AntiVirus\DefWatch.exe" (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Logical Disk Manager Driver: System32\drivers\dmio.sys (system)
dmload: System32\drivers\dmload.sys (system)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (manual start)
MS IEEE-1284.4 Driver: system32\DRIVERS\Dot4.sys (manual start)
Print Class Driver for IEEE-1284.4: system32\DRIVERS\Dot4Prt.sys (manual start)
Scan Class Driver for IEEE-1284.4: system32\DRIVERS\Dot4Scan.sys (manual start)
Dot4USB Filter Dot4USB Filter: system32\DRIVERS\dot4usb.sys (manual start)
dpti2o: system32\DRIVERS\dpti2o.sys (system)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
Intel® PRO Adapter Driver: system32\DRIVERS\e100b325.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
ewido security suite control: C:\Program Files\ewido\security suite\ewidoctrl.exe (autostart)
ewido security suite driver: \??\C:\Program Files\ewido\security suite\guard.sys (system)
ewido security suite guard: C:\Program Files\ewido\security suite\ewidoguard.exe (autostart)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Fax: %systemroot%\system32\fxssvc.exe (autostart)
Floppy Disk Controller Driver: system32\DRIVERS\fdc.sys (manual start)
Floppy Disk Driver: system32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\DRIVERS\fltMgr.sys (system)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
hpn: system32\DRIVERS\hpn.sys (system)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i2omp: system32\DRIVERS\i2omp.sys (system)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
ialm: system32\DRIVERS\ialmnt5.sys (manual start)
IIS Admin: C:\WINDOWS\system32\inetsrv\inetinfo.exe (autostart)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\system32\imapi.exe (manual start)
ini910u: system32\DRIVERS\ini910u.sys (system)
IntelIde: system32\DRIVERS\intelide.sys (system)
Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\DRIVERS\Ip6Fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Keyboard HID Driver: system32\DRIVERS\kbdhid.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe" (autostart)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
mraid35x: system32\DRIVERS\mraid35x.sys (system)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
FTP Publishing: %SystemRoot%\system32\inetsrv\inetinfo.exe (autostart)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
NAVENG: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20051003.006\naveng.sys (manual start)
NAVEX15: \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20051003.006\navex15.sys (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\system32\lsass.exe (autostart)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: system32\DRIVERS\nv4_mini.sys (manual start)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
Parallel port driver: system32\DRIVERS\parport.sys (manual start)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
perc2: system32\DRIVERS\perc2.sys (system)
perc2hib: system32\DRIVERS\perc2hib.sys (system)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
PxHelp20: system32\DRIVERS\PxHelp20.sys (system)
ql1080: system32\DRIVERS\ql1080.sys (system)
Ql10wnt: system32\DRIVERS\ql10wnt.sys (system)
ql12160: system32\DRIVERS\ql12160.sys (system)
ql1240: system32\DRIVERS\ql1240.sys (system)
ql1280: system32\DRIVERS\ql1280.sys (system)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Terminal Server Device Redirector Driver: system32\DRIVERS\rdpdr.sys (manual start)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Remote Registry: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
SAVRoam: "C:\Program Files\Symantec AntiVirus\SavRoam.exe" (autostart)
SAVRT: \??\C:\Program Files\Symantec AntiVirus\savrt.sys (system)
SAVRTPEL: \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys (system)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Sentinel: \SystemRoot\System32\Drivers\SENTINEL.SYS (autostart)
Serenum Filter Driver: system32\DRIVERS\serenum.sys (manual start)
Serial port driver: system32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SIS AGP Bus Filter: system32\DRIVERS\sisagp.sys (system)
Simple Mail Transfer Protocol (SMTP): C:\WINDOWS\system32\inetsrv\inetinfo.exe (autostart)
smwdm: system32\drivers\smwdm.sys (manual start)
Symantec Network Drivers Service: "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe" (manual start)
Rainbow USB SuperPro: system32\DRIVERS\SNTNLUSB.SYS (manual start)
Sparrow: system32\DRIVERS\sparrow.sys (system)
SPBBCDrv: \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (manual start)
Symantec SPBBCSvc: "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe" (manual start)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
Webroot Spy Sweeper Engine: C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe (autostart)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{2F130D52-0BDB-47EB-AF81-1E09BA7E21E7} (manual start)
Symantec AntiVirus: "C:\Program Files\Symantec AntiVirus\Rtvscan.exe" (autostart)
symc810: system32\DRIVERS\symc810.sys (system)
symc8xx: system32\DRIVERS\symc8xx.sys (system)
SymEvent: \??\C:\Program Files\Symantec\SYMEVENT.SYS (disabled)
SYMREDRV: \SystemRoot\System32\Drivers\SYMREDRV.SYS (manual start)
SYMTDI: \SystemRoot\System32\Drivers\SYMTDI.SYS (system)
sym_hi: system32\DRIVERS\sym_hi.sys (system)
sym_u3: system32\DRIVERS\sym_u3.sys (system)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Telnet: C:\WINDOWS\system32\tlntsvr.exe (disabled)
TosIde: system32\DRIVERS\toside.sys (system)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
ultra: system32\DRIVERS\ultra.sys (system)
uosfngi: \??\C:\WINDOWS\system32\flpiqev\uosfngi (manual start)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
USB2 Enabled Hub: system32\DRIVERS\usbhub.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: system32\DRIVERS\usbuhci.sys (manual start)
VgaSave: \SystemRoot\System32\drivers\vga.sys (system)
VIA AGP Bus Filter: system32\DRIVERS\viaagp.sys (system)
ViaIde: system32\DRIVERS\viaide.sys (system)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
World Wide Web Publishing: %SystemRoot%\system32\inetsrv\inetinfo.exe (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
Windows CE USB Serial Host Driver: system32\DRIVERS\wceusbsh.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Windows Management Instrumentation Driver Extensions: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NTPort Library Driver: \??\C:\WINDOWS\system32\zntport.sys (autostart)


