Help With Log

Logfile of HijackThis v1.99.1
Scan saved at 3:02:36 PM, on 3/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\PackethSvc.exe
C:\Program Files\America Online 6.0a\aoltray.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinAce\WinAce.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\~AceTemp\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://northeastkansas.cox.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://discussions.playnet.com/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [webmc] C:\WINDOWS\AppPatch\webmc.exe
O4 - HKLM\..\Run: [*utilcab] C:\WINDOWS\Fonts\utilcab.exe
O4 - HKLM\..\Run: [*playav] C:\WINDOWS\Speech\playav.exe
O4 - HKLM\..\Run: [*bakvga] C:\WINDOWS\Config\bakvga.exe
O4 - HKLM\..\Run: [*dlldoc] C:\WINDOWS\repair\dlldoc.exe
O4 - HKLM\..\Run: [*rasmfc] C:\WINDOWS\Microsoft.NET\rasmfc.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [tgryb] C:\WINDOWS\system32\ynvqv\tgryb.exe
O4 - HKLM\..\Run: [bohref] C:\WINDOWS\system32\cugeiulo\bohref.exe
O4 - HKLM\..\Run: [chpb] C:\WINDOWS\system32\ecnt\chpb.exe
O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\system32\wsxsvc\wsxsvc.exe
O4 - HKLM\..\Run: [vmss] C:\WINDOWS\system32\vmss\vmss.exe
O4 - HKLM\..\Run: [wrswho] C:\WINDOWS\system32\qbefm\wrswho.exe
O4 - HKLM\..\Run: [tvqc] C:\WINDOWS\system32\xvmjee\tvqc.exe
O4 - HKLM\..\Run: [mjlnlwna] C:\WINDOWS\system32\qxnsmqd\mjlnlwna.exe
O4 - HKLM\..\Run: [jihkc] C:\WINDOWS\system32\pjbe\jihkc.exe
O4 - HKLM\..\Run: [sfkc] C:\WINDOWS\system32\uvxfc\sfkc.exe
O4 - HKLM\..\Run: [movsj] C:\WINDOWS\system32\kuscrjeg\movsj.exe
O4 - HKLM\..\Run: [qpifi] C:\WINDOWS\system32\hufryck\qpifi.exe
O4 - HKLM\..\Run: [jksu] C:\WINDOWS\system32\ysektxo\jksu.exe
O4 - HKLM\..\Run: [pqiyft] C:\WINDOWS\system32\eilyhul\pqiyft.exe
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\dealhelper.exe
O4 - HKLM\..\Run: [vdmw] C:\WINDOWS\system32\nmggq\vdmw.exe
O4 - HKLM\..\Run: [heuyws] C:\WINDOWS\system32\cvvtex\heuyws.exe
O4 - HKLM\..\Run: [brfagtf] C:\WINDOWS\system32\dfuf\brfagtf.exe
O4 - HKLM\..\Run: [cyukojxe] C:\WINDOWS\system32\abttggkq\cyukojxe.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DeskAd Service] C:\Program Files\DeskAd Service\DeskAdServ.exe
O4 - HKLM\..\Run: [lmu] C:\WINDOWS\LMU.exe
O4 - HKLM\..\Run: [aKkF] C:\WINDOWS\vvdbwlbo.exe
O4 - HKLM\..\Run: [secure] C:\WINDOWS\system32\secure.exe
O4 - HKLM\..\Run: [qgkg] C:\WINDOWS\system32\fnyraya\qgkg.exe
O4 - HKLM\..\Run: [otkie] C:\WINDOWS\system32\xwwwre\otkie.exe
O4 - HKLM\..\Run: [piwae] C:\WINDOWS\system32\ggfvaox\piwae.exe
O4 - HKLM\..\Run: [vxkxyaih] C:\WINDOWS\system32\duldbvi\vxkxyaih.exe
O4 - HKLM\..\Run: [ssqb.exe] ssqb.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [dlsmgr] C:\Program Files\dlsmgr\dlsmgr.exe
O4 - HKLM\..\Run: [ajds] C:\WINDOWS\system32\gscutwrr\ajds.exe
O4 - HKLM\..\Run: [eansiafj] C:\WINDOWS\system32\cttq\eansiafj.exe
O4 - HKLM\..\Run: [mbbuvord] C:\WINDOWS\system32\pglcww\mbbuvord.exe
O4 - HKLM\..\Run: [jtfxm] C:\WINDOWS\system32\gbbky\jtfxm.exe
O4 - HKLM\..\Run: [wfqqf] C:\WINDOWS\system32\uiihhj\wfqqf.exe
O4 - HKLM\..\Run: [mvxwusni] C:\WINDOWS\system32\iktwikql\mvxwusni.exe
O4 - HKLM\..\Run: [oagtejrl] C:\WINDOWS\system32\ugbof\oagtejrl.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [popuppers] C:\WINDOWS\newpop61.exe
O4 - HKLM\..\Run: [BPT] "C:\Program Files\Bpt\bpt.exe"
O4 - HKLM\..\Run: [utrmjyx] C:\WINDOWS\system32\bmsoda\utrmjyx.exe
O4 - HKLM\..\Run: [wmpd] C:\WINDOWS\system32\ntpvf\wmpd.exe
O4 - HKLM\..\Run: [ryqqovr] C:\WINDOWS\system32\oraxij\ryqqovr.exe
O4 - HKLM\..\Run: [iuuvn] C:\WINDOWS\system32\hfjqcjrr\iuuvn.exe
O4 - HKLM\..\Run: [dicb] C:\WINDOWS\system32\amustwh\dicb.exe
O4 - HKLM\..\Run: [yener] C:\WINDOWS\system32\xhadf\yener.exe
O4 - HKLM\..\Run: [pdqjhdh] C:\WINDOWS\system32\kcxub\pdqjhdh.exe
O4 - HKLM\..\Run: [ygqt] C:\WINDOWS\system32\dkpdp\ygqt.exe
O4 - HKLM\..\Run: [jhgbiqjb] C:\WINDOWS\system32\sxny\jhgbiqjb.exe
O4 - HKLM\..\Run: [nnoit] C:\WINDOWS\system32\monwysa\nnoit.exe
O4 - HKLM\..\Run: [mqsp] C:\WINDOWS\system32\oufgggy\mqsp.exe
O4 - HKLM\..\Run: [wlexjffx] C:\WINDOWS\system32\ehfetf\wlexjffx.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [tkhiset] C:\WINDOWS\system32\wxqus\tkhiset.exe
O4 - HKLM\..\Run: [dvct] C:\WINDOWS\system32\palkmhl\dvct.exe
O4 - HKLM\..\Run: [xsecnvxa] C:\WINDOWS\system32\fvia\xsecnvxa.exe
O4 - HKLM\..\Run: [bfggwx] C:\WINDOWS\system32\hbxq\bfggwx.exe
O4 - HKLM\..\Run: [scjfpj] C:\WINDOWS\system32\ioskfum\scjfpj.exe
O4 - HKLM\..\Run: [guyh] C:\WINDOWS\system32\sehf\guyh.exe
O4 - HKLM\..\Run: [ungmfxq] C:\WINDOWS\system32\lvprhck\ungmfxq.exe
O4 - HKLM\..\Run: [wlxohjn] C:\WINDOWS\system32\bjqkxkby\wlxohjn.exe
O4 - HKLM\..\Run: [shoji] C:\WINDOWS\system32\dayee\shoji.exe
O4 - HKLM\..\Run: [giomly] C:\WINDOWS\system32\dihw\giomly.exe
O4 - HKLM\..\Run: [hjsjmoc] C:\WINDOWS\system32\ohajbl\hjsjmoc.exe
O4 - HKLM\..\Run: [igdw] C:\WINDOWS\system32\rmxh\igdw.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdt.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [ci61kvo1] C:\Program Files\ci61kvo1\ci61kvo1.exe
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [App32dll] C:\windows\system32\msnavc32.exe lee0105
O4 - HKLM\..\Run: [SystemCheck] C:\WINDOWS\SysCheckBop32
O4 - HKLM\..\Run: [wlei] C:\WINDOWS\system32\btmkjbbd\wlei.exe
O4 - HKLM\..\Run: [crjhpcol] C:\WINDOWS\system32\lredin\crjhpcol.exe
O4 - HKLM\..\Run: [ukofxu] C:\WINDOWS\system32\bbvcr\ukofxu.exe
O4 - HKLM\..\Run: [ayqj] C:\WINDOWS\system32\qwacvmd\ayqj.exe
O4 - HKLM\..\Run: [srigl] C:\WINDOWS\system32\ftejqb\srigl.exe
O4 - HKLM\..\Run: [ldxgwa] C:\WINDOWS\system32\gfogg\ldxgwa.exe
O4 - HKLM\..\Run: [acqjqwq] C:\WINDOWS\system32\mmbjom\acqjqwq.exe
O4 - HKLM\..\Run: [wciel] C:\WINDOWS\system32\qcbbt\wciel.exe
O4 - HKLM\..\Run: [kxqv] C:\WINDOWS\system32\lwkwih\kxqv.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [viblcm] C:\WINDOWS\system32\whwfaiqm\viblcm.exe
O4 - HKLM\..\Run: [qyfit] C:\WINDOWS\system32\qyxo\qyfit.exe
O4 - HKLM\..\Run: [salsrhqi] C:\WINDOWS\system32\yyuhnoo\salsrhqi.exe
O4 - HKLM\..\Run: [bspymfgr] C:\WINDOWS\system32\uomvrba\bspymfgr.exe
O4 - HKLM\..\Run: [ioddw] C:\WINDOWS\system32\ofneao\ioddw.exe
O4 - HKLM\..\Run: [nldfn] C:\WINDOWS\system32\ibyfco\nldfn.exe
O4 - HKLM\..\Run: [toqb] C:\WINDOWS\system32\idcwma\toqb.exe
O4 - HKLM\..\Run: [njfkwfjy] C:\WINDOWS\system32\cuxc\njfkwfjy.exe
O4 - HKLM\..\Run: [yrtodi] C:\WINDOWS\system32\agfcff\yrtodi.exe
O4 - HKLM\..\Run: [axbftveh] C:\WINDOWS\system32\ornb\axbftveh.exe
O4 - HKLM\..\Run: [iwwovw] C:\WINDOWS\system32\ybdwboy\iwwovw.exe
O4 - HKLM\..\Run: [tjnlgk] C:\WINDOWS\system32\wicagx\tjnlgk.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [fayjcuio] C:\WINDOWS\system32\ynlxg\fayjcuio.exe
O4 - HKLM\..\Run: [hrfd] C:\WINDOWS\system32\isei\hrfd.exe
O4 - HKLM\..\Run: [kwcdd] C:\WINDOWS\system32\iewuhtfi\kwcdd.exe
O4 - HKLM\..\Run: [qxjgmwo] C:\WINDOWS\system32\cfcfltgk\qxjgmwo.exe
O4 - HKLM\..\Run: [xmawvdsu] C:\WINDOWS\system32\gwdtffy\xmawvdsu.exe
O4 - HKLM\..\Run: [vovvswe] C:\WINDOWS\system32\nfubeu\vovvswe.exe
O4 - HKLM\..\Run: [ftbjl] C:\WINDOWS\system32\mlollpbp\ftbjl.exe
O4 - HKLM\..\Run: [ycinkjeg] C:\WINDOWS\system32\cdddf\ycinkjeg.exe
O4 - HKLM\..\Run: [mjtnxa] C:\WINDOWS\system32\fniuyf\mjtnxa.exe
O4 - HKLM\..\Run: [ewfud] C:\WINDOWS\system32\menwrmml\ewfud.exe
O4 - HKLM\..\Run: [qshl] C:\WINDOWS\system32\qshl.exe
O4 - HKLM\..\Run: [gxjcb] C:\WINDOWS\system32\pyax\gxjcb.exe
O4 - HKLM\..\Run: [nllafxkb] C:\WINDOWS\system32\ykdjyh\nllafxkb.exe
O4 - HKLM\..\Run: [crtjgkr] C:\WINDOWS\system32\ptvgdrnu\crtjgkr.exe
O4 - HKLM\..\Run: [drndmoh] C:\WINDOWS\system32\iyarlnqb\drndmoh.exe
O4 - HKLM\..\Run: [vjtpmoh] C:\WINDOWS\system32\qgrrcn\vjtpmoh.exe
O4 - HKLM\..\Run: [bbabhvkb] C:\WINDOWS\system32\xoepjalg\bbabhvkb.exe
O4 - HKLM\..\Run: [gwekerv] C:\WINDOWS\system32\gaukur\gwekerv.exe
O4 - HKLM\..\Run: [xves] C:\WINDOWS\system32\lwujjw\xves.exe
O4 - HKLM\..\Run: [vusgnf] C:\WINDOWS\system32\mcfout\vusgnf.exe
O4 - HKLM\..\Run: [vomuejnc] C:\WINDOWS\system32\xgpb\vomuejnc.exe
O4 - HKLM\..\Run: [AutoLoader3Fw61OWgKZaU] "C:\WINDOWS\system32\ctbenh.exe" /HideDir /HideUninstall /PC="CP.FHB" /ShowLegalNote="nonbranded"
O4 - HKLM\..\Run: [jevb] C:\WINDOWS\system32\amcxdb\jevb.exe
O4 - HKLM\..\Run: [oucae] C:\WINDOWS\system32\xeddojx\oucae.exe
O4 - HKLM\..\Run: [rawju] C:\WINDOWS\system32\igbhqgje\rawju.exe
O4 - HKLM\..\Run: [ouggwd] C:\WINDOWS\system32\ipxmo\ouggwd.exe
O4 - HKLM\..\Run: [awicimc] C:\WINDOWS\system32\cjanxbqr\awicimc.exe
O4 - HKLM\..\Run: [jwkiwq] C:\WINDOWS\system32\ruafwr\jwkiwq.exe
O4 - HKLM\..\Run: [xxlt] C:\WINDOWS\system32\geju\xxlt.exe
O4 - HKLM\..\Run: [3sFg34j] ctbenh.exe
O4 - HKLM\..\Run: [hodidaav] C:\WINDOWS\system32\isytdk\hodidaav.exe
O4 - HKLM\..\Run: [yrtf] C:\WINDOWS\system32\kmgshy\yrtf.exe
O4 - HKLM\..\Run: [cqxcr] C:\WINDOWS\system32\ekipqeqh\cqxcr.exe
O4 - HKLM\..\Run: [gobukj] C:\WINDOWS\system32\ravwpj\gobukj.exe
O4 - HKLM\..\Run: [dggc] C:\WINDOWS\system32\qjyeobt\dggc.exe
O4 - HKLM\..\Run: [jscegef] C:\WINDOWS\system32\shykydbi\jscegef.exe
O4 - HKLM\..\Run: [vurim] C:\WINDOWS\system32\dmjn\vurim.exe
O4 - HKLM\..\Run: [msw] C:\Documents and Settings\All Users\Application Data\msw\MSW.exe
O4 - HKLM\..\Run: [owhhny] C:\WINDOWS\system32\srrcs\owhhny.exe
O4 - HKLM\..\Run: [sqjl] C:\WINDOWS\system32\eylm\sqjl.exe
O4 - HKLM\..\Run: [rasl] C:\WINDOWS\system32\vnlxoifc\rasl.exe
O4 - HKLM\..\Run: [tkoubqy] C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O4 - HKLM\..\Run: [iamexsng] C:\WINDOWS\system32\cgdo\iamexsng.exe
O4 - HKLM\..\Run: [ynudcnq] C:\WINDOWS\system32\pbhiuvvx\ynudcnq.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\eliteifg32.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Game Service 4] C:\Program Files\ubi.com\Core\GS4.exe +user +pswd -l +js "SILENTHUNTER2|DESTROYERCOMMAND|1000015" -nopatch
O4 - HKCU\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKCU\..\Run: [IBwmRQHqR] mdmdui.exe
O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\wtta.exe
O4 - HKCU\..\Run: [Zyvylft] C:\WINDOWS\system32\l?gonui.exe
O4 - HKCU\..\Run: [sysmonnt] C:\WINDOWS\system32\sysmonnt
O4 - HKCU\..\Run: [pruttct] C:\WINDOWS\system32\pruttct.exe
O4 - HKCU\..\RunOnce: [pruttct] C:\WINDOWS\system32\pruttct.exe
O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Registration Lock On
O4 - Global Startup: America Online 6.0 Tray Icon.lnk = C:\Program Files\America Online 6.0a\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: LimeWire 3.8.10.lnk = C:\Program Files\LimeWire\3.8.10\LimeWire.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: >>> HARDCORE MOVIES <<< - javascript:{document.location='http://neosexvideo.com/webmasters/df004/access.htm';}
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Hijacked Internet access by New.Net
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\lsp.dll' missing
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/NDWCab.CAB
O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - http://download.bargain-buddy.net/download…MARKETING11.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.taxsimple.com/TSWeb/msrdp.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0410.dll
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0011.exe
O16 - DPF: {EEF29D20-9A47-4657-ADF7-283EC2504001} - http://download.bigwebportal.com/toolbar2/winenc32.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: hodidaavisytdk - Unknown owner - C:\WINDOWS\system32\isytdk\hodidaav.exe (file missing)
O23 - Service: jscegefshykydbi - Unknown owner - C:\WINDOWS\system32\shykydbi\jscegef.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: tkoubqyhrohgbgo - Unknown owner - C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Hi Alan, thanks for the help.
The anti-virus you had me download found a boatload of "stuff"

The new HiJackThis scan is below

Logfile of HijackThis v1.99.1
Scan saved at 11:33:56 PM, on 3/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\PackethSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\hqenascb\hgws.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
C:\HJT\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://northeastkansas.cox.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://discussions.playnet.com/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\system32\stlb2.dll (file missing)
O2 - BHO: CControl Object - {3643ABC2-21BF-46B9-B230-F247DB0C6FD6} - C:\Program Files\E2G\IeBHOs.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll (file missing)
O2 - BHO: (no name) - {9545AF7D-6AB2-3514-CDD2-46819AC50F91} - C:\WINDOWS\system32\hxt.dll (file missing)
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\system32\stlb2.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [webmc] C:\WINDOWS\AppPatch\webmc.exe
O4 - HKLM\..\Run: [*utilcab] C:\WINDOWS\Fonts\utilcab.exe
O4 - HKLM\..\Run: [*playav] C:\WINDOWS\Speech\playav.exe
O4 - HKLM\..\Run: [*bakvga] C:\WINDOWS\Config\bakvga.exe
O4 - HKLM\..\Run: [*dlldoc] C:\WINDOWS\repair\dlldoc.exe
O4 - HKLM\..\Run: [*rasmfc] C:\WINDOWS\Microsoft.NET\rasmfc.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [bohref] C:\WINDOWS\system32\cugeiulo\bohref.exe
O4 - HKLM\..\Run: [chpb] C:\WINDOWS\system32\ecnt\chpb.exe
O4 - HKLM\..\Run: [wrswho] C:\WINDOWS\system32\qbefm\wrswho.exe
O4 - HKLM\..\Run: [mjlnlwna] C:\WINDOWS\system32\qxnsmqd\mjlnlwna.exe
O4 - HKLM\..\Run: [sfkc] C:\WINDOWS\system32\uvxfc\sfkc.exe
O4 - HKLM\..\Run: [movsj] C:\WINDOWS\system32\kuscrjeg\movsj.exe
O4 - HKLM\..\Run: [jksu] C:\WINDOWS\system32\ysektxo\jksu.exe
O4 - HKLM\..\Run: [pqiyft] C:\WINDOWS\system32\eilyhul\pqiyft.exe
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\dealhelper.exe
O4 - HKLM\..\Run: [vdmw] C:\WINDOWS\system32\nmggq\vdmw.exe
O4 - HKLM\..\Run: [heuyws] C:\WINDOWS\system32\cvvtex\heuyws.exe
O4 - HKLM\..\Run: [brfagtf] C:\WINDOWS\system32\dfuf\brfagtf.exe
O4 - HKLM\..\Run: [cyukojxe] C:\WINDOWS\system32\abttggkq\cyukojxe.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [aKkF] C:\WINDOWS\vvdbwlbo.exe
O4 - HKLM\..\Run: [qgkg] C:\WINDOWS\system32\fnyraya\qgkg.exe
O4 - HKLM\..\Run: [otkie] C:\WINDOWS\system32\xwwwre\otkie.exe
O4 - HKLM\..\Run: [piwae] C:\WINDOWS\system32\ggfvaox\piwae.exe
O4 - HKLM\..\Run: [vxkxyaih] C:\WINDOWS\system32\duldbvi\vxkxyaih.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [eansiafj] C:\WINDOWS\system32\cttq\eansiafj.exe
O4 - HKLM\..\Run: [mbbuvord] C:\WINDOWS\system32\pglcww\mbbuvord.exe
O4 - HKLM\..\Run: [jtfxm] C:\WINDOWS\system32\gbbky\jtfxm.exe
O4 - HKLM\..\Run: [wfqqf] C:\WINDOWS\system32\uiihhj\wfqqf.exe
O4 - HKLM\..\Run: [mvxwusni] C:\WINDOWS\system32\iktwikql\mvxwusni.exe
O4 - HKLM\..\Run: [oagtejrl] C:\WINDOWS\system32\ugbof\oagtejrl.exe
O4 - HKLM\..\Run: [utrmjyx] C:\WINDOWS\system32\bmsoda\utrmjyx.exe
O4 - HKLM\..\Run: [wmpd] C:\WINDOWS\system32\ntpvf\wmpd.exe
O4 - HKLM\..\Run: [ryqqovr] C:\WINDOWS\system32\oraxij\ryqqovr.exe
O4 - HKLM\..\Run: [iuuvn] C:\WINDOWS\system32\hfjqcjrr\iuuvn.exe
O4 - HKLM\..\Run: [dicb] C:\WINDOWS\system32\amustwh\dicb.exe
O4 - HKLM\..\Run: [yener] C:\WINDOWS\system32\xhadf\yener.exe
O4 - HKLM\..\Run: [pdqjhdh] C:\WINDOWS\system32\kcxub\pdqjhdh.exe
O4 - HKLM\..\Run: [ygqt] C:\WINDOWS\system32\dkpdp\ygqt.exe
O4 - HKLM\..\Run: [jhgbiqjb] C:\WINDOWS\system32\sxny\jhgbiqjb.exe
O4 - HKLM\..\Run: [nnoit] C:\WINDOWS\system32\monwysa\nnoit.exe
O4 - HKLM\..\Run: [mqsp] C:\WINDOWS\system32\oufgggy\mqsp.exe
O4 - HKLM\..\Run: [wlexjffx] C:\WINDOWS\system32\ehfetf\wlexjffx.exe
O4 - HKLM\..\Run: [tkhiset] C:\WINDOWS\system32\wxqus\tkhiset.exe
O4 - HKLM\..\Run: [dvct] C:\WINDOWS\system32\palkmhl\dvct.exe
O4 - HKLM\..\Run: [xsecnvxa] C:\WINDOWS\system32\fvia\xsecnvxa.exe
O4 - HKLM\..\Run: [bfggwx] C:\WINDOWS\system32\hbxq\bfggwx.exe
O4 - HKLM\..\Run: [scjfpj] C:\WINDOWS\system32\ioskfum\scjfpj.exe
O4 - HKLM\..\Run: [guyh] C:\WINDOWS\system32\sehf\guyh.exe
O4 - HKLM\..\Run: [ungmfxq] C:\WINDOWS\system32\lvprhck\ungmfxq.exe
O4 - HKLM\..\Run: [wlxohjn] C:\WINDOWS\system32\bjqkxkby\wlxohjn.exe
O4 - HKLM\..\Run: [shoji] C:\WINDOWS\system32\dayee\shoji.exe
O4 - HKLM\..\Run: [giomly] C:\WINDOWS\system32\dihw\giomly.exe
O4 - HKLM\..\Run: [hjsjmoc] C:\WINDOWS\system32\ohajbl\hjsjmoc.exe
O4 - HKLM\..\Run: [igdw] C:\WINDOWS\system32\rmxh\igdw.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\system32\winupdt.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [App32dll] C:\windows\system32\msnavc32.exe lee0105
O4 - HKLM\..\Run: [wlei] C:\WINDOWS\system32\btmkjbbd\wlei.exe
O4 - HKLM\..\Run: [crjhpcol] C:\WINDOWS\system32\lredin\crjhpcol.exe
O4 - HKLM\..\Run: [ukofxu] C:\WINDOWS\system32\bbvcr\ukofxu.exe
O4 - HKLM\..\Run: [srigl] C:\WINDOWS\system32\ftejqb\srigl.exe
O4 - HKLM\..\Run: [acqjqwq] C:\WINDOWS\system32\mmbjom\acqjqwq.exe
O4 - HKLM\..\Run: [wciel] C:\WINDOWS\system32\qcbbt\wciel.exe
O4 - HKLM\..\Run: [kxqv] C:\WINDOWS\system32\lwkwih\kxqv.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [viblcm] C:\WINDOWS\system32\whwfaiqm\viblcm.exe
O4 - HKLM\..\Run: [qyfit] C:\WINDOWS\system32\qyxo\qyfit.exe
O4 - HKLM\..\Run: [bspymfgr] C:\WINDOWS\system32\uomvrba\bspymfgr.exe
O4 - HKLM\..\Run: [ioddw] C:\WINDOWS\system32\ofneao\ioddw.exe
O4 - HKLM\..\Run: [nldfn] C:\WINDOWS\system32\ibyfco\nldfn.exe
O4 - HKLM\..\Run: [toqb] C:\WINDOWS\system32\idcwma\toqb.exe
O4 - HKLM\..\Run: [njfkwfjy] C:\WINDOWS\system32\cuxc\njfkwfjy.exe
O4 - HKLM\..\Run: [yrtodi] C:\WINDOWS\system32\agfcff\yrtodi.exe
O4 - HKLM\..\Run: [axbftveh] C:\WINDOWS\system32\ornb\axbftveh.exe
O4 - HKLM\..\Run: [tjnlgk] C:\WINDOWS\system32\wicagx\tjnlgk.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [fayjcuio] C:\WINDOWS\system32\ynlxg\fayjcuio.exe
O4 - HKLM\..\Run: [hrfd] C:\WINDOWS\system32\isei\hrfd.exe
O4 - HKLM\..\Run: [xmawvdsu] C:\WINDOWS\system32\gwdtffy\xmawvdsu.exe
O4 - HKLM\..\Run: [vovvswe] C:\WINDOWS\system32\nfubeu\vovvswe.exe
O4 - HKLM\..\Run: [ftbjl] C:\WINDOWS\system32\mlollpbp\ftbjl.exe
O4 - HKLM\..\Run: [ycinkjeg] C:\WINDOWS\system32\cdddf\ycinkjeg.exe
O4 - HKLM\..\Run: [mjtnxa] C:\WINDOWS\system32\fniuyf\mjtnxa.exe
O4 - HKLM\..\Run: [ewfud] C:\WINDOWS\system32\menwrmml\ewfud.exe
O4 - HKLM\..\Run: [gxjcb] C:\WINDOWS\system32\pyax\gxjcb.exe
O4 - HKLM\..\Run: [crtjgkr] C:\WINDOWS\system32\ptvgdrnu\crtjgkr.exe
O4 - HKLM\..\Run: [drndmoh] C:\WINDOWS\system32\iyarlnqb\drndmoh.exe
O4 - HKLM\..\Run: [bbabhvkb] C:\WINDOWS\system32\xoepjalg\bbabhvkb.exe
O4 - HKLM\..\Run: [xves] C:\WINDOWS\system32\lwujjw\xves.exe
O4 - HKLM\..\Run: [vusgnf] C:\WINDOWS\system32\mcfout\vusgnf.exe
O4 - HKLM\..\Run: [AutoLoader3Fw61OWgKZaU] "C:\WINDOWS\system32\ctbenh.exe" /HideDir /HideUninstall /PC="CP.FHB" /ShowLegalNote="nonbranded"
O4 - HKLM\..\Run: [jevb] C:\WINDOWS\system32\amcxdb\jevb.exe
O4 - HKLM\..\Run: [rawju] C:\WINDOWS\system32\igbhqgje\rawju.exe
O4 - HKLM\..\Run: [awicimc] C:\WINDOWS\system32\cjanxbqr\awicimc.exe
O4 - HKLM\..\Run: [jwkiwq] C:\WINDOWS\system32\ruafwr\jwkiwq.exe
O4 - HKLM\..\Run: [3sFg34j] ctbenh.exe
O4 - HKLM\..\Run: [hodidaav] C:\WINDOWS\system32\isytdk\hodidaav.exe
O4 - HKLM\..\Run: [yrtf] C:\WINDOWS\system32\kmgshy\yrtf.exe
O4 - HKLM\..\Run: [dggc] C:\WINDOWS\system32\qjyeobt\dggc.exe
O4 - HKLM\..\Run: [jscegef] C:\WINDOWS\system32\shykydbi\jscegef.exe
O4 - HKLM\..\Run: [owhhny] C:\WINDOWS\system32\srrcs\owhhny.exe
O4 - HKLM\..\Run: [sqjl] C:\WINDOWS\system32\eylm\sqjl.exe
O4 - HKLM\..\Run: [rasl] C:\WINDOWS\system32\vnlxoifc\rasl.exe
O4 - HKLM\..\Run: [tkoubqy] C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O4 - HKLM\..\Run: [iamexsng] C:\WINDOWS\system32\cgdo\iamexsng.exe
O4 - HKLM\..\Run: [ynudcnq] C:\WINDOWS\system32\pbhiuvvx\ynudcnq.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\eliteifg32.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [oeafuk] C:\WINDOWS\system32\dshofdox\oeafuk.exe
O4 - HKLM\..\Run: [edklxpn] C:\WINDOWS\system32\xgma\edklxpn.exe
O4 - HKLM\..\Run: [uouxqs] C:\WINDOWS\system32\utpxo\uouxqs.exe
O4 - HKLM\..\Run: [ikjv] C:\WINDOWS\system32\kyragesk\ikjv.exe
O4 - HKLM\..\Run: [hqumk] C:\WINDOWS\system32\rkoswwbq\hqumk.exe
O4 - HKLM\..\Run: [mvbtiru] C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
O4 - HKLM\..\Run: [tpuuyke] C:\WINDOWS\system32\bydl\tpuuyke.exe
O4 - HKLM\..\Run: [yfekhkan] C:\WINDOWS\system32\wqrr\yfekhkan.exe
O4 - HKLM\..\Run: [dfiaqs] C:\WINDOWS\system32\alccy\dfiaqs.exe
O4 - HKLM\..\Run: [alnlspq] C:\WINDOWS\system32\kgfyhvbe\alnlspq.exe
O4 - HKLM\..\Run: [uhmigfcf] C:\WINDOWS\system32\yieyb\uhmigfcf.exe
O4 - HKLM\..\Run: [djcuh] C:\WINDOWS\system32\qbqq\djcuh.exe
O4 - HKLM\..\Run: [jmctgwbi] C:\WINDOWS\system32\gnokcvv\jmctgwbi.exe
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [C:\WINDOWS\IEXPLOR.EXE] C:\WINDOWS\IEXPLOR.EXE
O4 - HKLM\..\Run: [AtxBrw] C:\WINDOWS\IEXPLOR.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [hgws] C:\WINDOWS\system32\hqenascb\hgws.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Game Service 4] C:\Program Files\ubi.com\Core\GS4.exe +user +pswd -l +js "SILENTHUNTER2|DESTROYERCOMMAND|1000015" -nopatch
O4 - HKCU\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKCU\..\Run: [IBwmRQHqR] mdmdui.exe
O4 - HKCU\..\Run: [Notn] C:\Documents and Settings\Owner\Application Data\wtta.exe
O4 - HKCU\..\Run: [Zyvylft] C:\WINDOWS\system32\l?gonui.exe
O4 - HKCU\..\Run: [sysmonnt] C:\WINDOWS\system32\sysmonnt
O4 - HKCU\..\Run: [aircity] C:\WINDOWS\system32\aircity.exe
O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Registration Lock On
O4 - Global Startup: America Online 6.0 Tray Icon.lnk = C:\Program Files\America Online 6.0a\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: LimeWire 3.8.10.lnk = C:\Program Files\LimeWire\3.8.10\LimeWire.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/NDWCab.CAB
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.taxsimple.com/TSWeb/msrdp.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0410.dll
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0011.exe
O16 - DPF: {EEF29D20-9A47-4657-ADF7-283EC2504001} - http://download.bigwebportal.com/toolbar2/winenc32.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: dggcqjyeobt - Unknown owner - C:\WINDOWS\system32\qjyeobt\dggc.exe
O23 - Service: edklxpnxgma - Unknown owner - C:\WINDOWS\system32\xgma\edklxpn.exe
O23 - Service: hgwshqenascb - Unknown owner - C:\WINDOWS\system32\hqenascb\hgws.exe
O23 - Service: jscegefshykydbi - Unknown owner - C:\WINDOWS\system32\shykydbi\jscegef.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: mvbtirultmfgq - Unknown owner - C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: oeafukdshofdox - Unknown owner - C:\WINDOWS\system32\dshofdox\oeafuk.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: tkoubqyhrohgbgo - Unknown owner - C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O23 - Service: uouxqsutpxo - Unknown owner - C:\WINDOWS\system32\utpxo\uouxqs.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: yfekhkanwqrr - Unknown owner - C:\WINDOWS\system32\wqrr\yfekhkan.exe

You still have a lot of bad items showing in your log. I'll have you run a few more scans to try to clean it up a little more. I realize that this will take some time but it is necessary to clean up your computer completely.

Step 1
Go to Add/Remove programs and remove New.Net or NewDotNet.

If there is no listing for it, use the uninstaller at newdotnet.com
Use procedure 4 to remove it. It requires that an internet connection be active while doing it.

Step 2
You have LimeWire on your computer. This is not technically malware by itself, but it may install malware in order to run properly and it opens the door for every other nasty program you can think of. I strongly recommend that you remove it. Read this article for alternatives that will provide some of the same function without the garbage: http://www.spywareinfo.com/articles/p2p/
This is optional but I strongly recommend removing this program.


Step 3
Download the free trojan scanner A2 Squared, update and run a scan with it. Fix anything found then reboot when completed.


Step 4
Please download and install Ad-Aware SE and Spybot S&D according to the following instructions. If you already have these programs, please make sure they are the latest version (Ad-Aware SE Personal 1.05, Spybot Search and Destroy 1.3), than run scans as described below.

Scanning With Spybot S&D:

1. Downloaded and Install Spybot S&D accepting the Default Settings.

2. In the Menu Bar at the top of the Spybot window you will see 'Mode'. Make certain that 'default mode' has a check mark beside it.

3. Close ALL windows except Spybot S&D.

4. Click the button to ‘Search for Updates’ then download and install the Updates.

5. Next click the button ‘Check for Problems’

6. When Spybot is complete, it will be showing ‘RED’ entries bold 'Black' entries and ‘GREEN’ entries in the window.

7. Make certain there is a check mark beside all of the RED entries ONLY.

8. Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED entries.

9.REBOOT to complete the scan and clear memory.

10. Do not enable Tea Timer until the log is clean as it will prevent the fix from working.


Scanning With Ad-Aware SE:

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan.

2.Close ALL windows except Ad-Aware SE.

3. Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window.

1) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

Under Definitions:
*Prompt to udate outdated definitions - set the number of days


2) Click on the ‘Scanning’ button on the left and select in green :

Under Driver, Folders & Files:
*Scan Within Archives

Under Select drives & folders to scan -
*choose all hard drives

Under Memory & Registry: all green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file


3) Click on the ‘Advanced’ button on the left and select in green:

Under Shell Integration:
*Move deleted files to recycle bin

Under Logfile Detail Level: (all green)
*include addtional object information
*DESELECT - include negligible objects information
*include environment information

Under Alternate Data Streams:
*Don't log streams smaller than 0 bytes
*Don't log ADS with the following names: CA_INOCULATEIT


4) Click the ‘Tweak’ button and select in green:

Under the ‘Scanning Engine’:
*Unload recognized processes during scanning
*Scan registry for all users instead of current user only


Under the ‘Cleaning Engine’:
*Let Windows remove files in use at next reboot


Under the Log Files:
*Include basic Ad-aware SE settings in logfile
*Include additional Ad-aware SE settings in logfile
*Please do not check or make green: Include Module list in logfile


5. Click on ‘Proceed’ to save the settings.

6. Click ‘Start’

*Choose:'Perform Full System Scan'
*DESELECT "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat.

7. Click ‘Next’ and Ad-Aware SE will scan your hard drive(s) with the options you have selected and clean automatically.

8. If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window.

9. Save the log file when it asks and then click ‘finish’.

10. REBOOT to complete the removal of what Ad-Aware SE found.


Step 5
Run at least two of the following online virus scans making sure to reboot in between each one. Allow them to fix anything they find.
You need to use Internet Explorer or Netscape browsers.
Bitdefender
Pandasoftware
Trend Micro << Click Auto Clean
Symantec Security Check << click scan for viruses
RAV Online Virus Scanner << Enter your e-mail address and click on To continue without subscribing
McAfee

Write down anything that can not be fixed. Include the file name and the path to the file.


Step 6
I need you to run this scan last (after the other scanners removed what they find) to see exactly what we are dealing with. Click here to download mwavscan. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.


Step 7
Scan with HijackThis and post the new log as a reply to this thread. Include anything that can not be fixed by the online scans. Please make sure no items are unchecked with msconfig nor stopped from startup with a startup manager.

Alan, all the scans have been run, results are below. Tried to remove Limewire but I get an error message that won't let it be removed. Thanks again for all of your help.

bitdefender:

C:\Documents and Settings\Owner\Local Settings\Temp\drhdmij.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.ProcKill.Jk

C:\Documents and Settings\Owner\Local Settings\Temp\drhdmij.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\Documents and Settings\Owner\Local Settings\Temp\drhdmij.exe=>(NSIS o)
Update failed

C:\Program Files\AIM95\aim95.exe=>wise0037=>wise0008
Detected with: Adware.Wheaterbug.A

C:\Program Files\AIM95\aim95.exe=>wise0037=>wise0008
Disinfection failed

C:\Program Files\AIM95\aim95.exe=>wise0037
Update failed

C:\Program Files\AIM95\Sysfiles\WxBug.EXE=>wise0008
Detected with: Adware.Wheaterbug.A

C:\Program Files\AIM95\Sysfiles\WxBug.EXE=>wise0008
Disinfection failed

C:\Program Files\AIM95\Sysfiles\WxBug.EXE
Update failed

C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
Detected with: Adware.Wheaterbug.A

C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227565.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.ProcKill.Jk

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227565.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227565.exe=>(NSIS o)
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227587.exe=>(NSIS o)=>zlib_nsis0001
Infected with: Trojan.Downloader.Agent.AF

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227587.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227587.exe=>(NSIS o)
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227588.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.Adware.BPC.A

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227588.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0227588.exe=>(NSIS o)
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230083.exe=>wise0037=>wise0008
Detected with: Adware.Wheaterbug.A

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230083.exe=>wise0037=>wise0008
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230083.exe=>wise0037
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230139.EXE=>wise0008
Detected with: Adware.Wheaterbug.A

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230139.EXE=>wise0008
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230139.EXE
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230797.dll
Detected with: Adware.Wheaterbug.A

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0230797.dll
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0237501.exe
Infected with: Dropped:Trojan.Downloader.Agent.AF

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP482\A0237501.exe
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248263.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.ProcKill.Jk

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248263.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248263.exe=>(NSIS o)
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248305.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.Adware.BPC.A

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248305.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248305.exe=>(NSIS o)
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248340.exe=>(NSIS o)=>zlib_nsis0001
Infected with: Trojan.Downloader.Agent.AF

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248340.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP486\A0248340.exe=>(NSIS o)
Update failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP487\A0249453.dll
Detected with: Adware.Wheaterbug.A

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP487\A0249453.dll
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP487\A0252418.exe
Infected with: Dropped:Trojan.Downloader.Agent.AF

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP487\A0252418.exe
Disinfection failed

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP487\A0256299.dll
Detected with: Adware.Wheaterbug.A

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP487\A0256299.dll
Disinfection failed

C:\WINDOWS\bundles\TrafficSpec8.exe
Infected with: Dropped:Trojan.Downloader.Agent.AF

C:\WINDOWS\bundles\TrafficSpec8.exe
Disinfection failed

C:\WINDOWS\SYSTEM32\drhdmij.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.ProcKill.Jk

C:\WINDOWS\SYSTEM32\drhdmij.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\WINDOWS\SYSTEM32\drhdmij.exe=>(NSIS o)
Update failed

C:\WINDOWS\SYSTEM32\knwmljo.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.Adware.BPC.A

C:\WINDOWS\SYSTEM32\knwmljo.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\WINDOWS\SYSTEM32\knwmljo.exe=>(NSIS o)
Update failed

C:\WINDOWS\SYSTEM32\odcfdfnt.exe=>(NSIS o)=>zlib_nsis0001
Infected with: Trojan.Downloader.Agent.AF

C:\WINDOWS\SYSTEM32\odcfdfnt.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\WINDOWS\SYSTEM32\odcfdfnt.exe=>(NSIS o)
Update failed

C:\WINDOWS\Temp\drhdmij.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.ProcKill.Jk

C:\WINDOWS\Temp\drhdmij.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\WINDOWS\Temp\drhdmij.exe=>(NSIS o)
Update failed

C:\WINDOWS\Temp\knwmljo.exe=>(NSIS o)=>zlib_nsis0001
Detected with: Application.Adware.BPC.A

C:\WINDOWS\Temp\knwmljo.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\WINDOWS\Temp\knwmljo.exe=>(NSIS o)
Update failed

C:\WINDOWS\Temp\odcfdfnt.exe=>(NSIS o)=>zlib_nsis0001
Infected with: Trojan.Downloader.Agent.AF

C:\WINDOWS\Temp\odcfdfnt.exe=>(NSIS o)=>zlib_nsis0001
Disinfection failed

C:\WINDOWS\Temp\odcfdfnt.exe=>(NSIS o)
Update failed


Panda:

Incident Status Location

Spyware:Spyware/New.net No disinfected C:\Program Files\NewDotNet
Adware:Adware/SaveNow No disinfected C:\Program Files\BearShare\RunMSC.dll
Adware:Adware/Gator No disinfected C:\DOCUME~1\Owner\LOCALS~1\Temp\fsg_tmp
Adware:Adware/nCase No disinfected C:\Temp\FLEOK
Spyware:Spyware/Dyfuca No disinfected C:\WINDOWS\optimize.exe
Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\susp.???
Adware:Adware/PortalScan No disinfected C:\WINDOWS\bundles
Adware:Adware/SAHAgent No disinfected Windows Registry
Spyware:Spyware/TVMedia No disinfected C:\WINDOWS\Bundles
Adware:Adware/DelFinMedia No disinfected C:\keys.ini
Adware:Adware/SideSearch No disinfected C:\Documents and Settings\Owner\Application
Data\Lycos
Adware:Adware/IPInsight No disinfected C:\WINDOWS\farmmext.ini
Adware:Adware/SideFind No disinfected Windows Registry
Adware:Adware/DealHelper No disinfected C:\WINDOWS\system32\DealHelper
Adware:Adware/ISearch No disinfected C:\WINDOWS\isrvs
Adware:Adware/WUpd No disinfected C:\Program Files\DeskAd Service
Adware:Adware/MoeMoney No disinfected Windows Registry
Adware:Adware/EliteBar No disinfected C:\Documents and Settings\Owner\Favorites\Finances& Business
Adware:Adware/ExactSearch No disinfected Windows Registry
Adware:Adware/SBSoft No disinfected C:\WINDOWS\Downloaded Program Files\webdlg32.inf
Spyware:Spyware/Virtumonde No disinfected Windows Registry
Adware:Adware/Fastvideoplayer No disinfected C:\WINDOWS\inf\fastvideoplayer.inf
Adware:Adware/MyCustomIE No disinfected Windows Registry
Spyware:Spyware/Whazit No disinfected C:\WINDOWS\system32\Cards.ico
Spyware:Spyware/SurfSideKick No disinfected Windows Registry
Spyware:Spyware/Search3 No disinfected C:\Program Files\Search3 Toolbar
Adware:Adware/Transponder No disinfected Windows Registry
Adware:Adware/BroadcastPC No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\28.exe\28.exe
Adware:Adware/Apropos No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\II22.exe
Spyware:Spyware/ClearSearch No disinfected C:\Program Files\ci61kvo1\csLDRupdater.DLL
Possible Virus. No disinfected C:\Program Files\Playnet\PlayGATE\PlayGate.exe
Spyware:Spyware/ISTbar No disinfected C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ISTactivex.inf
Adware:Adware/SBSoft No disinfected C:\WINDOWS\Downloaded Program Files\webdlg32.inf
Adware:Adware/Transponder No disinfected C:\WINDOWS\INF\Pynix.inf

Adware:Adware/FIsearch No disinfected C:\WINDOWS\isrvs\msdbhk.dll
Adware:Adware/Startpage.CM No disinfected C:\WINDOWS\protector_update.exe

Adware:Adware/eZula No disinfected C:\WINDOWS\SYSTEM32\iezset.exe
Adware:Adware/BroadcastPC No disinfected C:\WINDOWS\SYSTEM32\knwmljo.exe
Adware:Adware/BroadcastPC No disinfected C:\WINDOWS\Temp\knwmljo.exe
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI22A9.tmp\farmmext.cab[farmmext.inf]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI22A9.tmp\farmmext.cab[farmmext.exe]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI22A9.tmp\farmmext.cab[farmmext.ini]
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI22A9.tmp\farmmext.inf
Adware:Adware/IPInsight No disinfected C:\WINDOWS\Temp\THI22A9.tmp\farmmext.ini
Adware:Adware/Transponder No disinfected C:\WINDOWS\Temp\THI4407.tmp\pynix.cab[Pynix.inf]
Adware:Adware/Transponder No disinfected C:\WINDOWS\Temp\THI4407.tmp\pynix.cab[Pynix.dll]
Adware:Adware/Transponder No disinfected C:\WINDOWS\Temp\THI4407.tmp\pynix.cab[spike.exe]
Adware:Adware/Transponder No disinfected C:\WINDOWS\Temp\THI4407.tmp\Pynix.inf


mwavscan:

File System Found infected by "tsa Spyware/Adware" Virus. Action Taken: No Action Taken.


File C:\aida32pe_393.zip infected by "Trojan.Win32.StartPage.ws" Virus. Action Taken: No Action Taken.


File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Newspopupper.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.


File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WindUpdates1.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken.


File C:\WINDOWS\Temp\THI22A9.tmp\farmmext.cab infected by "Trojan-Downloader.Win32.Stubby.c" Virus. Action Taken: No Action Taken.


File C:\WINDOWS\Temp\THI4407.tmp\pynix.cab infected by "Trojan.Win32.Agent.cb" Virus. Action Taken: No Action Taken.


HiJackThis:

Logfile of HijackThis v1.99.1
Scan saved at 6:41:09 AM, on 3/28/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PackethSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hqenascb\hgws.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://northeastkansas.cox.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://discussions.playnet.com/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [bohref] C:\WINDOWS\system32\cugeiulo\bohref.exe
O4 - HKLM\..\Run: [wrswho] C:\WINDOWS\system32\qbefm\wrswho.exe
O4 - HKLM\..\Run: [sfkc] C:\WINDOWS\system32\uvxfc\sfkc.exe
O4 - HKLM\..\Run: [jksu] C:\WINDOWS\system32\ysektxo\jksu.exe
O4 - HKLM\..\Run: [vdmw] C:\WINDOWS\system32\nmggq\vdmw.exe
O4 - HKLM\..\Run: [heuyws] C:\WINDOWS\system32\cvvtex\heuyws.exe
O4 - HKLM\..\Run: [brfagtf] C:\WINDOWS\system32\dfuf\brfagtf.exe
O4 - HKLM\..\Run: [cyukojxe] C:\WINDOWS\system32\abttggkq\cyukojxe.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [qgkg] C:\WINDOWS\system32\fnyraya\qgkg.exe
O4 - HKLM\..\Run: [otkie] C:\WINDOWS\system32\xwwwre\otkie.exe
O4 - HKLM\..\Run: [piwae] C:\WINDOWS\system32\ggfvaox\piwae.exe
O4 - HKLM\..\Run: [vxkxyaih] C:\WINDOWS\system32\duldbvi\vxkxyaih.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [eansiafj] C:\WINDOWS\system32\cttq\eansiafj.exe
O4 - HKLM\..\Run: [mbbuvord] C:\WINDOWS\system32\pglcww\mbbuvord.exe
O4 - HKLM\..\Run: [jtfxm] C:\WINDOWS\system32\gbbky\jtfxm.exe
O4 - HKLM\..\Run: [wfqqf] C:\WINDOWS\system32\uiihhj\wfqqf.exe
O4 - HKLM\..\Run: [mvxwusni] C:\WINDOWS\system32\iktwikql\mvxwusni.exe
O4 - HKLM\..\Run: [oagtejrl] C:\WINDOWS\system32\ugbof\oagtejrl.exe
O4 - HKLM\..\Run: [utrmjyx] C:\WINDOWS\system32\bmsoda\utrmjyx.exe
O4 - HKLM\..\Run: [wmpd] C:\WINDOWS\system32\ntpvf\wmpd.exe
O4 - HKLM\..\Run: [ryqqovr] C:\WINDOWS\system32\oraxij\ryqqovr.exe
O4 - HKLM\..\Run: [iuuvn] C:\WINDOWS\system32\hfjqcjrr\iuuvn.exe
O4 - HKLM\..\Run: [dicb] C:\WINDOWS\system32\amustwh\dicb.exe
O4 - HKLM\..\Run: [yener] C:\WINDOWS\system32\xhadf\yener.exe
O4 - HKLM\..\Run: [pdqjhdh] C:\WINDOWS\system32\kcxub\pdqjhdh.exe
O4 - HKLM\..\Run: [jhgbiqjb] C:\WINDOWS\system32\sxny\jhgbiqjb.exe
O4 - HKLM\..\Run: [nnoit] C:\WINDOWS\system32\monwysa\nnoit.exe
O4 - HKLM\..\Run: [mqsp] C:\WINDOWS\system32\oufgggy\mqsp.exe
O4 - HKLM\..\Run: [wlexjffx] C:\WINDOWS\system32\ehfetf\wlexjffx.exe
O4 - HKLM\..\Run: [tkhiset] C:\WINDOWS\system32\wxqus\tkhiset.exe
O4 - HKLM\..\Run: [dvct] C:\WINDOWS\system32\palkmhl\dvct.exe
O4 - HKLM\..\Run: [xsecnvxa] C:\WINDOWS\system32\fvia\xsecnvxa.exe
O4 - HKLM\..\Run: [bfggwx] C:\WINDOWS\system32\hbxq\bfggwx.exe
O4 - HKLM\..\Run: [scjfpj] C:\WINDOWS\system32\ioskfum\scjfpj.exe
O4 - HKLM\..\Run: [guyh] C:\WINDOWS\system32\sehf\guyh.exe
O4 - HKLM\..\Run: [ungmfxq] C:\WINDOWS\system32\lvprhck\ungmfxq.exe
O4 - HKLM\..\Run: [wlxohjn] C:\WINDOWS\system32\bjqkxkby\wlxohjn.exe
O4 - HKLM\..\Run: [shoji] C:\WINDOWS\system32\dayee\shoji.exe
O4 - HKLM\..\Run: [hjsjmoc] C:\WINDOWS\system32\ohajbl\hjsjmoc.exe
O4 - HKLM\..\Run: [igdw] C:\WINDOWS\system32\rmxh\igdw.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [wlei] C:\WINDOWS\system32\btmkjbbd\wlei.exe
O4 - HKLM\..\Run: [crjhpcol] C:\WINDOWS\system32\lredin\crjhpcol.exe
O4 - HKLM\..\Run: [ukofxu] C:\WINDOWS\system32\bbvcr\ukofxu.exe
O4 - HKLM\..\Run: [srigl] C:\WINDOWS\system32\ftejqb\srigl.exe
O4 - HKLM\..\Run: [acqjqwq] C:\WINDOWS\system32\mmbjom\acqjqwq.exe
O4 - HKLM\..\Run: [wciel] C:\WINDOWS\system32\qcbbt\wciel.exe
O4 - HKLM\..\Run: [kxqv] C:\WINDOWS\system32\lwkwih\kxqv.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [viblcm] C:\WINDOWS\system32\whwfaiqm\viblcm.exe
O4 - HKLM\..\Run: [qyfit] C:\WINDOWS\system32\qyxo\qyfit.exe
O4 - HKLM\..\Run: [bspymfgr] C:\WINDOWS\system32\uomvrba\bspymfgr.exe
O4 - HKLM\..\Run: [ioddw] C:\WINDOWS\system32\ofneao\ioddw.exe
O4 - HKLM\..\Run: [nldfn] C:\WINDOWS\system32\ibyfco\nldfn.exe
O4 - HKLM\..\Run: [toqb] C:\WINDOWS\system32\idcwma\toqb.exe
O4 - HKLM\..\Run: [njfkwfjy] C:\WINDOWS\system32\cuxc\njfkwfjy.exe
O4 - HKLM\..\Run: [tjnlgk] C:\WINDOWS\system32\wicagx\tjnlgk.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [fayjcuio] C:\WINDOWS\system32\ynlxg\fayjcuio.exe
O4 - HKLM\..\Run: [xmawvdsu] C:\WINDOWS\system32\gwdtffy\xmawvdsu.exe
O4 - HKLM\..\Run: [vovvswe] C:\WINDOWS\system32\nfubeu\vovvswe.exe
O4 - HKLM\..\Run: [ftbjl] C:\WINDOWS\system32\mlollpbp\ftbjl.exe
O4 - HKLM\..\Run: [ycinkjeg] C:\WINDOWS\system32\cdddf\ycinkjeg.exe
O4 - HKLM\..\Run: [ewfud] C:\WINDOWS\system32\menwrmml\ewfud.exe
O4 - HKLM\..\Run: [gxjcb] C:\WINDOWS\system32\pyax\gxjcb.exe
O4 - HKLM\..\Run: [crtjgkr] C:\WINDOWS\system32\ptvgdrnu\crtjgkr.exe
O4 - HKLM\..\Run: [drndmoh] C:\WINDOWS\system32\iyarlnqb\drndmoh.exe
O4 - HKLM\..\Run: [bbabhvkb] C:\WINDOWS\system32\xoepjalg\bbabhvkb.exe
O4 - HKLM\..\Run: [xves] C:\WINDOWS\system32\lwujjw\xves.exe
O4 - HKLM\..\Run: [vusgnf] C:\WINDOWS\system32\mcfout\vusgnf.exe
O4 - HKLM\..\Run: [jevb] C:\WINDOWS\system32\amcxdb\jevb.exe
O4 - HKLM\..\Run: [awicimc] C:\WINDOWS\system32\cjanxbqr\awicimc.exe
O4 - HKLM\..\Run: [jwkiwq] C:\WINDOWS\system32\ruafwr\jwkiwq.exe
O4 - HKLM\..\Run: [hodidaav] C:\WINDOWS\system32\isytdk\hodidaav.exe
O4 - HKLM\..\Run: [yrtf] C:\WINDOWS\system32\kmgshy\yrtf.exe
O4 - HKLM\..\Run: [dggc] C:\WINDOWS\system32\qjyeobt\dggc.exe
O4 - HKLM\..\Run: [jscegef] C:\WINDOWS\system32\shykydbi\jscegef.exe
O4 - HKLM\..\Run: [owhhny] C:\WINDOWS\system32\srrcs\owhhny.exe
O4 - HKLM\..\Run: [sqjl] C:\WINDOWS\system32\eylm\sqjl.exe
O4 - HKLM\..\Run: [rasl] C:\WINDOWS\system32\vnlxoifc\rasl.exe
O4 - HKLM\..\Run: [tkoubqy] C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O4 - HKLM\..\Run: [iamexsng] C:\WINDOWS\system32\cgdo\iamexsng.exe
O4 - HKLM\..\Run: [ynudcnq] C:\WINDOWS\system32\pbhiuvvx\ynudcnq.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [oeafuk] C:\WINDOWS\system32\dshofdox\oeafuk.exe
O4 - HKLM\..\Run: [edklxpn] C:\WINDOWS\system32\xgma\edklxpn.exe
O4 - HKLM\..\Run: [uouxqs] C:\WINDOWS\system32\utpxo\uouxqs.exe
O4 - HKLM\..\Run: [ikjv] C:\WINDOWS\system32\kyragesk\ikjv.exe
O4 - HKLM\..\Run: [hqumk] C:\WINDOWS\system32\rkoswwbq\hqumk.exe
O4 - HKLM\..\Run: [mvbtiru] C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
O4 - HKLM\..\Run: [tpuuyke] C:\WINDOWS\system32\bydl\tpuuyke.exe
O4 - HKLM\..\Run: [yfekhkan] C:\WINDOWS\system32\wqrr\yfekhkan.exe
O4 - HKLM\..\Run: [dfiaqs] C:\WINDOWS\system32\alccy\dfiaqs.exe
O4 - HKLM\..\Run: [alnlspq] C:\WINDOWS\system32\kgfyhvbe\alnlspq.exe
O4 - HKLM\..\Run: [uhmigfcf] C:\WINDOWS\system32\yieyb\uhmigfcf.exe
O4 - HKLM\..\Run: [djcuh] C:\WINDOWS\system32\qbqq\djcuh.exe
O4 - HKLM\..\Run: [jmctgwbi] C:\WINDOWS\system32\gnokcvv\jmctgwbi.exe
O4 - HKLM\..\Run: [C:\WINDOWS\IEXPLOR.EXE] C:\WINDOWS\IEXPLOR.EXE
O4 - HKLM\..\Run: [AtxBrw] C:\WINDOWS\IEXPLOR.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [hgws] C:\WINDOWS\system32\hqenascb\hgws.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKCU\..\Run: [Zyvylft] C:\WINDOWS\system32\l?gonui.exe
O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Registration Lock On
O4 - Global Startup: America Online 6.0 Tray Icon.lnk = C:\Program Files\America Online 6.0a\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: NDWCab - http://www.neededware.com/NDWCab.CAB
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.taxsimple.com/TSWeb/msrdp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0410.dll
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0011.exe
O16 - DPF: {EEF29D20-9A47-4657-ADF7-283EC2504001} - http://download.bigwebportal.com/toolbar2/winenc32.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: dggcqjyeobt - Unknown owner - C:\WINDOWS\system32\qjyeobt\dggc.exe
O23 - Service: edklxpnxgma - Unknown owner - C:\WINDOWS\system32\xgma\edklxpn.exe
O23 - Service: hgwshqenascb - Unknown owner - C:\WINDOWS\system32\hqenascb\hgws.exe
O23 - Service: jscegefshykydbi - Unknown owner - C:\WINDOWS\system32\shykydbi\jscegef.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: mvbtirultmfgq - Unknown owner - C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: oeafukdshofdox - Unknown owner - C:\WINDOWS\system32\dshofdox\oeafuk.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: tkoubqyhrohgbgo - Unknown owner - C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O23 - Service: uouxqsutpxo - Unknown owner - C:\WINDOWS\system32\utpxo\uouxqs.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

You may want to print out these instructions or save them to your desktop as a text file with Notepad because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet.

Step 1
Go to Add/Remove programs and remove New.Net or NewDotNet.

If there is no listing for it, use the uninstaller at newdotnet.com
Use procedure 4 to remove it. It requires that an internet connection be active while doing it.


Step 2
Click on this link http://www.downloads.subratam.org/KillBox.zip to download Pocket Killbox by Option^Explicit. Extract it from the zip file. We'll use this in a little bit.


Step 3
Click Start < Run and type services.msc. Scroll down to dggcqjyeobt and right click on it. Click Properties and under Service Status click Stop, then under Startup Type change it to Disabled.
Continue this process for the following:

edklxpnxgma
hgwshqenascb
jscegefshykydbi
mvbtirultmfgq
oeafukdshofdox
tkoubqyhrohgbgo
uouxqsutpxo


Step 4
Open HijackThis, run a scan, then check the following:

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

O4 - HKLM\..\Run: [bohref] C:\WINDOWS\system32\cugeiulo\bohref.exe
O4 - HKLM\..\Run: [wrswho] C:\WINDOWS\system32\qbefm\wrswho.exe
O4 - HKLM\..\Run: [sfkc] C:\WINDOWS\system32\uvxfc\sfkc.exe
O4 - HKLM\..\Run: [jksu] C:\WINDOWS\system32\ysektxo\jksu.exe
O4 - HKLM\..\Run: [vdmw] C:\WINDOWS\system32\nmggq\vdmw.exe
O4 - HKLM\..\Run: [heuyws] C:\WINDOWS\system32\cvvtex\heuyws.exe
O4 - HKLM\..\Run: [brfagtf] C:\WINDOWS\system32\dfuf\brfagtf.exe
O4 - HKLM\..\Run: [cyukojxe] C:\WINDOWS\system32\abttggkq\cyukojxe.exe
O4 - HKLM\..\Run: [qgkg] C:\WINDOWS\system32\fnyraya\qgkg.exe
O4 - HKLM\..\Run: [otkie] C:\WINDOWS\system32\xwwwre\otkie.exe
O4 - HKLM\..\Run: [piwae] C:\WINDOWS\system32\ggfvaox\piwae.exe
O4 - HKLM\..\Run: [vxkxyaih] C:\WINDOWS\system32\duldbvi\vxkxyaih.exe
O4 - HKLM\..\Run: [eansiafj] C:\WINDOWS\system32\cttq\eansiafj.exe
O4 - HKLM\..\Run: [mbbuvord] C:\WINDOWS\system32\pglcww\mbbuvord.exe
O4 - HKLM\..\Run: [jtfxm] C:\WINDOWS\system32\gbbky\jtfxm.exe
O4 - HKLM\..\Run: [wfqqf] C:\WINDOWS\system32\uiihhj\wfqqf.exe
O4 - HKLM\..\Run: [mvxwusni] C:\WINDOWS\system32\iktwikql\mvxwusni.exe
O4 - HKLM\..\Run: [oagtejrl] C:\WINDOWS\system32\ugbof\oagtejrl.exe
O4 - HKLM\..\Run: [utrmjyx] C:\WINDOWS\system32\bmsoda\utrmjyx.exe
O4 - HKLM\..\Run: [wmpd] C:\WINDOWS\system32\ntpvf\wmpd.exe
O4 - HKLM\..\Run: [ryqqovr] C:\WINDOWS\system32\oraxij\ryqqovr.exe
O4 - HKLM\..\Run: [iuuvn] C:\WINDOWS\system32\hfjqcjrr\iuuvn.exe
O4 - HKLM\..\Run: [dicb] C:\WINDOWS\system32\amustwh\dicb.exe
O4 - HKLM\..\Run: [yener] C:\WINDOWS\system32\xhadf\yener.exe
O4 - HKLM\..\Run: [pdqjhdh] C:\WINDOWS\system32\kcxub\pdqjhdh.exe
O4 - HKLM\..\Run: [jhgbiqjb] C:\WINDOWS\system32\sxny\jhgbiqjb.exe
O4 - HKLM\..\Run: [nnoit] C:\WINDOWS\system32\monwysa\nnoit.exe
O4 - HKLM\..\Run: [mqsp] C:\WINDOWS\system32\oufgggy\mqsp.exe
O4 - HKLM\..\Run: [wlexjffx] C:\WINDOWS\system32\ehfetf\wlexjffx.exe
O4 - HKLM\..\Run: [tkhiset] C:\WINDOWS\system32\wxqus\tkhiset.exe
O4 - HKLM\..\Run: [dvct] C:\WINDOWS\system32\palkmhl\dvct.exe
O4 - HKLM\..\Run: [xsecnvxa] C:\WINDOWS\system32\fvia\xsecnvxa.exe
O4 - HKLM\..\Run: [bfggwx] C:\WINDOWS\system32\hbxq\bfggwx.exe
O4 - HKLM\..\Run: [scjfpj] C:\WINDOWS\system32\ioskfum\scjfpj.exe
O4 - HKLM\..\Run: [guyh] C:\WINDOWS\system32\sehf\guyh.exe
O4 - HKLM\..\Run: [ungmfxq] C:\WINDOWS\system32\lvprhck\ungmfxq.exe
O4 - HKLM\..\Run: [wlxohjn] C:\WINDOWS\system32\bjqkxkby\wlxohjn.exe
O4 - HKLM\..\Run: [shoji] C:\WINDOWS\system32\dayee\shoji.exe
O4 - HKLM\..\Run: [hjsjmoc] C:\WINDOWS\system32\ohajbl\hjsjmoc.exe
O4 - HKLM\..\Run: [igdw] C:\WINDOWS\system32\rmxh\igdw.exe
O4 - HKLM\..\Run: [A70F6A1D-0195-42a2-934C-D8AC0F7C08EB] rundll32.exe E6F1873B.DLL,D9EBC318C
O4 - HKLM\..\Run: [98D0CE0C16B1] rundll32.exe D0CE0C16B1,D0CE0C16B1
O4 - HKLM\..\Run: [wlei] C:\WINDOWS\system32\btmkjbbd\wlei.exe
O4 - HKLM\..\Run: [crjhpcol] C:\WINDOWS\system32\lredin\crjhpcol.exe
O4 - HKLM\..\Run: [ukofxu] C:\WINDOWS\system32\bbvcr\ukofxu.exe
O4 - HKLM\..\Run: [srigl] C:\WINDOWS\system32\ftejqb\srigl.exe
O4 - HKLM\..\Run: [acqjqwq] C:\WINDOWS\system32\mmbjom\acqjqwq.exe
O4 - HKLM\..\Run: [wciel] C:\WINDOWS\system32\qcbbt\wciel.exe
O4 - HKLM\..\Run: [kxqv] C:\WINDOWS\system32\lwkwih\kxqv.exe
O4 - HKLM\..\Run: [viblcm] C:\WINDOWS\system32\whwfaiqm\viblcm.exe
O4 - HKLM\..\Run: [qyfit] C:\WINDOWS\system32\qyxo\qyfit.exe
O4 - HKLM\..\Run: [bspymfgr] C:\WINDOWS\system32\uomvrba\bspymfgr.exe
O4 - HKLM\..\Run: [ioddw] C:\WINDOWS\system32\ofneao\ioddw.exe
O4 - HKLM\..\Run: [nldfn] C:\WINDOWS\system32\ibyfco\nldfn.exe
O4 - HKLM\..\Run: [toqb] C:\WINDOWS\system32\idcwma\toqb.exe
O4 - HKLM\..\Run: [njfkwfjy] C:\WINDOWS\system32\cuxc\njfkwfjy.exe
O4 - HKLM\..\Run: [tjnlgk] C:\WINDOWS\system32\wicagx\tjnlgk.exe
O4 - HKLM\..\Run: [fayjcuio] C:\WINDOWS\system32\ynlxg\fayjcuio.exe
O4 - HKLM\..\Run: [xmawvdsu] C:\WINDOWS\system32\gwdtffy\xmawvdsu.exe
O4 - HKLM\..\Run: [vovvswe] C:\WINDOWS\system32\nfubeu\vovvswe.exe
O4 - HKLM\..\Run: [ftbjl] C:\WINDOWS\system32\mlollpbp\ftbjl.exe
O4 - HKLM\..\Run: [ycinkjeg] C:\WINDOWS\system32\cdddf\ycinkjeg.exe
O4 - HKLM\..\Run: [ewfud] C:\WINDOWS\system32\menwrmml\ewfud.exe
O4 - HKLM\..\Run: [gxjcb] C:\WINDOWS\system32\pyax\gxjcb.exe
O4 - HKLM\..\Run: [crtjgkr] C:\WINDOWS\system32\ptvgdrnu\crtjgkr.exe
O4 - HKLM\..\Run: [drndmoh] C:\WINDOWS\system32\iyarlnqb\drndmoh.exe
O4 - HKLM\..\Run: [bbabhvkb] C:\WINDOWS\system32\xoepjalg\bbabhvkb.exe
O4 - HKLM\..\Run: [xves] C:\WINDOWS\system32\lwujjw\xves.exe
O4 - HKLM\..\Run: [vusgnf] C:\WINDOWS\system32\mcfout\vusgnf.exe
O4 - HKLM\..\Run: [jevb] C:\WINDOWS\system32\amcxdb\jevb.exe
O4 - HKLM\..\Run: [awicimc] C:\WINDOWS\system32\cjanxbqr\awicimc.exe
O4 - HKLM\..\Run: [jwkiwq] C:\WINDOWS\system32\ruafwr\jwkiwq.exe
O4 - HKLM\..\Run: [hodidaav] C:\WINDOWS\system32\isytdk\hodidaav.exe
O4 - HKLM\..\Run: [yrtf] C:\WINDOWS\system32\kmgshy\yrtf.exe
O4 - HKLM\..\Run: [dggc] C:\WINDOWS\system32\qjyeobt\dggc.exe
O4 - HKLM\..\Run: [jscegef] C:\WINDOWS\system32\shykydbi\jscegef.exe
O4 - HKLM\..\Run: [owhhny] C:\WINDOWS\system32\srrcs\owhhny.exe
O4 - HKLM\..\Run: [sqjl] C:\WINDOWS\system32\eylm\sqjl.exe
O4 - HKLM\..\Run: [rasl] C:\WINDOWS\system32\vnlxoifc\rasl.exe
O4 - HKLM\..\Run: [tkoubqy] C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O4 - HKLM\..\Run: [iamexsng] C:\WINDOWS\system32\cgdo\iamexsng.exe
O4 - HKLM\..\Run: [ynudcnq] C:\WINDOWS\system32\pbhiuvvx\ynudcnq.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [BMan] C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
O4 - HKLM\..\Run: [oeafuk] C:\WINDOWS\system32\dshofdox\oeafuk.exe
O4 - HKLM\..\Run: [edklxpn] C:\WINDOWS\system32\xgma\edklxpn.exe
O4 - HKLM\..\Run: [uouxqs] C:\WINDOWS\system32\utpxo\uouxqs.exe
O4 - HKLM\..\Run: [ikjv] C:\WINDOWS\system32\kyragesk\ikjv.exe
O4 - HKLM\..\Run: [hqumk] C:\WINDOWS\system32\rkoswwbq\hqumk.exe
O4 - HKLM\..\Run: [mvbtiru] C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
O4 - HKLM\..\Run: [tpuuyke] C:\WINDOWS\system32\bydl\tpuuyke.exe
O4 - HKLM\..\Run: [yfekhkan] C:\WINDOWS\system32\wqrr\yfekhkan.exe
O4 - HKLM\..\Run: [dfiaqs] C:\WINDOWS\system32\alccy\dfiaqs.exe
O4 - HKLM\..\Run: [alnlspq] C:\WINDOWS\system32\kgfyhvbe\alnlspq.exe
O4 - HKLM\..\Run: [uhmigfcf] C:\WINDOWS\system32\yieyb\uhmigfcf.exe
O4 - HKLM\..\Run: [djcuh] C:\WINDOWS\system32\qbqq\djcuh.exe
O4 - HKLM\..\Run: [jmctgwbi] C:\WINDOWS\system32\gnokcvv\jmctgwbi.exe
O4 - HKLM\..\Run: [C:\WINDOWS\IEXPLOR.EXE] C:\WINDOWS\IEXPLOR.EXE
O4 - HKLM\..\Run: [AtxBrw] C:\WINDOWS\IEXPLOR.exe
O4 - HKLM\..\Run: [hgws] C:\WINDOWS\system32\hqenascb\hgws.exe
O4 - HKCU\..\Run: [Zyvylft] C:\WINDOWS\system32\l?gonui.exe

O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O15 - Trusted Zone: http://www.neededware.com

O16 - DPF: NDWCab - http://www.neededware.com/NDWCab.CAB
O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0011.exe
O16 - DPF: {EEF29D20-9A47-4657-ADF7-283EC2504001} - http://download.bigwebportal.com/toolbar2/winenc32.cab

O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

O23 - Service: dggcqjyeobt - Unknown owner - C:\WINDOWS\system32\qjyeobt\dggc.exe
O23 - Service: edklxpnxgma - Unknown owner - C:\WINDOWS\system32\xgma\edklxpn.exe
O23 - Service: hgwshqenascb - Unknown owner - C:\WINDOWS\system32\hqenascb\hgws.exe
O23 - Service: jscegefshykydbi - Unknown owner - C:\WINDOWS\system32\shykydbi\jscegef.exe
O23 - Service: mvbtirultmfgq - Unknown owner - C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
O23 - Service: oeafukdshofdox - Unknown owner - C:\WINDOWS\system32\dshofdox\oeafuk.exe
O23 - Service: tkoubqyhrohgbgo - Unknown owner - C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
O23 - Service: uouxqsutpxo - Unknown owner - C:\WINDOWS\system32\utpxo\uouxqs.exe

With all other programs and browsers closed, click fix checked.


Step 5
Go to Add/Remove Programs and remove the following items (if found):

BrowserAid
CashToolbar
Web Toolbar
BrowserPal


Step 6
Double-click on Killbox.exe to run it.
In the 'Paste Full Path of File to Delete' box, copy and paste this entry:
C:\WINDOWS\system32\cugeiulo\bohref.exe

Check the option for "Delete on Reboot". Click the button with the red circle with a
white X in it. Click 'yes'. When asked to reboot choose 'no'.

In the 'Paste Full Path of File to Delete' box, copy and paste this entry:
C:\WINDOWS\system32\qbefm\wrswho.exe

Click the button with the red circle with a
white X in it. Click 'yes'. When asked to reboot choose 'no'.

Continue this process with the following entries:
C:\WINDOWS\system32\uvxfc\sfkc.exe
C:\WINDOWS\system32\ysektxo\jksu.exe
C:\WINDOWS\system32\nmggq\vdmw.exe
C:\WINDOWS\system32\cvvtex\heuyws.exe
C:\WINDOWS\system32\dfuf\brfagtf.exe
C:\WINDOWS\system32\abttggkq\cyukojxe.exe
C:\WINDOWS\system32\fnyraya\qgkg.exe
C:\WINDOWS\system32\xwwwre\otkie.exe
C:\WINDOWS\system32\ggfvaox\piwae.exe
C:\WINDOWS\system32\duldbvi\vxkxyaih.exe
C:\WINDOWS\system32\cttq\eansiafj.exe
C:\WINDOWS\system32\pglcww\mbbuvord.exe
C:\WINDOWS\system32\gbbky\jtfxm.exe
C:\WINDOWS\system32\uiihhj\wfqqf.exe
C:\WINDOWS\system32\iktwikql\mvxwusni.exe
C:\WINDOWS\system32\ugbof\oagtejrl.exe
C:\WINDOWS\system32\bmsoda\utrmjyx.exe
C:\WINDOWS\system32\ntpvf\wmpd.exe
C:\WINDOWS\system32\oraxij\ryqqovr.exe
C:\WINDOWS\system32\hfjqcjrr\iuuvn.exe
C:\WINDOWS\system32\amustwh\dicb.exe
C:\WINDOWS\system32\xhadf\yener.exe
C:\WINDOWS\system32\kcxub\pdqjhdh.exe
C:\WINDOWS\system32\sxny\jhgbiqjb.exe
C:\WINDOWS\system32\monwysa\nnoit.exe
C:\WINDOWS\system32\oufgggy\mqsp.exe
C:\WINDOWS\system32\ehfetf\wlexjffx.exe
C:\WINDOWS\system32\wxqus\tkhiset.exe
C:\WINDOWS\system32\palkmhl\dvct.exe
C:\WINDOWS\system32\fvia\xsecnvxa.exe
C:\WINDOWS\system32\hbxq\bfggwx.exe
C:\WINDOWS\system32\ioskfum\scjfpj.exe
C:\WINDOWS\system32\sehf\guyh.exe
C:\WINDOWS\system32\lvprhck\ungmfxq.exe
C:\WINDOWS\system32\bjqkxkby\wlxohjn.exe
C:\WINDOWS\system32\dayee\shoji.exe
C:\WINDOWS\system32\ohajbl\hjsjmoc.exe
C:\WINDOWS\system32\rmxh\igdw.exe
C:\WINDOWS\system32\btmkjbbd\wlei.exe
C:\WINDOWS\system32\lredin\crjhpcol.exe
C:\WINDOWS\system32\bbvcr\ukofxu.exe
C:\WINDOWS\system32\ftejqb\srigl.exe
C:\WINDOWS\system32\mmbjom\acqjqwq.exe
C:\WINDOWS\system32\qcbbt\wciel.exe
C:\WINDOWS\system32\lwkwih\kxqv.exe
C:\WINDOWS\system32\whwfaiqm\viblcm.exe
C:\WINDOWS\system32\qyxo\qyfit.exe
C:\WINDOWS\system32\uomvrba\bspymfgr.exe
C:\WINDOWS\system32\ofneao\ioddw.exe
C:\WINDOWS\system32\ibyfco\nldfn.exe
C:\WINDOWS\system32\idcwma\toqb.exe
C:\WINDOWS\system32\cuxc\njfkwfjy.exe
C:\WINDOWS\system32\wicagx\tjnlgk.exe
C:\WINDOWS\system32\ynlxg\fayjcuio.exe
C:\WINDOWS\system32\gwdtffy\xmawvdsu.exe
C:\WINDOWS\system32\nfubeu\vovvswe.exe
C:\WINDOWS\system32\mlollpbp\ftbjl.exe
C:\WINDOWS\system32\cdddf\ycinkjeg.exe
C:\WINDOWS\system32\menwrmml\ewfud.exe
C:\WINDOWS\system32\pyax\gxjcb.exe
C:\WINDOWS\system32\ptvgdrnu\crtjgkr.exe
C:\WINDOWS\system32\iyarlnqb\drndmoh.exe
C:\WINDOWS\system32\xoepjalg\bbabhvkb.exe
C:\WINDOWS\system32\lwujjw\xves.exe
C:\WINDOWS\system32\mcfout\vusgnf.exe
C:\WINDOWS\system32\amcxdb\jevb.exe
C:\WINDOWS\system32\cjanxbqr\awicimc.exe
C:\WINDOWS\system32\ruafwr\jwkiwq.exe
C:\WINDOWS\system32\isytdk\hodidaav.exe
C:\WINDOWS\system32\kmgshy\yrtf.exe
C:\WINDOWS\system32\qjyeobt\dggc.exe
C:\WINDOWS\system32\shykydbi\jscegef.exe
C:\WINDOWS\system32\srrcs\owhhny.exe
C:\WINDOWS\system32\eylm\sqjl.exe
C:\WINDOWS\system32\vnlxoifc\rasl.exe
C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
C:\WINDOWS\system32\cgdo\iamexsng.exe
C:\WINDOWS\system32\pbhiuvvx\ynudcnq.exe
C:\Documents and Settings\All Users\Application Data\msw\BMan1.exe
C:\WINDOWS\system32\dshofdox\oeafuk.exe
C:\WINDOWS\system32\xgma\edklxpn.exe
C:\WINDOWS\system32\utpxo\uouxqs.exe
C:\WINDOWS\system32\kyragesk\ikjv.exe
C:\WINDOWS\system32\rkoswwbq\hqumk.exe
C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
C:\WINDOWS\system32\bydl\tpuuyke.exe
C:\WINDOWS\system32\wqrr\yfekhkan.exe
C:\WINDOWS\system32\alccy\dfiaqs.exe
C:\WINDOWS\system32\kgfyhvbe\alnlspq.exe
C:\WINDOWS\system32\yieyb\uhmigfcf.exe
C:\WINDOWS\system32\qbqq\djcuh.exe
C:\WINDOWS\system32\gnokcvv\jmctgwbi.exe
C:\WINDOWS\IEXPLOR.EXE
C:\WINDOWS\system32\hqenascb\hgws.exe
C:\WINDOWS\system32\l?gonui.exe
C:\WINDOWS\system32\qjyeobt\dggc.exe
C:\WINDOWS\system32\xgma\edklxpn.exe
C:\WINDOWS\system32\hqenascb\hgws.exe
C:\WINDOWS\system32\shykydbi\jscegef.exe
C:\WINDOWS\system32\ltmfgq\mvbtiru.exe
C:\WINDOWS\system32\dshofdox\oeafuk.exe
C:\WINDOWS\system32\hrohgbgo\tkoubqy.exe
C:\WINDOWS\system32\utpxo\uouxqs.exe
C:\WINDOWS\isrvs\mfiltis.dll


After the last item is entered, Click the button with the red circle with a white X in it. Click 'yes'. When asked to reboot choose 'yes'.


Step 7
While the computer is booting up, start tapping F8, use arrow keys to select Safe Mode, then hit 'enter'. Please delete the following folders:

C:\WINDOWS\system32\cugeiulo
C:\WINDOWS\system32\qbefm
C:\WINDOWS\system32\uvxfc
C:\WINDOWS\system32\ysektxo
C:\WINDOWS\system32\nmggq
C:\WINDOWS\system32\cvvtex
C:\WINDOWS\system32\dfuf
C:\WINDOWS\system32\abttggkq
C:\WINDOWS\system32\fnyraya
C:\WINDOWS\system32\xwwwre
C:\WINDOWS\system32\ggfvaox
C:\WINDOWS\system32\duldbvi
C:\WINDOWS\system32\cttq
C:\WINDOWS\system32\pglcww
C:\WINDOWS\system32\gbbky
C:\WINDOWS\system32\uiihhj
C:\WINDOWS\system32\iktwikql
C:\WINDOWS\system32\ugbof
C:\WINDOWS\system32\bmsoda
C:\WINDOWS\system32\ntpvf
C:\WINDOWS\system32\oraxij
C:\WINDOWS\system32\hfjqcjrr
C:\WINDOWS\system32\amustwh
C:\WINDOWS\system32\xhadf
C:\WINDOWS\system32\kcxub
C:\WINDOWS\system32\sxny
C:\WINDOWS\system32\monwysa
C:\WINDOWS\system32\oufgggy
C:\WINDOWS\system32\ehfetf
C:\WINDOWS\system32\wxqus
C:\WINDOWS\system32\palkmhl
C:\WINDOWS\system32\fvia
C:\WINDOWS\system32\hbxq
C:\WINDOWS\system32\ioskfum
C:\WINDOWS\system32\sehf
C:\WINDOWS\system32\lvprhck
C:\WINDOWS\system32\bjqkxkby
C:\WINDOWS\system32\dayee
C:\WINDOWS\system32\ohajbl
C:\WINDOWS\system32\rmxh
C:\WINDOWS\system32\btmkjbbd
C:\WINDOWS\system32\lredin
C:\WINDOWS\system32\bbvcr
C:\WINDOWS\system32\ftejqb
C:\WINDOWS\system32\mmbjom
C:\WINDOWS\system32\qcbbt
C:\WINDOWS\system32\lwkwih
C:\WINDOWS\system32\whwfaiqm
C:\WINDOWS\system32\qyxo
C:\WINDOWS\system32\uomvrba
C:\WINDOWS\system32\ofneao
C:\WINDOWS\system32\ibyfco
C:\WINDOWS\system32\idcwma
C:\WINDOWS\system32\cuxc
C:\WINDOWS\system32\wicagx
C:\WINDOWS\system32\ynlxg
C:\WINDOWS\system32\gwdtffy
C:\WINDOWS\system32\nfubeu
C:\WINDOWS\system32\mlollpbp
C:\WINDOWS\system32\cdddf
C:\WINDOWS\system32\menwrmml
C:\WINDOWS\system32\pyax
C:\WINDOWS\system32\ptvgdrnu
C:\WINDOWS\system32\iyarlnqb
C:\WINDOWS\system32\xoepjalg
C:\WINDOWS\system32\lwujjw
C:\WINDOWS\system32\mcfout
C:\WINDOWS\system32\amcxdb
C:\WINDOWS\system32\cjanxbqr
C:\WINDOWS\system32\ruafwr
C:\WINDOWS\system32\isytdk
C:\WINDOWS\system32\kmgshy
C:\WINDOWS\system32\qjyeobt
C:\WINDOWS\system32\shykydbi
C:\WINDOWS\system32\srrcs
C:\WINDOWS\system32\eylm
C:\WINDOWS\system32\vnlxoifc
C:\WINDOWS\system32\hrohgbgo
C:\WINDOWS\system32\cgdo
C:\WINDOWS\system32\pbhiuvvx
C:\Documents and Settings\All Users\Application Data\msw
C:\WINDOWS\system32\dshofdox
C:\WINDOWS\system32\xgma
C:\WINDOWS\system32\utpxo
C:\WINDOWS\system32\kyragesk
C:\WINDOWS\system32\rkoswwbq
C:\WINDOWS\system32\ltmfgq
C:\WINDOWS\system32\bydl
C:\WINDOWS\system32\wqrr
C:\WINDOWS\system32\alccy
C:\WINDOWS\system32\kgfyhvbe
C:\WINDOWS\system32\yieyb
C:\WINDOWS\system32\qbqq
C:\WINDOWS\system32\gnokcvv
C:\WINDOWS\system32\hqenascb
C:\WINDOWS\system32\qjyeobt
C:\WINDOWS\system32\xgma
C:\WINDOWS\system32\hqenascb
C:\WINDOWS\system32\shykydbi
C:\WINDOWS\system32\ltmfgq
C:\WINDOWS\system32\dshofdox
C:\WINDOWS\system32\hrohgbgo
C:\WINDOWS\system32\utpxo
C:\WINDOWS\isrvs


Step 8
Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\Every username\Local Settings\Temp\
Also delete your Temporary Internet Files (Start > Control Panel > Internet Options > Delete Files), be sure to also select delete all offline content.
Empty the Recycle Bin.



Step 9
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.

The computer is running much much better, thank you. On step 4, all the 023 entries were already gone. Step 6, killbox, when I hit the reboot button the message I got was "PendingfileRenameOperation Registry Data has been Removed by External Process!". I rebooted manually and everything seems ok.

Below is the new HiJackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 1:19:21 PM, on 3/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\QUICKENW\QWDLLS.EXE
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\AOL Companion\companion.exe
C:\WINDOWS\system32\PackethSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://northeastkansas.cox.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://discussions.playnet.com/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - Startup: iMesh.lnk = C:\Program Files\iMesh\Client\iMeshClient.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Registration Lock On
O4 - Global Startup: America Online 6.0 Tray Icon.lnk = C:\Program Files\America Online 6.0a\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.taxsimple.com/TSWeb/msrdp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0410.dll
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: yfekhkanwqrr - Unknown owner - C:\WINDOWS\system32\wqrr\yfekhkan.exe (file missing)

Here's the latest HiJackThis log. The computers performance very much improved, many thanks!

Logfile of HijackThis v1.99.1
Scan saved at 8:44:49 PM, on 3/30/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\AOL Companion\companion.exe
C:\WINDOWS\system32\PackethSvc.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM95\aim.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://northeastkansas.cox.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://northeastkansas.cox.net/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPINST~1\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [Zero Knowledge Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - Global Startup: America Online 6.0 Tray Icon.lnk = C:\Program Files\America Online 6.0a\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Billminder.lnk = C:\Program Files\QUICKENW\BILLMIND.EXE
O4 - Global Startup: hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
O4 - Global Startup: hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
O4 - Global Startup: Quicken Startup.lnk = C:\Program Files\QUICKENW\QWDLLS.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: MktBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra 'Tools' menuitem: MarketBrowser - {17A27031-71FC-11d4-815C-005004D0F1FA} - C:\Program Files\MarketBrowser\lmt\MarketBrowser_Launch.xpy
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0522.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/packages/GSManager.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://www.taxsimple.com/TSWeb/msrdp.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…ymmapi_0410.dll
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe