What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

cws browser hijacker

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I believe I have the CWS browser hijacker .o my pc running Windows XP Pro. All my anti-spyware-icrosoft anti-spyware beta, AdAware and Spybot- I ran Hijack this and my log is below. Not sure if I did this right, but I would appreciate someone telling me what I should delete. Thank you
Logfile of HijackThis v1.99.0
Scan saved at 7:26:18 AM, on 5/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\windows\jdlsfxq.exe
C:\Program Files\Linksys\WPC11 V2.5 Config Utility\Config.exe
C:\Palm\HOTSYNC.EXE
D:\Support\LUpdate\LUSetup.exe
C:\DOCUME~1\Greg\LOCALS~1\Temp\pft4.tmp\LSETUP.EXE
C:\WINDOWS\System32\taskmgr.exe
D:\Support\LUpdate\LUSetup.exe
C:\DOCUME~1\Greg\LOCALS~1\Temp\pft8.tmp\LSETUP.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Documents and Settings\Greg\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Player Component] C:\WINDOWS\System32\fixmprxy.exe
O4 - HKCU\..\Run: [gnaduyc] c:\windows\jdlsfxq.exe
O4 - HKCU\..\Run: [jcjxkja] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [qhivpym] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [mwqujme] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [dhxxeqa] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nperbjp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [pcfnijs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uhtdluy] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yaxgyfu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wvqkfyh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [snjhrip] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yywacob] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wcuccmp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ljdfjre] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uduoihk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ohjkxih] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gqnmvgk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lubcfeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wkuwoef] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lmuhaeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cwcndhc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [usbkasv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ykemtvx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rqeddhi] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rgothhf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [klugunx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fyyykcu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [boxnvgs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jjlvlvm] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jbovnnf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cjglhmh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yuhhvuw] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [auqqsir] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yfwehfo] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nmphwjn] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ulmgxtq] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [afayksc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fhlcnsv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gsyiitg] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [aipjjaf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lnsxkke] c:\windows\xvsnrbf.exe
O4 - HKCU\..\Run: [lwxeadh] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [wdwmnxu] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mdakfbb] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mslmlxg] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aotmsil] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vhoeikm] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [halrjkc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aivybbw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [slfcskw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [biwombc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [cqmxbjp] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [arlypaq] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [rectuvk] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vlcemyr] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [qttkqbl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [moawgsl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [hvirdap] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [xjdvmob] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jpkardf] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [knyfbhj] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jtavonn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [shmlhmn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vhpnxet] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ahlokog] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xcnobjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ickgaew] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [asnboiv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ddkibqi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fkjujkh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xmpyrfg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [goqrfrn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ivdyvgo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mxqlvdm] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kpqubes] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ucpipea] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iwwvlrw] c:\windows\okqgkue.exe
O4 - Startup: HotSync Manager.LNK = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless Network PC Card Config Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/109c8a9490aac7…ip/RdxIE601.cab
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://192.168.0.5/plugin/h263ctrl.cab
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab
O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab
O21 - SSODL: Client Component - {D251E18F-199A-4A20-90F0-CF4CBAE5E783} - C:\WINDOWS\System32\c_12ntfs.dll
O23 - Service: Gear Security Service - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown - C:\WINDOWS\System32\ScsiAccess.EXE
Post #2
Hi skier! I'm 'KotaGuy. Welcome to TomCoyote!

If you still require assistance, could you please post a new HijackThis log. It has been a few days since you've posted and something might have changed since then.

Before you post. I would like you to delete/uninstall your old version of HijackThis and download the newest version here. Extract(unzip) it to its own folder, do not run it from a temp folder or from the zip. Run the program. Press the Do a System scan and save a log file button. The log should open up in notepad. Copy/Paste the complete contents of the log into a reply to this thread.

Thanks!
Post #3
KotaGuy. Here is the new post. I really appreciate your help!
Logfile of HijackThis v1.99.1
Scan saved at 12:22:16 PM, on 5/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\windows\pnpwtjy.exe
C:\Program Files\Linksys\WPC11 V2.5 Config Utility\Config.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Greg\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Player Component] C:\WINDOWS\System32\fixmprxy.exe
O4 - HKCU\..\Run: [gnaduyc] c:\windows\jdlsfxq.exe
O4 - HKCU\..\Run: [jcjxkja] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [qhivpym] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [mwqujme] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [dhxxeqa] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nperbjp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [pcfnijs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uhtdluy] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yaxgyfu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wvqkfyh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [snjhrip] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yywacob] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wcuccmp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ljdfjre] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uduoihk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ohjkxih] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gqnmvgk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lubcfeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wkuwoef] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lmuhaeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cwcndhc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [usbkasv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ykemtvx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rqeddhi] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rgothhf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [klugunx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fyyykcu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [boxnvgs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jjlvlvm] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jbovnnf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cjglhmh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yuhhvuw] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [auqqsir] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yfwehfo] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nmphwjn] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ulmgxtq] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [afayksc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fhlcnsv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gsyiitg] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [aipjjaf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lnsxkke] c:\windows\xvsnrbf.exe
O4 - HKCU\..\Run: [lwxeadh] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [wdwmnxu] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mdakfbb] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mslmlxg] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aotmsil] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vhoeikm] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [halrjkc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aivybbw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [slfcskw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [biwombc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [cqmxbjp] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [arlypaq] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [rectuvk] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vlcemyr] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [qttkqbl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [moawgsl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [hvirdap] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [xjdvmob] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jpkardf] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [knyfbhj] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jtavonn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [shmlhmn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vhpnxet] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ahlokog] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xcnobjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ickgaew] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [asnboiv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ddkibqi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fkjujkh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xmpyrfg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [goqrfrn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ivdyvgo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mxqlvdm] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kpqubes] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ucpipea] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iwwvlrw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [comsyrr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kvuqbar] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nvreshv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hashvid] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dgjchbw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vlfuhry] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ifyqhue] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qesrfdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gicawmu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [stdfwkc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [arpdqbc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rsdjnff] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ideckdb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uadeceh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [unyeefn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fuopgbs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ajvbjhi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gggiady] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iasehct] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jahmcew] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pmjidyq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hherhdq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xwgqxgk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gogwnjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pfeljfn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yskktdg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qxqsgpo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nxhhqgb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mxbrxqb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vsnaeni] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhwmlue] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gfnavqd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [feibmvg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pfjwxse] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pwfrgsc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mohuidl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gxegctd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vjcsomy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aaesvuh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xojbbja] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ygmqchx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [penbskf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gnsrhpc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [twkmdlq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jplfomi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hrgipko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [posckfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [emujvqb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xhmjfen] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cqvyvbh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cuuammm] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ccaeblb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dxnyyjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wsaeaaj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bwqwswx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [asvrakt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ewehqqs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vevukqp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bxgofod] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lemabgu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [spvysqv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [daxlufy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iydclxt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ugrgeln] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qicuvko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mtqkbnr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pjjvcba] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aifqxqc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mdqwuxa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cpejrgj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ufxinfp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cvpnydq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jsqjxnw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [faxqtij] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qvscuef] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bqscqfr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nsymajx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcmyoou] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jfxtctj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lkumxsb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [eadnutx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xayhdww] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ljeblfw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [egqrxji] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yksrvsy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jnecyxw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gvnklpx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wxtlqgr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xuocaiq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hiqwyjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfxfckg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cjrfogn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wxroked] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lncoujo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gigreti] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mfydnlg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lmvvvwl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rbiaudq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xxorebp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdnwfsr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [julhpmu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vfsemeb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [paevwhr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ogwrbwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mftwfsl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [evcylvy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nhxggmj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nscfply] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ikifave] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ffdkuuy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xpmqqfd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [paeoouy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tyvjvpg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lwldekd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sjgfdyy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [njfdhvj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ttouwaw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xqwtcdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ibuooqx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jkorlhr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yllndsc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aspqubx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [embqtwy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [khxbueu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nsgsgid] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bggrafa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [knesyqk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sluiyfj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcuwdxr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aqhonfn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhefloy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ysiqtiw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mwgrsnu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [heykvky] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fotujja] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdtejbw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mdaypml] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hguvapk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [goufljq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dynaobd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kpfpsxi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dckbehx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dxffowe] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmjgvhw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wouncfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kubjjfl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [imlomqv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dfsrruw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [casnjip] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfnqdse] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [eolxnil] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vmrbnyv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kfakslu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ramveir] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nlawhvi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iuhpkxh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fadqkdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [chtfgwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qtsriwn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [agtkoac] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lndplaa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bcfymkq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcojwjc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [haoaejj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [khqhjdi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pogmnex] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ldqrksd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kttoacu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jvlhuhp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ftueuhd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cirxmpc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vebpexw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ifgwkrq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qurglfo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vjcxhba] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [geyduox] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ogfteev] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [njnwaaf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nkebmbl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ypflsem] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nbvclsl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dggbxyq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [npiatyb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vnreasi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hnkkmao] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bqdlmwj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gsewoci] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vrsbxlr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mrbpdpp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [urvlipa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfwctuf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sxialko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhwumsf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pwxbdlk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vafflgy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vsheats] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [txjjsho] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmutlpw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [etramsn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rnknbkd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hvhrosr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rxxsfpl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mhalgbr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qerdabu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rfdifek] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xkdjnsu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdyjhad] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qklwpei] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xkdvvaq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ldqnlmv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [suurdxv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yjrnywv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qunsjgr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fukijyo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ikhftwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ttdqxxh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tutieyf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ugfgbkk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pbaqoka] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wsikxro] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bsovpwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lntucnk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qbmjrry] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kucurtw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wshgypb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jrfrsag] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pulqdcq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ornfvnr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ctydadw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uywqjyt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gsuhbqu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [epgrpka] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iorvojn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kixmmgt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qdfssll] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lslrpjp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmmekmw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fydtgcn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aiuybcd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [smjcike] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [antnvim] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yogeahs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ejtlicc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dgfbbwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cemsjxo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fyhwgxv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jchdajl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dolckcv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wofwkxk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rindfof] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ybwegpj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lsbxbnq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jyjpbyk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [evvqkuf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cmmdpui] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ndoijnh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tjlpqfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [byttpto] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ibrsvpe] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ksighmv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [arewlrl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cbumejk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lfxxotk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gksptno] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nlsmntv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dmogcwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmpsvqk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gqkjotw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ayxrfpj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pcnyrqo] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [fpggdis] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [cmhwfyw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [qtapanm] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [sdbhbeb] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nwvedcg] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nbwvvab] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [jhdiakj] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nfojwwu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [awhjwmo] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [yuqdwoh] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [fyjbuaj] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nhynwfn] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [xpdkmtb] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [shxdape] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [hbuarja] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [eicdkrf] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [yoelhdt] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [genthrr] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [ctobomu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [jlrmvcw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [twebnoi] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [skscmiv] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nqwcgej] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [wfniapv] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [klyundu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [lkewraw] c:\windows\nytqwxn.exe
O4 - Startup: HotSync Manager.LNK = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Global Startup: Wireless Network PC Card Config Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/109c8a9490aac7…ip/RdxIE601.cab
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://192.168.0.5/plugin/h263ctrl.cab
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…484/mcfscan.cab
O21 - SSODL: Client Component - {D251E18F-199A-4A20-90F0-CF4CBAE5E783} - C:\WINDOWS\System32\c_12ntfs.dll
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
Post #4
Thanks for posting the new log.

Going to get rid of that bad LSP fisrt.

Download LSPFix.

Disconnect from the internet, and close all browser windows.

Run LSPFix. Click the "I know what I'm doing" button. Check all instances of flsmngr.dll (and nothing else), move them to the "Remove" pane by clicking the ">>" button. Click Finish.

Reboot Windows normally and post a new HijackThis log please.
Post #5
Thanks, KoyaGuy. Here's the new log.
Logfile of HijackThis v1.99.1
Scan saved at 5:44:58 PM, on 5/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\windows\jdlsfxq.exe
C:\Program Files\Linksys\WPC11 V2.5 Config Utility\Config.exe
C:\Palm\HOTSYNC.EXE
C:\Documents and Settings\Greg\Desktop\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Player Component] C:\WINDOWS\System32\fixmprxy.exe
O4 - HKCU\..\Run: [gnaduyc] c:\windows\jdlsfxq.exe
O4 - HKCU\..\Run: [jcjxkja] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [qhivpym] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [mwqujme] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [dhxxeqa] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nperbjp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [pcfnijs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uhtdluy] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yaxgyfu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wvqkfyh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [snjhrip] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yywacob] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wcuccmp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ljdfjre] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uduoihk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ohjkxih] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gqnmvgk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lubcfeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wkuwoef] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lmuhaeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cwcndhc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [usbkasv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ykemtvx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rqeddhi] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rgothhf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [klugunx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fyyykcu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [boxnvgs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jjlvlvm] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jbovnnf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cjglhmh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yuhhvuw] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [auqqsir] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yfwehfo] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nmphwjn] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ulmgxtq] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [afayksc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fhlcnsv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gsyiitg] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [aipjjaf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lnsxkke] c:\windows\xvsnrbf.exe
O4 - HKCU\..\Run: [lwxeadh] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [wdwmnxu] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mdakfbb] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mslmlxg] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aotmsil] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vhoeikm] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [halrjkc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aivybbw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [slfcskw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [biwombc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [cqmxbjp] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [arlypaq] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [rectuvk] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vlcemyr] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [qttkqbl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [moawgsl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [hvirdap] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [xjdvmob] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jpkardf] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [knyfbhj] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jtavonn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [shmlhmn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vhpnxet] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ahlokog] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xcnobjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ickgaew] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [asnboiv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ddkibqi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fkjujkh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xmpyrfg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [goqrfrn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ivdyvgo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mxqlvdm] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kpqubes] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ucpipea] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iwwvlrw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [comsyrr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kvuqbar] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nvreshv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hashvid] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dgjchbw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vlfuhry] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ifyqhue] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qesrfdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gicawmu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [stdfwkc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [arpdqbc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rsdjnff] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ideckdb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uadeceh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [unyeefn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fuopgbs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ajvbjhi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gggiady] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iasehct] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jahmcew] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pmjidyq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hherhdq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xwgqxgk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gogwnjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pfeljfn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yskktdg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qxqsgpo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nxhhqgb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mxbrxqb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vsnaeni] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhwmlue] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gfnavqd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [feibmvg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pfjwxse] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pwfrgsc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mohuidl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gxegctd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vjcsomy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aaesvuh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xojbbja] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ygmqchx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [penbskf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gnsrhpc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [twkmdlq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jplfomi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hrgipko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [posckfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [emujvqb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xhmjfen] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cqvyvbh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cuuammm] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ccaeblb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dxnyyjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wsaeaaj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bwqwswx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [asvrakt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ewehqqs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vevukqp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bxgofod] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lemabgu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [spvysqv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [daxlufy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iydclxt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ugrgeln] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qicuvko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mtqkbnr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pjjvcba] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aifqxqc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mdqwuxa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cpejrgj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ufxinfp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cvpnydq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jsqjxnw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [faxqtij] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qvscuef] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bqscqfr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nsymajx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcmyoou] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jfxtctj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lkumxsb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [eadnutx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xayhdww] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ljeblfw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [egqrxji] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yksrvsy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jnecyxw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gvnklpx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wxtlqgr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xuocaiq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hiqwyjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfxfckg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cjrfogn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wxroked] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lncoujo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gigreti] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mfydnlg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lmvvvwl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rbiaudq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xxorebp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdnwfsr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [julhpmu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vfsemeb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [paevwhr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ogwrbwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mftwfsl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [evcylvy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nhxggmj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nscfply] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ikifave] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ffdkuuy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xpmqqfd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [paeoouy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tyvjvpg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lwldekd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sjgfdyy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [njfdhvj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ttouwaw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xqwtcdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ibuooqx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jkorlhr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yllndsc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aspqubx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [embqtwy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [khxbueu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nsgsgid] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bggrafa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [knesyqk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sluiyfj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcuwdxr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aqhonfn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhefloy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ysiqtiw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mwgrsnu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [heykvky] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fotujja] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdtejbw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mdaypml] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hguvapk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [goufljq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dynaobd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kpfpsxi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dckbehx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dxffowe] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmjgvhw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wouncfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kubjjfl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [imlomqv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dfsrruw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [casnjip] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfnqdse] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [eolxnil] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vmrbnyv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kfakslu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ramveir] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nlawhvi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iuhpkxh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fadqkdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [chtfgwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qtsriwn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [agtkoac] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lndplaa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bcfymkq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcojwjc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [haoaejj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [khqhjdi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pogmnex] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ldqrksd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kttoacu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jvlhuhp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ftueuhd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cirxmpc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vebpexw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ifgwkrq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qurglfo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vjcxhba] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [geyduox] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ogfteev] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [njnwaaf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nkebmbl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ypflsem] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nbvclsl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dggbxyq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [npiatyb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vnreasi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hnkkmao] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bqdlmwj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gsewoci] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vrsbxlr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mrbpdpp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [urvlipa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfwctuf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sxialko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhwumsf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pwxbdlk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vafflgy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vsheats] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [txjjsho] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmutlpw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [etramsn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rnknbkd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hvhrosr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rxxsfpl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mhalgbr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qerdabu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rfdifek] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xkdjnsu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdyjhad] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qklwpei] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xkdvvaq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ldqnlmv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [suurdxv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yjrnywv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qunsjgr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fukijyo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ikhftwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ttdqxxh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tutieyf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ugfgbkk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pbaqoka] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wsikxro] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bsovpwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lntucnk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qbmjrry] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kucurtw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wshgypb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jrfrsag] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pulqdcq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ornfvnr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ctydadw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uywqjyt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gsuhbqu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [epgrpka] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iorvojn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kixmmgt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qdfssll] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lslrpjp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmmekmw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fydtgcn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aiuybcd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [smjcike] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [antnvim] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yogeahs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ejtlicc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dgfbbwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cemsjxo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fyhwgxv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jchdajl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dolckcv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wofwkxk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rindfof] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ybwegpj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lsbxbnq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jyjpbyk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [evvqkuf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cmmdpui] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ndoijnh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tjlpqfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [byttpto] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ibrsvpe] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ksighmv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [arewlrl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cbumejk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lfxxotk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gksptno] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nlsmntv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dmogcwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmpsvqk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gqkjotw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ayxrfpj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pcnyrqo] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [fpggdis] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [cmhwfyw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [qtapanm] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [sdbhbeb] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nwvedcg] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nbwvvab] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [jhdiakj] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nfojwwu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [awhjwmo] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [yuqdwoh] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [fyjbuaj] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nhynwfn] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [xpdkmtb] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [shxdape] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [hbuarja] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [eicdkrf] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [yoelhdt] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [genthrr] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [ctobomu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [jlrmvcw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [twebnoi] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [skscmiv] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nqwcgej] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [wfniapv] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [klyundu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [lkewraw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [toyccpi] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [vscotbk] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [qdjckht] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [efsqoja] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [oxahmlt] c:\windows\ewljicw.exe
O4 - Startup: HotSync Manager.LNK = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Global Startup: Wireless Network PC Card Config Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/109c8a9490aac7…ip/RdxIE601.cab
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://192.168.0.5/plugin/h263ctrl.cab
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…484/mcfscan.cab
O21 - SSODL: Client Component - {D251E18F-199A-4A20-90F0-CF4CBAE5E783} - C:\WINDOWS\System32\c_12ntfs.dll
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
Post #6
Thanks for posting the new log.

Lets get the rest of this cleaned up now :)

Download and install CCleaner. Don't run it yet.

Download CWShredder. Save it to its own folder. Run the program. Update it. Press the Fix button. Close when done.

Print this out for reference during the fix.

Make sure no files are hidden. To do this:

1. Click Start.
2. Open My Computer.
3. Select the Tools menu and click Folder Options.
4. Select the View Tab.
5. Under the Hidden files and folders heading select Show hidden files and folders.
6. Uncheck the Hide protected operating system files (recommended) option.
7. Click Yes to confirm.
8. Click OK.

Hit Ctrl+Alt+Delete to bring up the Task Manager. End Task:

jdlsfxq.exe

Rund and scan with HijackThis. With all other browsers and windows closed, place a check beside the following and Fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
O4 - HKLM\..\Run: [Player Component] C:\WINDOWS\System32\fixmprxy.exe
O4 - HKCU\..\Run: [gnaduyc] c:\windows\jdlsfxq.exe
O4 - HKCU\..\Run: [jcjxkja] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [qhivpym] c:\windows\pnpwtjy.exe
O4 - HKCU\..\Run: [mwqujme] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [dhxxeqa] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nperbjp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [pcfnijs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uhtdluy] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yaxgyfu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wvqkfyh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [snjhrip] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yywacob] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wcuccmp] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ljdfjre] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [uduoihk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ohjkxih] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gqnmvgk] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lubcfeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [wkuwoef] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lmuhaeh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cwcndhc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [usbkasv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ykemtvx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rqeddhi] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [rgothhf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [klugunx] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fyyykcu] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [boxnvgs] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jjlvlvm] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [jbovnnf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [cjglhmh] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yuhhvuw] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [auqqsir] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [yfwehfo] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [nmphwjn] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [ulmgxtq] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [afayksc] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [fhlcnsv] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [gsyiitg] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [aipjjaf] c:\windows\bwqyhnx.exe
O4 - HKCU\..\Run: [lnsxkke] c:\windows\xvsnrbf.exe
O4 - HKCU\..\Run: [lwxeadh] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [wdwmnxu] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mdakfbb] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [mslmlxg] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aotmsil] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vhoeikm] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [halrjkc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [aivybbw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [slfcskw] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [biwombc] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [cqmxbjp] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [arlypaq] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [rectuvk] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [vlcemyr] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [qttkqbl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [moawgsl] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [hvirdap] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [xjdvmob] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jpkardf] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [knyfbhj] c:\windows\lwmrwvv.exe
O4 - HKCU\..\Run: [jtavonn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [shmlhmn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vhpnxet] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ahlokog] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xcnobjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ickgaew] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [asnboiv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ddkibqi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fkjujkh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xmpyrfg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [goqrfrn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ivdyvgo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mxqlvdm] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kpqubes] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ucpipea] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iwwvlrw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [comsyrr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kvuqbar] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nvreshv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hashvid] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dgjchbw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vlfuhry] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ifyqhue] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qesrfdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gicawmu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [stdfwkc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [arpdqbc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rsdjnff] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ideckdb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uadeceh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [unyeefn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fuopgbs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ajvbjhi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gggiady] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iasehct] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jahmcew] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pmjidyq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hherhdq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xwgqxgk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gogwnjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pfeljfn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yskktdg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qxqsgpo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nxhhqgb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mxbrxqb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vsnaeni] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhwmlue] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gfnavqd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [feibmvg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pfjwxse] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pwfrgsc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mohuidl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gxegctd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vjcsomy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aaesvuh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xojbbja] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ygmqchx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [penbskf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gnsrhpc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [twkmdlq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jplfomi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hrgipko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [posckfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [emujvqb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xhmjfen] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cqvyvbh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cuuammm] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ccaeblb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dxnyyjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wsaeaaj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bwqwswx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [asvrakt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ewehqqs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vevukqp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bxgofod] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lemabgu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [spvysqv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [daxlufy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iydclxt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ugrgeln] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qicuvko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mtqkbnr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pjjvcba] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aifqxqc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mdqwuxa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cpejrgj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ufxinfp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cvpnydq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jsqjxnw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [faxqtij] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qvscuef] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bqscqfr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nsymajx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcmyoou] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jfxtctj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lkumxsb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [eadnutx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xayhdww] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ljeblfw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [egqrxji] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yksrvsy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jnecyxw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gvnklpx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wxtlqgr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xuocaiq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hiqwyjr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfxfckg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cjrfogn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wxroked] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lncoujo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gigreti] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mfydnlg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lmvvvwl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rbiaudq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xxorebp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdnwfsr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [julhpmu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vfsemeb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [paevwhr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ogwrbwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mftwfsl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [evcylvy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nhxggmj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nscfply] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ikifave] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ffdkuuy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xpmqqfd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [paeoouy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tyvjvpg] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lwldekd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sjgfdyy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [njfdhvj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ttouwaw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xqwtcdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ibuooqx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jkorlhr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yllndsc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aspqubx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [embqtwy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [khxbueu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nsgsgid] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bggrafa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [knesyqk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sluiyfj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcuwdxr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aqhonfn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhefloy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ysiqtiw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mwgrsnu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [heykvky] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fotujja] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdtejbw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mdaypml] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hguvapk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [goufljq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dynaobd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kpfpsxi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dckbehx] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dxffowe] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmjgvhw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wouncfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kubjjfl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [imlomqv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dfsrruw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [casnjip] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfnqdse] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [eolxnil] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vmrbnyv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kfakslu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ramveir] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nlawhvi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iuhpkxh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fadqkdf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [chtfgwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qtsriwn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [agtkoac] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lndplaa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bcfymkq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rcojwjc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [haoaejj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [khqhjdi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pogmnex] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ldqrksd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kttoacu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jvlhuhp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ftueuhd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cirxmpc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vebpexw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ifgwkrq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qurglfo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vjcxhba] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [geyduox] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ogfteev] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [njnwaaf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nkebmbl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ypflsem] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nbvclsl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dggbxyq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [npiatyb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vnreasi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hnkkmao] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bqdlmwj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gsewoci] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vrsbxlr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mrbpdpp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [urvlipa] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tfwctuf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [sxialko] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uhwumsf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pwxbdlk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vafflgy] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vsheats] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [txjjsho] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmutlpw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [etramsn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rnknbkd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [hvhrosr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rxxsfpl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [mhalgbr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qerdabu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rfdifek] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xkdjnsu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [vdyjhad] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qklwpei] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [xkdvvaq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ldqnlmv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [suurdxv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yjrnywv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qunsjgr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fukijyo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ikhftwf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ttdqxxh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tutieyf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ugfgbkk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pbaqoka] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wsikxro] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bsovpwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lntucnk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qbmjrry] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kucurtw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wshgypb] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jrfrsag] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pulqdcq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ornfvnr] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ctydadw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [uywqjyt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gsuhbqu] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [epgrpka] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [iorvojn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [kixmmgt] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [qdfssll] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lslrpjp] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmmekmw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fydtgcn] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [aiuybcd] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [smjcike] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [antnvim] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [yogeahs] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ejtlicc] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dgfbbwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cemsjxo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [fyhwgxv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jchdajl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dolckcv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [wofwkxk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [rindfof] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ybwegpj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lsbxbnq] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [jyjpbyk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [evvqkuf] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cmmdpui] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ndoijnh] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [tjlpqfi] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [byttpto] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ibrsvpe] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ksighmv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [arewlrl] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [cbumejk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [lfxxotk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gksptno] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [nlsmntv] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [dmogcwo] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [bmpsvqk] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [gqkjotw] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [ayxrfpj] c:\windows\okqgkue.exe
O4 - HKCU\..\Run: [pcnyrqo] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [fpggdis] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [cmhwfyw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [qtapanm] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [sdbhbeb] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nwvedcg] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nbwvvab] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [jhdiakj] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nfojwwu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [awhjwmo] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [yuqdwoh] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [fyjbuaj] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nhynwfn] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [xpdkmtb] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [shxdape] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [hbuarja] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [eicdkrf] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [yoelhdt] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [genthrr] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [ctobomu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [jlrmvcw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [twebnoi] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [skscmiv] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [nqwcgej] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [wfniapv] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [klyundu] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [lkewraw] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [toyccpi] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [vscotbk] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [qdjckht] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [efsqoja] c:\windows\nytqwxn.exe
O4 - HKCU\..\Run: [oxahmlt] c:\windows\ewljicw.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/109c8a9490aac7…ip/RdxIE601.cab
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://192.168.0.5/plugin/h263ctrl.cab
O21 - SSODL: Client Component - {D251E18F-199A-4A20-90F0-CF4CBAE5E783} - C:\WINDOWS\System32\c_12ntfs.dll

Boot into Safe Mode. To do this:

1. Reboot your computer.
2. Tap the F8 button as your computer is booting to bring you to the Advanced Options Menu.
3. Select Safe Mode and press Enter.

Search for and delete this folder:

C:\freescan

Search for and delete these files:

C:\windows\jdlsfxq.exe
C:\windows\pnpwtjy.exe
C:\windows\bwqyhnx.exe
C:\windows\xvsnrbf.exe
C:\windows\lwmrwvv.exe
C:\windows\nytqwxn.exe
C:\windows\ewljicw.exe
C:\WINDOWS\System32\fixmprxy.exe
C:\WINDOWS\System32\c_12ntfs.dll

Browse to your C:\Windows\Prefetch folder. Delete all the files in the folder, do not delete the folder itself. Empty your Recycle Bin. Run CCleaner.

Reboot Windows normally and post a new HijackThis log please.
Post #7
Thanks KotaGuy. Here is the new post. Sorry it took so long. I lost my internet connection for a good part of today.
Logfile of HijackThis v1.99.1
Scan saved at 3:25:16 PM, on 5/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\Linksys\WPC11 V2.5 Config Utility\Config.exe
C:\Palm\HOTSYNC.EXE
C:\Documents and Settings\Greg\Desktop\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [cfhanfd] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rojuhcr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [mfsqvpw] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [hjsjuwh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [emnblfr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [dfywmch] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xppruha] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [idinpjx] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [vislktr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [dnlumfb] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [peewole] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [pvvgfxh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [lppegin] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cvepkgr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [iymnmxq] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rmqprhm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jsrkcnt] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [diylvoj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rniekai] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [bmdpcvu] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jpcdtxc] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jddivge] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cwtkxml] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gqirnmk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [qpejxyp] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cewhdux] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cmcgkpf] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cyrfkqy] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cmdwbda] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xciyjjw] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [mdfljvl] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [usstsfj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ljwjwmv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [aftdgih] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [oxobocm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [hhpryml] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [nmnaoam] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [flsuvnf] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [edrtfgo] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [efbmrbr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [klgxphp] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [iknbobd] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [bhbkdnu] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [fxvhist] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [nxvnlnb] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gyugogr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [axljxfr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gxoirpk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yolcgmk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [frnmspj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yradgou] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [oqigxvb] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [qfhajmt] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [tgkbbrd] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ifsmyuq] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yfkouqj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [lnhklei] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [hvqyrfe] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yyffhcc] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cqaiyje] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [kbunppe] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xtugfsm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [qiegajh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [lqtfxdy] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xfibpfv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [wpfkstu] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [blmlqke] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rorgnbr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [adcrbne] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [oxvbgty] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ygntrrh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [thqaubj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jsuoolv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [umyanvv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ogavshm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gifinuv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [pkkpcte] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [bysarxx] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [morhtxk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [fpdnbql] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ngrbvos] c:\windows\ewljicw.exe
O4 - Startup: HotSync Manager.LNK = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O4 - Global Startup: Wireless Network PC Card Config Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…484/mcfscan.cab
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
Post #8 last edited
Thanks for posting the new log. Looking lots better! You're doing good.

Disable SpySubtract as it may interfere with the fix.

Run and scan with HijackThis. With all other browsers and windows closed, place a check beside the following and fix:

O4 - HKCU\..\Run: [cfhanfd] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rojuhcr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [mfsqvpw] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [hjsjuwh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [emnblfr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [dfywmch] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xppruha] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [idinpjx] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [vislktr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [dnlumfb] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [peewole] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [pvvgfxh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [lppegin] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cvepkgr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [iymnmxq] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rmqprhm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jsrkcnt] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [diylvoj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rniekai] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [bmdpcvu] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jpcdtxc] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jddivge] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cwtkxml] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gqirnmk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [qpejxyp] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cewhdux] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cmcgkpf] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cyrfkqy] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cmdwbda] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xciyjjw] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [mdfljvl] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [usstsfj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ljwjwmv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [aftdgih] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [oxobocm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [hhpryml] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [nmnaoam] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [flsuvnf] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [edrtfgo] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [efbmrbr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [klgxphp] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [iknbobd] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [bhbkdnu] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [fxvhist] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [nxvnlnb] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gyugogr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [axljxfr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gxoirpk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yolcgmk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [frnmspj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yradgou] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [oqigxvb] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [qfhajmt] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [tgkbbrd] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ifsmyuq] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yfkouqj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [lnhklei] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [hvqyrfe] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [yyffhcc] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [cqaiyje] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [kbunppe] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xtugfsm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [qiegajh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [lqtfxdy] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [xfibpfv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [wpfkstu] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [blmlqke] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [rorgnbr] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [adcrbne] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [oxvbgty] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ygntrrh] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [thqaubj] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [jsuoolv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [umyanvv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ogavshm] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [gifinuv] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [pkkpcte] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [bysarxx] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [morhtxk] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [fpdnbql] c:\windows\ewljicw.exe
O4 - HKCU\..\Run: [ngrbvos] c:\windows\ewljicw.exe

Boot into Safe Mode.

Search for and delete this file:

C:\Windows\ewljicw.exe

Browse to your C:\Windows\Prefetch folder. Delete all the files in the folder, do not delete the folder itself. Empty your Recycle Bin. Run CCleaner.

Reboot Windows normally and post a new HijackThis log please.

Thanks!
Post #9
KotaGuy. Thanks for sticking with me. Here is the new log. By the way, a search failed to reveal the file ewljicw.exe.
Logfile of HijackThis v1.97.7
Scan saved at 5:37:19 PM, on 5/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Linksys\WPC11 V2.5 Config Utility\Config.exe
C:\Palm\HOTSYNC.EXE
C:\Documents and Settings\Greg\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Startup: HotSync Manager.LNK = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless Network PC Card Config Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc2.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…484/mcfscan.cab
Post #10
Whoah!

Logfile of HijackThis v1.97.7
Scan saved at 5:37:19 PM, on 5/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)


You reverted back to and old version. :)

Need you to post the log with v1.99.1 please.

Thanks!
Post #11
Here's new log
Logfile of HijackThis v1.99.1
Scan saved at 6:51:44 PM, on 5/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\gearsec.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Linksys\WPC11 V2.5 Config Utility\Config.exe
C:\Palm\HOTSYNC.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Greg\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sundayriver.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Startup: HotSync Manager.LNK = C:\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Wireless Network PC Card Config Utility.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {D44C75D8-C827-473E-8F68-A77E42500782} (Uploader Class) - http://photo.walmart.com/photo/uploads/WebUploadClient.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…484/mcfscan.cab
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
Post #15
Good to hear! Glad I was able to help!

Now… some suggestions…

You need to get some form of AntiVirus installed on your computer. I suggest downloading and installing AVG Free Edition. Update it. Do a full system scan and fix anything found.

To clean up any remnants that may have been left behind, I suggest doing a couple online virus scans. A couple good ones are Panda ActiveScan and TrendMicro HouseCall. Let them fix anything they find. Reboot between each scan.

Visit this page for proper configuration of Spybot and Ad-Aware. Run and scan with both, letting them fix whatever they find. Remember to reboot between each scan.

After that reset your System Restore Point. This will ensure a nice clean backup to fall upon if you ever need it. To do this:

1. Right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Check the "Turn off System Restore" or "Turn off System Restore on all drives"

Reboot your computer, follow the steps above, this time unchecking the "Turn off System Restore" and reboot.

Along with Ad-Aware and Spybot, you might also want to look into installing SpywareBlaster, SpywareGuard, and IE-SPYAD. You can grab them from the links in my sig. The programs are free and can be updated, so please remember to do so. Installing these will go a long way in preventing reinfection.

I never saw any indication of a Firewall installed. I'm sure you've heard of ZoneAlarm :)

Check out the links in my sig named How'd I get Infected and Understanding Spyware as well, some good information for you :)

Might want to think about updating Windows to Service Pack 2 now that your computer is clean. It fixes a lot of security issues with XP.

Other than that, remember to update Windows frequently, update your protection programs, scan often and…

Surf Safe!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI