What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijacked by w-find

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:( Please help! IE defaults to w-find and I can't shake it. System runs OK but I don't this little devil is controlling my systme and that can't be good. Here is the HijackThis scan log…


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\combo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\windows\tnossgw.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\PopSubtract\PopSub.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [tjokvhx] c:\windows\tnossgw.exe
O4 - HKCU\..\Run: [jeusnlx] c:\windows\jnorywd.exe
O4 - HKCU\..\Run: [lfyiwdq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ribehgo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ujjwfug] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [cviygit] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [lfwafal] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wjsoonq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [fanbyew] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [qgqnobv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [rcnviwk] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [slvcona] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xqbcgiw] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [fbmnlmv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [utgrwyy] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [pogycka] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [eindigo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [oouaubn] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [uygaksb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [gbojctq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [nipnckl] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ljbxvyq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ibcfpfm] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [vnxmrlj] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [icslxnc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [nidtydr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [pxkhisc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [dvnjnlq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [qcreito] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [unsxgfo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wgpyyxa] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [uyjetbr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [pxkppng] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [odjdkle] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jxqkorl] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ncbmnld] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [mcrsmjn] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wlvvdqi] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [tnmmwbp] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ehgcubu] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xysyaak] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [nrbwcdg] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [avciwcc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ysscwag] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ftasxfi] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [gdonkph] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xaurpas] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [umpmjpo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ipvrqsr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [cwjjndr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ajijmyh] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [hjkoltb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [edcjtkr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [hupiree] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wndspay] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [aenlcht] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [vsvovtw] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [urfkviq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jejatbk] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [qgbiesl] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [sjfsaia] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [funabkc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [sakxutb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [isjdrdc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [rovitfo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [agdkqkv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [tsrapqc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ogxubhm] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jfrnljm] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [yolbhir] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [dbebkta] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [rbstalf] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [dstjiiw] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xvmfgdi] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jmglbug] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [vujldhb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ostktfv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [lmoplix] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [sdgugiu] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [dhcnejk] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [cysdrdm] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [qbqbgce] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [atbrbhd] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [slncutx] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [qdtiecu] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [byqujuu] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [jiaybut] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [loxwjfg] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [ptswrqb] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [nffukxs] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [byfpqkd] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [rqpipgl] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [aokqums] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [bjhpuvh] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [tctveqk] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [dlnrtgt] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [xlnqmpv] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [hrrbyud] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [nqosrnr] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [hdniqyf] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [maakxkq] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [oudsivn] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [wqyqgcr] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [kltyxxq] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [uycwydq] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [dimeyfp] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [ghtqysy] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [yplsyhd] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [infpqfe] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [jxasguy] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [uwvmtpk] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [bgigyhe] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [fobbngp] c:\windows\xflptmb.exe
O4 - HKCU\..\Run: [hdfxpyw] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [xwegchd] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [gtgjucg] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [fhmimbp] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [jfxdurt] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [gpbpluo] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [cxqratm] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [wybunwr] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [jjsjhpd] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [qfcjipj] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [aipnety] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [fcmiljx] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [cojjahb] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [urhwtcx] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [pnamnnh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [lcbgxhq] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [vbiyhjs] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [urcigyg] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ivutwch] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [nkntdlb] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [dfaokhh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [bdenqec] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [bwvqlps] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [lrkhflb] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ddvuyye] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [hkcnsnu] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [kxuytyh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ltqidcj] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ougyjwy] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [krecbvq] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [tqeqwrx] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [bpkdhsp] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ncnhsjy] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ykhbmcw] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [peelvau] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [qhvsang] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ybprkoh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [pgyinql] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [xktmdjj] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [qbfxoic] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [wpfvfdy] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [lqdqawa] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [iklxdrp] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [dkwqccp] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [uduaxth] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [knpvlmp] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [ujxkvdw] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [ntpmunt] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [fyhnawu] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [ccupird] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [dxomxok] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [xwaxswm] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [knfdado] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [yyffjpw] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [iewcseh] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [txywgws] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [kmwaxvd] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [hgxalhq] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [mncfdfy] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [otcpnhw] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ksvlcdl] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [xkjaioj] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lupdquw] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tgivolb] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vnbybik] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [nbbusdv] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [cehcins] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [bnxgjbp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vmdbxtc] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [rmlaxgg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lmockrg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ypdspyp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mfwbwbj] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ityuuen] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ypysymq] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lyfvige] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [nkrbyqa] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [oseouwo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [bfejpec] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lgtrkqt] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [wirvrot] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ipassyc] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tehakqt] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [omyxjyo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [qfuxsnr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ehbpiqa] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mfvfjyh] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [wupscpg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mrhgqqe] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [stroxnp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [pcceepr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mojokyq] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mhmikqg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [rsevhwp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [idgmxyu] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [faaiuuo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tvlelnt] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [iwckdfm] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [esnfuwg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [iqodgve] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [evqdwtm] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ehfaykq] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [sslruys] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [kpmipxb] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [bdruoai] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [scxcpnm] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lvyrgcf] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [pfvkrvo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vwaerep] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fpjrbbu] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fesbqud] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [thpynlv] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tpkjhie] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ebmjbjr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [alfwlvn] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [wtpplef] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [odcpdrn] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fvlhtdb] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ttvjlkf] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [uvavmoa] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [egugkid] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [qaqwoum] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [usjqrtd] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [auhfgpg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [jbgqfop] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fsxercr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vduafph] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [eclylgj] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [moxbniu] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [trugugo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [hgwnmld] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [awjfsur] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fxrqpqy] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ymrowrk] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ghgxyxi] c:\windows\otooebu.exe
O4 - HKCU\..\Run: [tybmyoy] c:\windows\otooebu.exe
O4 - HKCU\..\Run: [gggjnvg] c:\windows\otooebu.exe
O4 - HKCU\..\Run: [saamjoo] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [ndgqmgy] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [wnocakv] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [efcdbvh] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [txsuvnt] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [edwdqbe] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [ewbwumf] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [kslktpm] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [jeaijfj] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [xgthotu] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [ohqwrym] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [imlojcr] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [myyeprb] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [lghgkbg] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [vdexpwi] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [lyssfvf] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [coomyur] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [vimdppt] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [cmbgmit] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [rlmvcwc] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [ckakfyh] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [ygrwvcb] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [rmdppve] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [bqatoyk] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [exepoby] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [lrkoagd] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [xqmitoq] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [egiofek] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [ltlsyfy] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [qqcdsbt] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [hqtsvxg] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [mwxumme] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [uqcbsgt] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [vfpeiiu] c:\windows\wcmqlnw.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\interMute\PopSubtract\PopSub.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2
Greetings and welcome to TomCoyote.org!

I see a ton of unidentified malware in the log.

A couple that I can identify are these:

O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe

They use your machine to send SPAM emails!

Let's try some free online tools & work our way up from there.

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from http://security.kolla.de
(This is the NEW Version 1.4)
Get AdAware SE Personal from http://www.lavasoft.de/support/download
(This is the NEW Build 1.6)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

Configure Adaware

Configure Spybot

Reboot after running each program.

Please try these free online virus scans of your system:

Trend-Micro Housecall

Panda Activescan

Etrust Security Advisor

Choose "fix" or "clean".

Let them remove any infections found. Reboot after each scan.

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. MOVE HijackThis into this folder and off your desktop.

If required a tutorial is here = Hijackthis Folder Tutorial

Make a new Hijack This! log file, and "copy/paste" it into this thread.

Please include the ENTIRE log file. The 1st one was missing the header information.
:)
Post #3
Thnak you! I ran both the Spyware Search and Destroy and the Adware program. It appears that the w-find hijack is gone from IE. Here is the latest HJT log…any other suspiscious items in here? Thanks again! :)

Logfile of HijackThis v1.99.1
Scan saved at 9:45:06 AM, on 7/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\combo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\windows\tnossgw.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\PopSubtract\PopSub.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe
O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [tjokvhx] c:\windows\tnossgw.exe
O4 - HKCU\..\Run: [jeusnlx] c:\windows\jnorywd.exe
O4 - HKCU\..\Run: [lfyiwdq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ribehgo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ujjwfug] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [cviygit] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [lfwafal] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wjsoonq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [fanbyew] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [qgqnobv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [rcnviwk] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [slvcona] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xqbcgiw] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [fbmnlmv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [utgrwyy] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [pogycka] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [eindigo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [oouaubn] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [uygaksb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [gbojctq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [nipnckl] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ljbxvyq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ibcfpfm] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [vnxmrlj] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [icslxnc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [nidtydr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [pxkhisc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [dvnjnlq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [qcreito] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [unsxgfo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wgpyyxa] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [uyjetbr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [pxkppng] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [odjdkle] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jxqkorl] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ncbmnld] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [mcrsmjn] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wlvvdqi] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [tnmmwbp] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ehgcubu] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xysyaak] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [nrbwcdg] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [avciwcc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ysscwag] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ftasxfi] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [gdonkph] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xaurpas] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [umpmjpo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ipvrqsr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [cwjjndr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ajijmyh] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [hjkoltb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [edcjtkr] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [hupiree] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [wndspay] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [aenlcht] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [vsvovtw] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [urfkviq] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jejatbk] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [qgbiesl] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [sjfsaia] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [funabkc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [sakxutb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [isjdrdc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [rovitfo] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [agdkqkv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [tsrapqc] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ogxubhm] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jfrnljm] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [yolbhir] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [dbebkta] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [rbstalf] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [dstjiiw] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [xvmfgdi] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [jmglbug] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [vujldhb] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [ostktfv] c:\windows\yqaiwuw.exe
O4 - HKCU\..\Run: [lmoplix] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [sdgugiu] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [dhcnejk] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [cysdrdm] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [qbqbgce] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [atbrbhd] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [slncutx] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [qdtiecu] c:\windows\ptgadhm.exe
O4 - HKCU\..\Run: [byqujuu] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [jiaybut] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [loxwjfg] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [ptswrqb] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [nffukxs] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [byfpqkd] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [rqpipgl] c:\windows\wxtiwtj.exe
O4 - HKCU\..\Run: [aokqums] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [bjhpuvh] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [tctveqk] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [dlnrtgt] c:\windows\ykllgep.exe
O4 - HKCU\..\Run: [xlnqmpv] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [hrrbyud] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [nqosrnr] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [hdniqyf] c:\windows\apvrnrk.exe
O4 - HKCU\..\Run: [maakxkq] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [oudsivn] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [wqyqgcr] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [kltyxxq] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [uycwydq] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [dimeyfp] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [ghtqysy] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [yplsyhd] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [infpqfe] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [jxasguy] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [uwvmtpk] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [bgigyhe] c:\windows\fexwudi.exe
O4 - HKCU\..\Run: [fobbngp] c:\windows\xflptmb.exe
O4 - HKCU\..\Run: [hdfxpyw] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [xwegchd] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [gtgjucg] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [fhmimbp] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [jfxdurt] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [gpbpluo] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [cxqratm] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [wybunwr] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [jjsjhpd] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [qfcjipj] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [aipnety] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [fcmiljx] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [cojjahb] c:\windows\yoyxtid.exe
O4 - HKCU\..\Run: [urhwtcx] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [pnamnnh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [lcbgxhq] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [vbiyhjs] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [urcigyg] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ivutwch] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [nkntdlb] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [dfaokhh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [bdenqec] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [bwvqlps] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [lrkhflb] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ddvuyye] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [hkcnsnu] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [kxuytyh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ltqidcj] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ougyjwy] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [krecbvq] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [tqeqwrx] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [bpkdhsp] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ncnhsjy] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ykhbmcw] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [peelvau] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [qhvsang] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [ybprkoh] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [pgyinql] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [xktmdjj] c:\windows\texqsna.exe
O4 - HKCU\..\Run: [qbfxoic] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [wpfvfdy] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [lqdqawa] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [iklxdrp] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [dkwqccp] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [uduaxth] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [knpvlmp] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [ujxkvdw] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [ntpmunt] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [fyhnawu] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [ccupird] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [dxomxok] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [xwaxswm] c:\windows\fybcftr.exe
O4 - HKCU\..\Run: [knfdado] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [yyffjpw] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [iewcseh] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [txywgws] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [kmwaxvd] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [hgxalhq] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [mncfdfy] c:\windows\mdogtbg.exe
O4 - HKCU\..\Run: [otcpnhw] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ksvlcdl] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [xkjaioj] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lupdquw] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tgivolb] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vnbybik] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [nbbusdv] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [cehcins] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [bnxgjbp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vmdbxtc] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [rmlaxgg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lmockrg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ypdspyp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mfwbwbj] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ityuuen] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ypysymq] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lyfvige] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [nkrbyqa] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [oseouwo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [bfejpec] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lgtrkqt] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [wirvrot] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ipassyc] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tehakqt] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [omyxjyo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [qfuxsnr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ehbpiqa] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mfvfjyh] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [wupscpg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mrhgqqe] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [stroxnp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [pcceepr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mojokyq] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [mhmikqg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [rsevhwp] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [idgmxyu] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [faaiuuo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tvlelnt] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [iwckdfm] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [esnfuwg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [iqodgve] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [evqdwtm] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ehfaykq] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [sslruys] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [kpmipxb] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [bdruoai] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [scxcpnm] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [lvyrgcf] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [pfvkrvo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vwaerep] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fpjrbbu] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fesbqud] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [thpynlv] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [tpkjhie] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ebmjbjr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [alfwlvn] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [wtpplef] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [odcpdrn] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fvlhtdb] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ttvjlkf] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [uvavmoa] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [egugkid] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [qaqwoum] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [usjqrtd] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [auhfgpg] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [jbgqfop] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fsxercr] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [vduafph] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [eclylgj] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [moxbniu] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [trugugo] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [hgwnmld] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [awjfsur] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [fxrqpqy] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ymrowrk] c:\windows\hxhlfmo.exe
O4 - HKCU\..\Run: [ghgxyxi] c:\windows\otooebu.exe
O4 - HKCU\..\Run: [tybmyoy] c:\windows\otooebu.exe
O4 - HKCU\..\Run: [gggjnvg] c:\windows\otooebu.exe
O4 - HKCU\..\Run: [saamjoo] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [ndgqmgy] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [wnocakv] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [efcdbvh] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [txsuvnt] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [edwdqbe] c:\windows\lwaqmdr.exe
O4 - HKCU\..\Run: [ewbwumf] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [kslktpm] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [jeaijfj] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [xgthotu] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [ohqwrym] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [imlojcr] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [myyeprb] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [lghgkbg] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [vdexpwi] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [lyssfvf] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [coomyur] c:\windows\grwmeff.exe
O4 - HKCU\..\Run: [vimdppt] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [cmbgmit] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [rlmvcwc] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [ckakfyh] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [ygrwvcb] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [rmdppve] c:\windows\fhdtfbf.exe
O4 - HKCU\..\Run: [bqatoyk] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [exepoby] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [lrkoagd] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [xqmitoq] c:\windows\qbjkafq.exe
O4 - HKCU\..\Run: [egiofek] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [ltlsyfy] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [qqcdsbt] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [hqtsvxg] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [mwxumme] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [uqcbsgt] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [vfpeiiu] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [rdggxrb] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [nsammev] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [fnbjdjt] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [kveltbm] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [hmvuoeo] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [wjyeoag] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [ioasayi] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [bivysaa] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [sjyfkag] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [tgcjhms] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [imoipdv] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [gxdfrpd] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [svrrnct] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [dwmslsa] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [docroii] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [ihnrxxq] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [kosdndw] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [xokqnmt] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [nohljpb] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [rkehapj] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [irbpwxv] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [hlhsnbm] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [kqymfji] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [wmovpvn] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [qpktayj] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [rjfbnew] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [vhromkc] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [dbikcfq] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [odjikte] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [dwqsobw] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [njnrsrs] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [bssvhre] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [eiqlcjp] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [ieelafe] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [qvnnbmr] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [eeobcqc] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [wlxekpo] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [xyfqqlt] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [hytxbfb] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [cdsrhos] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [mvpyqxy] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [pmndxvx] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [oargggk] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [mhxkahk] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [lanyujl] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [mjendps] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [uhyvddn] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [mgiitqe] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [akkpdie] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [yqwoobs] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [rffnjjx] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [tmhmsrg] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [iktybtm] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [gqcttnr] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [mxoabgp] c:\windows\wcmqlnw.exe
O4 - HKCU\..\Run: [qrcguny] c:\windows\akrcpig.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\interMute\PopSubtract\PopSub.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #4
You'd better print this out to be sure you get it right… It's quite lengthy. :(

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. MOVE HijackThis into this folder and off the desktop.

If required a tutorial is here = Hijackthis Folder Tutorial

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [combop.exe] combop.exe

O4 - HKLM\..\Run: [combo.exe] combo.exe

O4 - HKCU\..\Run: [tjokvhx] c:\windows\tnossgw.exe

O4 - HKCU\..\Run: [jeusnlx] c:\windows\jnorywd.exe

O4 - HKCU\..\Run: [lfyiwdq] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ribehgo] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ujjwfug] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [cviygit] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [lfwafal] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [wjsoonq] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [fanbyew] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [qgqnobv] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [rcnviwk] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [slvcona] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [xqbcgiw] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [fbmnlmv] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [utgrwyy] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [pogycka] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [eindigo] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [oouaubn] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [uygaksb] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [gbojctq] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [nipnckl] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ljbxvyq] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ibcfpfm] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [vnxmrlj] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [icslxnc] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [nidtydr] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [pxkhisc] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [dvnjnlq] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [qcreito] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [unsxgfo] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [wgpyyxa] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [uyjetbr] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [pxkppng] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [odjdkle] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [jxqkorl] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ncbmnld] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [mcrsmjn] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [wlvvdqi] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [tnmmwbp] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ehgcubu] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [xysyaak] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [nrbwcdg] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [avciwcc] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ysscwag] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ftasxfi] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [gdonkph] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [xaurpas] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [umpmjpo] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ipvrqsr] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [cwjjndr] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ajijmyh] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [hjkoltb] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [edcjtkr] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [hupiree] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [wndspay] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [aenlcht] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [vsvovtw] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [urfkviq] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [jejatbk] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [qgbiesl] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [sjfsaia] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [funabkc] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [sakxutb] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [isjdrdc] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [rovitfo] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [agdkqkv] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [tsrapqc] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ogxubhm] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [jfrnljm] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [yolbhir] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [dbebkta] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [rbstalf] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [dstjiiw] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [xvmfgdi] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [jmglbug] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [vujldhb] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [ostktfv] c:\windows\yqaiwuw.exe

O4 - HKCU\..\Run: [lmoplix] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [sdgugiu] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [dhcnejk] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [cysdrdm] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [qbqbgce] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [atbrbhd] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [slncutx] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [qdtiecu] c:\windows\ptgadhm.exe

O4 - HKCU\..\Run: [byqujuu] c:\windows\wxtiwtj.exe

O4 - HKCU\..\Run: [jiaybut] c:\windows\wxtiwtj.exe

O4 - HKCU\..\Run: [loxwjfg] c:\windows\wxtiwtj.exe

O4 - HKCU\..\Run: [ptswrqb] c:\windows\wxtiwtj.exe

O4 - HKCU\..\Run: [nffukxs] c:\windows\wxtiwtj.exe

O4 - HKCU\..\Run: [byfpqkd] c:\windows\wxtiwtj.exe

O4 - HKCU\..\Run: [rqpipgl] c:\windows\wxtiwtj.exe

O4 - HKCU\..\Run: [aokqums] c:\windows\ykllgep.exe

O4 - HKCU\..\Run: [bjhpuvh] c:\windows\ykllgep.exe

O4 - HKCU\..\Run: [tctveqk] c:\windows\ykllgep.exe

O4 - HKCU\..\Run: [dlnrtgt] c:\windows\ykllgep.exe

O4 - HKCU\..\Run: [xlnqmpv] c:\windows\apvrnrk.exe

O4 - HKCU\..\Run: [hrrbyud] c:\windows\apvrnrk.exe

O4 - HKCU\..\Run: [nqosrnr] c:\windows\apvrnrk.exe

O4 - HKCU\..\Run: [hdniqyf] c:\windows\apvrnrk.exe

O4 - HKCU\..\Run: [maakxkq] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [oudsivn] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [wqyqgcr] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [kltyxxq] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [uycwydq] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [dimeyfp] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [ghtqysy] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [yplsyhd] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [infpqfe] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [jxasguy] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [uwvmtpk] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [bgigyhe] c:\windows\fexwudi.exe

O4 - HKCU\..\Run: [fobbngp] c:\windows\xflptmb.exe

O4 - HKCU\..\Run: [hdfxpyw] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [xwegchd] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [gtgjucg] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [fhmimbp] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [jfxdurt] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [gpbpluo] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [cxqratm] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [wybunwr] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [jjsjhpd] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [qfcjipj] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [aipnety] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [fcmiljx] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [cojjahb] c:\windows\yoyxtid.exe

O4 - HKCU\..\Run: [urhwtcx] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [pnamnnh] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [lcbgxhq] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [vbiyhjs] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [urcigyg] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [ivutwch] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [nkntdlb] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [dfaokhh] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [bdenqec] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [bwvqlps] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [lrkhflb] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [ddvuyye] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [hkcnsnu] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [kxuytyh] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [ltqidcj] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [ougyjwy] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [krecbvq] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [tqeqwrx] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [bpkdhsp] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [ncnhsjy] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [ykhbmcw] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [peelvau] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [qhvsang] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [ybprkoh] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [pgyinql] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [xktmdjj] c:\windows\texqsna.exe

O4 - HKCU\..\Run: [qbfxoic] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [wpfvfdy] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [lqdqawa] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [iklxdrp] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [dkwqccp] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [uduaxth] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [knpvlmp] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [ujxkvdw] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [ntpmunt] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [fyhnawu] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [ccupird] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [dxomxok] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [xwaxswm] c:\windows\fybcftr.exe

O4 - HKCU\..\Run: [knfdado] c:\windows\mdogtbg.exe

O4 - HKCU\..\Run: [yyffjpw] c:\windows\mdogtbg.exe

O4 - HKCU\..\Run: [iewcseh] c:\windows\mdogtbg.exe

O4 - HKCU\..\Run: [txywgws] c:\windows\mdogtbg.exe

O4 - HKCU\..\Run: [kmwaxvd] c:\windows\mdogtbg.exe

O4 - HKCU\..\Run: [hgxalhq] c:\windows\mdogtbg.exe

O4 - HKCU\..\Run: [mncfdfy] c:\windows\mdogtbg.exe

O4 - HKCU\..\Run: [otcpnhw] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ksvlcdl] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [xkjaioj] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [lupdquw] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [tgivolb] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [vnbybik] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [nbbusdv] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [cehcins] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [bnxgjbp] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [vmdbxtc] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [rmlaxgg] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [lmockrg] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ypdspyp] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [mfwbwbj] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ityuuen] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ypysymq] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [lyfvige] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [nkrbyqa] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [oseouwo] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [bfejpec] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [lgtrkqt] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [wirvrot] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ipassyc] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [tehakqt] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [omyxjyo] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [qfuxsnr] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ehbpiqa] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [mfvfjyh] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [wupscpg] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [mrhgqqe] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [stroxnp] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [pcceepr] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [mojokyq] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [mhmikqg] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [rsevhwp] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [idgmxyu] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [faaiuuo] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [tvlelnt] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [iwckdfm] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [esnfuwg] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [iqodgve] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [evqdwtm] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ehfaykq] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [sslruys] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [kpmipxb] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [bdruoai] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [scxcpnm] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [lvyrgcf] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [pfvkrvo] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [vwaerep] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [fpjrbbu] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [fesbqud] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [thpynlv] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [tpkjhie] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ebmjbjr] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [alfwlvn] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [wtpplef] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [odcpdrn] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [fvlhtdb] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ttvjlkf] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [uvavmoa] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [egugkid] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [qaqwoum] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [usjqrtd] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [auhfgpg] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [jbgqfop] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [fsxercr] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [vduafph] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [eclylgj] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [moxbniu] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [trugugo] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [hgwnmld] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [awjfsur] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [fxrqpqy] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ymrowrk] c:\windows\hxhlfmo.exe

O4 - HKCU\..\Run: [ghgxyxi] c:\windows\otooebu.exe

O4 - HKCU\..\Run: [tybmyoy] c:\windows\otooebu.exe

O4 - HKCU\..\Run: [gggjnvg] c:\windows\otooebu.exe

O4 - HKCU\..\Run: [saamjoo] c:\windows\lwaqmdr.exe

O4 - HKCU\..\Run: [ndgqmgy] c:\windows\lwaqmdr.exe

O4 - HKCU\..\Run: [wnocakv] c:\windows\lwaqmdr.exe

O4 - HKCU\..\Run: [efcdbvh] c:\windows\lwaqmdr.exe

O4 - HKCU\..\Run: [txsuvnt] c:\windows\lwaqmdr.exe

O4 - HKCU\..\Run: [edwdqbe] c:\windows\lwaqmdr.exe

O4 - HKCU\..\Run: [ewbwumf] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [kslktpm] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [jeaijfj] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [xgthotu] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [ohqwrym] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [imlojcr] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [myyeprb] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [lghgkbg] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [vdexpwi] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [lyssfvf] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [coomyur] c:\windows\grwmeff.exe

O4 - HKCU\..\Run: [vimdppt] c:\windows\fhdtfbf.exe

O4 - HKCU\..\Run: [cmbgmit] c:\windows\fhdtfbf.exe

O4 - HKCU\..\Run: [rlmvcwc] c:\windows\fhdtfbf.exe

O4 - HKCU\..\Run: [ckakfyh] c:\windows\fhdtfbf.exe

O4 - HKCU\..\Run: [ygrwvcb] c:\windows\fhdtfbf.exe

O4 - HKCU\..\Run: [rmdppve] c:\windows\fhdtfbf.exe

O4 - HKCU\..\Run: [bqatoyk] c:\windows\qbjkafq.exe

O4 - HKCU\..\Run: [exepoby] c:\windows\qbjkafq.exe

O4 - HKCU\..\Run: [lrkoagd] c:\windows\qbjkafq.exe

O4 - HKCU\..\Run: [xqmitoq] c:\windows\qbjkafq.exe

O4 - HKCU\..\Run: [egiofek] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [ltlsyfy] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [qqcdsbt] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [hqtsvxg] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [mwxumme] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [uqcbsgt] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [vfpeiiu] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [rdggxrb] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [nsammev] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [fnbjdjt] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [kveltbm] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [hmvuoeo] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [wjyeoag] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [ioasayi] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [bivysaa] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [sjyfkag] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [tgcjhms] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [imoipdv] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [gxdfrpd] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [svrrnct] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [dwmslsa] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [docroii] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [ihnrxxq] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [kosdndw] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [xokqnmt] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [nohljpb] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [rkehapj] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [irbpwxv] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [hlhsnbm] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [kqymfji] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [wmovpvn] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [qpktayj] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [rjfbnew] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [vhromkc] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [dbikcfq] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [odjikte] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [dwqsobw] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [njnrsrs] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [bssvhre] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [eiqlcjp] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [ieelafe] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [qvnnbmr] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [eeobcqc] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [wlxekpo] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [xyfqqlt] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [hytxbfb] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [cdsrhos] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [mvpyqxy] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [pmndxvx] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [oargggk] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [mhxkahk] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [lanyujl] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [mjendps] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [uhyvddn] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [mgiitqe] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [akkpdie] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [yqwoobs] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [rffnjjx] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [tmhmsrg] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [iktybtm] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [gqcttnr] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [mxoabgp] c:\windows\wcmqlnw.exe

O4 - HKCU\..\Run: [qrcguny] c:\windows\akrcpig.exe

O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab

O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab

O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\windows\akrcpig.exe <— file

c:\windows\alcxmntr.exe <— file

c:\windows\apvrnrk.exe <— file

c:\windows\fexwudi.exe <— file

c:\windows\fhdtfbf.exe <— file

c:\windows\fybcftr.exe <— file

c:\windows\grwmeff.exe <— file

c:\windows\hxhlfmo.exe <— file

c:\windows\jnorywd.exe <— file

c:\windows\lwaqmdr.exe <— file

c:\windows\mdogtbg.exe <— file

c:\windows\otooebu.exe <— file

c:\windows\ptgadhm.exe <— file

c:\windows\qbjkafq.exe <— file

c:\windows\system32\combo.exe <— file

c:\windows\system32\vbsys2.dll <— file

c:\windows\texqsna.exe <— file

c:\windows\tnossgw.exe <— file

c:\windows\wcmqlnw.exe <— file

c:\windows\wxtiwtj.exe <— file

c:\windows\xflptmb.exe <— file

c:\windows\ykllgep.exe <— file

c:\windows\yoyxtid.exe <— file

c:\windows\yqaiwuw.exe <— file

combop.exe <— file

Use windows explorer to find the last one.

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #5
Could not find the combop.exe files (I did select the Show Hidden Files Option). Here is the HJT log. w-Find is still there. What's our next move?

Logfile of HijackThis v1.99.1
Scan saved at 11:57:48 AM, on 7/9/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\PopSubtract\PopSub.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\HJT\HijackThis.exe
C:\WINDOWS\System32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [vehvjva] c:\windows\akrcpig.exe
O4 - HKCU\..\Run: [laqpeyh] c:\windows\kyhxhkj.exe
O4 - HKCU\..\Run: [lnmojia] c:\windows\kyhxhkj.exe
O4 - HKCU\..\Run: [kpxwhix] c:\windows\fffgnps.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\interMute\PopSubtract\PopSub.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #6
We'll just continue down this road. As long as the "kill list" gets shorter each time, we're doing the right thing.

As long as the last "kill list" was, it's not uncommon to see a few "die hards" return.

If and when Hijack This! ceases to work, we have much bigger guns in our arsenal we can call upon if need be.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/

O4 - HKCU\..\Run: [vehvjva] c:\windows\akrcpig.exe

O4 - HKCU\..\Run: [laqpeyh] c:\windows\kyhxhkj.exe

O4 - HKCU\..\Run: [lnmojia] c:\windows\kyhxhkj.exe

O4 - HKCU\..\Run: [kpxwhix] c:\windows\fffgnps.exe

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\windows\akrcpig.exe <— file

c:\windows\fffgnps.exe <— file

c:\windows\kyhxhkj.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #7
Done. w-Find is now gone from my IE. Below is the latest system scan. Anything else in there to be worried about? Also, I get a messagebox on start-up, "Invalid BackWeb application id 137903" Please let me know. This whole experience has been kind of interesting. Thanks again for helping!

Logfile of HijackThis v1.99.1
Scan saved at 11:31:50 AM, on 7/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\PopSubtract\PopSub.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.web/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [vaynvnd] c:\windows\llhejff.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\interMute\PopSubtract\PopSub.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #8
Almost there…

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O4 - HKCU\..\Run: [vaynvnd] c:\windows\llhejff.exe

Then click "Fix checked".

Then clean out your "temp" files.

Please remove all files in each of these folders.

DO NOT DELETE THE FOLDERS, JUST ALL FILES INSIDE THE FOLDERS!

C:\Windows\Temp <- this folder

C:\Documents and Settings\\Local Settings\Temp <- this folder

C:\Documents and Settings\\Local Settings\Temp <- this folder for each user

C:\Documents and Settings\\Local Settings\Temporary Internet Files <- this folder

C:\Documents and Settings\\Local Settings\Temporary Internet Files <- this folder for each user

Then empty the recycle bin.

Reboot in "safe" mode.

Find and delete:

c:\windows\llhejff.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)

Also, I get a messagebox on start-up, "Invalid BackWeb application id 137903"

Please read this:

Invalid Backweb application id 137903

Let me know if this error continues.
Post #9
Here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 3:59:40 PM, on 7/10/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\PROGRA~1\AIM\aim.exe
C:\Program Files\America Online 8.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\PopSubtract\PopSub.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\wuauclt.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\interMute\PopSubtract\PopSub.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #10
The log looks good now. :thumbup:

Good job!

I'm going to assume the "Invalid BackWeb application id 137903" error has disappeared since you didn't mention it.

If not, post back and let me know.

GOD bless!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #11
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI