What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Co-Workers Computer

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi Guys,

You helped me out back in March, so I hope you can help me to fix a co-workers pc.
Here is the log file from the latest scan.

Logfile of HijackThis v1.99.1
Scan saved at 8:04:13 PM, on 10/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Jorge Cruz\Desktop\HijackThis.exe

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {1C044AAD-7955-4cbd-8175-501A165C4E5D} - C:\WINDOWS\System32\req.dat
O2 - BHO: (no name) - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe"
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [YoqtRXYFi] lmripto.exe
O4 - HKCU\..\Run: [yndeyyh] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [ynbiabf] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [ymdbkdj] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ymamaqb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [yheyocw] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [yhcnpfm] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [ycbpvhs] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [yanonio] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xuhmqhl] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [xtjlhmv] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [xsweudx] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [xpmobbh] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [xpenuhx] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [xoxxcxs] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [xoswokc] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [xmicljt] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [xlwcjpt] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xkcprkt] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [xjcmiku] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [xfunyfg] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xdahdsb] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [xbndluw] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [xbhfkqf] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [wykwfsi] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wwveqvx] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [wwmpfkk] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wwmeqxn] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wvxmvrd] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [wuarrgf] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [wtcsgex] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [wryakrb] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wrvenqg] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wrsipgx] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [wrdlxng] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [wqleuto] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [woyjmfn] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wnfhuln] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [wmuhksl] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [wmamfnb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [wkmlwld] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wjtpixi] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wjnobbo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wehifgm] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [wcicdqr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [wcchrwr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wbtukga] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vxqovog] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [vuwwuro] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vjquxkm] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [viyndoq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [vgtuiqu] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [vgfprom] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [veiryyt] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vdtxryw] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [vappsgm] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [uvsymiq] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [uuxjvqb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [uuuqbpy] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [usncsgo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [upadhxt] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [uovqjqn] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [uoiiubt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [unwqysl] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [uhyfmsq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ugcgyxe] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [ufawgot] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ucskkvr] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [uccldpy] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ubxeppo] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [tykxncx] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [txoyttl] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [twmoovk] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [twhxned] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [twchsbu] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [tqgmcev] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [toffeni] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [tnnpgue] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [tgmewhr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [tcxjpch] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [tbyklfj] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [srnqwon] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [srdavyo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [sqsdvix] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [spnxwjj] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [spgbjxu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [spagmof] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sousuad] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [somxloj] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [sodytdf] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sljeeci] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sjbjunh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [shqchlx] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [sgfbklv] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [sdwyqxg] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [scvjskv] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [rykckud] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [rxpkmxq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rxopfvg] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rtmepuq] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [rqkkepb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [rmkcpvw] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [rkkktwq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rjnijeq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [rjjhrlt] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [rgyemqj] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [renqtii] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [rcwpvvk] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [qxsnvhu] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [qtnkbwp] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [qshwgye] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [qrslyfe] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [qqqjjrj] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [qldaxxq] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [qkyhlxi] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [qkxrsht] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [qkompfh] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [qjrigel] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [qjmcbwo] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [qelwmji] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [qcaoklo] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [pvtgrue] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [pvinxig] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [pvggjcl] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [puxfaqr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ppyphuc] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [pljxjbi] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [pinuxfw] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [phlcutf] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [pguquyo] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [pdytobi] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pdykqba] c:\windows\fvqhiyv.exe
O4 - HKCU\..\Run: [pcwcwvb] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pchxxng] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pcapaiq] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [oymewma] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [oxmrrbk] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [oxhveic] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [ovpikkp] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [ovkutyn] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [orlvpbh] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [omlpkqi] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ojkvioa] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ofhmdog] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [oednahv] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [odjvhti] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [oaekupe] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [nwquqpo] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [nsppnji] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [nsgefbv] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [nrircql] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [noglnsx] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [nlyrktk] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [njfmckx] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [nguwqid] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [nfnwvdb] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [nfgypkx] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [nclhtbi] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [nahotmr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [nadysyg] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [mvvexqx] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [mvqssnf] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [muvchoo] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [mldwgbc] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [mghjjpp] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [mfaqytp] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [mengvtu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [mdinhcb] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [mdbekai] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lvdjgov] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [lvbkkqa] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [luvsojg] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [lqmxery] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [lprnirs] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [loiafnf] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lohvbrk] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ljrupbi] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [livmvbp] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [lccetvs] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lbseuon] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kxsqagc] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kwyhsgi] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [kwogoui] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [kvytlfb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [kvuydqu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [kvsfbdn] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kuonpcf] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ktqowbv] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [krswgpp] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [krffdlk] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [komowlh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [knsbtya] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [kmdcjaw] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kleafba] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kjbudin] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [kiogvpb] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [kfguasr] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [keykyfr] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [kbyacly] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kbvwknu] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [jxdpoxf] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [jvldygo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [juvsjbk] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [jusjgvh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [jubncfo] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [jtuuysv] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [jsrwnqj] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [jdrgudl] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [iwepatw] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [iwcvdds] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [itfecfq] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [iqwvpsa] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [inmeouo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [imldxgl] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ihndati] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [ifhxjdl] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [idausve] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ibmdxwm] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hxrxssg] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [hwyxwiy] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [hwybvgf] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [httrnnr] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [hrqufwd] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [hrcjgqk] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [hqufcls] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [hpeslca] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hpbkcjd] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [hpalpsc] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hoclatj] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [hkhppow] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [hgfybam] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hefjeel] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [hcslomn] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [gyytvbd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [gxoidih] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gsxhuwe] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [gslxrlt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [greaiwb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [gqucnms] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gqkfhvk] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gqjxdof] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [gqioxxr] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [gqbtuky] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [gowxqbd] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [ginasmr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [ghwwprg] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [gggwoth] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [gbogbrj] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [gauaqul] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [fyojjpq] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [fvqlplq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [fsfudyg] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [frfabib] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [frapxiu] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [fqxljbc] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [fqgovty] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [fnnofmn] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [fmrilgd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [flagvrg] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [fgkslmr] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [feouytb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [fbktmew] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [favnbeq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [eyxkaao] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [eylrwxr] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [evyahrs] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [eqctido] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [enchals] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [ekiunps] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [ekbvcvv] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ehdicxo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [efarabd] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [dthxpgk] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [dsxgbdi] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [dqcmktn] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [dmphmqu] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [dikglyv] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [dcyxuvp] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [dcgwmee] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [dcdortl] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [daohwpk] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [dakvvtt] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [dadomrd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [cvpqvmn] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [cvnuuvd] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [ctcvqqt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [crjqwba] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [cppxeyf] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [cmrhxkr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [clbcdlv] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [ckryndt] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [cfvungr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [cfrtsku] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [cetqoyq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [byehsft] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [bxpflkm] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [bwbrfne] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [bsqcluu] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [bqotuut] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [bpbjrow] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [bmuyccr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [bmsuakt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [bmitwef] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [blmdrhi] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [bkqpnkr] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [bkkvfiq] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [bjspeqs] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [bidylil] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [bcepuks] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [avvropf] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [avrthcq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [avqoqom] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [avexltm] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [arqjqsm] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [almpqll] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [aimftlj] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [aijjtam] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [aieqfwb] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [agvnbvb] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [afugapc] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [abfcvei] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0g\aoltray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.4.2) -
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: req - C:\WINDOWS\System32\req.dat
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Loading Outpost Connections (KDE) - Unknown owner - C:\WINDOWS\System32\cmdtel.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2
We are sorry for the delay in replying to you. Since that log is more than a week old, please Post a fresh Hijackthis log as a reply to this thread. I'll receive an e-mail notification of your reply and will respond as soon as possible. Thank you for your patience.
Post #3
Hi,

Here is the new HJT log file you asked for. Thank you in advance for helping me.

Frank


Logfile of HijackThis v1.99.1
Scan saved at 4:39:43 PM, on 10/23/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\WINDOWS\system32\BacsTray.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\America Online 9.0g\aoltray.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\My Downloads\HijackThis.exe

O2 - BHO: (no name) - {1C044AAD-7955-4cbd-8175-501A165C4E5D} - C:\WINDOWS\System32\req.dat
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - HKCU\..\Run: [YoqtRXYFi] lmripto.exe
O4 - HKCU\..\Run: [yndeyyh] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [ynbiabf] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [ymdbkdj] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ymamaqb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [yheyocw] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [yhcnpfm] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [ycbpvhs] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [yanonio] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xuhmqhl] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [xtjlhmv] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [xsweudx] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [xpmobbh] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [xpenuhx] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [xoxxcxs] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [xoswokc] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [xmicljt] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [xlwcjpt] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xkcprkt] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [xjcmiku] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [xfunyfg] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xdahdsb] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [xbndluw] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [xbhfkqf] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [wykwfsi] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wwveqvx] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [wwmpfkk] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wwmeqxn] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wvxmvrd] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [wuarrgf] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [wtcsgex] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [wryakrb] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wrvenqg] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wrsipgx] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [wrdlxng] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [wqleuto] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [woyjmfn] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wnfhuln] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [wmuhksl] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [wmamfnb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [wkmlwld] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wjtpixi] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wjnobbo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wehifgm] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [wcicdqr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [wcchrwr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wbtukga] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vxqovog] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [vuwwuro] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vjquxkm] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [viyndoq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [vgtuiqu] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [vgfprom] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [veiryyt] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vdtxryw] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [vappsgm] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [uvsymiq] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [uuxjvqb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [uuuqbpy] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [usncsgo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [upadhxt] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [uovqjqn] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [uoiiubt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [unwqysl] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [uhyfmsq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ugcgyxe] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [ufawgot] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ucskkvr] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [uccldpy] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ubxeppo] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [tykxncx] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [txoyttl] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [twmoovk] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [twhxned] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [twchsbu] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [tqgmcev] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [toffeni] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [tnnpgue] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [tgmewhr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [tcxjpch] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [tbyklfj] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [srnqwon] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [srdavyo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [sqsdvix] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [spnxwjj] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [spgbjxu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [spagmof] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sousuad] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [somxloj] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [sodytdf] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sljeeci] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sjbjunh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [shqchlx] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [sgfbklv] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [sdwyqxg] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [scvjskv] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [rykckud] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [rxpkmxq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rxopfvg] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rtmepuq] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [rqkkepb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [rmkcpvw] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [rkkktwq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rjnijeq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [rjjhrlt] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [rgyemqj] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [renqtii] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [rcwpvvk] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [qxsnvhu] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [qtnkbwp] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [qshwgye] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [qrslyfe] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [qqqjjrj] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [qldaxxq] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [qkyhlxi] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [qkxrsht] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [qkompfh] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [qjrigel] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [qjmcbwo] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [qelwmji] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [qcaoklo] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [pvtgrue] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [pvinxig] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [pvggjcl] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [puxfaqr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ppyphuc] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [pljxjbi] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [pinuxfw] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [phlcutf] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [pguquyo] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [pdytobi] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pdykqba] c:\windows\fvqhiyv.exe
O4 - HKCU\..\Run: [pcwcwvb] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pchxxng] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pcapaiq] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [oymewma] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [oxmrrbk] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [oxhveic] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [ovpikkp] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [ovkutyn] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [orlvpbh] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [omlpkqi] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ojkvioa] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ofhmdog] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [oednahv] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [odjvhti] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [oaekupe] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [nwquqpo] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [nsppnji] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [nsgefbv] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [nrircql] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [noglnsx] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [nlyrktk] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [njfmckx] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [nguwqid] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [nfnwvdb] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [nfgypkx] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [nclhtbi] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [nahotmr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [nadysyg] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [mvvexqx] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [mvqssnf] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [muvchoo] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [mldwgbc] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [mghjjpp] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [mfaqytp] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [mengvtu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [mdinhcb] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [mdbekai] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lvdjgov] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [lvbkkqa] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [luvsojg] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [lqmxery] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [lprnirs] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [loiafnf] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lohvbrk] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ljrupbi] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [livmvbp] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [lccetvs] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lbseuon] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kxsqagc] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kwyhsgi] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [kwogoui] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [kvytlfb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [kvuydqu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [kvsfbdn] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kuonpcf] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ktqowbv] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [krswgpp] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [krffdlk] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [komowlh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [knsbtya] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [kmdcjaw] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kleafba] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kjbudin] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [kiogvpb] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [kfguasr] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [keykyfr] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [kbyacly] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kbvwknu] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [jxdpoxf] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [jvldygo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [juvsjbk] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [jusjgvh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [jubncfo] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [jtuuysv] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [jsrwnqj] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [jdrgudl] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [iwepatw] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [iwcvdds] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [itfecfq] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [iqwvpsa] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [inmeouo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [imldxgl] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ihndati] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [ifhxjdl] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [idausve] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ibmdxwm] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hxrxssg] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [hwyxwiy] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [hwybvgf] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [httrnnr] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [hrqufwd] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [hrcjgqk] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [hqufcls] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [hpeslca] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hpbkcjd] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [hpalpsc] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hoclatj] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [hkhppow] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [hgfybam] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hefjeel] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [hcslomn] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [gyytvbd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [gxoidih] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gsxhuwe] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [gslxrlt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [greaiwb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [gqucnms] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gqkfhvk] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gqjxdof] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [gqioxxr] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [gqbtuky] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [gowxqbd] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [ginasmr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [ghwwprg] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [gggwoth] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [gbogbrj] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [gauaqul] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [fyojjpq] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [fvqlplq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [fsfudyg] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [frfabib] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [frapxiu] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [fqxljbc] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [fqgovty] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [fnnofmn] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [fmrilgd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [flagvrg] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [fgkslmr] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [feouytb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [fbktmew] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [favnbeq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [eyxkaao] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [eylrwxr] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [evyahrs] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [eqctido] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [enchals] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [ekiunps] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [ekbvcvv] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ehdicxo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [efarabd] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [dthxpgk] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [dsxgbdi] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [dqcmktn] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [dmphmqu] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [dikglyv] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [dcyxuvp] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [dcgwmee] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [dcdortl] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [daohwpk] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [dakvvtt] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [dadomrd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [cvpqvmn] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [cvnuuvd] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [ctcvqqt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [crjqwba] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [cppxeyf] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [cmrhxkr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [clbcdlv] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [ckryndt] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [cfvungr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [cfrtsku] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [cetqoyq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [byehsft] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [bxpflkm] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [bwbrfne] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [bsqcluu] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [bqotuut] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [bpbjrow] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [bmuyccr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [bmsuakt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [bmitwef] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [blmdrhi] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [bkqpnkr] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [bkkvfiq] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [bjspeqs] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [bidylil] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [bcepuks] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [avvropf] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [avrthcq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [avqoqom] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [avexltm] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [arqjqsm] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [almpqll] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [aimftlj] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [aijjtam] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [aieqfwb] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [agvnbvb] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [afugapc] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [abfcvei] c:\windows\dfhgxmt.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0g\aoltray.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.4.2) -
O20 - Winlogon Notify: req - C:\WINDOWS\System32\req.dat
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Loading Outpost Connections (KDE) - Unknown owner - C:\WINDOWS\System32\cmdtel.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #4
Step 1
I need you to disable SpySweeper until after the computer is clean as it will interfere with the registry changes we will need to do.
  • Open SpySweeper click > Options over to the left then > program options > Uncheck "load at windows startup".
  • Over to the left click "shields" and uncheck all there.
  • Uncheck "home page shield".
  • Uncheck 'automatically restore default without notification".
  • Close the program
Step 2
Click here to download Killbox by Option^Explicit.
Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
In the killbox program, select the Replace on Reboot option and place a check in the box for Use Dummy.
In the field labeled Full Path of File to Delete enter the file paths listed below ONE AT A TIME (EXACTLY as it appears, please double check to make sure!):

C:\WINDOWS\System32\req.dat

Press the button that looks like a red circle with a white X in it after each one. When it asks if you would like to delete on reboot, press the YES button, when it asks if you want to reboot now, press the NO button. Do this after each one until you have entered the LAST file path I have listed above. After that LAST file path has been entered, press the YES button at both prompts so that your computer restarts.
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.


Step 3
After the computer reboots scan with Hijackthis and check the following:

O2 - BHO: (no name) - {1C044AAD-7955-4cbd-8175-501A165C4E5D} - C:\WINDOWS\System32\req.dat

O4 - HKCU\..\Run: [YoqtRXYFi] lmripto.exe
O4 - HKCU\..\Run: [yndeyyh] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [ynbiabf] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [ymdbkdj] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ymamaqb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [yheyocw] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [yhcnpfm] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [ycbpvhs] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [yanonio] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xuhmqhl] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [xtjlhmv] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [xsweudx] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [xpmobbh] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [xpenuhx] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [xoxxcxs] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [xoswokc] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [xmicljt] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [xlwcjpt] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xkcprkt] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [xjcmiku] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [xfunyfg] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [xdahdsb] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [xbndluw] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [xbhfkqf] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [wykwfsi] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wwveqvx] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [wwmpfkk] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wwmeqxn] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wvxmvrd] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [wuarrgf] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [wtcsgex] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [wryakrb] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wrvenqg] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wrsipgx] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [wrdlxng] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [wqleuto] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [woyjmfn] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wnfhuln] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [wmuhksl] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [wmamfnb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [wkmlwld] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [wjtpixi] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [wjnobbo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wehifgm] c:\windows\rbkglrw.exe
O4 - HKCU\..\Run: [wcicdqr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [wcchrwr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [wbtukga] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vxqovog] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [vuwwuro] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vjquxkm] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [viyndoq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [vgtuiqu] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [vgfprom] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [veiryyt] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [vdtxryw] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [vappsgm] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [uvsymiq] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [uuxjvqb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [uuuqbpy] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [usncsgo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [upadhxt] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [uovqjqn] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [uoiiubt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [unwqysl] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [uhyfmsq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ugcgyxe] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [ufawgot] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ucskkvr] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [uccldpy] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ubxeppo] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [tykxncx] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [txoyttl] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [twmoovk] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [twhxned] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [twchsbu] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [tqgmcev] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [toffeni] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [tnnpgue] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [tgmewhr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [tcxjpch] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [tbyklfj] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [srnqwon] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [srdavyo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [sqsdvix] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [spnxwjj] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [spgbjxu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [spagmof] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sousuad] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [somxloj] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [sodytdf] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sljeeci] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [sjbjunh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [shqchlx] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [sgfbklv] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [sdwyqxg] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [scvjskv] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [rykckud] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [rxpkmxq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rxopfvg] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rtmepuq] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [rqkkepb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [rmkcpvw] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [rkkktwq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [rjnijeq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [rjjhrlt] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [rgyemqj] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [renqtii] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [rcwpvvk] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [qxsnvhu] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [qtnkbwp] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [qshwgye] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [qrslyfe] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [qqqjjrj] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [qldaxxq] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [qkyhlxi] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [qkxrsht] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [qkompfh] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [qjrigel] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [qjmcbwo] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [qelwmji] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [qcaoklo] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [pvtgrue] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [pvinxig] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [pvggjcl] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [puxfaqr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ppyphuc] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [pljxjbi] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [pinuxfw] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [phlcutf] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [pguquyo] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [pdytobi] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pdykqba] c:\windows\fvqhiyv.exe
O4 - HKCU\..\Run: [pcwcwvb] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pchxxng] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [pcapaiq] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [oymewma] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [oxmrrbk] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [oxhveic] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [ovpikkp] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [ovkutyn] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [orlvpbh] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [omlpkqi] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [ojkvioa] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ofhmdog] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [oednahv] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [odjvhti] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [oaekupe] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [nwquqpo] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [nsppnji] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [nsgefbv] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [nrircql] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [noglnsx] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [nlyrktk] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [njfmckx] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [nguwqid] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [nfnwvdb] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [nfgypkx] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [nclhtbi] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [nahotmr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [nadysyg] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [mvvexqx] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [mvqssnf] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [muvchoo] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [mldwgbc] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [mghjjpp] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [mfaqytp] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [mengvtu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [mdinhcb] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [mdbekai] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lvdjgov] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [lvbkkqa] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [luvsojg] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [lqmxery] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [lprnirs] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [loiafnf] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lohvbrk] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ljrupbi] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [livmvbp] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [lccetvs] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [lbseuon] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kxsqagc] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kwyhsgi] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [kwogoui] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [kvytlfb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [kvuydqu] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [kvsfbdn] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kuonpcf] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [ktqowbv] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [krswgpp] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [krffdlk] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [komowlh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [knsbtya] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [kmdcjaw] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [kleafba] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kjbudin] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [kiogvpb] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [kfguasr] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [keykyfr] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [kbyacly] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [kbvwknu] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [jxdpoxf] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [jvldygo] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [juvsjbk] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [jusjgvh] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [jubncfo] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [jtuuysv] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [jsrwnqj] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [jdrgudl] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [iwepatw] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [iwcvdds] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [itfecfq] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [iqwvpsa] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [inmeouo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [imldxgl] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [ihndati] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [ifhxjdl] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [idausve] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ibmdxwm] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hxrxssg] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [hwyxwiy] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [hwybvgf] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [httrnnr] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [hrqufwd] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [hrcjgqk] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [hqufcls] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [hpeslca] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hpbkcjd] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [hpalpsc] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hoclatj] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [hkhppow] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [hgfybam] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [hefjeel] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [hcslomn] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [gyytvbd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [gxoidih] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gsxhuwe] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [gslxrlt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [greaiwb] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [gqucnms] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gqkfhvk] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [gqjxdof] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [gqioxxr] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [gqbtuky] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [gowxqbd] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [ginasmr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [ghwwprg] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [gggwoth] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [gbogbrj] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [gauaqul] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [fyojjpq] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [fvqlplq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [fsfudyg] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [frfabib] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [frapxiu] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [fqxljbc] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [fqgovty] c:\windows\ygyrlfx.exe
O4 - HKCU\..\Run: [fnnofmn] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [fmrilgd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [flagvrg] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [fgkslmr] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [feouytb] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [fbktmew] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [favnbeq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [eyxkaao] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [eylrwxr] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [evyahrs] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [eqctido] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [enchals] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [ekiunps] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [ekbvcvv] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [ehdicxo] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [efarabd] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [dthxpgk] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [dsxgbdi] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [dqcmktn] c:\windows\gurauve.exe
O4 - HKCU\..\Run: [dmphmqu] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [dikglyv] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [dcyxuvp] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [dcgwmee] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [dcdortl] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [daohwpk] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [dakvvtt] c:\windows\tgndnqm.exe
O4 - HKCU\..\Run: [dadomrd] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [cvpqvmn] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [cvnuuvd] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [ctcvqqt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [crjqwba] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [cppxeyf] c:\windows\icafyyt.exe
O4 - HKCU\..\Run: [cmrhxkr] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [clbcdlv] c:\windows\ngbhsxj.exe
O4 - HKCU\..\Run: [ckryndt] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [cfvungr] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [cfrtsku] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [cetqoyq] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [byehsft] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [bxpflkm] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [bwbrfne] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [bsqcluu] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [bqotuut] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [bpbjrow] c:\windows\scpgywk.exe
O4 - HKCU\..\Run: [bmuyccr] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [bmsuakt] c:\windows\fittjfd.exe
O4 - HKCU\..\Run: [bmitwef] c:\windows\vxwlamr.exe
O4 - HKCU\..\Run: [blmdrhi] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [bkqpnkr] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [bkkvfiq] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [bjspeqs] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [bidylil] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [bcepuks] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [avvropf] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [avrthcq] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [avqoqom] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [avexltm] c:\windows\orvmxfl.exe
O4 - HKCU\..\Run: [arqjqsm] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [almpqll] c:\windows\ncuhhqi.exe
O4 - HKCU\..\Run: [aimftlj] c:\windows\slhpdcf.exe
O4 - HKCU\..\Run: [aijjtam] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [aieqfwb] c:\windows\dfhgxmt.exe
O4 - HKCU\..\Run: [agvnbvb] c:\windows\ptklujl.exe
O4 - HKCU\..\Run: [afugapc] c:\windows\sgvbtnu.exe
O4 - HKCU\..\Run: [abfcvei] c:\windows\dfhgxmt.exe

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.4.2) -

O20 - Winlogon Notify: req - C:\WINDOWS\System32\req.dat

O23 - Service: Loading Outpost Connections (KDE) - Unknown owner - C:\WINDOWS\System32\cmdtel.exe (file missing)

With all other programs and browsers closed, click Fix checked.


Step 4
Still in Hijackthis, click Config -> Misc Tools -> Delete an NT service.
In the Delete window, type KDE and press OK.
OK any prompts, close HijackThis, and restart your computer.


Step 5
Please download the trial version of Ewido security suite.

Install and Update Ewido:
  • Download and install Ewido security suite.
  • When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  • Launch Ewido, there should be an icon on your desktop for it to double-click.
  • You will need to update ewido to the latest definition files.
    • On the left hand side of the main screen click update.
    • Click on Start Update.
    • The update will start and a progress bar will show the updates being installed.
  • Once the updates are installed, close the program.
Scanning With Ewido:
  • Reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter').
  • Launch Ewido again.
    • Click on scanner
    • Click on Complete System Scan and the scan will begin.
    • While the scan is in progress you will be prompted to clean files, click OK
    • When it asks if you want to clean the first file, put a check in the lower left corner of the boxes that say "Perform action on all infections"and "Create encrypted backup" then choose clean and click OK.
    • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
    • Click Save report.
    • Save the report.txt file to your desktop.
  • Now close ewido security suite.
Step 6
Reboot normally and scan with HijackThis. Post the new log as a reply to this thread. Include the Ewido report.
Let us know how the computer is working now.
Post #5
Things are getting better but still not right. I think something is wrong with EZ Trust Armor program it won't let me update Norton Live update or downlaod anything unless I shut it down. Computer still takes a long time to start up maybe to many programs set to start with Windows start up.
Here are the two logs you asked for , Thanks again.

Logfile of HijackThis v1.99.1
Scan saved at 8:52:57 PM, on 10/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\WINDOWS\system32\BacsTray.exe
C:\Program Files\America Online 9.0g\aoltray.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\My Downloads\HijackThis.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0g\aoltray.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Loading Outpost Connections (KDE) - Unknown owner - C:\WINDOWS\System32\cmdtel.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


———————————————————
ewido security suite - Scan report
———————————————————

+ Created on: 12:04:48 AM, 10/24/2005
+ Report-Checksum: 5579BA81

+ Scan result:

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\ins -> Spyware.WebRebates : Cleaned with backup
C:\My Downloads\backups\backup-20051016-030906-637.dll -> Backdoor.Eiaf : Cleaned with backup
C:\My Downloads\backups\backup-20051016-130405-694.dll -> Backdoor.Eiaf : Cleaned with backup
C:\My Downloads\backups\backup-20051016-222154-764.dll -> Backdoor.Eiaf : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\6A57C5F4-C2DA-48E7-8BE9-CFC228\4C225320-F562-44AA-8C0E-A65FAF -> Backdoor.Eiaf : Cleaned with backup
C:\Program Files\Microsoft AntiSpyware\Quarantine\F2699C44-0B13-42B8-AD28-DE601F\709BC595-C245-40C7-AA52-7A31EF -> Backdoor.Eiaf : Cleaned with backup
C:\RECYCLER\NPROTECT\00010934 -> Spyware.NewDotNet : Cleaned with backup
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP4\A0002060.EXE -> Spyware.Suggestor : Cleaned with backup
C:\WINDOWS\SYSTEM32\27.exe -> TrojanDropper.Small.sc : Cleaned with backup
C:\WINDOWS\SYSTEM32\Eprocessing_TdOm3IC.exe -> TrojanDropper.Small.sc : Cleaned with backup
C:\WINDOWS\SYSTEM32\exact.dll -> TrojanDownloader.Miewer.a : Cleaned with backup
C:\WINDOWS\SYSTEM32\midad.dll -> TrojanDownloader.Miewer.a : Cleaned with backup
C:\WINDOWS\SYSTEM32\oins.exe -> Spyware.MediaTickets : Cleaned with backup
C:\WINDOWS\SYSTEM32\req#2.dat -> Backdoor.Eiaf : Cleaned with backup
C:\WINDOWS\SYSTEM32\tvnew.dll -> TrojanDropper.Miewer.a : Cleaned with backup


::Report End
Post #6
Just one bad item still remaining in the new log.

Disable the offending Service
  • Click Start < Run and type services.msc.
  • Scroll down to Loading Outpost Connections and right click on it.
  • Click Properties and under Service Status click Stop, then under Startup Type change it to Disabled.
Delete the offending Service
  • Open HijackThis and click Config -> Misc Tools -> Delete an NT service.
  • In the Delete window, type KDE and press OK.
  • OK any prompts, close HijackThis, and restart your computer.

Open HijackThis and click config than on the misc tools tab, select delete a file on reboot. Paste the bold text into the file name box and click open.

C:\WINDOWS\System32\cmdtel.exe

When it asks you to reboot, choose yes.



Download CCleaner to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • Click Options < Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  • Click Run Cleaner to run the program.
  • After it has completed it's process, click Exit.
Caution : It is not recommended to use the 'Issues' tab as it is known to find legitimate items.


Reboot the computer one more time and run a scan with HijackThis. Post the new log as a reply to this thread.
Post #7
Well it looks like we have cleaned up all the bugs. But the ather things I mentioned the last time are still happening. Takes a long time to get everything started up and EZ Armor seems to block alot of things I should be able to access. EZ Amor uses Zone Alam for it's firewall protection and seeing as how I have been using Zone Alarm as a stand alone firewll for many years I don't know why it's acting that way. Any insight would be appreciated.

Frank

Logfile of HijackThis v1.99.1
Scan saved at 9:47:41 PM, on 10/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe —- What Are These Two Entries for??? Frank
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\WINDOWS\system32\BacsTray.exe
C:\Program Files\America Online 9.0g\aoltray.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\system32\ZoneLabs\isafe.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\snmp.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\My Downloads\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [bacstray] BacsTray.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0g\aoltray.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #8

C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe —- What Are These Two Entries for??? Frank


Here is some information on hkcmd.exe
Here is some information on tfswctrl.exe

I am not great at troubleshooting issues and I do not use either of those programs. You may want to post for help in the Other Computer Problems Forum. Be sure to include a link to this thread so they can see that your computer is clean of malware.


Your new log appears clean. :)

Open Killbox, click File < Delete all Dummy files. Click "Yes" at the prompt and click Exit.


Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.


I suggest that you download these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer. Spyware Blaster runs silently in the background.
ie-spyad - Puts over 12,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - 'Safer' alternative to the Internet Explorer web browser.

Here are two very good and free malware scanners:

Spybot Search and Destroy 1.4
AdAware SE v1.06
Set-up Instructions for Spybot S&D; and Adaware SE

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read the following posts to learn how to better secure your computer.
"So how did I get infected in the first place"
"Securing Your PC After An Attack"

Be sure to keep Windows and your Anti-virus updated.
Post #9
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI