Spyware / Malware / Virus Removal

hikack this log please help

10 min read

Looking for the outcome? Ask AI

BuuDDha Topic Starter

Post #1July 13, 2005, 3:07 AM UTC

my comp takes forever to open programs and it has trouble running games. seems like something is taking up all of my cpu and my comp struggles to catch up. also i cant get my homepage to stay…it keeps switching to www.abcsearch4u.com or something…please help!

Logfile of HijackThis v1.99.1
Scan saved at 8:05:50 PM, on 7/12/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Dit.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\htpatch.exe
C:\WINNT\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINNT\System32\combo.exe
C:\WINNT\System32\ctfmon.exe
C:\winnt\emrrcxk.exe
C:\WINNT\DitExp.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Dan Osborn\Desktop\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abcsearch4u.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abcsearch4u.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abcsearch4u.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\Toolbar.dll (file missing)
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [noxuamr] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [jbeujjk] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [xyelrhb] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ivykums] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [yaxjhlw] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ogarjae] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [mpkciax] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [qtdyyjn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [upfdqwv] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [wxfcawm] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [msvkjcn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [sveycra] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [vctqhpu] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [eipjnhh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [kjfmvqk] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jsqsscd] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lgvooop] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [quiawng] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jaqakbo] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [hedtlof] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [vpvweyh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [iwmenwv] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [yoaprry] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lbdhqob] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [qfducko] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [uunbgjs] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jlwilhl] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [ugkdfky] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [dahkmft] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [kburrab] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [faocqyg] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ebmhhkr] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fftrelq] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [urxlmhy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [svmfmtf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qnrsvry] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [eoefbvi] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fkjobex] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qvrpkhd] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [nqhcddo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [avoyuiy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fidkhrn] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [xpwlush] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [iltcild] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ooqiwvo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mxajnaj] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [onukmnu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wcghheh] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mjhpaux] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mppjokc] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [roccsjs] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wibeoum] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fsbllyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [emufqpu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mfcmeyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qwhmifr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [wmmjgch] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pxnrryd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [kadsejv] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [dbnsinl] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [joevvxw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [amqlbyg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sysrixp] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jgqcbav] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [oqykfqd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [swrmjmk] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [puplono] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [srqspuh] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skhuysj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [allvcvt] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sjlmcbj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cnjiccj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [nddbdfo] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ixcgldm] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jeyldsy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skffnju] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cuiyiwr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ynailpe] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ocauikg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pkkoigc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [juggpam] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [uvrvkqw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [bmuxiba] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tkhlxpd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [varulms] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [radason] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [aemhufc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [gowmrqn] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [itbfire] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [orhogmx] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [yiympuy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [clhuify] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [hdyabyu] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [njdlkhb] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tweqqpq] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [xsptiux] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [rgoifac] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kvaouys] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [rmygcsk] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [pjjqppn] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iybgdet] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [amjeefe] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [ctfbloc] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iaqtpdh] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kqlixnk] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qgnapnt] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [scocnky] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tuhylfj] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xwdyode] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [wmwsine] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bblpcxb] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [mkbhjlv] c:\winnt\rvrtips.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O10 - Unknown file in Winsock LSP: c:\winnt\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\flsmngr.dll
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1101546546012
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {FCC56E79-0FA2-4969-9164-06F140763455} (ActiveFormX Control) - http://klikw.com/awd/cabs/10110.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

alsocom

Post #2July 21, 2005, 6:34 AM UTC

We are sorry for the delay in replying to you. If you still require help, please Post a fresh Hijackthis log as a reply to this thread. I'll receive an e-mail notification of your reply and will respond as soon as possible. Thank you for your patience.

BuuDDha

Post #3July 24, 2005, 8:11 PM UTC

thank you so much for replying to my post. i appreciate it very much. im still having pretty much the same problems as before….homepage is www.abcsearch4u.com and it seems like i dont have any cpu…programs take forever to open. thanks a lot…i will be looking forward to your reply!

Logfile of HijackThis v1.99.1
Scan saved at 1:06:10 PM, on 7/24/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\RUNDLL32.exe
C:\WINNT\Dit.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\htpatch.exe
C:\WINNT\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINNT\System32\ctfmon.exe
C:\winnt\emrrcxk.exe
C:\WINNT\DitExp.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Dan Osborn\Desktop\Merijn.org stuff\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abcsearch4u.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abcsearch4u.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abcsearch4u.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\Toolbar.dll (file missing)
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [noxuamr] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [jbeujjk] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [xyelrhb] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ivykums] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [yaxjhlw] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ogarjae] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [mpkciax] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [qtdyyjn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [upfdqwv] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [wxfcawm] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [msvkjcn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [sveycra] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [vctqhpu] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [eipjnhh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [kjfmvqk] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jsqsscd] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lgvooop] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [quiawng] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jaqakbo] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [hedtlof] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [vpvweyh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [iwmenwv] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [yoaprry] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lbdhqob] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [qfducko] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [uunbgjs] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jlwilhl] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [ugkdfky] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [dahkmft] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [kburrab] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [faocqyg] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ebmhhkr] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fftrelq] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [urxlmhy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [svmfmtf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qnrsvry] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [eoefbvi] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fkjobex] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qvrpkhd] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [nqhcddo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [avoyuiy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fidkhrn] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [xpwlush] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [iltcild] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ooqiwvo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mxajnaj] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [onukmnu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wcghheh] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mjhpaux] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mppjokc] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [roccsjs] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wibeoum] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fsbllyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [emufqpu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mfcmeyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qwhmifr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [wmmjgch] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pxnrryd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [kadsejv] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [dbnsinl] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [joevvxw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [amqlbyg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sysrixp] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jgqcbav] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [oqykfqd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [swrmjmk] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [puplono] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [srqspuh] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skhuysj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [allvcvt] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sjlmcbj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cnjiccj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [nddbdfo] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ixcgldm] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jeyldsy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skffnju] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cuiyiwr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ynailpe] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ocauikg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pkkoigc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [juggpam] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [uvrvkqw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [bmuxiba] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tkhlxpd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [varulms] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [radason] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [aemhufc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [gowmrqn] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [itbfire] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [orhogmx] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [yiympuy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [clhuify] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [hdyabyu] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [njdlkhb] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tweqqpq] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [xsptiux] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [rgoifac] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kvaouys] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [rmygcsk] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [pjjqppn] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iybgdet] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [amjeefe] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [ctfbloc] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iaqtpdh] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kqlixnk] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qgnapnt] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [scocnky] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tuhylfj] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xwdyode] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [wmwsine] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bblpcxb] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [mkbhjlv] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qdjyvgp] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bavmwks] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [oomhsya] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gfwwkxg] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sgavjwe] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [knljvvu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [lrmeuhg] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [fcifsvi] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kdskokc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sirqumf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [edpowen] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cnemyoj] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vokxynr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tpalcgl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cmcrjjo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gnxuqrm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gtfvnsu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [umeegxm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jggnjqn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [wtjxgqa] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ddkemhv] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [otcrhsn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pharysa] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uprmjsq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gbehmvl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kpimwbm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ayderak] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [yeiafth] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jucjcnl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xttslcn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ssnljom] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [asgenpw] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ukpmisf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sjniopu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tjfmgcf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kvburlx] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xpadyga] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sbkowww] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uthunad] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rvxphvr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [hyodref] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jdiagmc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vegsynr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gcmbtbs] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pafrvic] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [trkgekm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [odtigvl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ylgbqvo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rfejodq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kvbalww] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qyrcbfs] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uxelvop] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [clkcudh] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [yesykpl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sshxaoo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cgslmst] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jewffea] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pwpegyh] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [lubvpof] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rkbhwyx] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rtkuvwq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [mnutnat] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ucicngk] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vlnxwga] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pyrapbc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qeymmyq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bnycien] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pqnfxxd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cjgnmac] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vamesnc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yvrtvgw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [okhkdca] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mpcnbqk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [spmvenq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rstsysq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [axxdysj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [usxnokc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cpwgups] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pmxjflx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yeylarn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vrqqruv] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fygqnjk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rfewfey] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jgoekfy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iaqsjlq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eymehrd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pngjpyp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ortmkuc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [thsqvsw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tlltiie] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [evepaia] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [emmxvud] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qrbyvtp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qawjvbd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xvcjnjy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [drpdjnm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lsejglg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ulqawcd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gwkjjxl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fojaqvh] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tyyrrfq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mfpfopq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tklowwr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pgelblk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ysfdagj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kscfreo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xochuob] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ebqvqtl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vybokqf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ycngmgq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ywwvada] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pfytjfo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uehcnmg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hsqfyfa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kwppjwj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hjssuyc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iimykcy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [essvilj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fvwqade] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fopvuvw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ubtrxmy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kchrrrg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fqhcwjj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eodtxwq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hnpclor] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [taaigkp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ypsatii] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [obwowhu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kqlgaqn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qddgvbt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mlbofjf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gjtrjnm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lktuoyq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tevrltu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xfehhla] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tlbbdwf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xcmerfl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [nfogklw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aldhgxu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uwcxpaf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lotuldt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cjsvuxi] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [egblulb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hbalopw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qrwowgk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tgrsaxs] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pkrgiwq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ibfmdxu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yvsdmqt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iugitmn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ewbpyla] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [wdlcksp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aminbrb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eaeklar] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bsowhrl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kueuytu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bptrbxj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jnigurc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [evigcrb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dibewbh] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [wmrubcp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fsrqqan] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ndyjqit] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iwcxijo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [elplqam] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dojjhxa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hfiafmr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fervune] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rnyxnsq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [smahbqk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rvdawju] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uxjemij] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kjihcok] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hnnwbab] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [sogumbe] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [nlpfgqc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ndtxblp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [omfpnii] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ukarmua] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qfxejoo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tkyxswb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vavldus] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xqykfqm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lqqaitp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mlcpipr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jttkxpc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aqxliys] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kuhydoy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gwjvpsx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xykdkmm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uomvyhx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yjhuupf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [thwbfdk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dlxswur] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [opksqqb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ggupcys] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bdqjqfs] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [khohjfa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vpvyaur] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lsbhtgq] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [ocxsbjp] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [oktxptm] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [vlkiich] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [ijicyyu] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [fryismc] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [vdwxkon] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [kretqis] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [gyrgcle] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [anmdkrp] c:\winnt\ecjkbqo.exe
O4 - HKCU\..\Run: [pivswou] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [xolvyio] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [asborof] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [gjksnrl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [hrqnoav] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [vjvybga] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [oefnjuu] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [rbsoucj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [mljuvax] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [omranvb] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [igsccjf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [meajoov] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [phxxjuu] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ryhvkal] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [odlnrag] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ujesjtd] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [fbvdndl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [qcpxsws] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ctdvhfj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [tlojwlv] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [audifdq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [anbqpfh] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [insjksr] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [thxvjxq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [pbearxj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [jfvbrou] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [pydiepe] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [psjsxtc] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [afhtqpa] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ikeyqvl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [dnakypq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [kgplpgx] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [coaowvl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [acfdppt] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [rphlhqf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [nywunht] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [qyklccx] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [mxbjfmf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [jiumaew] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [yabbyoq] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [rtukawt] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [dgpopob] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [whryuon] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [gupkeoo] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [xeaveae] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ywatglk] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [uplwnqx] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [rkmjsta] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [yfvqerv] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ekrrnot] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [kwkcqbu] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ysleqgd] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [avxxsmw] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nlpkqoo] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [thygbmc] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [plgxaho] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [wpcjqcr] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ahorhni] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ffwnuha] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nnnjjrj] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [btotfhm] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [bfsxcgr] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nggwyyv] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [edbqpvb] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [fhkifle] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [fkwxuar] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [jjrjjfa] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [asprjoa] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [jixrvsw] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [dxtrijt] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [pusasxx] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [frnjgnk] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [pxkwrla] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [bhdnouh] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [vpynofg] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [xxqufcs] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [vaqbeui] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [xhtqbgt] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [wbvaiyr] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [yfopppr] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [jencxqj] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [pkhfuyg] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [sexcfbm] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [nrjeria] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ljimkmg] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [waifowy] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [vliiirm] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ifffscf] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [nroeeno] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ufwemqy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lctfuhv] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qqjcpbc] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [uyyerpo] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jeqtpdm] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ywmossy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [biijyms] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ibfdqbj] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [hqtgctd] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wsnmipd] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ytpskof] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ojsxodo] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qaimwny] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [tbrbrmc] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qnwsriy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [sxdgnfk] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [xlcbpib] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lslqnop] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wwivlpq] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ceaonfe] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [nwsdard] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jhmyhoi] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [xwtwkqg] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [nleybih] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [idiljxv] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lcnejsn] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [cycvpyq] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ehfhpno] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ndkbyif] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lhsoyej] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [btnxnsu] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wlyrpsk] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [iwuppww] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wmrltmr] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [thgeler] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jachyvh] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qkwwfec] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [slijuvl] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [kiytuli] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [bxmirvw] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [viaxbwt] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [xxvvbdy] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [ovcfojw] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [bwvqtkb] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [aopospc] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [dfhsvcy] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [qierwom] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [ibdkiqf] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [pqajrvm] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [atmupsq] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [lntxxbi] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [alyxosw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [oquvpyr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [foaggjl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [aenkdhc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bxvtgxp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [acfvekx] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ekukfky] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xlvsjgs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kfaiboy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jvlekwv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [esernpi] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dxnppga] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ijscgqt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yvfwdqf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ajbavfb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pcgsqal] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uxlkavq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jjynkom] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ekudmjy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dongvuw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qwocyui] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ndumujq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ykwgres] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [trxpebj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [egrchvv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fbwwxcs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fbkmdaj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [iogiphp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gsjyqnt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [wvlrcxq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ldgckvu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ejtpgib] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hvjyhlv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [osfgqja] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rmqvskn] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hxopftl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ihubwfc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sjsccnc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vbhnheh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qraslwc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dofygpm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cftxmyp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qeighyb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kayrurl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nfcmxqp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cdvdjsa] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bcijkso] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dmrcimp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lsyfbey] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [inspqrd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ijmlysl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hdxjcoy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lrxrekb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ljyknfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sntwjye] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [njbyrht] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xffngjt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qavqnfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ojekmvv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jlisiob] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xomhnxl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ovtqlje] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ygblkjs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [plcagmd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bpofsvp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [etghqwg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gsleqmy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ahckeju] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rqeraoy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [llrbcfr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pwpkdrc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yewoscb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cplrevk] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rlmsqkh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [shilqdc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [igjpwsb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [orutabb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gaqikta] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pcrouxy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cudprnf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vyygjmg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [swgjbmb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hoqiqty] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hndnwfl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eslqukc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eveehyy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qsnxuvd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [afjgolc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [atyrsvg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hvqakka] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mtcycct] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kuojbwh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dgghbjq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pmcbrid] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lyblave] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pqsqogf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mraaqin] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yqsadyp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vachfqc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yyknkxn] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mjmccke] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vmtsfnd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [envsiko] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fedgpws] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ybedcod] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uwymkyo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xrupmbt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sqqxenr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lynvmab] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cxthide] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bujnddo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [tqufemy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jdbmvva] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eclpgak] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bkymyeu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xarcrgu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [naseltm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lgcjhkk] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [phksqwb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pgrfjen] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fhqwdfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vmrmhbw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qjwewgo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jiwhjai] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [amijhrm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uvqhxun] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fjmsidp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pebywnc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yelaxrg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vptsuhi] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qiklwfj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cwcvnpf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nylauju] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [suukqua] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nvmkncj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vhofsno] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [tugflii] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [iaukpqh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [adsjsup] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [omxilnm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lkarqyu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [porbmnq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vysoqua] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [wruysge] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [hndhxjm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cctkbak] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jblhsvp] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [bxpvwrf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [kjbdptj] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [nbsoyjf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [axxesis] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ritidaw] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cjpxygr] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [wddncow] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [yanrqvb] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [rjndxvj] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ddhuctf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ggdalna] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [pesuouf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [msdhrph] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [khxhmkx] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [yhevngm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [hmyigpn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [sqtwktn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [htdutmf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ytsbxfx] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ncijwoi] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jqtfhuy] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [untuydn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [uhayagy] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [vblnnje] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [qvhhglq] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [secfsnb] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [qjjnasl] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ilaoqvu] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [abwfdsn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ivsxjvv] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [xvpllyd] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jdgpxaa] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [uawctjw] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ftljofm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cyhijgv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [aauhtup] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kcoqcpj] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [uqiixhr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [frrmdkg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [muxjgjj] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kiujgsm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cjfglry] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jaggqot] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [anfcubr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ncorlqi] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [difnmua] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ukhknvm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kuyrfpr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xnwbmgo] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [vqqppiq] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cxhqxcp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [hvvnnjg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ieggmmv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [skvnbee] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nyfutol] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [juwciax] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [akaihvh] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [qbrqprv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bypfnqe] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cmctpkf] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xottyou] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [esoeetp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ghkegsg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [lbxkrnn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ildrtdn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xqqtgbi] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ubqfxfa] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [dlvbslu] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [npuelnn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [sscheey] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [icaxbml] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [gogneog] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bxeiqav] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nxcnffm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [idbgqtq] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [uumkamn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bctxamy] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xcvbkxu] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nmminnd] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ferrqiw] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [fjmsbfk] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ypdcikc] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [qqxfvjt] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jajxayn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rxwyymv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kyxmllk] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jdwnamb] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rhoyajv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rawxdni] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [sumspgt] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [pycixui] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ynlgbwp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [whoolcy] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jqrxdbg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ujmdaka] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [lcudapm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tlqjavq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vkflotp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ptolmex] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mxtgbiy] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iitelmp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qippkwk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nnlynus] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gigflbf] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [fsfvlxt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xrxodkx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wkkdnpu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ngxnlpw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ndfasgg] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [kwewamh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [sbnnhhd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ahgcyye] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [grwqvci] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nbupqlw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [selwhqa] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cdvqoty] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [brhuqxf] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yxftxnb] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [epnyuyh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [hsuxuij] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wfahbva] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [oqmgmgm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [anlfjna] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [damrlap] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yknsilv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vjkcsod] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wqteblu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yrbrswv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mncvxca] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [dlfvlcj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ielxvvx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [svehtpm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ovwjdmw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bvpqysl] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xwoyjli] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xhqyfsp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [lqhuyql] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xewdamq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rleifgd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ookpies] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gkfauam] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jfvbtup] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ifsdpsu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gfipcgj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jkcnnaw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rvcwabw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rdligdo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iecujru] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nvtugyc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [uifehlm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [eguvvka] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [utfiwjt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yvlfodq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [prypabe] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ieuucei] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bucxywl] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yepwmdo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cptbakk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jdsplbc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [obiohve] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xaigrwh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [smbgphv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xgpobhv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ucnksgp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bebpqow] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yaqmitb] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qbcqwau] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [efwbmho] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tqfhaae] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nrkwbnm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [dnusqep] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vfkxyii] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ggcswkh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wftsxwg] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ncqyxkd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [foelvlo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [axllenr] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cojkpma] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tketlwk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iduxgxt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tatqgry] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [eywefyc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [hwvpgpp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vvfgblj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ybtrgrw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xoqcvfk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [aduuatx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mwslwgd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [swtmtsj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qcpbrvs] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [recvnxu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cibetvp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rxpqons] c:\winnt\lqgpoud.exe

alsocom

Post #4July 25, 2005, 3:56 AM UTC

Hello BuuDDha and welcome to TomCoyote.

Your Hijackthis post was too long so the bottom portion did not show up. I'll have you run the following scan to see if it will remove many of the bad files. Make sure when you post the next Hijackthis log that the entire log is posted. It may take more than one post to fit it all here.

Please download the trial version of Ewido security suite.

Install and Update Ewido:

Download and install Ewido security suite.
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
Launch Ewido, there should be an icon on your desktop for it to double-click.
- The program will prompt you to update, click the OK button.
- The program will now go to the main screen.
You will need to update ewido to the latest definition files.
- On the left hand side of the main screen click update.
- Click on Start Update.
- The update will start and a progress bar will show the updates being installed.
Once the updates are installed, close the program.

Scanning With Ewido:

Reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
Launch Ewido again.
- Click on scanner
- Click on Complete System Scan and the scan will begin.
- While the scan is in progress you will be prompted to clean files, click OK
- When it asks if you want to clean the first file, put a check in the lower left corner of the boxes that say "Perform action on all infections"and "Create encrypted backup" then choose clean and click OK.
- Once the scan has completed, there will be a button located on the bottom of the screen named Save report
- Click Save report.
- Save the report .txt file to your desktop.
Now close ewido security suite.

Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include the Ewido report.

BuuDDha

Post #5July 25, 2005, 11:32 PM UTC

thanks again for your help…here is my ewido report: ——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 4:17:25 PM, 7/25/2005 + Report-Checksum: E69C333A + Scan result: HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup HKLM\SOFTWARE\Classes\CLSID\{43F02779-6D88-4958-8AD3-83C12D86ADC7} -> Spyware.AdvancedSearchbar : Cleaned with backup :mozilla.9:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup :mozilla.16:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.17:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.18:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.19:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.20:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.21:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.22:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.23:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.24:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.25:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.26:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.27:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.28:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup :mozilla.36:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.37:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.38:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Specificclick : Cleaned with backup :mozilla.40:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.41:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.42:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.44:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.47:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.48:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.94:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.95:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.97:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup :mozilla.104:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup :mozilla.108:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Ad-logics : Cleaned with backup :mozilla.109:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup :mozilla.110:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup :mozilla.127:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Esomniture : Cleaned with backup :mozilla.138:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup :mozilla.139:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup :mozilla.140:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup :mozilla.142:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup :mozilla.143:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup :mozilla.150:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup :mozilla.152:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.153:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.154:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.160:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Questionmarket : Cleaned with backup :mozilla.167:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup :mozilla.168:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Sexcounter : Cleaned with backup :mozilla.169:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup :mozilla.170:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup :mozilla.202:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Bridgetrack : Cleaned with backup :mozilla.203:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup :mozilla.208:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.214:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.215:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.218:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.220:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.223:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Ru4 : Cleaned with backup :mozilla.234:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup :mozilla.238:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Sitestat : Cleaned with backup :mozilla.242:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup :mozilla.267:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.268:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.274:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.275:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Liveperson : Cleaned with backup :mozilla.277:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.278:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.279:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup :mozilla.284:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup :mozilla.291:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup :mozilla.292:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Coremetrics : Cleaned with backup :mozilla.294:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.296:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Euniverseads : Cleaned with backup :mozilla.299:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup :mozilla.300:C:\Documents and Settings\Dan Osborn\Application Data\Mozilla\Firefox\Profiles\sbq3bejm.default\cookies.txt -> Spyware.Cookie.Adserver : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan osborn@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan osborn@adbrite[1].txt -> Spyware.Cookie.Adbrite : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan [removed][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan osborn@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan osborn@burstnet[1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan [removed][2].txt -> Spyware.Cookie.Clickzs : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan [removed][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan osborn@fastclick[2].txt -> Spyware.Cookie.Fastclick : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan [removed][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan osborn@overture[2].txt -> Spyware.Cookie.Overture : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan [removed][1].txt -> Spyware.Cookie.Overture : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan osborn@statcounter[1].txt -> Spyware.Cookie.Statcounter : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan [removed][2].txt -> Spyware.Cookie.Popuptraffic : Cleaned with backup C:\Documents and Settings\Dan Osborn\Cookies\dan [removed][2].txt -> Spyware.Cookie.Popuptraffic : Cleaned with backup C:\Documents and Settings\Dan Osborn\Local Settings\Temp\Cookies\dan osborn@atdmt[1].txt -> Spyware.Cookie.Atdmt : Cleaned with backup C:\Documents and Settings\Dan Osborn\Local Settings\Temp\Cookies\dan [removed][2].txt -> Spyware.Cookie.Sexcounter : Cleaned with backup C:\Documents and Settings\Dan Osborn\Local Settings\Temp\iinstall.exe -> TrojanDownloader.IstBar.km : Cleaned with backup C:\WINNT\aooaflu.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\dalgasc.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\ddjcdxl.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\dexptjj.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\ebkxotx.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\ecjkbqo.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\emrrcxk.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\fsnljcm.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\gpqwhgl.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\idmqbfk.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\lqgpoud.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\nqdrxon.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\nqkiwho.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\oqacmar.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\prcwokf.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\rvrtips.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\sqiidhc.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\system32\combo.exe -> Worm.Bagz.j : Cleaned with backup C:\WINNT\system32\flsmngr.dll -> Spyware.Searcher : Cleaned with backup C:\WINNT\system32\gpaxqaaa.exe -> TrojanDropper.Agent.ka : Cleaned with backup C:\WINNT\system32\sender.exe -> Worm.Bagz.j : Cleaned with backup C:\WINNT\system32\srpcsrv32.dll -> TrojanDownloader.Adload.g : Cleaned with backup C:\WINNT\system32\vbgaaaaa.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\system32\vkfndtpi.exe -> TrojanDropper.Small.zp : Cleaned with backup C:\WINNT\ubwgnal.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\wt\wtupdates\webd\4.1.1\files\wtvh.dll -> Spyware.WildTangent : Cleaned with backup C:\WINNT\wt\wtvh.dll -> Spyware.WildTangent : Cleaned with backup C:\WINNT\xbglfdj.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\xgsqadg.exe -> Spyware.Hijacker.Generic : Cleaned with backup C:\WINNT\ysjuctj.exe -> Spyware.Hijacker.Generic : Cleaned with backup ::Report End

BuuDDha

Post #6July 25, 2005, 11:34 PM UTC

and my hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 4:25:58 PM, on 7/25/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\RUNDLL32.exe
C:\WINNT\Dit.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\htpatch.exe
C:\WINNT\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\DitExp.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\wuauclt.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Dan Osborn\Desktop\Merijn.org stuff\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abcsearch4u.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abcsearch4u.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\Toolbar.dll (file missing)
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [noxuamr] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [jbeujjk] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [xyelrhb] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ivykums] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [yaxjhlw] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ogarjae] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [mpkciax] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [qtdyyjn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [upfdqwv] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [wxfcawm] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [msvkjcn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [sveycra] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [vctqhpu] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [eipjnhh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [kjfmvqk] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jsqsscd] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lgvooop] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [quiawng] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jaqakbo] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [hedtlof] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [vpvweyh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [iwmenwv] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [yoaprry] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lbdhqob] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [qfducko] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [uunbgjs] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jlwilhl] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [ugkdfky] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [dahkmft] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [kburrab] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [faocqyg] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ebmhhkr] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fftrelq] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [urxlmhy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [svmfmtf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qnrsvry] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [eoefbvi] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fkjobex] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qvrpkhd] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [nqhcddo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [avoyuiy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fidkhrn] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [xpwlush] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [iltcild] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ooqiwvo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mxajnaj] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [onukmnu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wcghheh] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mjhpaux] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mppjokc] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [roccsjs] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wibeoum] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fsbllyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [emufqpu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mfcmeyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qwhmifr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [wmmjgch] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pxnrryd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [kadsejv] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [dbnsinl] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [joevvxw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [amqlbyg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sysrixp] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jgqcbav] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [oqykfqd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [swrmjmk] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [puplono] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [srqspuh] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skhuysj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [allvcvt] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sjlmcbj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cnjiccj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [nddbdfo] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ixcgldm] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jeyldsy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skffnju] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cuiyiwr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ynailpe] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ocauikg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pkkoigc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [juggpam] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [uvrvkqw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [bmuxiba] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tkhlxpd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [varulms] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [radason] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [aemhufc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [gowmrqn] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [itbfire] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [orhogmx] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [yiympuy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [clhuify] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [hdyabyu] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [njdlkhb] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tweqqpq] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [xsptiux] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [rgoifac] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kvaouys] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [rmygcsk] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [pjjqppn] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iybgdet] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [amjeefe] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [ctfbloc] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iaqtpdh] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kqlixnk] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qgnapnt] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [scocnky] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tuhylfj] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xwdyode] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [wmwsine] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bblpcxb] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [mkbhjlv] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qdjyvgp] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bavmwks] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [oomhsya] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gfwwkxg] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sgavjwe] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [knljvvu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [lrmeuhg] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [fcifsvi] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kdskokc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sirqumf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [edpowen] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cnemyoj] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vokxynr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tpalcgl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cmcrjjo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gnxuqrm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gtfvnsu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [umeegxm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jggnjqn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [wtjxgqa] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ddkemhv] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [otcrhsn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pharysa] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uprmjsq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gbehmvl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kpimwbm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ayderak] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [yeiafth] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jucjcnl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xttslcn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ssnljom] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [asgenpw] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ukpmisf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sjniopu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tjfmgcf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kvburlx] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xpadyga] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sbkowww] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uthunad] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rvxphvr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [hyodref] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jdiagmc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vegsynr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gcmbtbs] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pafrvic] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [trkgekm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [odtigvl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ylgbqvo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rfejodq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kvbalww] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qyrcbfs] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uxelvop] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [clkcudh] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [yesykpl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sshxaoo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cgslmst] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jewffea] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pwpegyh] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [lubvpof] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rkbhwyx] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rtkuvwq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [mnutnat] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ucicngk] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vlnxwga] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pyrapbc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qeymmyq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bnycien] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pqnfxxd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cjgnmac] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vamesnc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yvrtvgw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [okhkdca] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mpcnbqk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [spmvenq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rstsysq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [axxdysj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [usxnokc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cpwgups] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pmxjflx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yeylarn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vrqqruv] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fygqnjk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rfewfey] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jgoekfy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iaqsjlq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eymehrd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pngjpyp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ortmkuc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [thsqvsw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tlltiie] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [evepaia] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [emmxvud] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qrbyvtp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qawjvbd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xvcjnjy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [drpdjnm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lsejglg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ulqawcd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gwkjjxl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fojaqvh] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tyyrrfq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mfpfopq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tklowwr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pgelblk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ysfdagj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kscfreo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xochuob] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ebqvqtl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vybokqf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ycngmgq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ywwvada] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pfytjfo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uehcnmg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hsqfyfa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kwppjwj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hjssuyc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iimykcy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [essvilj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fvwqade] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fopvuvw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ubtrxmy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kchrrrg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fqhcwjj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eodtxwq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hnpclor] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [taaigkp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ypsatii] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [obwowhu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kqlgaqn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qddgvbt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mlbofjf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gjtrjnm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lktuoyq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tevrltu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xfehhla] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tlbbdwf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xcmerfl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [nfogklw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aldhgxu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uwcxpaf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lotuldt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cjsvuxi] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [egblulb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hbalopw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qrwowgk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tgrsaxs] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pkrgiwq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ibfmdxu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yvsdmqt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iugitmn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ewbpyla] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [wdlcksp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aminbrb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eaeklar] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bsowhrl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kueuytu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bptrbxj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jnigurc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [evigcrb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dibewbh] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [wmrubcp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fsrqqan] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ndyjqit] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iwcxijo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [elplqam] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dojjhxa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hfiafmr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fervune] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rnyxnsq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [smahbqk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rvdawju] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uxjemij] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kjihcok] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hnnwbab] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [sogumbe] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [nlpfgqc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ndtxblp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [omfpnii] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ukarmua] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qfxejoo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tkyxswb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vavldus] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xqykfqm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lqqaitp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mlcpipr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jttkxpc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aqxliys] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kuhydoy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gwjvpsx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xykdkmm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uomvyhx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yjhuupf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [thwbfdk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dlxswur] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [opksqqb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ggupcys] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bdqjqfs] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [khohjfa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vpvyaur] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lsbhtgq] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [ocxsbjp] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [oktxptm] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [vlkiich] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [ijicyyu] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [fryismc] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [vdwxkon] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [kretqis] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [gyrgcle] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [anmdkrp] c:\winnt\ecjkbqo.exe
O4 - HKCU\..\Run: [pivswou] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [xolvyio] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [asborof] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [gjksnrl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [hrqnoav] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [vjvybga] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [oefnjuu] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [rbsoucj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [mljuvax] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [omranvb] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [igsccjf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [meajoov] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [phxxjuu] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ryhvkal] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [odlnrag] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ujesjtd] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [fbvdndl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [qcpxsws] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ctdvhfj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [tlojwlv] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [audifdq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [anbqpfh] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [insjksr] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [thxvjxq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [pbearxj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [jfvbrou] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [pydiepe] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [psjsxtc] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [afhtqpa] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ikeyqvl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [dnakypq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [kgplpgx] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [coaowvl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [acfdppt] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [rphlhqf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [nywunht] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [qyklccx] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [mxbjfmf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [jiumaew] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [yabbyoq] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [rtukawt] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [dgpopob] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [whryuon] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [gupkeoo] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [xeaveae] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ywatglk] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [uplwnqx] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [rkmjsta] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [yfvqerv] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ekrrnot] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [kwkcqbu] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ysleqgd] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [avxxsmw] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nlpkqoo] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [thygbmc] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [plgxaho] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [wpcjqcr] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ahorhni] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ffwnuha] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nnnjjrj] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [btotfhm] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [bfsxcgr] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nggwyyv] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [edbqpvb] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [fhkifle] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [fkwxuar] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [jjrjjfa] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [asprjoa] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [jixrvsw] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [dxtrijt] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [pusasxx] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [frnjgnk] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [pxkwrla] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [bhdnouh] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [vpynofg] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [xxqufcs] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [vaqbeui] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [xhtqbgt] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [wbvaiyr] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [yfopppr] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [jencxqj] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [pkhfuyg] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [sexcfbm] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [nrjeria] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ljimkmg] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [waifowy] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [vliiirm] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ifffscf] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [nroeeno] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ufwemqy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lctfuhv] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qqjcpbc] c:\winnt\ebkxotx.exe

to be continued…

BuuDDha

Post #7July 25, 2005, 11:35 PM UTC

the rest:

O4 - HKCU\..\Run: [uyyerpo] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jeqtpdm] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ywmossy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [biijyms] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ibfdqbj] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [hqtgctd] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wsnmipd] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ytpskof] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ojsxodo] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qaimwny] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [tbrbrmc] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qnwsriy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [sxdgnfk] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [xlcbpib] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lslqnop] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wwivlpq] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ceaonfe] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [nwsdard] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jhmyhoi] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [xwtwkqg] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [nleybih] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [idiljxv] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lcnejsn] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [cycvpyq] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ehfhpno] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ndkbyif] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lhsoyej] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [btnxnsu] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wlyrpsk] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [iwuppww] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wmrltmr] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [thgeler] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jachyvh] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qkwwfec] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [slijuvl] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [kiytuli] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [bxmirvw] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [viaxbwt] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [xxvvbdy] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [ovcfojw] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [bwvqtkb] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [aopospc] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [dfhsvcy] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [qierwom] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [ibdkiqf] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [pqajrvm] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [atmupsq] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [lntxxbi] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [alyxosw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [oquvpyr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [foaggjl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [aenkdhc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bxvtgxp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [acfvekx] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ekukfky] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xlvsjgs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kfaiboy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jvlekwv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [esernpi] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dxnppga] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ijscgqt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yvfwdqf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ajbavfb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pcgsqal] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uxlkavq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jjynkom] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ekudmjy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dongvuw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qwocyui] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ndumujq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ykwgres] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [trxpebj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [egrchvv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fbwwxcs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fbkmdaj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [iogiphp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gsjyqnt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [wvlrcxq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ldgckvu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ejtpgib] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hvjyhlv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [osfgqja] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rmqvskn] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hxopftl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ihubwfc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sjsccnc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vbhnheh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qraslwc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dofygpm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cftxmyp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qeighyb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kayrurl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nfcmxqp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cdvdjsa] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bcijkso] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dmrcimp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lsyfbey] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [inspqrd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ijmlysl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hdxjcoy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lrxrekb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ljyknfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sntwjye] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [njbyrht] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xffngjt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qavqnfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ojekmvv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jlisiob] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xomhnxl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ovtqlje] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ygblkjs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [plcagmd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bpofsvp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [etghqwg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gsleqmy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ahckeju] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rqeraoy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [llrbcfr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pwpkdrc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yewoscb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cplrevk] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rlmsqkh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [shilqdc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [igjpwsb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [orutabb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gaqikta] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pcrouxy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cudprnf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vyygjmg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [swgjbmb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hoqiqty] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hndnwfl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eslqukc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eveehyy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qsnxuvd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [afjgolc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [atyrsvg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hvqakka] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mtcycct] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kuojbwh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dgghbjq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pmcbrid] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lyblave] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pqsqogf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mraaqin] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yqsadyp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vachfqc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yyknkxn] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mjmccke] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vmtsfnd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [envsiko] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fedgpws] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ybedcod] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uwymkyo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xrupmbt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sqqxenr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lynvmab] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cxthide] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bujnddo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [tqufemy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jdbmvva] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eclpgak] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bkymyeu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xarcrgu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [naseltm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lgcjhkk] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [phksqwb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pgrfjen] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fhqwdfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vmrmhbw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qjwewgo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jiwhjai] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [amijhrm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uvqhxun] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fjmsidp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pebywnc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yelaxrg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vptsuhi] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qiklwfj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cwcvnpf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nylauju] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [suukqua] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nvmkncj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vhofsno] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [tugflii] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [iaukpqh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [adsjsup] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [omxilnm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lkarqyu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [porbmnq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vysoqua] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [wruysge] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [hndhxjm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cctkbak] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jblhsvp] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [bxpvwrf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [kjbdptj] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [nbsoyjf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [axxesis] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ritidaw] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cjpxygr] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [wddncow] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [yanrqvb] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [rjndxvj] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ddhuctf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ggdalna] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [pesuouf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [msdhrph] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [khxhmkx] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [yhevngm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [hmyigpn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [sqtwktn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [htdutmf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ytsbxfx] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ncijwoi] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jqtfhuy] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [untuydn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [uhayagy] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [vblnnje] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [qvhhglq] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [secfsnb] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [qjjnasl] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ilaoqvu] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [abwfdsn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ivsxjvv] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [xvpllyd] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jdgpxaa] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [uawctjw] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ftljofm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cyhijgv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [aauhtup] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kcoqcpj] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [uqiixhr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [frrmdkg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [muxjgjj] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kiujgsm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cjfglry] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jaggqot] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [anfcubr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ncorlqi] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [difnmua] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ukhknvm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kuyrfpr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xnwbmgo] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [vqqppiq] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cxhqxcp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [hvvnnjg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ieggmmv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [skvnbee] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nyfutol] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [juwciax] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [akaihvh] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [qbrqprv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bypfnqe] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cmctpkf] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xottyou] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [esoeetp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ghkegsg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [lbxkrnn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ildrtdn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xqqtgbi] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ubqfxfa] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [dlvbslu] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [npuelnn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [sscheey] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [icaxbml] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [gogneog] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bxeiqav] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nxcnffm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [idbgqtq] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [uumkamn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bctxamy] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xcvbkxu] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nmminnd] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ferrqiw] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [fjmsbfk] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ypdcikc] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [qqxfvjt] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jajxayn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rxwyymv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kyxmllk] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jdwnamb] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rhoyajv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rawxdni] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [sumspgt] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [pycixui] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ynlgbwp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [whoolcy] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jqrxdbg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ujmdaka] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [lcudapm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tlqjavq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vkflotp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ptolmex] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mxtgbiy] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iitelmp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qippkwk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nnlynus] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gigflbf] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [fsfvlxt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xrxodkx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wkkdnpu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ngxnlpw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ndfasgg] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [kwewamh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [sbnnhhd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ahgcyye] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [grwqvci] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nbupqlw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [selwhqa] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cdvqoty] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [brhuqxf] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yxftxnb] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [epnyuyh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [hsuxuij] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wfahbva] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [oqmgmgm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [anlfjna] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [damrlap] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yknsilv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vjkcsod] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wqteblu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yrbrswv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mncvxca] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [dlfvlcj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ielxvvx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [svehtpm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ovwjdmw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bvpqysl] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xwoyjli] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xhqyfsp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [lqhuyql] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xewdamq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rleifgd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ookpies] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gkfauam] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jfvbtup] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ifsdpsu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gfipcgj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jkcnnaw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rvcwabw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rdligdo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iecujru] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nvtugyc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [uifehlm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [eguvvka] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [utfiwjt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yvlfodq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [prypabe] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ieuucei] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bucxywl] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yepwmdo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cptbakk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jdsplbc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [obiohve] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xaigrwh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [smbgphv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xgpobhv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ucnksgp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bebpqow] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yaqmitb] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qbcqwau] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [efwbmho] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tqfhaae] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nrkwbnm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [dnusqep] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vfkxyii] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ggcswkh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wftsxwg] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ncqyxkd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [foelvlo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [axllenr] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cojkpma] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tketlwk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iduxgxt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tatqgry] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [eywefyc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [hwvpgpp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vvfgblj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ybtrgrw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xoqcvfk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [aduuatx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mwslwgd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [swtmtsj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qcpbrvs] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [recvnxu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cibetvp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rxpqons] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bgdmlct] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wlotayx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gqwsgym] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wytigdq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yuddpom] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [grggnnr] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [icodywi] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wbqcxor] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rjsrphq] c:\winnt\prcwokf.exe
O4 - HKCU\..\Run: [djvrfjx] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [micovsb] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [vcreubl] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [wyhqrck] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [oiakaxh] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bikfexr] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [waccjlq] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [vevdpqq] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [reohtss] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [xxkfaam] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [djngkcf] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [hcqfbkj] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bmdqjqw] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [jvqghec] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bxupljw] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [nstncse] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [cowxdsh] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [sontrtp] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [hldkxtu] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [pmqvrnm] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [xfrxush] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [umiqkrk] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ycbocro] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [buhhkgv] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [auetdtw] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ylfenng] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [tjekrgh] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [idbkoiu] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bxpywtp] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [rsjrwni] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [qefuauy] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [odyuuti] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [pbkxoon] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [aaayqpp] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [risimil] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [gltxldq] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [jqellxe] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [vesnfut] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [benacnd] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ykhhfav] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [tqdemju] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ttpquxv] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ctifwvv] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [kjntqkx] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [kaimrwk] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [tehlbbn] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [plejgfn] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [iwkonsp] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bytvrog] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [umykcmu] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [qxtpsgo] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [jojrbsk] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bfbkgoe] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [lblmkrd] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [tuxufwm] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bhrbaar] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [wkeaiuv] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bikypke] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [flfsupb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bxibiec] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ajalxfs] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [etgults] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [rtvjqae] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [jjhqvur] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ssasmmr] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [rhsrvnb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [gddhmvs] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [vdgniqv] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bjoobrh] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ejlunth] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [dwerjha] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [epmobor] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [biovtor] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bkrperb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [nwgkfll] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [mmytxkd] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ctgnkbc] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [kebjyft] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ypvuwji] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ulgijti] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ylttbyv] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [auifbcj] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xjdbqfr] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [mhnelhx] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [hjbjiiw] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [gxjqgex] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [iayrlqx] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [skaqvep] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xtsnqmx] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [kkyblhj] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ltsvqxb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [nexofcp] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [noufjdf] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [sawtqei] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [inhebvh] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [wiwufec] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xxccdeq] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [qpxlgqt] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bjwpffp] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bahtaqa] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [uhqsigu] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [cpemmmg] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [cnmegsi] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [apmpjpo] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [homiigf] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xavfsgm] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [tjohlyo] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [pkpljcf] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [trigglg] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [eawwvks] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [rdsaevm] c:\winnt\dexptjj.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1101546546012
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {FCC56E79-0FA2-4969-9164-06F140763455} (ActiveFormX Control) - http://klikw.com/awd/cabs/10110.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

alsocom

Post #8July 26, 2005, 12:31 AM UTC last edited July 26, 2005, 12:40 AM UTC

Step 1
Open HijackThis, run a scan, then check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://abcsearch4u.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://abcsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://abcsearch4u.com/

O2 - BHO: ToolHelper - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\Toolbar.dll (file missing)

O4 - HKLM\..\Run: [combo.exe] combo.exe
O4 - HKCU\..\Run: [noxuamr] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [jbeujjk] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [xyelrhb] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ivykums] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [yaxjhlw] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [ogarjae] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [mpkciax] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [qtdyyjn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [upfdqwv] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [wxfcawm] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [msvkjcn] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [sveycra] c:\winnt\emrrcxk.exe
O4 - HKCU\..\Run: [vctqhpu] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [eipjnhh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [kjfmvqk] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jsqsscd] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lgvooop] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [quiawng] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jaqakbo] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [hedtlof] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [vpvweyh] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [iwmenwv] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [yoaprry] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [lbdhqob] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [qfducko] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [uunbgjs] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [jlwilhl] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [ugkdfky] c:\winnt\oqacmar.exe
O4 - HKCU\..\Run: [dahkmft] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [kburrab] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [faocqyg] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ebmhhkr] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fftrelq] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [urxlmhy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [svmfmtf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qnrsvry] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [eoefbvi] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fkjobex] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qvrpkhd] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [nqhcddo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [avoyuiy] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fidkhrn] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [xpwlush] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [iltcild] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [ooqiwvo] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mxajnaj] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [onukmnu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wcghheh] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mjhpaux] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mppjokc] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [roccsjs] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [wibeoum] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [fsbllyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [emufqpu] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [mfcmeyf] c:\winnt\nqkiwho.exe
O4 - HKCU\..\Run: [qwhmifr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [wmmjgch] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pxnrryd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [kadsejv] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [dbnsinl] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [joevvxw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [amqlbyg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sysrixp] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jgqcbav] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [oqykfqd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [swrmjmk] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [puplono] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [srqspuh] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skhuysj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [allvcvt] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [sjlmcbj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cnjiccj] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [nddbdfo] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ixcgldm] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [jeyldsy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [skffnju] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [cuiyiwr] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ynailpe] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [ocauikg] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [pkkoigc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [juggpam] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [uvrvkqw] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [bmuxiba] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tkhlxpd] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [varulms] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [radason] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [aemhufc] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [gowmrqn] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [itbfire] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [orhogmx] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [yiympuy] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [clhuify] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [hdyabyu] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [njdlkhb] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [tweqqpq] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [xsptiux] c:\winnt\nqdrxon.exe
O4 - HKCU\..\Run: [rgoifac] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kvaouys] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [rmygcsk] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [pjjqppn] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iybgdet] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [amjeefe] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [ctfbloc] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [iaqtpdh] c:\winnt\ysjuctj.exe
O4 - HKCU\..\Run: [kqlixnk] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qgnapnt] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [scocnky] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tuhylfj] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xwdyode] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [wmwsine] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bblpcxb] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [mkbhjlv] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qdjyvgp] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bavmwks] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [oomhsya] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gfwwkxg] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sgavjwe] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [knljvvu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [lrmeuhg] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [fcifsvi] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kdskokc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sirqumf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [edpowen] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cnemyoj] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vokxynr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tpalcgl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cmcrjjo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gnxuqrm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gtfvnsu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [umeegxm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jggnjqn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [wtjxgqa] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ddkemhv] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [otcrhsn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pharysa] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uprmjsq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gbehmvl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kpimwbm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ayderak] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [yeiafth] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jucjcnl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xttslcn] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ssnljom] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [asgenpw] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ukpmisf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sjniopu] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [tjfmgcf] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kvburlx] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [xpadyga] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sbkowww] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uthunad] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rvxphvr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [hyodref] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jdiagmc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vegsynr] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [gcmbtbs] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pafrvic] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [trkgekm] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [odtigvl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ylgbqvo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rfejodq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [kvbalww] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qyrcbfs] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [uxelvop] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [clkcudh] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [yesykpl] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [sshxaoo] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [cgslmst] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [jewffea] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pwpegyh] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [lubvpof] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rkbhwyx] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [rtkuvwq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [mnutnat] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [ucicngk] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [vlnxwga] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pyrapbc] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [qeymmyq] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [bnycien] c:\winnt\rvrtips.exe
O4 - HKCU\..\Run: [pqnfxxd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cjgnmac] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vamesnc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yvrtvgw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [okhkdca] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mpcnbqk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [spmvenq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rstsysq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [axxdysj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [usxnokc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cpwgups] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pmxjflx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yeylarn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vrqqruv] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fygqnjk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rfewfey] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jgoekfy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iaqsjlq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eymehrd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pngjpyp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ortmkuc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [thsqvsw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tlltiie] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [evepaia] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [emmxvud] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qrbyvtp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qawjvbd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xvcjnjy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [drpdjnm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lsejglg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ulqawcd] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gwkjjxl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fojaqvh] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tyyrrfq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mfpfopq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tklowwr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pgelblk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ysfdagj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kscfreo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xochuob] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ebqvqtl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vybokqf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ycngmgq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ywwvada] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pfytjfo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uehcnmg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hsqfyfa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kwppjwj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hjssuyc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iimykcy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [essvilj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fvwqade] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fopvuvw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ubtrxmy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kchrrrg] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fqhcwjj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eodtxwq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hnpclor] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [taaigkp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ypsatii] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [obwowhu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kqlgaqn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qddgvbt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mlbofjf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gjtrjnm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lktuoyq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tevrltu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xfehhla] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tlbbdwf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xcmerfl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [nfogklw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aldhgxu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uwcxpaf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lotuldt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [cjsvuxi] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [egblulb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hbalopw] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qrwowgk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tgrsaxs] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [pkrgiwq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ibfmdxu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yvsdmqt] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iugitmn] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ewbpyla] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [wdlcksp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aminbrb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [eaeklar] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bsowhrl] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kueuytu] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bptrbxj] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jnigurc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [evigcrb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dibewbh] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [wmrubcp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fsrqqan] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ndyjqit] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [iwcxijo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [elplqam] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dojjhxa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hfiafmr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [fervune] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rnyxnsq] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [smahbqk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [rvdawju] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uxjemij] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kjihcok] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [hnnwbab] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [sogumbe] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [nlpfgqc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ndtxblp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [omfpnii] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ukarmua] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [qfxejoo] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [tkyxswb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vavldus] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xqykfqm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lqqaitp] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [mlcpipr] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [jttkxpc] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [aqxliys] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [kuhydoy] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [gwjvpsx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [xykdkmm] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [uomvyhx] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [yjhuupf] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [thwbfdk] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [dlxswur] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [opksqqb] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [ggupcys] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [bdqjqfs] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [khohjfa] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [vpvyaur] c:\winnt\ddjcdxl.exe
O4 - HKCU\..\Run: [lsbhtgq] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [ocxsbjp] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [oktxptm] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [vlkiich] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [ijicyyu] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [fryismc] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [vdwxkon] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [kretqis] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [gyrgcle] c:\winnt\dalgasc.exe
O4 - HKCU\..\Run: [anmdkrp] c:\winnt\ecjkbqo.exe
O4 - HKCU\..\Run: [pivswou] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [xolvyio] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [asborof] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [gjksnrl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [hrqnoav] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [vjvybga] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [oefnjuu] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [rbsoucj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [mljuvax] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [omranvb] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [igsccjf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [meajoov] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [phxxjuu] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ryhvkal] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [odlnrag] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ujesjtd] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [fbvdndl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [qcpxsws] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ctdvhfj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [tlojwlv] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [audifdq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [anbqpfh] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [insjksr] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [thxvjxq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [pbearxj] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [jfvbrou] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [pydiepe] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [psjsxtc] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [afhtqpa] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [ikeyqvl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [dnakypq] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [kgplpgx] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [coaowvl] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [acfdppt] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [rphlhqf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [nywunht] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [qyklccx] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [mxbjfmf] c:\winnt\aooaflu.exe
O4 - HKCU\..\Run: [jiumaew] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [yabbyoq] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [rtukawt] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [dgpopob] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [whryuon] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [gupkeoo] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [xeaveae] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ywatglk] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [uplwnqx] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [rkmjsta] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [yfvqerv] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ekrrnot] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [kwkcqbu] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ysleqgd] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [avxxsmw] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nlpkqoo] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [thygbmc] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [plgxaho] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [wpcjqcr] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ahorhni] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [ffwnuha] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nnnjjrj] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [btotfhm] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [bfsxcgr] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [nggwyyv] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [edbqpvb] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [fhkifle] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [fkwxuar] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [jjrjjfa] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [asprjoa] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [jixrvsw] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [dxtrijt] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [pusasxx] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [frnjgnk] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [pxkwrla] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [bhdnouh] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [vpynofg] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [xxqufcs] c:\winnt\gpqwhgl.exe
O4 - HKCU\..\Run: [vaqbeui] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [xhtqbgt] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [wbvaiyr] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [yfopppr] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [jencxqj] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [pkhfuyg] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [sexcfbm] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [nrjeria] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ljimkmg] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [waifowy] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [vliiirm] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ifffscf] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [nroeeno] c:\winnt\fsnljcm.exe
O4 - HKCU\..\Run: [ufwemqy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lctfuhv] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qqjcpbc] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [uyyerpo] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jeqtpdm] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ywmossy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [biijyms] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ibfdqbj] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [hqtgctd] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wsnmipd] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ytpskof] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ojsxodo] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qaimwny] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [tbrbrmc] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qnwsriy] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [sxdgnfk] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [xlcbpib] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lslqnop] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wwivlpq] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ceaonfe] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [nwsdard] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jhmyhoi] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [xwtwkqg] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [nleybih] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [idiljxv] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lcnejsn] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [cycvpyq] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ehfhpno] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [ndkbyif] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [lhsoyej] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [btnxnsu] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wlyrpsk] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [iwuppww] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [wmrltmr] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [thgeler] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [jachyvh] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [qkwwfec] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [slijuvl] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [kiytuli] c:\winnt\ebkxotx.exe
