BleepingComputer.com: log file Goya

Thanks grinler !!

Goya, welcome.

Please print this out and follow ALL these directions carefully.

This is a new CoolWebSearch (CWS) hijack infection and is hard to remove.
http://www.silentrunners.org/sr_cwsremoval.html

Note: Every time you reboot the files multiply and change names. This process is like exterminating cockroaches.

If you insist on running file (music) sharing applications like KaZaa then you will continually be infected by all kinds of nasties in the downloaded files.
This is the new prefered method of virus/worm/trojan spreaders to get into your system and there will be no detection nor removal capability for days/weeks.
The spreaders count on this time to do their nastieness and create new nasties that are not detected.

Go to Add/Remove Programs and uninstall it.

Please download the tool called about:buster from
http://www.downloads.subratam.org/AboutBuster.zip
or
http://www.majorgeeks.com/download4289.html

Unzip it to your desktop.

In WinME/XP turn off System Restore.
http://www.arnoldco.com/help/html/disable_restore.html

Then reboot into Safe Mode by tapping F8 key repeatedly during bootup.

Enable System Restore after the infection is removed.

Double click aboutbuster.exe, click OK, click Start, then click OK.
This will scan your computer for the bad files and delete them.

Now start Hijack this and tick the boxes next to these items.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nqwlb.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nqwlb.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://C:\WINDOWS\system32\nqwlb.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://C:\WINDOWS\system32\nqwlb.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\nqwlb.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\nqwlb.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\nqwlb.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://C:\WINDOWS\system32\nqwlb.dll/index.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nqwlb.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\nqwlb.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {489CB8A5-F200-EAC7-EB4D-CADBFD62480E} - C:\WINDOWS\mfcak32.dll
O4 - HKLM\..\Run: [iegx32.exe] C:\WINDOWS\system32\iegx32.exe
O4 - HKLM\..\Run: [KAZAA] C:\Program Files\kazaa\kazaa.exe /SYSTRAY
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

Now close ALL windows and hit fix checked.
Do not open internet explorer to come back here until after running the tool.

Install the prevention protection below and help your friends from being infected on the Internet.

Empty the Recycle Bin.

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there.
Index.dat Suite helps with this.
http://support.it-mate.co.uk/?mode=Products&p=index.datsuite

Insure that Index.dat Suite is Setup to empty the Temp folders especially
C:\Documents and Settings\{user}\Local Settings\Temp
then run the Find and create the run.bat and reboot to have it remove what it finds.

{user} is the User Account ID.
Removal of infections and prevention protection should be installed on ALL User Account IDS.

Download and install WinPatrol.
http://www.winpatrol.com

Browser settings for increased security:
http://bshagnasty.home.att.net/browsersettings.htm

Install IE-SPYAD then run the install.bat in the ie-spyad folder and SpywareBlaster then keep them up to date as today's Internet is full of nasty infections.
https://netfiles.uiuc.edu/ehowes/www/resource.htm#IESPYAD
http://www.javacoolsoftware.com/spywareblaster.html