About::Blank Browser Hijacker

Logfile of HijackThis v1.99.0
Scan saved at 4:59:40 PM, on 5/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\msfk32.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {FC5F4FD2-9814-9658-709F-821EB79F97AB} - C:\WINDOWS\javatk.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [msfk32.exe] C:\WINDOWS\msfk32.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunOnce: [ntce32.exe] C:\WINDOWS\system32\ntce32.exe
O4 - HKLM\..\RunOnce: [netam32.exe] C:\WINDOWS\netam32.exe
O4 - HKLM\..\RunOnce: [netav.exe] C:\WINDOWS\system32\netav.exe
O4 - HKLM\..\RunOnce: [ieqj32.exe] C:\WINDOWS\system32\ieqj32.exe
O4 - HKLM\..\RunOnce: [netdn32.exe] C:\WINDOWS\system32\netdn32.exe
O4 - HKLM\..\RunOnce: [msbt32.exe] C:\WINDOWS\system32\msbt32.exe
O4 - HKLM\..\RunOnce: [atlrr.exe] C:\WINDOWS\system32\atlrr.exe
O4 - HKLM\..\RunOnce: [mfcuo32.exe] C:\WINDOWS\system32\mfcuo32.exe
O4 - HKLM\..\RunOnce: [iekv32.exe] C:\WINDOWS\system32\iekv32.exe
O4 - HKLM\..\RunOnce: [crsu32.exe] C:\WINDOWS\system32\crsu32.exe
O4 - HKLM\..\RunOnce: [sysml32.exe] C:\WINDOWS\system32\sysml32.exe
O4 - HKLM\..\RunOnce: [mfcxh32.exe] C:\WINDOWS\mfcxh32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Norton Disk Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\NDD32.EXE
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD…sharingctrl.cab
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\system32\atlcr.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Roger Wilco Base Station - Unknown - C:\Program Files\Red Storm Entertainment\Roger Wilco\rwbs\rwbs.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Servic

Welcome to the forum.


Please read through the instructions before you start (you may want to print this out).

Please download and install these programs - don't run them yet!!

Please download and unzip
AboutBuster to a folder. Inside the folder is a readme file that has instructions on the use of the program.
AboutBuster MUST be updated before you use it.
Start AboutBuster, click the update button, check for update, drag the box to the side and hit download updates, close the box . Don't run it yet.
AboutBuster Tutorial

Download and unzip cwsserviceremove to your desktop. use link below:
http://lineofire.geekstogo.com/cwsserviceremove.zip

Download CW-Shredder at the link below:
http://cwshredder.net/bin/CWShredder.exe

Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked.
Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Reboot into SafeMode. <—MAKE SURE YOU KNOW HOW TO DO THIS!!

+++++++++++++++++++++++++++++++++++++++++++++++++

Here's the fix:

Important Step
1. Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:
Remote Procedure Call (RPC) Helper

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

2. Reboot into Safe Mode

3. Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for:

msfk32.exe

If you find the files, click on them, and then click End Process => Exit the Task Manager.

4. CLOSE ALL WINDOWS AND BROWSERS Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\aoavu.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {FC5F4FD2-9814-9658-709F-821EB79F97AB} - C:\WINDOWS\javatk.dll
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [msfk32.exe] C:\WINDOWS\msfk32.exe
O4 - HKLM\..\RunOnce: [ntce32.exe] C:\WINDOWS\system32\ntce32.exe
O4 - HKLM\..\RunOnce: [netam32.exe] C:\WINDOWS\netam32.exe
O4 - HKLM\..\RunOnce: [netav.exe] C:\WINDOWS\system32\netav.exe
O4 - HKLM\..\RunOnce: [ieqj32.exe] C:\WINDOWS\system32\ieqj32.exe
O4 - HKLM\..\RunOnce: [netdn32.exe] C:\WINDOWS\system32\netdn32.exe
O4 - HKLM\..\RunOnce: [msbt32.exe] C:\WINDOWS\system32\msbt32.exe
O4 - HKLM\..\RunOnce: [atlrr.exe] C:\WINDOWS\system32\atlrr.exe
O4 - HKLM\..\RunOnce: [mfcuo32.exe] C:\WINDOWS\system32\mfcuo32.exe
O4 - HKLM\..\RunOnce: [iekv32.exe] C:\WINDOWS\system32\iekv32.exe
O4 - HKLM\..\RunOnce: [crsu32.exe] C:\WINDOWS\system32\crsu32.exe
O4 - HKLM\..\RunOnce: [sysml32.exe] C:\WINDOWS\system32\sysml32.exe
O4 - HKLM\..\RunOnce: [mfcxh32.exe] C:\WINDOWS\mfcxh32.exe
O4 - Global Startup: officejet 6100.lnk = ?
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\system32\atlcr.exe (file missing)


Click on Fix Checked and exit HijackThis.


5. Delete the following files if present:

C:\WINDOWS\system32\atlcr.exe
C:\WINDOWS\system32\aoavu.dll
C:\WINDOWS\system32\ntce32.exe
C:\WINDOWS\system32\netav.exe
C:\WINDOWS\system32\ieqj32.exe
C:\WINDOWS\system32\netdn32.exe
C:\WINDOWS\system32\msbt32.exe
C:\WINDOWS\system32\atlrr.exe
C:\WINDOWS\system32\mfcuo32.exe
C:\WINDOWS\system32\iekv32.exe
C:\WINDOWS\system32\crsu32.exe
C:\WINDOWS\system32\sysml32.exe
C:\WINDOWS\mfcxh32.exe
C:\WINDOWS\msfk32.exe
C:\WINDOWS\javatk.dll
C:\WINDOWS\netam32.exe


(and any other files with the same name that end in .dll, .exe or .dat, you may find them right next to each other, example - appsw.exe, appsw.dll, appsw.dat)
If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. if it is uncheck it and try again.


6. Run AboutBuster . This will scan your computer for the bad files and delete them. It will ask to scan the system again, let it. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

7. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

8. Double click on the cwsserviceremove and when asked to merge say yes.

9. Run CW-Shredder - Hit the FIX button - let it run and fix what it finds.

10. Reboot into normal mode.

11. Download and run this online virus scan:<—Important
http://housecall.trendmicro.com/housecall/start_corp.asp
Make sure you check "AutoClean"

You are using an old version of HJT, could you please delete it and rescan the system with the new version and post that log.

http://tools.radiosplace.com/HijackThis.exe

12. Reboot and post a fresh HJT log back here by using the add reply button below, and lets see how we did, MrC

ok did as directed all but the last virus scan with trend micro went to get online to do the scan and there was the about blank took over automatically so did not see any point in doing the scan. It returned rather quickly so maybe I missed something somewhere. Here is the hijack this log file and the About Buster log file as requested. Seems Like some new things showed up and some did not return.

Thanks for your help.

See if we can beat the dang thing.


AB LOG:



Scanned at: 4:39:18 PM on: 5/21/2005


– Scan 1 —————————
About:Buster Version 4.0
Reference List : 26


Removed Data Streams:
C:\WINDOWS\Q810565.log:nzjtk
C:\WINDOWS\smscfg.ini:xxpax


Removed 2 Random Key Entries
Removed! : C:\WINDOWS\nmmmb.dat
Removed! : C:\WINDOWS\nturk.dat
Removed! : C:\WINDOWS\paomu.dat
Removed! : C:\WINDOWS\rosju.dat
Removed! : C:\WINDOWS\system32\efyhe.dat
Removed! : C:\WINDOWS\system32\nzevb.dat
Removed! : C:\WINDOWS\system32\rikkr.dat
Removed! : C:\WINDOWS\system32\uzfus.dat
Attempted Clean Of Temp folder.
Removed Uninstall Key (HSA)
Removed Uninstall Key (SE)
Removed Uninstall Key (SW)
Pages Reset… Done!

– Scan 2 —————————
About:Buster Version 4.0
Reference List : 26


Removed Data Streams:
C:\WINDOWS\Q810565.log:nzjtk
C:\WINDOWS\smscfg.ini:xxpax


Attempted Clean Of Temp folder.
Pages Reset… Done!


The Hijack This Log:

Logfile of HijackThis v1.99.0
Scan saved at 5:32:35 PM, on 5/21/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\msfk32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xapjl.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xapjl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\xapjl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xapjl.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xapjl.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xapjl.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xapjl.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {B564A708-4E47-CDCA-F6E8-BD3C3C34F916} - C:\WINDOWS\system32\iefn.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [msfk32.exe] C:\WINDOWS\msfk32.exe
O4 - HKLM\..\RunOnce: [msmf32.exe] C:\WINDOWS\system32\msmf32.exe
O4 - HKLM\..\RunOnce: [nths.exe] C:\WINDOWS\system32\nths.exe
O4 - HKLM\..\RunOnce: [sdkfi.exe] C:\WINDOWS\system32\sdkfi.exe
O4 - HKLM\..\RunOnce: [ieye.exe] C:\WINDOWS\ieye.exe
O4 - HKLM\..\RunOnce: [sdkrv32.exe] C:\WINDOWS\sdkrv32.exe
O4 - HKLM\..\RunOnce: [winab.exe] C:\WINDOWS\winab.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Norton Disk Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\NDD32.EXE
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD…sharingctrl.cab
O23 - Service: Remote Procedure Call (RPC) Helper - Unknown - C:\WINDOWS\system32\atlcr.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Roger Wilco Base Station - Unknown - C:\Program Files\Red Storm Entertainment\Roger Wilco\rwbs\rwbs.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Ok got the new version of Hijack This and here is the new log file, it is a big one. Much larger than the last.

Logfile of HijackThis v1.99.1
Scan saved at 12:33:28 PM, on 5/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\msfk32.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Class - {EE2B2B58-4FA2-966B-F815-3DCADD24A6A3} - C:\WINDOWS\system32\appwy.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [msfk32.exe] C:\WINDOWS\msfk32.exe
O4 - HKLM\..\RunOnce: [msmf32.exe] C:\WINDOWS\msmf32.exe
O4 - HKLM\..\RunOnce: [nths.exe] C:\WINDOWS\system32\nths.exe
O4 - HKLM\..\RunOnce: [sdkfi.exe] C:\WINDOWS\system32\sdkfi.exe
O4 - HKLM\..\RunOnce: [ieye.exe] C:\WINDOWS\ieye.exe
O4 - HKLM\..\RunOnce: [sdkrv32.exe] C:\WINDOWS\sdkrv32.exe
O4 - HKLM\..\RunOnce: [winab.exe] C:\WINDOWS\winab.exe
O4 - HKLM\..\RunOnce: [javagv32.exe] C:\WINDOWS\system32\javagv32.exe
O4 - HKLM\..\RunOnce: [mfcvz32.exe] C:\WINDOWS\system32\mfcvz32.exe
O4 - HKLM\..\RunOnce: [d3ff.exe] C:\WINDOWS\d3ff.exe
O4 - HKLM\..\RunOnce: [netkh32.exe] C:\WINDOWS\system32\netkh32.exe
O4 - HKLM\..\RunOnce: [mfccg.exe] C:\WINDOWS\mfccg.exe
O4 - HKLM\..\RunOnce: [mfcxx.exe] C:\WINDOWS\system32\mfcxx.exe
O4 - HKLM\..\RunOnce: [apicu32.exe] C:\WINDOWS\apicu32.exe
O4 - HKLM\..\RunOnce: [syswl.exe] C:\WINDOWS\syswl.exe
O4 - HKLM\..\RunOnce: [msts.exe] C:\WINDOWS\msts.exe
O4 - HKLM\..\RunOnce: [ntsi32.exe] C:\WINDOWS\system32\ntsi32.exe
O4 - HKLM\..\RunOnce: [mfcix32.exe] C:\WINDOWS\mfcix32.exe
O4 - HKLM\..\RunOnce: [applh.exe] C:\WINDOWS\system32\applh.exe
O4 - HKLM\..\RunOnce: [netpd.exe] C:\WINDOWS\system32\netpd.exe
O4 - HKLM\..\RunOnce: [javaae32.exe] C:\WINDOWS\system32\javaae32.exe
O4 - HKLM\..\RunOnce: [msql.exe] C:\WINDOWS\system32\msql.exe
O4 - HKLM\..\RunOnce: [addup32.exe] C:\WINDOWS\addup32.exe
O4 - HKLM\..\RunOnce: [syseq.exe] C:\WINDOWS\system32\syseq.exe
O4 - HKLM\..\RunOnce: [winjm32.exe] C:\WINDOWS\winjm32.exe
O4 - HKLM\..\RunOnce: [sysyj32.exe] C:\WINDOWS\system32\sysyj32.exe
O4 - HKLM\..\RunOnce: [mfcii.exe] C:\WINDOWS\system32\mfcii.exe
O4 - HKLM\..\RunOnce: [ntab.exe] C:\WINDOWS\system32\ntab.exe
O4 - HKLM\..\RunOnce: [addri32.exe] C:\WINDOWS\system32\addri32.exe
O4 - HKLM\..\RunOnce: [ntgx.exe] C:\WINDOWS\system32\ntgx.exe
O4 - HKLM\..\RunOnce: [javaff.exe] C:\WINDOWS\javaff.exe
O4 - HKLM\..\RunOnce: [ieqg.exe] C:\WINDOWS\ieqg.exe
O4 - HKLM\..\RunOnce: [ntpn32.exe] C:\WINDOWS\ntpn32.exe
O4 - HKLM\..\RunOnce: [sysvc32.exe] C:\WINDOWS\sysvc32.exe
O4 - HKLM\..\RunOnce: [ipdc.exe] C:\WINDOWS\system32\ipdc.exe
O4 - HKLM\..\RunOnce: [mfczo.exe] C:\WINDOWS\system32\mfczo.exe
O4 - HKLM\..\RunOnce: [sdkwd32.exe] C:\WINDOWS\sdkwd32.exe
O4 - HKLM\..\RunOnce: [msnl32.exe] C:\WINDOWS\msnl32.exe
O4 - HKLM\..\RunOnce: [crix.exe] C:\WINDOWS\crix.exe
O4 - HKLM\..\RunOnce: [nethm32.exe] C:\WINDOWS\nethm32.exe
O4 - HKLM\..\RunOnce: [addfu32.exe] C:\WINDOWS\system32\addfu32.exe
O4 - HKLM\..\RunOnce: [appfk.exe] C:\WINDOWS\system32\appfk.exe
O4 - HKLM\..\RunOnce: [addok.exe] C:\WINDOWS\addok.exe
O4 - HKLM\..\RunOnce: [ntxq32.exe] C:\WINDOWS\system32\ntxq32.exe
O4 - HKLM\..\RunOnce: [mfcng.exe] C:\WINDOWS\system32\mfcng.exe
O4 - HKLM\..\RunOnce: [sysmv32.exe] C:\WINDOWS\sysmv32.exe
O4 - HKLM\..\RunOnce: [crkd32.exe] C:\WINDOWS\system32\crkd32.exe
O4 - HKLM\..\RunOnce: [crkt.exe] C:\WINDOWS\system32\crkt.exe
O4 - HKLM\..\RunOnce: [appnc32.exe] C:\WINDOWS\system32\appnc32.exe
O4 - HKLM\..\RunOnce: [atlnk.exe] C:\WINDOWS\atlnk.exe
O4 - HKLM\..\RunOnce: [addwl.exe] C:\WINDOWS\system32\addwl.exe
O4 - HKLM\..\RunOnce: [apprc32.exe] C:\WINDOWS\system32\apprc32.exe
O4 - HKLM\..\RunOnce: [d3wy32.exe] C:\WINDOWS\system32\d3wy32.exe
O4 - HKLM\..\RunOnce: [appzs32.exe] C:\WINDOWS\appzs32.exe
O4 - HKLM\..\RunOnce: [apidw.exe] C:\WINDOWS\apidw.exe
O4 - HKLM\..\RunOnce: [mfcex32.exe] C:\WINDOWS\system32\mfcex32.exe
O4 - HKLM\..\RunOnce: [atltt32.exe] C:\WINDOWS\atltt32.exe
O4 - HKLM\..\RunOnce: [iexq32.exe] C:\WINDOWS\iexq32.exe
O4 - HKLM\..\RunOnce: [mfcsb32.exe] C:\WINDOWS\mfcsb32.exe
O4 - HKLM\..\RunOnce: [ipfg.exe] C:\WINDOWS\system32\ipfg.exe
O4 - HKLM\..\RunOnce: [netgg32.exe] C:\WINDOWS\netgg32.exe
O4 - HKLM\..\RunOnce: [apiud.exe] C:\WINDOWS\system32\apiud.exe
O4 - HKLM\..\RunOnce: [netaa.exe] C:\WINDOWS\system32\netaa.exe
O4 - HKLM\..\RunOnce: [sysow.exe] C:\WINDOWS\sysow.exe
O4 - HKLM\..\RunOnce: [ipii.exe] C:\WINDOWS\system32\ipii.exe
O4 - HKLM\..\RunOnce: [javank.exe] C:\WINDOWS\javank.exe
O4 - HKLM\..\RunOnce: [ntwk32.exe] C:\WINDOWS\system32\ntwk32.exe
O4 - HKLM\..\RunOnce: [ntch32.exe] C:\WINDOWS\ntch32.exe
O4 - HKLM\..\RunOnce: [sdkkp32.exe] C:\WINDOWS\sdkkp32.exe
O4 - HKLM\..\RunOnce: [ieup32.exe] C:\WINDOWS\system32\ieup32.exe
O4 - HKLM\..\RunOnce: [netux.exe] C:\WINDOWS\netux.exe
O4 - HKLM\..\RunOnce: [atlyb.exe] C:\WINDOWS\system32\atlyb.exe
O4 - HKLM\..\RunOnce: [ntnr32.exe] C:\WINDOWS\ntnr32.exe
O4 - HKLM\..\RunOnce: [d3dg.exe] C:\WINDOWS\d3dg.exe
O4 - HKLM\..\RunOnce: [winhc32.exe] C:\WINDOWS\system32\winhc32.exe
O4 - HKLM\..\RunOnce: [msrl.exe] C:\WINDOWS\msrl.exe
O4 - HKLM\..\RunOnce: [iexz32.exe] C:\WINDOWS\system32\iexz32.exe
O4 - HKLM\..\RunOnce: [mslw32.exe] C:\WINDOWS\mslw32.exe
O4 - HKLM\..\RunOnce: [ntqa32.exe] C:\WINDOWS\ntqa32.exe
O4 - HKLM\..\RunOnce: [ielm.exe] C:\WINDOWS\ielm.exe
O4 - HKLM\..\RunOnce: [crpq32.exe] C:\WINDOWS\system32\crpq32.exe
O4 - HKLM\..\RunOnce: [ipnf.exe] C:\WINDOWS\ipnf.exe
O4 - HKLM\..\RunOnce: [apijh.exe] C:\WINDOWS\apijh.exe
O4 - HKLM\..\RunOnce: [sdknl32.exe] C:\WINDOWS\system32\sdknl32.exe
O4 - HKLM\..\RunOnce: [netwu.exe] C:\WINDOWS\system32\netwu.exe
O4 - HKLM\..\RunOnce: [ipci32.exe] C:\WINDOWS\system32\ipci32.exe
O4 - HKLM\..\RunOnce: [ipqf32.exe] C:\WINDOWS\ipqf32.exe
O4 - HKLM\..\RunOnce: [addvb32.exe] C:\WINDOWS\addvb32.exe
O4 - HKLM\..\RunOnce: [ipqv32.exe] C:\WINDOWS\ipqv32.exe
O4 - HKLM\..\RunOnce: [d3pi.exe] C:\WINDOWS\d3pi.exe
O4 - HKLM\..\RunOnce: [atlxr.exe] C:\WINDOWS\system32\atlxr.exe
O4 - HKLM\..\RunOnce: [crsc.exe] C:\WINDOWS\crsc.exe
O4 - HKLM\..\RunOnce: [nthr.exe] C:\WINDOWS\nthr.exe
O4 - HKLM\..\RunOnce: [atlsk32.exe] C:\WINDOWS\system32\atlsk32.exe
O4 - HKLM\..\RunOnce: [mfclv.exe] C:\WINDOWS\mfclv.exe
O4 - HKLM\..\RunOnce: [sdkhz.exe] C:\WINDOWS\sdkhz.exe
O4 - HKLM\..\RunOnce: [d3za32.exe] C:\WINDOWS\d3za32.exe
O4 - HKLM\..\RunOnce: [winqi.exe] C:\WINDOWS\winqi.exe
O4 - HKLM\..\RunOnce: [mfcum32.exe] C:\WINDOWS\mfcum32.exe
O4 - HKLM\..\RunOnce: [adddm.exe] C:\WINDOWS\adddm.exe
O4 - HKLM\..\RunOnce: [appjj32.exe] C:\WINDOWS\appjj32.exe
O4 - HKLM\..\RunOnce: [addxy32.exe] C:\WINDOWS\system32\addxy32.exe
O4 - HKLM\..\RunOnce: [d3cc32.exe] C:\WINDOWS\d3cc32.exe
O4 - HKLM\..\RunOnce: [javasx.exe] C:\WINDOWS\javasx.exe
O4 - HKLM\..\RunOnce: [mfcrx32.exe] C:\WINDOWS\mfcrx32.exe
O4 - HKLM\..\RunOnce: [crgu.exe] C:\WINDOWS\system32\crgu.exe
O4 - HKLM\..\RunOnce: [msxb.exe] C:\WINDOWS\system32\msxb.exe
O4 - HKLM\..\RunOnce: [addpc.exe] C:\WINDOWS\system32\addpc.exe
O4 - HKLM\..\RunOnce: [javaoc32.exe] C:\WINDOWS\system32\javaoc32.exe
O4 - HKLM\..\RunOnce: [addvr32.exe] C:\WINDOWS\system32\addvr32.exe
O4 - HKLM\..\RunOnce: [javavz.exe] C:\WINDOWS\javavz.exe
O4 - HKLM\..\RunOnce: [netzd.exe] C:\WINDOWS\system32\netzd.exe
O4 - HKLM\..\RunOnce: [d3oa32.exe] C:\WINDOWS\d3oa32.exe
O4 - HKLM\..\RunOnce: [sysmh32.exe] C:\WINDOWS\sysmh32.exe
O4 - HKLM\..\RunOnce: [mshl.exe] C:\WINDOWS\system32\mshl.exe
O4 - HKLM\..\RunOnce: [ntgb32.exe] C:\WINDOWS\system32\ntgb32.exe
O4 - HKLM\..\RunOnce: [mfcwq32.exe] C:\WINDOWS\mfcwq32.exe
O4 - HKLM\..\RunOnce: [syska32.exe] C:\WINDOWS\syska32.exe
O4 - HKLM\..\RunOnce: [crii.exe] C:\WINDOWS\system32\crii.exe
O4 - HKLM\..\RunOnce: [nethy32.exe] C:\WINDOWS\system32\nethy32.exe
O4 - HKLM\..\RunOnce: [appxn32.exe] C:\WINDOWS\appxn32.exe
O4 - HKLM\..\RunOnce: [atlxd32.exe] C:\WINDOWS\atlxd32.exe
O4 - HKLM\..\RunOnce: [iphw32.exe] C:\WINDOWS\iphw32.exe
O4 - HKLM\..\RunOnce: [winoe.exe] C:\WINDOWS\system32\winoe.exe
O4 - HKLM\..\RunOnce: [mski.exe] C:\WINDOWS\system32\mski.exe
O4 - HKLM\..\RunOnce: [appaf32.exe] C:\WINDOWS\appaf32.exe
O4 - HKLM\..\RunOnce: [netym32.exe] C:\WINDOWS\netym32.exe
O4 - HKLM\..\RunOnce: [mfctq.exe] C:\WINDOWS\mfctq.exe
O4 - HKLM\..\RunOnce: [iesg32.exe] C:\WINDOWS\iesg32.exe
O4 - HKLM\..\RunOnce: [javaqv32.exe] C:\WINDOWS\system32\javaqv32.exe
O4 - HKLM\..\RunOnce: [crqd.exe] C:\WINDOWS\system32\crqd.exe
O4 - HKLM\..\RunOnce: [javazd.exe] C:\WINDOWS\javazd.exe
O4 - HKLM\..\RunOnce: [sysoa32.exe] C:\WINDOWS\system32\sysoa32.exe
O4 - HKLM\..\RunOnce: [atlei32.exe] C:\WINDOWS\system32\atlei32.exe
O4 - HKLM\..\RunOnce: [sdkuv32.exe] C:\WINDOWS\sdkuv32.exe
O4 - HKLM\..\RunOnce: [javaoo.exe] C:\WINDOWS\system32\javaoo.exe
O4 - HKLM\..\RunOnce: [iesk.exe] C:\WINDOWS\system32\iesk.exe
O4 - HKLM\..\RunOnce: [mfchh.exe] C:\WINDOWS\mfchh.exe
O4 - HKLM\..\RunOnce: [addwo.exe] C:\WINDOWS\system32\addwo.exe
O4 - HKLM\..\RunOnce: [d3hh32.exe] C:\WINDOWS\system32\d3hh32.exe
O4 - HKLM\..\RunOnce: [ieaa32.exe] C:\WINDOWS\ieaa32.exe
O4 - HKLM\..\RunOnce: [ntxx32.exe] C:\WINDOWS\ntxx32.exe
O4 - HKLM\..\RunOnce: [netvs32.exe] C:\WINDOWS\netvs32.exe
O4 - HKLM\..\RunOnce: [javalz.exe] C:\WINDOWS\javalz.exe
O4 - HKLM\..\RunOnce: [iepd32.exe] C:\WINDOWS\system32\iepd32.exe
O4 - HKLM\..\RunOnce: [crzm.exe] C:\WINDOWS\system32\crzm.exe
O4 - HKLM\..\RunOnce: [d3ea32.exe] C:\WINDOWS\system32\d3ea32.exe
O4 - HKLM\..\RunOnce: [crtx32.exe] C:\WINDOWS\crtx32.exe
O4 - HKLM\..\RunOnce: [netyt32.exe] C:\WINDOWS\netyt32.exe
O4 - HKLM\..\RunOnce: [d3bn32.exe] C:\WINDOWS\d3bn32.exe
O4 - HKLM\..\RunOnce: [sysfr.exe] C:\WINDOWS\system32\sysfr.exe
O4 - HKLM\..\RunOnce: [iegs32.exe] C:\WINDOWS\iegs32.exe
O4 - HKLM\..\RunOnce: [msvp32.exe] C:\WINDOWS\system32\msvp32.exe
O4 - HKLM\..\RunOnce: [ntzl32.exe] C:\WINDOWS\system32\ntzl32.exe
O4 - HKLM\..\RunOnce: [ieux32.exe] C:\WINDOWS\system32\ieux32.exe
O4 - HKLM\..\RunOnce: [addhb.exe] C:\WINDOWS\addhb.exe
O4 - HKLM\..\RunOnce: [javanv.exe] C:\WINDOWS\system32\javanv.exe
O4 - HKLM\..\RunOnce: [iprh.exe] C:\WINDOWS\system32\iprh.exe
O4 - HKLM\..\RunOnce: [mshw32.exe] C:\WINDOWS\mshw32.exe
O4 - HKLM\..\RunOnce: [winfe.exe] C:\WINDOWS\winfe.exe
O4 - HKLM\..\RunOnce: [mfcbi32.exe] C:\WINDOWS\mfcbi32.exe
O4 - HKLM\..\RunOnce: [appkj.exe] C:\WINDOWS\appkj.exe
O4 - HKLM\..\RunOnce: [ipjb.exe] C:\WINDOWS\system32\ipjb.exe
O4 - HKLM\..\RunOnce: [crbc.exe] C:\WINDOWS\system32\crbc.exe
O4 - HKLM\..\RunOnce: [apisc32.exe] C:\WINDOWS\system32\apisc32.exe
O4 - HKLM\..\RunOnce: [d3hz32.exe] C:\WINDOWS\system32\d3hz32.exe
O4 - HKLM\..\RunOnce: [mfchz32.exe] C:\WINDOWS\mfchz32.exe
O4 - HKLM\..\RunOnce: [crcl32.exe] C:\WINDOWS\system32\crcl32.exe
O4 - HKLM\..\RunOnce: [msop.exe] C:\WINDOWS\system32\msop.exe
O4 - HKLM\..\RunOnce: [d3pp32.exe] C:\WINDOWS\system32\d3pp32.exe
O4 - HKLM\..\RunOnce: [crem.exe] C:\WINDOWS\system32\crem.exe
O4 - HKLM\..\RunOnce: [d3jj.exe] C:\WINDOWS\system32\d3jj.exe
O4 - HKLM\..\RunOnce: [apixf.exe] C:\WINDOWS\apixf.exe
O4 - HKLM\..\RunOnce: [msrr.exe] C:\WINDOWS\system32\msrr.exe
O4 - HKLM\..\RunOnce: [apima32.exe] C:\WINDOWS\system32\apima32.exe
O4 - HKLM\..\RunOnce: [msmi.exe] C:\WINDOWS\msmi.exe
O4 - HKLM\..\RunOnce: [javaqu.exe] C:\WINDOWS\javaqu.exe
O4 - HKLM\..\RunOnce: [winfj32.exe] C:\WINDOWS\system32\winfj32.exe
O4 - HKLM\..\RunOnce: [atlvr32.exe] C:\WINDOWS\system32\atlvr32.exe
O4 - HKLM\..\RunOnce: [addzu.exe] C:\WINDOWS\system32\addzu.exe
O4 - HKLM\..\RunOnce: [d3yk32.exe] C:\WINDOWS\system32\d3yk32.exe
O4 - HKLM\..\RunOnce: [ipoz32.exe] C:\WINDOWS\ipoz32.exe
O4 - HKLM\..\RunOnce: [ntoh.exe] C:\WINDOWS\ntoh.exe
O4 - HKLM\..\RunOnce: [ipwq.exe] C:\WINDOWS\system32\ipwq.exe
O4 - HKLM\..\RunOnce: [wincm32.exe] C:\WINDOWS\wincm32.exe
O4 - HKLM\..\RunOnce: [iefq.exe] C:\WINDOWS\iefq.exe
O4 - HKLM\..\RunOnce: [d3ba32.exe] C:\WINDOWS\system32\d3ba32.exe
O4 - HKLM\..\RunOnce: [javaed.exe] C:\WINDOWS\javaed.exe
O4 - HKLM\..\RunOnce: [apidt32.exe] C:\WINDOWS\system32\apidt32.exe
O4 - HKLM\..\RunOnce: [addti32.exe] C:\WINDOWS\addti32.exe
O4 - HKLM\..\RunOnce: [addtq.exe] C:\WINDOWS\addtq.exe
O4 - HKLM\..\RunOnce: [wincr.exe] C:\WINDOWS\system32\wincr.exe
O4 - HKLM\..\RunOnce: [netro32.exe] C:\WINDOWS\netro32.exe
O4 - HKLM\..\RunOnce: [sdkhv32.exe] C:\WINDOWS\sdkhv32.exe
O4 - HKLM\..\RunOnce: [ipkz.exe] C:\WINDOWS\system32\ipkz.exe
O4 - HKLM\..\RunOnce: [appjp32.exe] C:\WINDOWS\system32\appjp32.exe
O4 - HKLM\..\RunOnce: [ieze32.exe] C:\WINDOWS\ieze32.exe
O4 - HKLM\..\RunOnce: [syshm.exe] C:\WINDOWS\system32\syshm.exe
O4 - HKLM\..\RunOnce: [msin.exe] C:\WINDOWS\msin.exe
O4 - HKLM\..\RunOnce: [atlxk.exe] C:\WINDOWS\system32\atlxk.exe
O4 - HKLM\..\RunOnce: [crat32.exe] C:\WINDOWS\crat32.exe
O4 - HKLM\..\RunOnce: [atlab.exe] C:\WINDOWS\system32\atlab.exe
O4 - HKLM\..\RunOnce: [winef.exe] C:\WINDOWS\winef.exe
O4 - HKLM\..\RunOnce: [apitu32.exe] C:\WINDOWS\system32\apitu32.exe
O4 - HKLM\..\RunOnce: [sdkkc.exe] C:\WINDOWS\system32\sdkkc.exe
O4 - HKLM\..\RunOnce: [msog32.exe] C:\WINDOWS\msog32.exe
O4 - HKLM\..\RunOnce: [javaxo.exe] C:\WINDOWS\system32\javaxo.exe
O4 - HKLM\..\RunOnce: [crdd32.exe] C:\WINDOWS\crdd32.exe
O4 - HKLM\..\RunOnce: [crra32.exe] C:\WINDOWS\system32\crra32.exe
O4 - HKLM\..\RunOnce: [crrq32.exe] C:\WINDOWS\system32\crrq32.exe
O4 - HKLM\..\RunOnce: [winbi32.exe] C:\WINDOWS\system32\winbi32.exe
O4 - HKLM\..\RunOnce: [sdkbq.exe] C:\WINDOWS\sdkbq.exe
O4 - HKLM\..\RunOnce: [apifu.exe] C:\WINDOWS\apifu.exe
O4 - HKLM\..\RunOnce: [crur32.exe] C:\WINDOWS\system32\crur32.exe
O4 - HKLM\..\RunOnce: [iesz32.exe] C:\WINDOWS\system32\iesz32.exe
O4 - HKLM\..\RunOnce: [iptf32.exe] C:\WINDOWS\iptf32.exe
O4 - HKLM\..\RunOnce: [javajm.exe] C:\WINDOWS\javajm.exe
O4 - HKLM\..\RunOnce: [sysni32.exe] C:\WINDOWS\sysni32.exe
O4 - HKLM\..\RunOnce: [ipcl32.exe] C:\WINDOWS\system32\ipcl32.exe
O4 - HKLM\..\RunOnce: [netrg.exe] C:\WINDOWS\netrg.exe
O4 - HKLM\..\RunOnce: [addzr.exe] C:\WINDOWS\addzr.exe
O4 - HKLM\..\RunOnce: [d3sq32.exe] C:\WINDOWS\d3sq32.exe
O4 - HKLM\..\RunOnce: [atlnc32.exe] C:\WINDOWS\atlnc32.exe
O4 - HKLM\..\RunOnce: [appfm.exe] C:\WINDOWS\appfm.exe
O4 - HKLM\..\RunOnce: [d3el32.exe] C:\WINDOWS\d3el32.exe
O4 - HKLM\..\RunOnce: [crfr.exe] C:\WINDOWS\system32\crfr.exe
O4 - HKLM\..\RunOnce: [sdkdm.exe] C:\WINDOWS\system32\sdkdm.exe
O4 - HKLM\..\RunOnce: [appls32.exe] C:\WINDOWS\appls32.exe
O4 - HKLM\..\RunOnce: [addjv32.exe] C:\WINDOWS\addjv32.exe
O4 - HKLM\..\RunOnce: [appxy.exe] C:\WINDOWS\appxy.exe
O4 - HKLM\..\RunOnce: [appmt32.exe] C:\WINDOWS\system32\appmt32.exe
O4 - HKLM\..\RunOnce: [javamb.exe] C:\WINDOWS\javamb.exe
O4 - HKLM\..\RunOnce: [ipqn.exe] C:\WINDOWS\ipqn.exe
O4 - HKLM\..\RunOnce: [msfc32.exe] C:\WINDOWS\system32\msfc32.exe
O4 - HKLM\..\RunOnce: [winvj.exe] C:\WINDOWS\system32\winvj.exe
O4 - HKLM\..\RunOnce: [mfczn32.exe] C:\WINDOWS\system32\mfczn32.exe
O4 - HKLM\..\RunOnce: [appjo.exe] C:\WINDOWS\system32\appjo.exe
O4 - HKLM\..\RunOnce: [apppk32.exe] C:\WINDOWS\system32\apppk32.exe
O4 - HKLM\..\RunOnce: [appdh32.exe] C:\WINDOWS\appdh32.exe
O4 - HKLM\..\RunOnce: [d3id32.exe] C:\WINDOWS\system32\d3id32.exe
O4 - HKLM\..\RunOnce: [atldp32.exe] C:\WINDOWS\atldp32.exe
O4 - HKLM\..\RunOnce: [apiqt.exe] C:\WINDOWS\system32\apiqt.exe
O4 - HKLM\..\RunOnce: [mfcqu32.exe] C:\WINDOWS\mfcqu32.exe
O4 - HKLM\..\RunOnce: [atlfr32.exe] C:\WINDOWS\system32\atlfr32.exe
O4 - HKLM\..\RunOnce: [iekn32.exe] C:\WINDOWS\iekn32.exe
O4 - HKLM\..\RunOnce: [mfcfz32.exe] C:\WINDOWS\system32\mfcfz32.exe
O4 - HKLM\..\RunOnce: [sysmm32.exe] C:\WINDOWS\system32\sysmm32.exe
O4 - HKLM\..\RunOnce: [sdkxn32.exe] C:\WINDOWS\system32\sdkxn32.exe
O4 - HKLM\..\RunOnce: [javafv.exe] C:\WINDOWS\javafv.exe
O4 - HKLM\..\RunOnce: [ntgw.exe] C:\WINDOWS\system32\ntgw.exe
O4 - HKLM\..\RunOnce: [iedl32.exe] C:\WINDOWS\iedl32.exe
O4 - HKLM\..\RunOnce: [appus.exe] C:\WINDOWS\appus.exe
O4 - HKLM\..\RunOnce: [netqw32.exe] C:\WINDOWS\system32\netqw32.exe
O4 - HKLM\..\RunOnce: [atlhf.exe] C:\WINDOWS\system32\atlhf.exe
O4 - HKLM\..\RunOnce: [iesw32.exe] C:\WINDOWS\system32\iesw32.exe
O4 - HKLM\..\RunOnce: [apinh32.exe] C:\WINDOWS\system32\apinh32.exe
O4 - HKLM\..\RunOnce: [ntam.exe] C:\WINDOWS\ntam.exe
O4 - HKLM\..\RunOnce: [netbm32.exe] C:\WINDOWS\system32\netbm32.exe
O4 - HKLM\..\RunOnce: [netpj32.exe] C:\WINDOWS\netpj32.exe
O4 - HKLM\..\RunOnce: [winuf.exe] C:\WINDOWS\winuf.exe
O4 - HKLM\..\RunOnce: [msyr.exe] C:\WINDOWS\msyr.exe
O4 - HKLM\..\RunOnce: [appng32.exe] C:\WINDOWS\system32\appng32.exe
O4 - HKLM\..\RunOnce: [neteo32.exe] C:\WINDOWS\system32\neteo32.exe
O4 - HKLM\..\RunOnce: [mfczr.exe] C:\WINDOWS\system32\mfczr.exe
O4 - HKLM\..\RunOnce: [ieyh32.exe] C:\WINDOWS\system32\ieyh32.exe
O4 - HKLM\..\RunOnce: [javawx32.exe] C:\WINDOWS\javawx32.exe
O4 - HKLM\..\RunOnce: [crwf.exe] C:\WINDOWS\crwf.exe
O4 - HKLM\..\RunOnce: [javaen.exe] C:\WINDOWS\system32\javaen.exe
O4 - HKLM\..\RunOnce: [addol32.exe] C:\WINDOWS\system32\addol32.exe
O4 - HKLM\..\RunOnce: [msea.exe] C:\WINDOWS\msea.exe
O4 - HKLM\..\RunOnce: [ntdq32.exe] C:\WINDOWS\system32\ntdq32.exe
O4 - HKLM\..\RunOnce: [netgc.exe] C:\WINDOWS\netgc.exe
O4 - HKLM\..\RunOnce: [winfk32.exe] C:\WINDOWS\winfk32.exe
O4 - HKLM\..\RunOnce: [d3vz.exe] C:\WINDOWS\system32\d3vz.exe
O4 - HKLM\..\RunOnce: [ipup32.exe] C:\WINDOWS\system32\ipup32.exe
O4 - HKLM\..\RunOnce: [atlse32.exe] C:\WINDOWS\atlse32.exe
O4 - HKLM\..\RunOnce: [atlsm.exe] C:\WINDOWS\atlsm.exe
O4 - HKLM\..\RunOnce: [appbn.exe] C:\WINDOWS\appbn.exe
O4 - HKLM\..\RunOnce: [ntqk32.exe] C:\WINDOWS\system32\ntqk32.exe
O4 - HKLM\..\RunOnce: [crhr32.exe] C:\WINDOWS\crhr32.exe
O4 - HKLM\..\RunOnce: [sdkcv.exe] C:\WINDOWS\sdkcv.exe
O4 - HKLM\..\RunOnce: [mfcbl32.exe] C:\WINDOWS\mfcbl32.exe
O4 - HKLM\..\RunOnce: [winza32.exe] C:\WINDOWS\system32\winza32.exe
O4 - HKLM\..\RunOnce: [winzi.exe] C:\WINDOWS\system32\winzi.exe
O4 - HKLM\..\RunOnce: [javank32.exe] C:\WINDOWS\javank32.exe
O4 - HKLM\..\RunOnce: [mssp32.exe] C:\WINDOWS\system32\mssp32.exe
O4 - HKLM\..\RunOnce: [apirp.exe] C:\WINDOWS\apirp.exe
O4 - HKLM\..\RunOnce: [appvb.exe] C:\WINDOWS\appvb.exe
O4 - HKLM\..\RunOnce: [iplq32.exe] C:\WINDOWS\system32\iplq32.exe
O4 - HKLM\..\RunOnce: [crjx.exe] C:\WINDOWS\system32\crjx.exe
O4 - HKLM\..\RunOnce: [ipil.exe] C:\WINDOWS\ipil.exe
O4 - HKLM\..\RunOnce: [crep.exe] C:\WINDOWS\crep.exe
O4 - HKLM\..\RunOnce: [syswp32.exe] C:\WINDOWS\syswp32.exe
O4 - HKLM\..\RunOnce: [appmx.exe] C:\WINDOWS\appmx.exe
O4 - HKLM\..\RunOnce: [netib32.exe] C:\WINDOWS\netib32.exe
O4 - HKLM\..\RunOnce: [mfcac.exe] C:\WINDOWS\mfcac.exe
O4 - HKLM\..\RunOnce: [mfcgy32.exe] C:\WINDOWS\mfcgy32.exe
O4 - HKLM\..\RunOnce: [mfcuv32.exe] C:\WINDOWS\mfcuv32.exe
O4 - HKLM\..\RunOnce: [iezr32.exe] C:\WINDOWS\iezr32.exe
O4 - HKLM\..\RunOnce: [apiud32.exe] C:\WINDOWS\system32\apiud32.exe
O4 - HKLM\..\RunOnce: [ipzh.exe] C:\WINDOWS\system32\ipzh.exe
O4 - HKLM\..\RunOnce: [nethi32.exe] C:\WINDOWS\system32\nethi32.exe
O4 - HKLM\..\RunOnce: [netwe32.exe] C:\WINDOWS\system32\netwe32.exe
O4 - HKLM\..\RunOnce: [wintb32.exe] C:\WINDOWS\system32\wintb32.exe
O4 - HKLM\..\RunOnce: [netwm32.exe] C:\WINDOWS\netwm32.exe
O4 - HKLM\..\RunOnce: [addva32.exe] C:\WINDOWS\addva32.exe
O4 - HKLM\..\RunOnce: [crob32.exe] C:\WINDOWS\crob32.exe
O4 - HKLM\..\RunOnce: [d3oj32.exe] C:\WINDOWS\d3oj32.exe
O4 - HKLM\..\RunOnce: [addyc32.exe] C:\WINDOWS\addyc32.exe
O4 - HKLM\..\RunOnce: [sdkyk.exe] C:\WINDOWS\system32\sdkyk.exe
O4 - HKLM\..\RunOnce: [netcw.exe] C:\WINDOWS\system32\netcw.exe
O4 - HKLM\..\RunOnce: [mslc32.exe] C:\WINDOWS\mslc32.exe
O4 - HKLM\..\RunOnce: [javada.exe] C:\WINDOWS\javada.exe
O4 - HKLM\..\RunOnce: [sdkeb.exe] C:\WINDOWS\system32\sdkeb.exe
O4 - HKLM\..\RunOnce: [systq32.exe] C:\WINDOWS\systq32.exe
O4 - HKLM\..\RunOnce: [apprf32.exe] C:\WINDOWS\apprf32.exe
O4 - HKLM\..\RunOnce: [winnj.exe] C:\WINDOWS\system32\winnj.exe
O4 - HKLM\..\RunOnce: [crmz32.exe] C:\WINDOWS\crmz32.exe
O4 - HKLM\..\RunOnce: [ipco32.exe] C:\WINDOWS\system32\ipco32.exe
O4 - HKLM\..\RunOnce: [ipkw.exe] C:\WINDOWS\system32\ipkw.exe
O4 - HKLM\..\RunOnce: [netkw.exe] C:\WINDOWS\netkw.exe
O4 - HKLM\..\RunOnce: [d3im32.exe] C:\WINDOWS\system32\d3im32.exe
O4 - HKLM\..\RunOnce: [sysyb32.exe] C:\WINDOWS\system32\sysyb32.exe
O4 - HKLM\..\RunOnce: [mstf.exe] C:\WINDOWS\mstf.exe
O4 - HKLM\..\RunOnce: [ntsu32.exe] C:\WINDOWS\ntsu32.exe
O4 - HKLM\..\RunOnce: [mfcqk.exe] C:\WINDOWS\system32\mfcqk.exe
O4 - HKLM\..\RunOnce: [iepa32.exe] C:\WINDOWS\iepa32.exe
O4 - HKLM\..\RunOnce: [javafh32.exe] C:\WINDOWS\system32\javafh32.exe
O4 - HKLM\..\RunOnce: [syskj32.exe] C:\WINDOWS\syskj32.exe
O4 - HKLM\..\RunOnce: [netyy.exe] C:\WINDOWS\netyy.exe
O4 - HKLM\..\RunOnce: [ntxo32.exe] C:\WINDOWS\system32\ntxo32.exe
O4 - HKLM\..\RunOnce: [appjh32.exe] C:\WINDOWS\system32\appjh32.exe
O4 - HKLM\..\RunOnce: [apprp.exe] C:\WINDOWS\system32\apprp.exe
O4 - HKLM\..\RunOnce: [atlwl32.exe] C:\WINDOWS\system32\atlwl32.exe
O4 - HKLM\..\RunOnce: [appli32.exe] C:\WINDOWS\appli32.exe
O4 - HKLM\..\RunOnce: [msqe32.exe] C:\WINDOWS\msqe32.exe
O4 - HKLM\..\RunOnce: [atllq32.exe] C:\WINDOWS\atllq32.exe
O4 - HKLM\..\RunOnce: [netpu.exe] C:\WINDOWS\system32\netpu.exe
O4 - HKLM\..\RunOnce: [apiyv32.exe] C:\WINDOWS\apiyv32.exe
O4 - HKLM\..\RunOnce: [mfcns.exe] C:\WINDOWS\system32\mfcns.exe
O4 - HKLM\..\RunOnce: [ipmf.exe] C:\WINDOWS\ipmf.exe
O4 - HKLM\..\RunOnce: [mfccm.exe] C:\WINDOWS\mfccm.exe
O4 - HKLM\..\RunOnce: [sysmf32.exe] C:\WINDOWS\system32\sysmf32.exe
O4 - HKLM\..\RunOnce: [winfy32.exe] C:\WINDOWS\winfy32.exe
O4 - HKLM\..\RunOnce: [crkv32.exe] C:\WINDOWS\crkv32.exe
O4 - HKLM\..\RunOnce: [addfg.exe] C:\WINDOWS\system32\addfg.exe
O4 - HKLM\..\RunOnce: [iejs32.exe] C:\WINDOWS\system32\iejs32.exe
O4 - HKLM\..\RunOnce: [javaza.exe] C:\WINDOWS\javaza.exe
O4 - HKLM\..\RunOnce: [mfcyq32.exe] C:\WINDOWS\mfcyq32.exe
O4 - HKLM\..\RunOnce: [winxf32.exe] C:\WINDOWS\system32\winxf32.exe
O4 - HKLM\..\RunOnce: [addwn.exe] C:\WINDOWS\addwn.exe
O4 - HKLM\..\RunOnce: [winfn.exe] C:\WINDOWS\system32\winfn.exe
O4 - HKLM\..\RunOnce: [apivk32.exe] C:\WINDOWS\apivk32.exe
O4 - HKLM\..\RunOnce: [sdkls32.exe] C:\WINDOWS\sdkls32.exe
O4 - HKLM\..\RunOnce: [ipgw.exe] C:\WINDOWS\system32\ipgw.exe
O4 - HKLM\..\RunOnce: [addnl32.exe] C:\WINDOWS\system32\addnl32.exe
O4 - HKLM\..\RunOnce: [msdb.exe] C:\WINDOWS\msdb.exe
O4 - HKLM\..\RunOnce: [crhc.exe] C:\WINDOWS\crhc.exe
O4 - HKLM\..\RunOnce: [windg32.exe] C:\WINDOWS\system32\windg32.exe
O4 - HKLM\..\RunOnce: [msmp.exe] C:\WINDOWS\msmp.exe
O4 - HKLM\..\RunOnce: [iead32.exe] C:\WINDOWS\system32\iead32.exe
O4 - HKLM\..\RunOnce: [msga32.exe] C:\WINDOWS\msga32.exe
O4 - HKLM\..\RunOnce: [ntlx32.exe] C:\WINDOWS\ntlx32.exe
O4 - HKLM\..\RunOnce: [ieoq32.exe] C:\WINDOWS\ieoq32.exe
O4 - HKLM\..\RunOnce: [addtv.exe] C:\WINDOWS\system32\addtv.exe
O4 - HKLM\..\RunOnce: [sysuv32.exe] C:\WINDOWS\sysuv32.exe
O4 - HKLM\..\RunOnce: [sysis32.exe] C:\WINDOWS\system32\sysis32.exe
O4 - HKLM\..\RunOnce: [sdkno32.exe] C:\WINDOWS\system32\sdkno32.exe
O4 - HKLM\..\RunOnce: [winqa32.exe] C:\WINDOWS\system32\winqa32.exe
O4 - HKLM\..\RunOnce: [atlve.exe] C:\WINDOWS\atlve.exe
O4 - HKLM\..\RunOnce: [netob32.exe] C:\WINDOWS\netob32.exe
O4 - HKLM\..\RunOnce: [winiu32.exe] C:\WINDOWS\system32\winiu32.exe
O4 - HKLM\..\RunOnce: [addhc32.exe] C:\WINDOWS\system32\addhc32.exe
O4 - HKLM\..\RunOnce: [netrc32.exe] C:\WINDOWS\netrc32.exe
O4 - HKLM\..\RunOnce: [ierk.exe] C:\WINDOWS\system32\ierk.exe
O4 - HKLM\..\RunOnce: [crvo.exe] C:\WINDOWS\crvo.exe
O4 - HKLM\..\RunOnce: [addke32.exe] C:\WINDOWS\system32\addke32.exe
O4 - HKLM\..\RunOnce: [mfcat32.exe] C:\WINDOWS\system32\mfcat32.exe
O4 - HKLM\..\RunOnce: [appex.exe] C:\WINDOWS\appex.exe
O4 - HKLM\..\RunOnce: [ipih.exe] C:\WINDOWS\ipih.exe
O4 - HKLM\..\RunOnce: [winnl32.exe] C:\WINDOWS\system32\winnl32.exe
O4 - HKLM\..\RunOnce: [apphw32.exe] C:\WINDOWS\apphw32.exe
O4 - HKLM\..\RunOnce: [d3mb32.exe] C:\WINDOWS\d3mb32.exe
O4 - HKLM\..\RunOnce: [d3vf32.exe] C:\WINDOWS\system32\d3vf32.exe
O4 - HKLM\..\RunOnce: [nttu32.exe] C:\WINDOWS\nttu32.exe
O4 - HKLM\..\RunOnce: [sdktc32.exe] C:\WINDOWS\sdktc32.exe
O4 - HKLM\..\RunOnce: [iedd32.exe] C:\WINDOWS\iedd32.exe
O4 - HKLM\..\RunOnce: [netdl32.exe] C:\WINDOWS\system32\netdl32.exe
O4 - HKLM\..\RunOnce: [msgw32.exe] C:\WINDOWS\system32\msgw32.exe
O4 - HKLM\..\RunOnce: [syslb.exe] C:\WINDOWS\syslb.exe
O4 - HKLM\..\RunOnce: [ielb32.exe] C:\WINDOWS\system32\ielb32.exe
O4 - HKLM\..\RunOnce: [ieay.exe] C:\WINDOWS\ieay.exe
O4 - HKLM\..\RunOnce: [ieom.exe] C:\WINDOWS\ieom.exe
O4 - HKLM\..\RunOnce: [iptr.exe] C:\WINDOWS\iptr.exe
O4 - HKLM\..\RunOnce: [sysnd.exe] C:\WINDOWS\sysnd.exe
O4 - HKLM\..\RunOnce: [d3dk.exe] C:\WINDOWS\d3dk.exe
O4 - HKLM\..\RunOnce: [ntnd32.exe] C:\WINDOWS\system32\ntnd32.exe
O4 - HKLM\..\RunOnce: [sdkhw.exe] C:\WINDOWS\sdkhw.exe
O4 - HKLM\..\RunOnce: [msda.exe] C:\WINDOWS\msda.exe
O4 - HKLM\..\RunOnce: [d3uw32.exe] C:\WINDOWS\system32\d3uw32.exe
O4 - HKLM\..\RunOnce: [addex32.exe] C:\WINDOWS\addex32.exe
O4 - HKLM\..\RunOnce: [javaex32.exe] C:\WINDOWS\system32\javaex32.exe
O4 - HKLM\..\RunOnce: [crml.exe] C:\WINDOWS\system32\crml.exe
O4 - HKLM\..\RunOnce: [crhw32.exe] C:\WINDOWS\crhw32.exe
O4 - HKLM\..\RunOnce: [apiap32.exe] C:\WINDOWS\apiap32.exe
O4 - HKLM\..\RunOnce: [apiaf32.exe] C:\WINDOWS\apiaf32.exe
O4 - HKLM\..\RunOnce: [javajy32.exe] C:\WINDOWS\javajy32.exe
O4 - HKLM\..\RunOnce: [atljg.exe] C:\WINDOWS\system32\atljg.exe
O4 - HKLM\..\RunOnce: [sysns.exe] C:\WINDOWS\system32\sysns.exe
O4 - HKLM\..\RunOnce: [apich32.exe] C:\WINDOWS\apich32.exe
O4 - HKLM\..\RunOnce: [sdkbo32.exe] C:\WINDOWS\sdkbo32.exe
O4 - HKLM\..\RunOnce: [netws.exe] C:\WINDOWS\netws.exe
O4 - HKLM\..\RunOnce: [addvi32.exe] C:\WINDOWS\addvi32.exe
O4 - HKLM\..\RunOnce: [mstx32.exe] C:\WINDOWS\system32\mstx32.exe
O4 - HKLM\..\RunOnce: [crph.exe] C:\WINDOWS\crph.exe
O4 - HKLM\..\RunOnce: [systd32.exe] C:\WINDOWS\systd32.exe
O4 - HKLM\..\RunOnce: [mscl.exe] C:\WINDOWS\mscl.exe
O4 - HKLM\..\RunOnce: [apidr.exe] C:\WINDOWS\system32\apidr.exe
O4 - HKLM\..\RunOnce: [wincz32.exe] C:\WINDOWS\system32\wincz32.exe
O4 - HKLM\..\RunOnce: [d3ao.exe] C:\WINDOWS\d3ao.exe
O4 - HKLM\..\RunOnce: [netze32.exe] C:\WINDOWS\system32\netze32.exe
O4 - HKLM\..\RunOnce: [apppu32.exe] C:\WINDOWS\system32\apppu32.exe
O4 - HKLM\..\RunOnce: [nettw32.exe] C:\WINDOWS\system32\nettw32.exe
O4 - HKLM\..\RunOnce: [msik.exe] C:\WINDOWS\system32\msik.exe
O4 - HKLM\..\RunOnce: [winhs.exe] C:\WINDOWS\winhs.exe
O4 - HKLM\..\RunOnce: [atlrt.exe] C:\WINDOWS\atlrt.exe
O4 - HKLM\..\RunOnce: [msrb32.exe] C:\WINDOWS\msrb32.exe
O4 - HKLM\..\RunOnce: [mfcxq32.exe] C:\WINDOWS\mfcxq32.exe
O4 - HKLM\..\RunOnce: [d3fq.exe] C:\WINDOWS\system32\d3fq.exe
O4 - HKLM\..\RunOnce: [sdkbc.exe] C:\WINDOWS\sdkbc.exe
O4 - HKLM\..\RunOnce: [sysyr32.exe] C:\WINDOWS\system32\sysyr32.exe
O4 - HKLM\..\RunOnce: [apppy32.exe] C:\WINDOWS\apppy32.exe
O4 - HKLM\..\RunOnce: [ntet32.exe] C:\WINDOWS\system32\ntet32.exe
O4 - HKLM\..\RunOnce: [sdkye.exe] C:\WINDOWS\system32\sdkye.exe
O4 - HKLM\..\RunOnce: [msci.exe] C:\WINDOWS\msci.exe
O4 - HKLM\..\RunOnce: [addmj32.exe] C:\WINDOWS\system32\addmj32.exe
O4 - HKLM\..\RunOnce: [apicr.exe] C:\WINDOWS\system32\apicr.exe
O4 - HKLM\..\RunOnce: [sdkgv32.exe] C:\WINDOWS\sdkgv32.exe
O4 - HKLM\..\RunOnce: [netqv.exe] C:\WINDOWS\netqv.exe
O4 - HKLM\..\RunOnce: [ipws32.exe] C:\WINDOWS\ipws32.exe
O4 - HKLM\..\RunOnce: [netkp32.exe] C:\WINDOWS\system32\netkp32.exe
O4 - HKLM\..\RunOnce: [addpl32.exe] C:\WINDOWS\system32\addpl32.exe
O4 - HKLM\..\RunOnce: [ipkx32.exe] C:\WINDOWS\system32\ipkx32.exe
O4 - HKLM\..\RunOnce: [javaxb.exe] C:\WINDOWS\javaxb.exe
O4 - HKLM\..\RunOnce: [sdkxb32.exe] C:\WINDOWS\system32\sdkxb32.exe
O4 - HKLM\..\RunOnce: [ntmy32.exe] C:\WINDOWS\ntmy32.exe
O4 - HKLM\..\RunOnce: [appru.exe] C:\WINDOWS\appru.exe
O4 - HKLM\..\RunOnce: [sysvg.exe] C:\WINDOWS\sysvg.exe
O4 - HKLM\..\RunOnce: [sdkqr.exe] C:\WINDOWS\system32\sdkqr.exe
O4 - HKLM\..\RunOnce: [ntih32.exe] C:\WINDOWS\system32\ntih32.exe
O4 - HKLM\..\RunOnce: [apiic.exe] C:\WINDOWS\apiic.exe
O4 - HKLM\..\RunOnce: [sysqo.exe] C:\WINDOWS\system32\sysqo.exe
O4 - HKLM\..\RunOnce: [javads.exe] C:\WINDOWS\javads.exe
O4 - HKLM\..\RunOnce: [iphu32.exe] C:\WINDOWS\system32\iphu32.exe
O4 - HKLM\..\RunOnce: [d3ca.exe] C:\WINDOWS\system32\d3ca.exe
O4 - HKLM\..\RunOnce: [mslk.exe] C:\WINDOWS\system32\mslk.exe
O4 - HKLM\..\RunOnce: [atlgi32.exe] C:\WINDOWS\system32\atlgi32.exe
O4 - HKLM\..\RunOnce: [msfp32.exe] C:\WINDOWS\system32\msfp32.exe
O4 - HKLM\..\RunOnce: [ipkj32.exe] C:\WINDOWS\system32\ipkj32.exe
O4 - HKLM\..\RunOnce: [iezg32.exe] C:\WINDOWS\system32\iezg32.exe
O4 - HKLM\..\RunOnce: [ipnb32.exe] C:\WINDOWS\ipnb32.exe
O4 - HKLM\..\RunOnce: [appsd.exe] C:\WINDOWS\system32\appsd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Norton Disk Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\NDD32.EXE
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD…sharingctrl.cab
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlcr.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Roger Wilco Base Station - Unknown owner - C:\Program Files\Red Storm Entertainment\Roger Wilco\rwbs\rwbs.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Again thanks for the help.

OK, do this for me….

Reboot into safe mode.

Press Ctrl+Alt+Delete once => Click Task Manager => Click the Processes tab => Double-click the Image Name column header to alphabetically sort the processes => Scroll through the list and look for:

msfk32.exe

If you find the files, click on them, and then click End Process => Exit the Task Manager

Go to Start->Run and type "Services.msc" (without quotes) then hit Ok
Scroll down and find the service called:
Remote Procedure Call (RPC) Helper

When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows. If you don´t find this service listed go ahead with the next steps.

CLOSE ALL WINDOWS AND BROWSERS Scan with Hijack This and put checks next to all the following, then click "Fix Checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vmyrv.dll/sp.html#14044
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {EE2B2B58-4FA2-966B-F815-3DCADD24A6A3} - C:\WINDOWS\system32\appwy.dll
O4 - HKLM\..\Run: [msfk32.exe] C:\WINDOWS\msfk32.exe
O4 - HKLM\..\RunOnce: [msmf32.exe] C:\WINDOWS\msmf32.exe
O4 - HKLM\..\RunOnce: [nths.exe] C:\WINDOWS\system32\nths.exe
O4 - HKLM\..\RunOnce: [sdkfi.exe] C:\WINDOWS\system32\sdkfi.exe
O4 - HKLM\..\RunOnce: [ieye.exe] C:\WINDOWS\ieye.exe
O4 - HKLM\..\RunOnce: [sdkrv32.exe] C:\WINDOWS\sdkrv32.exe
O4 - HKLM\..\RunOnce: [winab.exe] C:\WINDOWS\winab.exe
O4 - HKLM\..\RunOnce: [javagv32.exe] C:\WINDOWS\system32\javagv32.exe
O4 - HKLM\..\RunOnce: [mfcvz32.exe] C:\WINDOWS\system32\mfcvz32.exe
O4 - HKLM\..\RunOnce: [d3ff.exe] C:\WINDOWS\d3ff.exe
O4 - HKLM\..\RunOnce: [netkh32.exe] C:\WINDOWS\system32\netkh32.exe
O4 - HKLM\..\RunOnce: [mfccg.exe] C:\WINDOWS\mfccg.exe
O4 - HKLM\..\RunOnce: [mfcxx.exe] C:\WINDOWS\system32\mfcxx.exe
O4 - HKLM\..\RunOnce: [apicu32.exe] C:\WINDOWS\apicu32.exe
O4 - HKLM\..\RunOnce: [syswl.exe] C:\WINDOWS\syswl.exe
O4 - HKLM\..\RunOnce: [msts.exe] C:\WINDOWS\msts.exe
O4 - HKLM\..\RunOnce: [ntsi32.exe] C:\WINDOWS\system32\ntsi32.exe
O4 - HKLM\..\RunOnce: [mfcix32.exe] C:\WINDOWS\mfcix32.exe
O4 - HKLM\..\RunOnce: [applh.exe] C:\WINDOWS\system32\applh.exe
O4 - HKLM\..\RunOnce: [netpd.exe] C:\WINDOWS\system32\netpd.exe
O4 - HKLM\..\RunOnce: [javaae32.exe] C:\WINDOWS\system32\javaae32.exe
O4 - HKLM\..\RunOnce: [msql.exe] C:\WINDOWS\system32\msql.exe
O4 - HKLM\..\RunOnce: [addup32.exe] C:\WINDOWS\addup32.exe
O4 - HKLM\..\RunOnce: [syseq.exe] C:\WINDOWS\system32\syseq.exe
O4 - HKLM\..\RunOnce: [winjm32.exe] C:\WINDOWS\winjm32.exe
O4 - HKLM\..\RunOnce: [sysyj32.exe] C:\WINDOWS\system32\sysyj32.exe
O4 - HKLM\..\RunOnce: [mfcii.exe] C:\WINDOWS\system32\mfcii.exe
O4 - HKLM\..\RunOnce: [ntab.exe] C:\WINDOWS\system32\ntab.exe
O4 - HKLM\..\RunOnce: [addri32.exe] C:\WINDOWS\system32\addri32.exe
O4 - HKLM\..\RunOnce: [ntgx.exe] C:\WINDOWS\system32\ntgx.exe
O4 - HKLM\..\RunOnce: [javaff.exe] C:\WINDOWS\javaff.exe
O4 - HKLM\..\RunOnce: [ieqg.exe] C:\WINDOWS\ieqg.exe
O4 - HKLM\..\RunOnce: [ntpn32.exe] C:\WINDOWS\ntpn32.exe
O4 - HKLM\..\RunOnce: [sysvc32.exe] C:\WINDOWS\sysvc32.exe
O4 - HKLM\..\RunOnce: [ipdc.exe] C:\WINDOWS\system32\ipdc.exe
O4 - HKLM\..\RunOnce: [mfczo.exe] C:\WINDOWS\system32\mfczo.exe
O4 - HKLM\..\RunOnce: [sdkwd32.exe] C:\WINDOWS\sdkwd32.exe
O4 - HKLM\..\RunOnce: [msnl32.exe] C:\WINDOWS\msnl32.exe
O4 - HKLM\..\RunOnce: [crix.exe] C:\WINDOWS\crix.exe
O4 - HKLM\..\RunOnce: [nethm32.exe] C:\WINDOWS\nethm32.exe
O4 - HKLM\..\RunOnce: [addfu32.exe] C:\WINDOWS\system32\addfu32.exe
O4 - HKLM\..\RunOnce: [appfk.exe] C:\WINDOWS\system32\appfk.exe
O4 - HKLM\..\RunOnce: [addok.exe] C:\WINDOWS\addok.exe
O4 - HKLM\..\RunOnce: [ntxq32.exe] C:\WINDOWS\system32\ntxq32.exe
O4 - HKLM\..\RunOnce: [mfcng.exe] C:\WINDOWS\system32\mfcng.exe
O4 - HKLM\..\RunOnce: [sysmv32.exe] C:\WINDOWS\sysmv32.exe
O4 - HKLM\..\RunOnce: [crkd32.exe] C:\WINDOWS\system32\crkd32.exe
O4 - HKLM\..\RunOnce: [crkt.exe] C:\WINDOWS\system32\crkt.exe
O4 - HKLM\..\RunOnce: [appnc32.exe] C:\WINDOWS\system32\appnc32.exe
O4 - HKLM\..\RunOnce: [atlnk.exe] C:\WINDOWS\atlnk.exe
O4 - HKLM\..\RunOnce: [addwl.exe] C:\WINDOWS\system32\addwl.exe
O4 - HKLM\..\RunOnce: [apprc32.exe] C:\WINDOWS\system32\apprc32.exe
O4 - HKLM\..\RunOnce: [d3wy32.exe] C:\WINDOWS\system32\d3wy32.exe
O4 - HKLM\..\RunOnce: [appzs32.exe] C:\WINDOWS\appzs32.exe
O4 - HKLM\..\RunOnce: [apidw.exe] C:\WINDOWS\apidw.exe
O4 - HKLM\..\RunOnce: [mfcex32.exe] C:\WINDOWS\system32\mfcex32.exe
O4 - HKLM\..\RunOnce: [atltt32.exe] C:\WINDOWS\atltt32.exe
O4 - HKLM\..\RunOnce: [iexq32.exe] C:\WINDOWS\iexq32.exe
O4 - HKLM\..\RunOnce: [mfcsb32.exe] C:\WINDOWS\mfcsb32.exe
O4 - HKLM\..\RunOnce: [ipfg.exe] C:\WINDOWS\system32\ipfg.exe
O4 - HKLM\..\RunOnce: [netgg32.exe] C:\WINDOWS\netgg32.exe
O4 - HKLM\..\RunOnce: [apiud.exe] C:\WINDOWS\system32\apiud.exe
O4 - HKLM\..\RunOnce: [netaa.exe] C:\WINDOWS\system32\netaa.exe
O4 - HKLM\..\RunOnce: [sysow.exe] C:\WINDOWS\sysow.exe
O4 - HKLM\..\RunOnce: [ipii.exe] C:\WINDOWS\system32\ipii.exe
O4 - HKLM\..\RunOnce: [javank.exe] C:\WINDOWS\javank.exe
O4 - HKLM\..\RunOnce: [ntwk32.exe] C:\WINDOWS\system32\ntwk32.exe
O4 - HKLM\..\RunOnce: [ntch32.exe] C:\WINDOWS\ntch32.exe
O4 - HKLM\..\RunOnce: [sdkkp32.exe] C:\WINDOWS\sdkkp32.exe
O4 - HKLM\..\RunOnce: [ieup32.exe] C:\WINDOWS\system32\ieup32.exe
O4 - HKLM\..\RunOnce: [netux.exe] C:\WINDOWS\netux.exe
O4 - HKLM\..\RunOnce: [atlyb.exe] C:\WINDOWS\system32\atlyb.exe
O4 - HKLM\..\RunOnce: [ntnr32.exe] C:\WINDOWS\ntnr32.exe
O4 - HKLM\..\RunOnce: [d3dg.exe] C:\WINDOWS\d3dg.exe
O4 - HKLM\..\RunOnce: [winhc32.exe] C:\WINDOWS\system32\winhc32.exe
O4 - HKLM\..\RunOnce: [msrl.exe] C:\WINDOWS\msrl.exe
O4 - HKLM\..\RunOnce: [iexz32.exe] C:\WINDOWS\system32\iexz32.exe
O4 - HKLM\..\RunOnce: [mslw32.exe] C:\WINDOWS\mslw32.exe
O4 - HKLM\..\RunOnce: [ntqa32.exe] C:\WINDOWS\ntqa32.exe
O4 - HKLM\..\RunOnce: [ielm.exe] C:\WINDOWS\ielm.exe
O4 - HKLM\..\RunOnce: [crpq32.exe] C:\WINDOWS\system32\crpq32.exe
O4 - HKLM\..\RunOnce: [ipnf.exe] C:\WINDOWS\ipnf.exe
O4 - HKLM\..\RunOnce: [apijh.exe] C:\WINDOWS\apijh.exe
O4 - HKLM\..\RunOnce: [sdknl32.exe] C:\WINDOWS\system32\sdknl32.exe
O4 - HKLM\..\RunOnce: [netwu.exe] C:\WINDOWS\system32\netwu.exe
O4 - HKLM\..\RunOnce: [ipci32.exe] C:\WINDOWS\system32\ipci32.exe
O4 - HKLM\..\RunOnce: [ipqf32.exe] C:\WINDOWS\ipqf32.exe
O4 - HKLM\..\RunOnce: [addvb32.exe] C:\WINDOWS\addvb32.exe
O4 - HKLM\..\RunOnce: [ipqv32.exe] C:\WINDOWS\ipqv32.exe
O4 - HKLM\..\RunOnce: [d3pi.exe] C:\WINDOWS\d3pi.exe
O4 - HKLM\..\RunOnce: [atlxr.exe] C:\WINDOWS\system32\atlxr.exe
O4 - HKLM\..\RunOnce: [crsc.exe] C:\WINDOWS\crsc.exe
O4 - HKLM\..\RunOnce: [nthr.exe] C:\WINDOWS\nthr.exe
O4 - HKLM\..\RunOnce: [atlsk32.exe] C:\WINDOWS\system32\atlsk32.exe
O4 - HKLM\..\RunOnce: [mfclv.exe] C:\WINDOWS\mfclv.exe
O4 - HKLM\..\RunOnce: [sdkhz.exe] C:\WINDOWS\sdkhz.exe
O4 - HKLM\..\RunOnce: [d3za32.exe] C:\WINDOWS\d3za32.exe
O4 - HKLM\..\RunOnce: [winqi.exe] C:\WINDOWS\winqi.exe
O4 - HKLM\..\RunOnce: [mfcum32.exe] C:\WINDOWS\mfcum32.exe
O4 - HKLM\..\RunOnce: [adddm.exe] C:\WINDOWS\adddm.exe
O4 - HKLM\..\RunOnce: [appjj32.exe] C:\WINDOWS\appjj32.exe
O4 - HKLM\..\RunOnce: [addxy32.exe] C:\WINDOWS\system32\addxy32.exe
O4 - HKLM\..\RunOnce: [d3cc32.exe] C:\WINDOWS\d3cc32.exe
O4 - HKLM\..\RunOnce: [javasx.exe] C:\WINDOWS\javasx.exe
O4 - HKLM\..\RunOnce: [mfcrx32.exe] C:\WINDOWS\mfcrx32.exe
O4 - HKLM\..\RunOnce: [crgu.exe] C:\WINDOWS\system32\crgu.exe
O4 - HKLM\..\RunOnce: [msxb.exe] C:\WINDOWS\system32\msxb.exe
O4 - HKLM\..\RunOnce: [addpc.exe] C:\WINDOWS\system32\addpc.exe
O4 - HKLM\..\RunOnce: [javaoc32.exe] C:\WINDOWS\system32\javaoc32.exe
O4 - HKLM\..\RunOnce: [addvr32.exe] C:\WINDOWS\system32\addvr32.exe
O4 - HKLM\..\RunOnce: [javavz.exe] C:\WINDOWS\javavz.exe
O4 - HKLM\..\RunOnce: [netzd.exe] C:\WINDOWS\system32\netzd.exe
O4 - HKLM\..\RunOnce: [d3oa32.exe] C:\WINDOWS\d3oa32.exe
O4 - HKLM\..\RunOnce: [sysmh32.exe] C:\WINDOWS\sysmh32.exe
O4 - HKLM\..\RunOnce: [mshl.exe] C:\WINDOWS\system32\mshl.exe
O4 - HKLM\..\RunOnce: [ntgb32.exe] C:\WINDOWS\system32\ntgb32.exe
O4 - HKLM\..\RunOnce: [mfcwq32.exe] C:\WINDOWS\mfcwq32.exe
O4 - HKLM\..\RunOnce: [syska32.exe] C:\WINDOWS\syska32.exe
O4 - HKLM\..\RunOnce: [crii.exe] C:\WINDOWS\system32\crii.exe
O4 - HKLM\..\RunOnce: [nethy32.exe] C:\WINDOWS\system32\nethy32.exe
O4 - HKLM\..\RunOnce: [appxn32.exe] C:\WINDOWS\appxn32.exe
O4 - HKLM\..\RunOnce: [atlxd32.exe] C:\WINDOWS\atlxd32.exe
O4 - HKLM\..\RunOnce: [iphw32.exe] C:\WINDOWS\iphw32.exe
O4 - HKLM\..\RunOnce: [winoe.exe] C:\WINDOWS\system32\winoe.exe
O4 - HKLM\..\RunOnce: [mski.exe] C:\WINDOWS\system32\mski.exe
O4 - HKLM\..\RunOnce: [appaf32.exe] C:\WINDOWS\appaf32.exe
O4 - HKLM\..\RunOnce: [netym32.exe] C:\WINDOWS\netym32.exe
O4 - HKLM\..\RunOnce: [mfctq.exe] C:\WINDOWS\mfctq.exe
O4 - HKLM\..\RunOnce: [iesg32.exe] C:\WINDOWS\iesg32.exe
O4 - HKLM\..\RunOnce: [javaqv32.exe] C:\WINDOWS\system32\javaqv32.exe
O4 - HKLM\..\RunOnce: [crqd.exe] C:\WINDOWS\system32\crqd.exe
O4 - HKLM\..\RunOnce: [javazd.exe] C:\WINDOWS\javazd.exe
O4 - HKLM\..\RunOnce: [sysoa32.exe] C:\WINDOWS\system32\sysoa32.exe
O4 - HKLM\..\RunOnce: [atlei32.exe] C:\WINDOWS\system32\atlei32.exe
O4 - HKLM\..\RunOnce: [sdkuv32.exe] C:\WINDOWS\sdkuv32.exe
O4 - HKLM\..\RunOnce: [javaoo.exe] C:\WINDOWS\system32\javaoo.exe
O4 - HKLM\..\RunOnce: [iesk.exe] C:\WINDOWS\system32\iesk.exe
O4 - HKLM\..\RunOnce: [mfchh.exe] C:\WINDOWS\mfchh.exe
O4 - HKLM\..\RunOnce: [addwo.exe] C:\WINDOWS\system32\addwo.exe
O4 - HKLM\..\RunOnce: [d3hh32.exe] C:\WINDOWS\system32\d3hh32.exe
O4 - HKLM\..\RunOnce: [ieaa32.exe] C:\WINDOWS\ieaa32.exe
O4 - HKLM\..\RunOnce: [ntxx32.exe] C:\WINDOWS\ntxx32.exe
O4 - HKLM\..\RunOnce: [netvs32.exe] C:\WINDOWS\netvs32.exe
O4 - HKLM\..\RunOnce: [javalz.exe] C:\WINDOWS\javalz.exe
O4 - HKLM\..\RunOnce: [iepd32.exe] C:\WINDOWS\system32\iepd32.exe
O4 - HKLM\..\RunOnce: [crzm.exe] C:\WINDOWS\system32\crzm.exe
O4 - HKLM\..\RunOnce: [d3ea32.exe] C:\WINDOWS\system32\d3ea32.exe
O4 - HKLM\..\RunOnce: [crtx32.exe] C:\WINDOWS\crtx32.exe
O4 - HKLM\..\RunOnce: [netyt32.exe] C:\WINDOWS\netyt32.exe
O4 - HKLM\..\RunOnce: [d3bn32.exe] C:\WINDOWS\d3bn32.exe
O4 - HKLM\..\RunOnce: [sysfr.exe] C:\WINDOWS\system32\sysfr.exe
O4 - HKLM\..\RunOnce: [iegs32.exe] C:\WINDOWS\iegs32.exe
O4 - HKLM\..\RunOnce: [msvp32.exe] C:\WINDOWS\system32\msvp32.exe
O4 - HKLM\..\RunOnce: [ntzl32.exe] C:\WINDOWS\system32\ntzl32.exe
O4 - HKLM\..\RunOnce: [ieux32.exe] C:\WINDOWS\system32\ieux32.exe
O4 - HKLM\..\RunOnce: [addhb.exe] C:\WINDOWS\addhb.exe
O4 - HKLM\..\RunOnce: [javanv.exe] C:\WINDOWS\system32\javanv.exe
O4 - HKLM\..\RunOnce: [iprh.exe] C:\WINDOWS\system32\iprh.exe
O4 - HKLM\..\RunOnce: [mshw32.exe] C:\WINDOWS\mshw32.exe
O4 - HKLM\..\RunOnce: [winfe.exe] C:\WINDOWS\winfe.exe
O4 - HKLM\..\RunOnce: [mfcbi32.exe] C:\WINDOWS\mfcbi32.exe
O4 - HKLM\..\RunOnce: [appkj.exe] C:\WINDOWS\appkj.exe
O4 - HKLM\..\RunOnce: [ipjb.exe] C:\WINDOWS\system32\ipjb.exe
O4 - HKLM\..\RunOnce: [crbc.exe] C:\WINDOWS\system32\crbc.exe
O4 - HKLM\..\RunOnce: [apisc32.exe] C:\WINDOWS\system32\apisc32.exe
O4 - HKLM\..\RunOnce: [d3hz32.exe] C:\WINDOWS\system32\d3hz32.exe
O4 - HKLM\..\RunOnce: [mfchz32.exe] C:\WINDOWS\mfchz32.exe
O4 - HKLM\..\RunOnce: [crcl32.exe] C:\WINDOWS\system32\crcl32.exe
O4 - HKLM\..\RunOnce: [msop.exe] C:\WINDOWS\system32\msop.exe
O4 - HKLM\..\RunOnce: [d3pp32.exe] C:\WINDOWS\system32\d3pp32.exe
O4 - HKLM\..\RunOnce: [crem.exe] C:\WINDOWS\system32\crem.exe
O4 - HKLM\..\RunOnce: [d3jj.exe] C:\WINDOWS\system32\d3jj.exe
O4 - HKLM\..\RunOnce: [apixf.exe] C:\WINDOWS\apixf.exe
O4 - HKLM\..\RunOnce: [msrr.exe] C:\WINDOWS\system32\msrr.exe
O4 - HKLM\..\RunOnce: [apima32.exe] C:\WINDOWS\system32\apima32.exe
O4 - HKLM\..\RunOnce: [msmi.exe] C:\WINDOWS\msmi.exe
O4 - HKLM\..\RunOnce: [javaqu.exe] C:\WINDOWS\javaqu.exe
O4 - HKLM\..\RunOnce: [winfj32.exe] C:\WINDOWS\system32\winfj32.exe
O4 - HKLM\..\RunOnce: [atlvr32.exe] C:\WINDOWS\system32\atlvr32.exe
O4 - HKLM\..\RunOnce: [addzu.exe] C:\WINDOWS\system32\addzu.exe
O4 - HKLM\..\RunOnce: [d3yk32.exe] C:\WINDOWS\system32\d3yk32.exe
O4 - HKLM\..\RunOnce: [ipoz32.exe] C:\WINDOWS\ipoz32.exe
O4 - HKLM\..\RunOnce: [ntoh.exe] C:\WINDOWS\ntoh.exe
O4 - HKLM\..\RunOnce: [ipwq.exe] C:\WINDOWS\system32\ipwq.exe
O4 - HKLM\..\RunOnce: [wincm32.exe] C:\WINDOWS\wincm32.exe
O4 - HKLM\..\RunOnce: [iefq.exe] C:\WINDOWS\iefq.exe
O4 - HKLM\..\RunOnce: [d3ba32.exe] C:\WINDOWS\system32\d3ba32.exe
O4 - HKLM\..\RunOnce: [javaed.exe] C:\WINDOWS\javaed.exe
O4 - HKLM\..\RunOnce: [apidt32.exe] C:\WINDOWS\system32\apidt32.exe
O4 - HKLM\..\RunOnce: [addti32.exe] C:\WINDOWS\addti32.exe
O4 - HKLM\..\RunOnce: [addtq.exe] C:\WINDOWS\addtq.exe
O4 - HKLM\..\RunOnce: [wincr.exe] C:\WINDOWS\system32\wincr.exe
O4 - HKLM\..\RunOnce: [netro32.exe] C:\WINDOWS\netro32.exe
O4 - HKLM\..\RunOnce: [sdkhv32.exe] C:\WINDOWS\sdkhv32.exe
O4 - HKLM\..\RunOnce: [ipkz.exe] C:\WINDOWS\system32\ipkz.exe
O4 - HKLM\..\RunOnce: [appjp32.exe] C:\WINDOWS\system32\appjp32.exe
O4 - HKLM\..\RunOnce: [ieze32.exe] C:\WINDOWS\ieze32.exe
O4 - HKLM\..\RunOnce: [syshm.exe] C:\WINDOWS\system32\syshm.exe
O4 - HKLM\..\RunOnce: [msin.exe] C:\WINDOWS\msin.exe
O4 - HKLM\..\RunOnce: [atlxk.exe] C:\WINDOWS\system32\atlxk.exe
O4 - HKLM\..\RunOnce: [crat32.exe] C:\WINDOWS\crat32.exe
O4 - HKLM\..\RunOnce: [atlab.exe] C:\WINDOWS\system32\atlab.exe
O4 - HKLM\..\RunOnce: [winef.exe] C:\WINDOWS\winef.exe
O4 - HKLM\..\RunOnce: [apitu32.exe] C:\WINDOWS\system32\apitu32.exe
O4 - HKLM\..\RunOnce: [sdkkc.exe] C:\WINDOWS\system32\sdkkc.exe
O4 - HKLM\..\RunOnce: [msog32.exe] C:\WINDOWS\msog32.exe
O4 - HKLM\..\RunOnce: [javaxo.exe] C:\WINDOWS\system32\javaxo.exe
O4 - HKLM\..\RunOnce: [crdd32.exe] C:\WINDOWS\crdd32.exe
O4 - HKLM\..\RunOnce: [crra32.exe] C:\WINDOWS\system32\crra32.exe
O4 - HKLM\..\RunOnce: [crrq32.exe] C:\WINDOWS\system32\crrq32.exe
O4 - HKLM\..\RunOnce: [winbi32.exe] C:\WINDOWS\system32\winbi32.exe
O4 - HKLM\..\RunOnce: [sdkbq.exe] C:\WINDOWS\sdkbq.exe
O4 - HKLM\..\RunOnce: [apifu.exe] C:\WINDOWS\apifu.exe
O4 - HKLM\..\RunOnce: [crur32.exe] C:\WINDOWS\system32\crur32.exe
O4 - HKLM\..\RunOnce: [iesz32.exe] C:\WINDOWS\system32\iesz32.exe
O4 - HKLM\..\RunOnce: [iptf32.exe] C:\WINDOWS\iptf32.exe
O4 - HKLM\..\RunOnce: [javajm.exe] C:\WINDOWS\javajm.exe
O4 - HKLM\..\RunOnce: [sysni32.exe] C:\WINDOWS\sysni32.exe
O4 - HKLM\..\RunOnce: [ipcl32.exe] C:\WINDOWS\system32\ipcl32.exe
O4 - HKLM\..\RunOnce: [netrg.exe] C:\WINDOWS\netrg.exe
O4 - HKLM\..\RunOnce: [addzr.exe] C:\WINDOWS\addzr.exe
O4 - HKLM\..\RunOnce: [d3sq32.exe] C:\WINDOWS\d3sq32.exe
O4 - HKLM\..\RunOnce: [atlnc32.exe] C:\WINDOWS\atlnc32.exe
O4 - HKLM\..\RunOnce: [appfm.exe] C:\WINDOWS\appfm.exe
O4 - HKLM\..\RunOnce: [d3el32.exe] C:\WINDOWS\d3el32.exe
O4 - HKLM\..\RunOnce: [crfr.exe] C:\WINDOWS\system32\crfr.exe
O4 - HKLM\..\RunOnce: [sdkdm.exe] C:\WINDOWS\system32\sdkdm.exe
O4 - HKLM\..\RunOnce: [appls32.exe] C:\WINDOWS\appls32.exe
O4 - HKLM\..\RunOnce: [addjv32.exe] C:\WINDOWS\addjv32.exe
O4 - HKLM\..\RunOnce: [appxy.exe] C:\WINDOWS\appxy.exe
O4 - HKLM\..\RunOnce: [appmt32.exe] C:\WINDOWS\system32\appmt32.exe
O4 - HKLM\..\RunOnce: [javamb.exe] C:\WINDOWS\javamb.exe
O4 - HKLM\..\RunOnce: [ipqn.exe] C:\WINDOWS\ipqn.exe
O4 - HKLM\..\RunOnce: [msfc32.exe] C:\WINDOWS\system32\msfc32.exe
O4 - HKLM\..\RunOnce: [winvj.exe] C:\WINDOWS\system32\winvj.exe
O4 - HKLM\..\RunOnce: [mfczn32.exe] C:\WINDOWS\system32\mfczn32.exe
O4 - HKLM\..\RunOnce: [appjo.exe] C:\WINDOWS\system32\appjo.exe
O4 - HKLM\..\RunOnce: [apppk32.exe] C:\WINDOWS\system32\apppk32.exe
O4 - HKLM\..\RunOnce: [appdh32.exe] C:\WINDOWS\appdh32.exe
O4 - HKLM\..\RunOnce: [d3id32.exe] C:\WINDOWS\system32\d3id32.exe
O4 - HKLM\..\RunOnce: [atldp32.exe] C:\WINDOWS\atldp32.exe
O4 - HKLM\..\RunOnce: [apiqt.exe] C:\WINDOWS\system32\apiqt.exe
O4 - HKLM\..\RunOnce: [mfcqu32.exe] C:\WINDOWS\mfcqu32.exe
O4 - HKLM\..\RunOnce: [atlfr32.exe] C:\WINDOWS\system32\atlfr32.exe
O4 - HKLM\..\RunOnce: [iekn32.exe] C:\WINDOWS\iekn32.exe
O4 - HKLM\..\RunOnce: [mfcfz32.exe] C:\WINDOWS\system32\mfcfz32.exe
O4 - HKLM\..\RunOnce: [sysmm32.exe] C:\WINDOWS\system32\sysmm32.exe
O4 - HKLM\..\RunOnce: [sdkxn32.exe] C:\WINDOWS\system32\sdkxn32.exe
O4 - HKLM\..\RunOnce: [javafv.exe] C:\WINDOWS\javafv.exe
O4 - HKLM\..\RunOnce: [ntgw.exe] C:\WINDOWS\system32\ntgw.exe
O4 - HKLM\..\RunOnce: [iedl32.exe] C:\WINDOWS\iedl32.exe
O4 - HKLM\..\RunOnce: [appus.exe] C:\WINDOWS\appus.exe
O4 - HKLM\..\RunOnce: [netqw32.exe] C:\WINDOWS\system32\netqw32.exe
O4 - HKLM\..\RunOnce: [atlhf.exe] C:\WINDOWS\system32\atlhf.exe
O4 - HKLM\..\RunOnce: [iesw32.exe] C:\WINDOWS\system32\iesw32.exe
O4 - HKLM\..\RunOnce: [apinh32.exe] C:\WINDOWS\system32\apinh32.exe
O4 - HKLM\..\RunOnce: [ntam.exe] C:\WINDOWS\ntam.exe
O4 - HKLM\..\RunOnce: [netbm32.exe] C:\WINDOWS\system32\netbm32.exe
O4 - HKLM\..\RunOnce: [netpj32.exe] C:\WINDOWS\netpj32.exe
O4 - HKLM\..\RunOnce: [winuf.exe] C:\WINDOWS\winuf.exe
O4 - HKLM\..\RunOnce: [msyr.exe] C:\WINDOWS\msyr.exe
O4 - HKLM\..\RunOnce: [appng32.exe] C:\WINDOWS\system32\appng32.exe
O4 - HKLM\..\RunOnce: [neteo32.exe] C:\WINDOWS\system32\neteo32.exe
O4 - HKLM\..\RunOnce: [mfczr.exe] C:\WINDOWS\system32\mfczr.exe
O4 - HKLM\..\RunOnce: [ieyh32.exe] C:\WINDOWS\system32\ieyh32.exe
O4 - HKLM\..\RunOnce: [javawx32.exe] C:\WINDOWS\javawx32.exe
O4 - HKLM\..\RunOnce: [crwf.exe] C:\WINDOWS\crwf.exe
O4 - HKLM\..\RunOnce: [javaen.exe] C:\WINDOWS\system32\javaen.exe
O4 - HKLM\..\RunOnce: [addol32.exe] C:\WINDOWS\system32\addol32.exe
O4 - HKLM\..\RunOnce: [msea.exe] C:\WINDOWS\msea.exe
O4 - HKLM\..\RunOnce: [ntdq32.exe] C:\WINDOWS\system32\ntdq32.exe
O4 - HKLM\..\RunOnce: [netgc.exe] C:\WINDOWS\netgc.exe
O4 - HKLM\..\RunOnce: [winfk32.exe] C:\WINDOWS\winfk32.exe
O4 - HKLM\..\RunOnce: [d3vz.exe] C:\WINDOWS\system32\d3vz.exe
O4 - HKLM\..\RunOnce: [ipup32.exe] C:\WINDOWS\system32\ipup32.exe
O4 - HKLM\..\RunOnce: [atlse32.exe] C:\WINDOWS\atlse32.exe
O4 - HKLM\..\RunOnce: [atlsm.exe] C:\WINDOWS\atlsm.exe
O4 - HKLM\..\RunOnce: [appbn.exe] C:\WINDOWS\appbn.exe
O4 - HKLM\..\RunOnce: [ntqk32.exe] C:\WINDOWS\system32\ntqk32.exe
O4 - HKLM\..\RunOnce: [crhr32.exe] C:\WINDOWS\crhr32.exe
O4 - HKLM\..\RunOnce: [sdkcv.exe] C:\WINDOWS\sdkcv.exe
O4 - HKLM\..\RunOnce: [mfcbl32.exe] C:\WINDOWS\mfcbl32.exe
O4 - HKLM\..\RunOnce: [winza32.exe] C:\WINDOWS\system32\winza32.exe
O4 - HKLM\..\RunOnce: [winzi.exe] C:\WINDOWS\system32\winzi.exe
O4 - HKLM\..\RunOnce: [javank32.exe] C:\WINDOWS\javank32.exe
O4 - HKLM\..\RunOnce: [mssp32.exe] C:\WINDOWS\system32\mssp32.exe
O4 - HKLM\..\RunOnce: [apirp.exe] C:\WINDOWS\apirp.exe
O4 - HKLM\..\RunOnce: [appvb.exe] C:\WINDOWS\appvb.exe
O4 - HKLM\..\RunOnce: [iplq32.exe] C:\WINDOWS\system32\iplq32.exe
O4 - HKLM\..\RunOnce: [crjx.exe] C:\WINDOWS\system32\crjx.exe
O4 - HKLM\..\RunOnce: [ipil.exe] C:\WINDOWS\ipil.exe
O4 - HKLM\..\RunOnce: [crep.exe] C:\WINDOWS\crep.exe
O4 - HKLM\..\RunOnce: [syswp32.exe] C:\WINDOWS\syswp32.exe
O4 - HKLM\..\RunOnce: [appmx.exe] C:\WINDOWS\appmx.exe
O4 - HKLM\..\RunOnce: [netib32.exe] C:\WINDOWS\netib32.exe
O4 - HKLM\..\RunOnce: [mfcac.exe] C:\WINDOWS\mfcac.exe
O4 - HKLM\..\RunOnce: [mfcgy32.exe] C:\WINDOWS\mfcgy32.exe
O4 - HKLM\..\RunOnce: [mfcuv32.exe] C:\WINDOWS\mfcuv32.exe
O4 - HKLM\..\RunOnce: [iezr32.exe] C:\WINDOWS\iezr32.exe
O4 - HKLM\..\RunOnce: [apiud32.exe] C:\WINDOWS\system32\apiud32.exe
O4 - HKLM\..\RunOnce: [ipzh.exe] C:\WINDOWS\system32\ipzh.exe
O4 - HKLM\..\RunOnce: [nethi32.exe] C:\WINDOWS\system32\nethi32.exe
O4 - HKLM\..\RunOnce: [netwe32.exe] C:\WINDOWS\system32\netwe32.exe
O4 - HKLM\..\RunOnce: [wintb32.exe] C:\WINDOWS\system32\wintb32.exe
O4 - HKLM\..\RunOnce: [netwm32.exe] C:\WINDOWS\netwm32.exe
O4 - HKLM\..\RunOnce: [addva32.exe] C:\WINDOWS\addva32.exe
O4 - HKLM\..\RunOnce: [crob32.exe] C:\WINDOWS\crob32.exe
O4 - HKLM\..\RunOnce: [d3oj32.exe] C:\WINDOWS\d3oj32.exe
O4 - HKLM\..\RunOnce: [addyc32.exe] C:\WINDOWS\addyc32.exe
O4 - HKLM\..\RunOnce: [sdkyk.exe] C:\WINDOWS\system32\sdkyk.exe
O4 - HKLM\..\RunOnce: [netcw.exe] C:\WINDOWS\system32\netcw.exe
O4 - HKLM\..\RunOnce: [mslc32.exe] C:\WINDOWS\mslc32.exe
O4 - HKLM\..\RunOnce: [javada.exe] C:\WINDOWS\javada.exe
O4 - HKLM\..\RunOnce: [sdkeb.exe] C:\WINDOWS\system32\sdkeb.exe
O4 - HKLM\..\RunOnce: [systq32.exe] C:\WINDOWS\systq32.exe
O4 - HKLM\..\RunOnce: [apprf32.exe] C:\WINDOWS\apprf32.exe
O4 - HKLM\..\RunOnce: [winnj.exe] C:\WINDOWS\system32\winnj.exe
O4 - HKLM\..\RunOnce: [crmz32.exe] C:\WINDOWS\crmz32.exe
O4 - HKLM\..\RunOnce: [ipco32.exe] C:\WINDOWS\system32\ipco32.exe
O4 - HKLM\..\RunOnce: [ipkw.exe] C:\WINDOWS\system32\ipkw.exe
O4 - HKLM\..\RunOnce: [netkw.exe] C:\WINDOWS\netkw.exe
O4 - HKLM\..\RunOnce: [d3im32.exe] C:\WINDOWS\system32\d3im32.exe
O4 - HKLM\..\RunOnce: [sysyb32.exe] C:\WINDOWS\system32\sysyb32.exe
O4 - HKLM\..\RunOnce: [mstf.exe] C:\WINDOWS\mstf.exe
O4 - HKLM\..\RunOnce: [ntsu32.exe] C:\WINDOWS\ntsu32.exe
O4 - HKLM\..\RunOnce: [mfcqk.exe] C:\WINDOWS\system32\mfcqk.exe
O4 - HKLM\..\RunOnce: [iepa32.exe] C:\WINDOWS\iepa32.exe
O4 - HKLM\..\RunOnce: [javafh32.exe] C:\WINDOWS\system32\javafh32.exe
O4 - HKLM\..\RunOnce: [syskj32.exe] C:\WINDOWS\syskj32.exe
O4 - HKLM\..\RunOnce: [netyy.exe] C:\WINDOWS\netyy.exe
O4 - HKLM\..\RunOnce: [ntxo32.exe] C:\WINDOWS\system32\ntxo32.exe
O4 - HKLM\..\RunOnce: [appjh32.exe] C:\WINDOWS\system32\appjh32.exe
O4 - HKLM\..\RunOnce: [apprp.exe] C:\WINDOWS\system32\apprp.exe
O4 - HKLM\..\RunOnce: [atlwl32.exe] C:\WINDOWS\system32\atlwl32.exe
O4 - HKLM\..\RunOnce: [appli32.exe] C:\WINDOWS\appli32.exe
O4 - HKLM\..\RunOnce: [msqe32.exe] C:\WINDOWS\msqe32.exe
O4 - HKLM\..\RunOnce: [atllq32.exe] C:\WINDOWS\atllq32.exe
O4 - HKLM\..\RunOnce: [netpu.exe] C:\WINDOWS\system32\netpu.exe
O4 - HKLM\..\RunOnce: [apiyv32.exe] C:\WINDOWS\apiyv32.exe
O4 - HKLM\..\RunOnce: [mfcns.exe] C:\WINDOWS\system32\mfcns.exe
O4 - HKLM\..\RunOnce: [ipmf.exe] C:\WINDOWS\ipmf.exe
O4 - HKLM\..\RunOnce: [mfccm.exe] C:\WINDOWS\mfccm.exe
O4 - HKLM\..\RunOnce: [sysmf32.exe] C:\WINDOWS\system32\sysmf32.exe
O4 - HKLM\..\RunOnce: [winfy32.exe] C:\WINDOWS\winfy32.exe
O4 - HKLM\..\RunOnce: [crkv32.exe] C:\WINDOWS\crkv32.exe
O4 - HKLM\..\RunOnce: [addfg.exe] C:\WINDOWS\system32\addfg.exe
O4 - HKLM\..\RunOnce: [iejs32.exe] C:\WINDOWS\system32\iejs32.exe
O4 - HKLM\..\RunOnce: [javaza.exe] C:\WINDOWS\javaza.exe
O4 - HKLM\..\RunOnce: [mfcyq32.exe] C:\WINDOWS\mfcyq32.exe
O4 - HKLM\..\RunOnce: [winxf32.exe] C:\WINDOWS\system32\winxf32.exe
O4 - HKLM\..\RunOnce: [addwn.exe] C:\WINDOWS\addwn.exe
O4 - HKLM\..\RunOnce: [winfn.exe] C:\WINDOWS\system32\winfn.exe
O4 - HKLM\..\RunOnce: [apivk32.exe] C:\WINDOWS\apivk32.exe
O4 - HKLM\..\RunOnce: [sdkls32.exe] C:\WINDOWS\sdkls32.exe
O4 - HKLM\..\RunOnce: [ipgw.exe] C:\WINDOWS\system32\ipgw.exe
O4 - HKLM\..\RunOnce: [addnl32.exe] C:\WINDOWS\system32\addnl32.exe
O4 - HKLM\..\RunOnce: [msdb.exe] C:\WINDOWS\msdb.exe
O4 - HKLM\..\RunOnce: [crhc.exe] C:\WINDOWS\crhc.exe
O4 - HKLM\..\RunOnce: [windg32.exe] C:\WINDOWS\system32\windg32.exe
O4 - HKLM\..\RunOnce: [msmp.exe] C:\WINDOWS\msmp.exe
O4 - HKLM\..\RunOnce: [iead32.exe] C:\WINDOWS\system32\iead32.exe
O4 - HKLM\..\RunOnce: [msga32.exe] C:\WINDOWS\msga32.exe
O4 - HKLM\..\RunOnce: [ntlx32.exe] C:\WINDOWS\ntlx32.exe
O4 - HKLM\..\RunOnce: [ieoq32.exe] C:\WINDOWS\ieoq32.exe
O4 - HKLM\..\RunOnce: [addtv.exe] C:\WINDOWS\system32\addtv.exe
O4 - HKLM\..\RunOnce: [sysuv32.exe] C:\WINDOWS\sysuv32.exe
O4 - HKLM\..\RunOnce: [sysis32.exe] C:\WINDOWS\system32\sysis32.exe
O4 - HKLM\..\RunOnce: [sdkno32.exe] C:\WINDOWS\system32\sdkno32.exe
O4 - HKLM\..\RunOnce: [winqa32.exe] C:\WINDOWS\system32\winqa32.exe
O4 - HKLM\..\RunOnce: [atlve.exe] C:\WINDOWS\atlve.exe
O4 - HKLM\..\RunOnce: [netob32.exe] C:\WINDOWS\netob32.exe
O4 - HKLM\..\RunOnce: [winiu32.exe] C:\WINDOWS\system32\winiu32.exe
O4 - HKLM\..\RunOnce: [addhc32.exe] C:\WINDOWS\system32\addhc32.exe
O4 - HKLM\..\RunOnce: [netrc32.exe] C:\WINDOWS\netrc32.exe
O4 - HKLM\..\RunOnce: [ierk.exe] C:\WINDOWS\system32\ierk.exe
O4 - HKLM\..\RunOnce: [crvo.exe] C:\WINDOWS\crvo.exe
O4 - HKLM\..\RunOnce: [addke32.exe] C:\WINDOWS\system32\addke32.exe
O4 - HKLM\..\RunOnce: [mfcat32.exe] C:\WINDOWS\system32\mfcat32.exe
O4 - HKLM\..\RunOnce: [appex.exe] C:\WINDOWS\appex.exe
O4 - HKLM\..\RunOnce: [ipih.exe] C:\WINDOWS\ipih.exe
O4 - HKLM\..\RunOnce: [winnl32.exe] C:\WINDOWS\system32\winnl32.exe
O4 - HKLM\..\RunOnce: [apphw32.exe] C:\WINDOWS\apphw32.exe
O4 - HKLM\..\RunOnce: [d3mb32.exe] C:\WINDOWS\d3mb32.exe
O4 - HKLM\..\RunOnce: [d3vf32.exe] C:\WINDOWS\system32\d3vf32.exe
O4 - HKLM\..\RunOnce: [nttu32.exe] C:\WINDOWS\nttu32.exe
O4 - HKLM\..\RunOnce: [sdktc32.exe] C:\WINDOWS\sdktc32.exe
O4 - HKLM\..\RunOnce: [iedd32.exe] C:\WINDOWS\iedd32.exe
O4 - HKLM\..\RunOnce: [netdl32.exe] C:\WINDOWS\system32\netdl32.exe
O4 - HKLM\..\RunOnce: [msgw32.exe] C:\WINDOWS\system32\msgw32.exe
O4 - HKLM\..\RunOnce: [syslb.exe] C:\WINDOWS\syslb.exe
O4 - HKLM\..\RunOnce: [ielb32.exe] C:\WINDOWS\system32\ielb32.exe
O4 - HKLM\..\RunOnce: [ieay.exe] C:\WINDOWS\ieay.exe
O4 - HKLM\..\RunOnce: [ieom.exe] C:\WINDOWS\ieom.exe
O4 - HKLM\..\RunOnce: [iptr.exe] C:\WINDOWS\iptr.exe
O4 - HKLM\..\RunOnce: [sysnd.exe] C:\WINDOWS\sysnd.exe
O4 - HKLM\..\RunOnce: [d3dk.exe] C:\WINDOWS\d3dk.exe
O4 - HKLM\..\RunOnce: [ntnd32.exe] C:\WINDOWS\system32\ntnd32.exe
O4 - HKLM\..\RunOnce: [sdkhw.exe] C:\WINDOWS\sdkhw.exe
O4 - HKLM\..\RunOnce: [msda.exe] C:\WINDOWS\msda.exe
O4 - HKLM\..\RunOnce: [d3uw32.exe] C:\WINDOWS\system32\d3uw32.exe
O4 - HKLM\..\RunOnce: [addex32.exe] C:\WINDOWS\addex32.exe
O4 - HKLM\..\RunOnce: [javaex32.exe] C:\WINDOWS\system32\javaex32.exe
O4 - HKLM\..\RunOnce: [crml.exe] C:\WINDOWS\system32\crml.exe
O4 - HKLM\..\RunOnce: [crhw32.exe] C:\WINDOWS\crhw32.exe
O4 - HKLM\..\RunOnce: [apiap32.exe] C:\WINDOWS\apiap32.exe
O4 - HKLM\..\RunOnce: [apiaf32.exe] C:\WINDOWS\apiaf32.exe
O4 - HKLM\..\RunOnce: [javajy32.exe] C:\WINDOWS\javajy32.exe
O4 - HKLM\..\RunOnce: [atljg.exe] C:\WINDOWS\system32\atljg.exe
O4 - HKLM\..\RunOnce: [sysns.exe] C:\WINDOWS\system32\sysns.exe
O4 - HKLM\..\RunOnce: [apich32.exe] C:\WINDOWS\apich32.exe
O4 - HKLM\..\RunOnce: [sdkbo32.exe] C:\WINDOWS\sdkbo32.exe
O4 - HKLM\..\RunOnce: [netws.exe] C:\WINDOWS\netws.exe
O4 - HKLM\..\RunOnce: [addvi32.exe] C:\WINDOWS\addvi32.exe
O4 - HKLM\..\RunOnce: [mstx32.exe] C:\WINDOWS\system32\mstx32.exe
O4 - HKLM\..\RunOnce: [crph.exe] C:\WINDOWS\crph.exe
O4 - HKLM\..\RunOnce: [systd32.exe] C:\WINDOWS\systd32.exe
O4 - HKLM\..\RunOnce: [mscl.exe] C:\WINDOWS\mscl.exe
O4 - HKLM\..\RunOnce: [apidr.exe] C:\WINDOWS\system32\apidr.exe
O4 - HKLM\..\RunOnce: [wincz32.exe] C:\WINDOWS\system32\wincz32.exe
O4 - HKLM\..\RunOnce: [d3ao.exe] C:\WINDOWS\d3ao.exe
O4 - HKLM\..\RunOnce: [netze32.exe] C:\WINDOWS\system32\netze32.exe
O4 - HKLM\..\RunOnce: [apppu32.exe] C:\WINDOWS\system32\apppu32.exe
O4 - HKLM\..\RunOnce: [nettw32.exe] C:\WINDOWS\system32\nettw32.exe
O4 - HKLM\..\RunOnce: [msik.exe] C:\WINDOWS\system32\msik.exe
O4 - HKLM\..\RunOnce: [winhs.exe] C:\WINDOWS\winhs.exe
O4 - HKLM\..\RunOnce: [atlrt.exe] C:\WINDOWS\atlrt.exe
O4 - HKLM\..\RunOnce: [msrb32.exe] C:\WINDOWS\msrb32.exe
O4 - HKLM\..\RunOnce: [mfcxq32.exe] C:\WINDOWS\mfcxq32.exe
O4 - HKLM\..\RunOnce: [d3fq.exe] C:\WINDOWS\system32\d3fq.exe
O4 - HKLM\..\RunOnce: [sdkbc.exe] C:\WINDOWS\sdkbc.exe
O4 - HKLM\..\RunOnce: [sysyr32.exe] C:\WINDOWS\system32\sysyr32.exe
O4 - HKLM\..\RunOnce: [apppy32.exe] C:\WINDOWS\apppy32.exe
O4 - HKLM\..\RunOnce: [ntet32.exe] C:\WINDOWS\system32\ntet32.exe
O4 - HKLM\..\RunOnce: [sdkye.exe] C:\WINDOWS\system32\sdkye.exe
O4 - HKLM\..\RunOnce: [msci.exe] C:\WINDOWS\msci.exe
O4 - HKLM\..\RunOnce: [addmj32.exe] C:\WINDOWS\system32\addmj32.exe
O4 - HKLM\..\RunOnce: [apicr.exe] C:\WINDOWS\system32\apicr.exe
O4 - HKLM\..\RunOnce: [sdkgv32.exe] C:\WINDOWS\sdkgv32.exe
O4 - HKLM\..\RunOnce: [netqv.exe] C:\WINDOWS\netqv.exe
O4 - HKLM\..\RunOnce: [ipws32.exe] C:\WINDOWS\ipws32.exe
O4 - HKLM\..\RunOnce: [netkp32.exe] C:\WINDOWS\system32\netkp32.exe
O4 - HKLM\..\RunOnce: [addpl32.exe] C:\WINDOWS\system32\addpl32.exe
O4 - HKLM\..\RunOnce: [ipkx32.exe] C:\WINDOWS\system32\ipkx32.exe
O4 - HKLM\..\RunOnce: [javaxb.exe] C:\WINDOWS\javaxb.exe
O4 - HKLM\..\RunOnce: [sdkxb32.exe] C:\WINDOWS\system32\sdkxb32.exe
O4 - HKLM\..\RunOnce: [ntmy32.exe] C:\WINDOWS\ntmy32.exe
O4 - HKLM\..\RunOnce: [appru.exe] C:\WINDOWS\appru.exe
O4 - HKLM\..\RunOnce: [sysvg.exe] C:\WINDOWS\sysvg.exe
O4 - HKLM\..\RunOnce: [sdkqr.exe] C:\WINDOWS\system32\sdkqr.exe
O4 - HKLM\..\RunOnce: [ntih32.exe] C:\WINDOWS\system32\ntih32.exe
O4 - HKLM\..\RunOnce: [apiic.exe] C:\WINDOWS\apiic.exe
O4 - HKLM\..\RunOnce: [sysqo.exe] C:\WINDOWS\system32\sysqo.exe
O4 - HKLM\..\RunOnce: [javads.exe] C:\WINDOWS\javads.exe
O4 - HKLM\..\RunOnce: [iphu32.exe] C:\WINDOWS\system32\iphu32.exe
O4 - HKLM\..\RunOnce: [d3ca.exe] C:\WINDOWS\system32\d3ca.exe
O4 - HKLM\..\RunOnce: [mslk.exe] C:\WINDOWS\system32\mslk.exe
O4 - HKLM\..\RunOnce: [atlgi32.exe] C:\WINDOWS\system32\atlgi32.exe
O4 - HKLM\..\RunOnce: [msfp32.exe] C:\WINDOWS\system32\msfp32.exe
O4 - HKLM\..\RunOnce: [ipkj32.exe] C:\WINDOWS\system32\ipkj32.exe
O4 - HKLM\..\RunOnce: [iezg32.exe] C:\WINDOWS\system32\iezg32.exe
O4 - HKLM\..\RunOnce: [ipnb32.exe] C:\WINDOWS\ipnb32.exe
O4 - HKLM\..\RunOnce: [appsd.exe] C:\WINDOWS\system32\appsd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlcr.exe (file missing)

Delete these files:

C:\WINDOWS\system32\atlcr.exe
C:\WINDOWS\system32\appwy.dll
C:\WINDOWS\vmyrv.dll
C:\WINDOWS\msfk32.exe

Ideally you should delete all those 04 files in the log above also, it's up to you.

Run AboutBuster again, the run CW-Shredder..

Reboot.

Download and run this online virus scan:<—Important
http://housecall.trendmicro.com/housecall/start_corp.asp
Make sure you check "AutoClean"

Reboot and post a fresh HJT log, MrC

Ok I have been workin on this most of the day. I think that we may have finaly gotten it taken care of. I ran everything straigt through as instructed. There were some strange things that occured. When I booted up into safe mode, the majority of the O4 items in the registrt were gone there were just a hand full and only three were bad objects that were on the list to be deleted. When I ran the virus scan it found almost 600 infected files. Some were cleanable but most were not and I deleted them, most had names that reflected the files that were in the registry. The new HJT log looks pretty clean I dont see anything suspect on there this round.

Here is the new log.

Logfile of HijackThis v1.99.1
Scan saved at 6:28:41 PM, on 5/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Norton Disk Doctor.LNK = C:\Program Files\Norton SystemWorks\Norton Utilities\NDD32.EXE
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD…sharingctrl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Roger Wilco Base Station - Unknown owner - C:\Program Files\Red Storm Entertainment\Roger Wilco\rwbs\rwbs.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Thanks for all your help and for the good directions to the cleaning utilities.

Let me know if you want the new AB log, Should I run the Shredder in the online mode now to look for other spy/adware or other things.

Again Thanks…


J.