O4 - HKCU\..\Run: [bxmirvw] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [viaxbwt] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [xxvvbdy] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [ovcfojw] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [bwvqtkb] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [aopospc] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [dfhsvcy] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [qierwom] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [ibdkiqf] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [pqajrvm] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [atmupsq] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [lntxxbi] c:\winnt\xbglfdj.exe
O4 - HKCU\..\Run: [alyxosw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [oquvpyr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [foaggjl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [aenkdhc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bxvtgxp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [acfvekx] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ekukfky] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xlvsjgs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kfaiboy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jvlekwv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [esernpi] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dxnppga] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ijscgqt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yvfwdqf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ajbavfb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pcgsqal] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uxlkavq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jjynkom] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ekudmjy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dongvuw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qwocyui] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ndumujq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ykwgres] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [trxpebj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [egrchvv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fbwwxcs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fbkmdaj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [iogiphp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gsjyqnt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [wvlrcxq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ldgckvu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ejtpgib] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hvjyhlv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [osfgqja] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rmqvskn] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hxopftl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ihubwfc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sjsccnc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vbhnheh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qraslwc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dofygpm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cftxmyp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qeighyb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kayrurl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nfcmxqp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cdvdjsa] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bcijkso] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dmrcimp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lsyfbey] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [inspqrd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ijmlysl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hdxjcoy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lrxrekb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ljyknfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sntwjye] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [njbyrht] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xffngjt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qavqnfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ojekmvv] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jlisiob] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xomhnxl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ovtqlje] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ygblkjs] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [plcagmd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bpofsvp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [etghqwg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gsleqmy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ahckeju] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rqeraoy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [llrbcfr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pwpkdrc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yewoscb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cplrevk] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [rlmsqkh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [shilqdc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [igjpwsb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [orutabb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [gaqikta] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pcrouxy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cudprnf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vyygjmg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [swgjbmb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hoqiqty] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hndnwfl] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eslqukc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eveehyy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qsnxuvd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [afjgolc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [atyrsvg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [hvqakka] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mtcycct] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [kuojbwh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [dgghbjq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pmcbrid] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lyblave] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pqsqogf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mraaqin] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yqsadyp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vachfqc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yyknkxn] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [mjmccke] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vmtsfnd] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [envsiko] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fedgpws] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [ybedcod] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uwymkyo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xrupmbt] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [sqqxenr] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lynvmab] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cxthide] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bujnddo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [tqufemy] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jdbmvva] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [eclpgak] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [bkymyeu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [xarcrgu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [naseltm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lgcjhkk] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [phksqwb] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pgrfjen] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fhqwdfw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vmrmhbw] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qjwewgo] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [jiwhjai] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [amijhrm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [uvqhxun] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [fjmsidp] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [pebywnc] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [yelaxrg] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vptsuhi] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [qiklwfj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [cwcvnpf] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nylauju] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [suukqua] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [nvmkncj] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vhofsno] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [tugflii] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [iaukpqh] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [adsjsup] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [omxilnm] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [lkarqyu] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [porbmnq] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [vysoqua] c:\winnt\xgsqadg.exe
O4 - HKCU\..\Run: [wruysge] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [hndhxjm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cctkbak] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jblhsvp] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [bxpvwrf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [kjbdptj] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [nbsoyjf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [axxesis] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ritidaw] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cjpxygr] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [wddncow] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [yanrqvb] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [rjndxvj] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ddhuctf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ggdalna] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [pesuouf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [msdhrph] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [khxhmkx] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [yhevngm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [hmyigpn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [sqtwktn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [htdutmf] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ytsbxfx] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ncijwoi] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jqtfhuy] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [untuydn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [uhayagy] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [vblnnje] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [qvhhglq] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [secfsnb] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [qjjnasl] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ilaoqvu] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [abwfdsn] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ivsxjvv] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [xvpllyd] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [jdgpxaa] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [uawctjw] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [ftljofm] c:\winnt\idmqbfk.exe
O4 - HKCU\..\Run: [cyhijgv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [aauhtup] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kcoqcpj] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [uqiixhr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [frrmdkg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [muxjgjj] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kiujgsm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cjfglry] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jaggqot] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [anfcubr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ncorlqi] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [difnmua] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ukhknvm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kuyrfpr] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xnwbmgo] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [vqqppiq] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cxhqxcp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [hvvnnjg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ieggmmv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [skvnbee] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nyfutol] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [juwciax] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [akaihvh] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [qbrqprv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bypfnqe] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [cmctpkf] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xottyou] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [esoeetp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ghkegsg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [lbxkrnn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ildrtdn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xqqtgbi] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ubqfxfa] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [dlvbslu] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [npuelnn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [sscheey] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [icaxbml] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [gogneog] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bxeiqav] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nxcnffm] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [idbgqtq] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [uumkamn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [bctxamy] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [xcvbkxu] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [nmminnd] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ferrqiw] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [fjmsbfk] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ypdcikc] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [qqxfvjt] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jajxayn] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rxwyymv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [kyxmllk] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jdwnamb] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rhoyajv] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [rawxdni] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [sumspgt] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [pycixui] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ynlgbwp] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [whoolcy] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [jqrxdbg] c:\winnt\ubwgnal.exe
O4 - HKCU\..\Run: [ujmdaka] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [lcudapm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tlqjavq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vkflotp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ptolmex] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mxtgbiy] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iitelmp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qippkwk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nnlynus] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gigflbf] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [fsfvlxt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xrxodkx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wkkdnpu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ngxnlpw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ndfasgg] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [kwewamh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [sbnnhhd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ahgcyye] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [grwqvci] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nbupqlw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [selwhqa] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cdvqoty] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [brhuqxf] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yxftxnb] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [epnyuyh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [hsuxuij] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wfahbva] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [oqmgmgm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [anlfjna] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [damrlap] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yknsilv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vjkcsod] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wqteblu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yrbrswv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mncvxca] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [dlfvlcj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ielxvvx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [svehtpm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ovwjdmw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bvpqysl] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xwoyjli] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xhqyfsp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [lqhuyql] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xewdamq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rleifgd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ookpies] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gkfauam] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jfvbtup] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ifsdpsu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gfipcgj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jkcnnaw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rvcwabw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rdligdo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iecujru] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nvtugyc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [uifehlm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [eguvvka] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [utfiwjt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yvlfodq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [prypabe] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ieuucei] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bucxywl] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yepwmdo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cptbakk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [jdsplbc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [obiohve] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xaigrwh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [smbgphv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xgpobhv] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ucnksgp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bebpqow] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yaqmitb] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qbcqwau] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [efwbmho] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tqfhaae] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [nrkwbnm] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [dnusqep] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vfkxyii] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ggcswkh] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wftsxwg] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ncqyxkd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [foelvlo] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [axllenr] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cojkpma] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tketlwk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [iduxgxt] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [tatqgry] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [eywefyc] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [hwvpgpp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [vvfgblj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [ybtrgrw] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [xoqcvfk] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [aduuatx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [mwslwgd] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [swtmtsj] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [qcpbrvs] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [recvnxu] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [cibetvp] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rxpqons] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [bgdmlct] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wlotayx] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [gqwsgym] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wytigdq] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [yuddpom] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [grggnnr] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [icodywi] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [wbqcxor] c:\winnt\lqgpoud.exe
O4 - HKCU\..\Run: [rjsrphq] c:\winnt\prcwokf.exe
O4 - HKCU\..\Run: [djvrfjx] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [micovsb] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [vcreubl] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [wyhqrck] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [oiakaxh] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bikfexr] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [waccjlq] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [vevdpqq] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [reohtss] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [xxkfaam] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [djngkcf] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [hcqfbkj] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bmdqjqw] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [jvqghec] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bxupljw] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [nstncse] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [cowxdsh] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [sontrtp] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [hldkxtu] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [pmqvrnm] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [xfrxush] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [umiqkrk] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ycbocro] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [buhhkgv] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [auetdtw] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ylfenng] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [tjekrgh] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [idbkoiu] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [bxpywtp] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [rsjrwni] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [qefuauy] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [odyuuti] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [pbkxoon] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [aaayqpp] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [risimil] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [gltxldq] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [jqellxe] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [vesnfut] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [benacnd] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ykhhfav] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [tqdemju] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ttpquxv] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [ctifwvv] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [kjntqkx] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [kaimrwk] c:\winnt\sqiidhc.exe
O4 - HKCU\..\Run: [tehlbbn] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [plejgfn] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [iwkonsp] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bytvrog] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [umykcmu] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [qxtpsgo] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [jojrbsk] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bfbkgoe] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [lblmkrd] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [tuxufwm] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bhrbaar] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [wkeaiuv] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bikypke] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [flfsupb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bxibiec] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ajalxfs] c:\winnt\dexptjj.exe
~~~Continued next post~~~

alsocom

Post #9July 26, 2005, 12:35 AM UTC

~~~Continued~~~

O4 - HKCU\..\Run: [etgults] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [rtvjqae] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [jjhqvur] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ssasmmr] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [rhsrvnb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [gddhmvs] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [vdgniqv] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bjoobrh] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ejlunth] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [dwerjha] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [epmobor] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [biovtor] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bkrperb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [nwgkfll] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [mmytxkd] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ctgnkbc] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [kebjyft] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ypvuwji] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ulgijti] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ylttbyv] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [auifbcj] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xjdbqfr] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [mhnelhx] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [hjbjiiw] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [gxjqgex] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [iayrlqx] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [skaqvep] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xtsnqmx] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [kkyblhj] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [ltsvqxb] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [nexofcp] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [noufjdf] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [sawtqei] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [inhebvh] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [wiwufec] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xxccdeq] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [qpxlgqt] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bjwpffp] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [bahtaqa] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [uhqsigu] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [cpemmmg] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [cnmegsi] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [apmpjpo] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [homiigf] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [xavfsgm] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [tjohlyo] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [pkpljcf] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [trigglg] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [eawwvks] c:\winnt\dexptjj.exe
O4 - HKCU\..\Run: [rdsaevm] c:\winnt\dexptjj.exe

With all other programs and browsers closed, click fix checked.

Step 2
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread.
Please let us know of any complications you had and how the computer is behaving.

BuuDDha

Post #10July 26, 2005, 2:43 AM UTC

ok i did everything you said any my comp seems to be working just fine. i need to open a game to see if the cpu problem was solved but i am guessing that it works. the new hijackthislog looks a lot better to me…

Logfile of HijackThis v1.99.1
Scan saved at 7:38:46 PM, on 7/25/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Dit.exe
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\htpatch.exe
C:\WINNT\System32\khooker.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\AIM\aim.exe
C:\WINNT\System32\ctfmon.exe
C:\WINNT\DitExp.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\wuauclt.exe
C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe
C:\Documents and Settings\Dan Osborn\Desktop\Merijn.org stuff\HijackThis1991.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\System32\ctfmon.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1101546546012
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {FCC56E79-0FA2-4969-9164-06F140763455} (ActiveFormX Control) - http://klikw.com/awd/cabs/10110.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

thanks again….

alsocom

Post #11July 26, 2005, 3:47 AM UTC

This is the first time that I could not fit a fix in one post.

Your new log appears clean.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.

MOST IMPORTANT: You Need to Update Windows and IE to get all the Latest Security Patches to protect your computer from the malware that is on the internet.
I recommend going to the following link and update to SP2. This adds more security and extra features including a pop-up blocker for Internet Explorer.
Microsoft Windows and Internet Explorer Updates

Here is a great link that explains the procedure for updating to SP2 with less complications (scroll down to the second post).

I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Here are two very good and free malware scanners:

Spybot Search and Destroy 1.4
AdAware SE v1.06
Set-up Instructions for Spybot S&D; and Adaware SE

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.

alsocom

Post #12July 28, 2005, 9:28 AM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

hikack this log please help

✨ Ask AI

Ask AI