--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 37,941 bytes
Report generated in 0.094 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


____________________________________



Attached File  screenshot.doc   189.5KB   5 downloads



____________________________________




REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "guycrm.exe" 10/5/2005 8:56:30 AM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89C3C1CF-E7DD-6F34-93F4-C3504E424838}\InprocServer32]
@="C:\\WINDOWS\\system32\\fhlpnxy\\guycrm.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"guycrm"="C:\\WINDOWS\\system32\\fhlpnxy\\guycrm.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Webroot\SpySweeper\Startup\id_30]
"Value"="C:\\WINDOWS\\system32\\fhlpnxy\\guycrm.exe"

"C:\\Documents and Settings\\jbrown\\My Documents\\eDonkey2000 Downloads\\[Autodesk.AutoCAD.2006.?????].keygen.exe"="[Autodesk.AutoCAD.2006.?????].keygen"
"C:\\WINDOWS\\system32\\fhlpnxy\\guycrm.exe"="guycrm"
  • 0

#21
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
Hi there,

No, just the regsearch log will be fine ta.
  • 0

#22
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
Hiya

BINGO!!!!, got it!!

Great, I will post again asap.
  • 0

#23
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
Hi there :)

We are going to take this thing apart and see how it works.

Download sfp and unzip it to your desktop.
  • Double click sfp.exe thats on your desktop
  • In step one, please paste in the following files(s):
    • C:\WINDOWS\system32\fhlpnxy
  • Click "Continue"
  • sfp will creat a zip file called requested-files (and the date) on your desktop
Email that file to submit@atribune.org


Thanks :tazz:
  • 0

#24
jbrown7441

jbrown7441

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
Done
  • 0

#25
jbrown7441

jbrown7441

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
By the way, what have I contracted? Is it a virus, or just real bad malware?
  • 0

Advertisements


#26
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
Hi There

Thats not a question that has a straightforward answer.

Malware is becoming more and more complex, and its development is accelerating. The sad fact is that the coders who used to write virii as an intellectual exercise are now working for the malware companies and making money at it. Over the past month or so, we have started seeing familiar infections using new techniques to resist removal. This is one such case. An old infection (Aurora) which we had beat is using some fairly sophisticated techniques to reinstall itself, using what is known as a rootkit. this hides the re infector in strange places with camouflage to make them look legit and hide from the scanners. So we treat Aurora but it comes back. Then we dig and start looking for other things, lo and behold - a rootkit is there. I was sure we had them last time, but I still missed something in all that data, so you got reinfected. However, I think we have found where THAT reinfector was stealthed, but to make sure, we are going to take that folder you sent apart and see what makes it tick.

We WILL get this.
  • 0

#27
jbrown7441

jbrown7441

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
:tazz: Cool, thanks. By the way, I have seen no further popups since the "fix". I will still do what ever you say needs to be done. I think all these guys should be arrested. They rob the most valuable commodity, time. :)

Thanks
  • 0

#28
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
Thanks for that, your patience and willingness to help us here is appreciated. :tazz:
  • 0

#29
ukbiker

ukbiker

    Rest in Peace, ukbiker

  • Retired Staff
  • 2,014 posts
Hi again :)

Well this is getting to be annoying now :tazz:

can you please do the following

1) Ensure that your system is set to show all hidden files and folders.

2) Reboot into Safe Mode

3) Using Windows Explorer, navigate to this Folder

C:\WINDOWS\system32\fhlpnxy

4) Using Winzip or similar, compress that Folder and its contents into a .zip file.

5) Email the .zip file to

submit@atribune.org

6) Title the Email

FAO Atri - Rootkit Folder

Thanks.
  • 0

#30
jbrown7441

jbrown7441

    Member

  • Topic Starter
  • Member
  • PipPip
  • 25 posts
I couldn't find that file at all. :tazz:

I need to get outa here, so will respond further tomorrow.

Thanks.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP