Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Topsearch4u browser hijacker - help needed


  • This topic is locked This topic is locked
5 replies to this topic

#1 McIvan

McIvan

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:31 PM

Posted 22 April 2005 - 02:41 AM

I've been trying to get rid of this pest for the last five days....but the best efforts of AVG, spybot search & destroy, ad-aware, xoftspy (not recommended) and Couterspy (really thought Counterspy got it, but obviously not completely) have all failed.

It is a real resource hog, conflicts with some applications, tries to block all attempts to reset the registry, IE, or reboot in safe mode, and is generally a pain in the ass.

I can see oodles of suspect processes in the log, but I'm not an expert and I could easily go too far. Some expert help would be greatly appreciated.

Regards
Ivan McIntosh


Logfile of HijackThis v1.99.1
Scan saved at 19:36:36, on 04/22/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBPOLL.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\CTNOTIFY.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD2.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\PROGRAM FILES\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-NZ\MSNAPPAU.EXE
C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASDTSERV.EXE
C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASSERV.EXE
C:\WINDOWS\ORTVXMA.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBMENU.EXE
C:\WINDOWS\SYSTEM\MAPIICON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\COUNTERSPY.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://topsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://topsearch4u.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://topsearch4u.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://topsearch4u.com/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://topsearch4u.com/index.htm
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1001\en-xu\stmain.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE c:\windows\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\en-nz\msnappau.exe"
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [SUNASDTSERV] C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASDTSERV.exe
O4 - HKLM\..\Run: [sunasServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [GoBack Polling Service] C:\Program Files\Wild File\GoBack\GBPoll.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [lorpkwq] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [iqgvspo] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [pnqegff] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [qjorvsj] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE c:\windows\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [cttguub] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [ybdkmrx] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [jddqjrg] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [kyptcqd] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [diksjml] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [ibyeycc] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [fxocrqa] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [rlpppkl] c:\windows\bbrdoow.exe
O4 - HKCU\..\Run: [scrbuxh] c:\windows\bbrdoow.exe
O4 - HKCU\..\Run: [adlewor] c:\windows\bbrdoow.exe
O4 - HKCU\..\Run: [sqndabo] c:\windows\lbsrwrs.exe
O4 - HKCU\..\Run: [ovaoipc] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [pihptyf] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [sctcsrn] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [fbxuoyb] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [rnpxtgh] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [vamvttm] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [jenewbc] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [rkspmiw] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [gshbncu] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [pygaeif] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [yjyipjk] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [exurgev] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [njhlswm] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [byxeyxs] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [ediebon] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [wrejtdv] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [ojqnlrm] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [jeyaqcq] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [vadyfwy] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [qbtniwa] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [aheqere] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [umubafs] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [xiuepwv] c:\windows\pfxvdhm.exe
O4 - HKCU\..\Run: [kakijxg] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [xevragj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [bskfsad] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [jpnctkr] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [sqbrfyl] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [xvimifw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [bfbgwvj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [xvkgjgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ebaxvvk] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [jvbsjlb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [oqegiok] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ubtlglb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [eilqvjh] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [fxnwfxm] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [creulgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [cltonto] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [tcbybpw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [mgweeyd] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [aujtsxb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [bljlyon] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [hbbaihe] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [hiivkbm] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [rwskukj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [wrtbuud] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [mtbtvtp] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [sliiekb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [hcyokqx] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [skrornj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [njenqou] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [tnikovv] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ukiyhws] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [qidsrqj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [resyvcq] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [fsemohw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [wlthdxn] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [lfnwcoa] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [kjmhliy] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [sehsupj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [vxljlcc] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [vrhgnxe] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [kuenhmy] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [qpjeudm] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [opgkprt] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [cvgbsig] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [gnwqaum] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [adtaonn] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [mxeguyw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [excspvq] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [rqqsycp] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ygefkpx] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [lxjwcoc] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [yjfcvrg] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [nynsmai] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [hbxwllb] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [apvqxji] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [afeybha] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [homxoat] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [gjurmvq] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [diqcxfw] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [vwidjrx] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [nlgyltm] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [xfwtmqq] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [hqacitr] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [fgxntmw] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [yvrkdxx] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ycvqwxg] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ujymyxv] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [sxraluh] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [xdsuejy] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [cdaneko] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [dducgax] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [pnmpotw] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [yfkfjlk] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [hqafhpv] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ygurvgp] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ppoxtjh] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [vhfjodb] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [xcfwoxs] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [aoidvnn] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [utedjae] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [shnovtw] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [vnprgeg] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [qlpimml] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [mikvujq] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [wdbkxnb] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [ipsflfg] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [kcpogdq] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [qpdsunu] c:\windows\ebloijj.exe
O4 - HKCU\..\Run: [txbbfyc] c:\windows\vtggpoo.exe
O4 - HKCU\..\Run: [eriepmv] c:\windows\vtggpoo.exe
O4 - HKCU\..\Run: [ofqbdnb] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [fbcfpgk] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [dhylkci] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [rpnuysx] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [klmfqkw] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [jtfwidm] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [wxnncvj] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [jfpxkwl] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [qlcytov] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [hcgrqxj] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [lobjufx] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [tbwcrkt] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [hpdkstj] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [dhrgflk] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [prmhbuo] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [ednwiga] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [xdqxrhg] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [vtiyypr] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [iihbnbw] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [bmmxavu] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [elecdkt] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [pdhpvrq] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [legdkii] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [fpnlvtg] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [acoeklm] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [ijxxykg] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [qhkpjbn] c:\windows\dnkgucg.exe
O4 - HKCU\..\Run: [fsbrxjj] c:\windows\dnkgucg.exe
O4 - HKCU\..\Run: [fbyoimn] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [rsniskq] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [yxknbkw] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [jsmwgdt] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [fjhwnoj] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [wmnncxn] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [ruuoxge] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [ywapadr] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [lorpkwq] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [iqgvspo] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [pnqegff] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [qjorvsj] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\RunServices: [NvMediaCenter] RUNDLL32.EXE c:\windows\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\RunServices: [cttguub] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [ybdkmrx] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [jddqjrg] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [kyptcqd] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [diksjml] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [ibyeycc] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [fxocrqa] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [rlpppkl] c:\windows\bbrdoow.exe
O4 - HKCU\..\RunServices: [scrbuxh] c:\windows\bbrdoow.exe
O4 - HKCU\..\RunServices: [adlewor] c:\windows\bbrdoow.exe
O4 - HKCU\..\RunServices: [sqndabo] c:\windows\lbsrwrs.exe
O4 - HKCU\..\RunServices: [ovaoipc] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [pihptyf] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [sctcsrn] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [fbxuoyb] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [rnpxtgh] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [vamvttm] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [jenewbc] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [rkspmiw] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [gshbncu] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [pygaeif] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [yjyipjk] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [exurgev] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [njhlswm] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [byxeyxs] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [ediebon] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [wrejtdv] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [ojqnlrm] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [jeyaqcq] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [vadyfwy] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [qbtniwa] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [aheqere] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [umubafs] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [xiuepwv] c:\windows\pfxvdhm.exe
O4 - HKCU\..\RunServices: [kakijxg] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [xevragj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [bskfsad] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [jpnctkr] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [sqbrfyl] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [xvimifw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [bfbgwvj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [xvkgjgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ebaxvvk] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [jvbsjlb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [oqegiok] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ubtlglb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [eilqvjh] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [fxnwfxm] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [creulgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [cltonto] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [tcbybpw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [mgweeyd] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [aujtsxb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [bljlyon] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [hbbaihe] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [hiivkbm] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [rwskukj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [wrtbuud] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [mtbtvtp] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [sliiekb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [hcyokqx] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [skrornj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [njenqou] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [tnikovv] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ukiyhws] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [qidsrqj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [resyvcq] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [fsemohw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [wlthdxn] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [lfnwcoa] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [kjmhliy] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [sehsupj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [vxljlcc] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [vrhgnxe] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [kuenhmy] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [qpjeudm] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [opgkprt] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [cvgbsig] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [gnwqaum] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [adtaonn] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [mxeguyw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [excspvq] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [rqqsycp] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ygefkpx] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [lxjwcoc] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [yjfcvrg] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [nynsmai] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [hbxwllb] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [apvqxji] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [afeybha] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [homxoat] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [gjurmvq] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [diqcxfw] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [vwidjrx] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [nlgyltm] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [xfwtmqq] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [hqacitr] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [fgxntmw] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [yvrkdxx] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ycvqwxg] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ujymyxv] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [sxraluh] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [xdsuejy] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [cdaneko] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [dducgax] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [pnmpotw] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [yfkfjlk] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [hqafhpv] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ygurvgp] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ppoxtjh] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [vhfjodb] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [xcfwoxs] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [aoidvnn] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [utedjae] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [shnovtw] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [vnprgeg] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [qlpimml] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [mikvujq] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [wdbkxnb] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [ipsflfg] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [kcpogdq] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [qpdsunu] c:\windows\ebloijj.exe
O4 - HKCU\..\RunServices: [txbbfyc] c:\windows\vtggpoo.exe
O4 - HKCU\..\RunServices: [eriepmv] c:\windows\vtggpoo.exe
O4 - HKCU\..\RunServices: [ofqbdnb] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [fbcfpgk] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [dhylkci] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [rpnuysx] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [klmfqkw] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [jtfwidm] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [wxnncvj] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [jfpxkwl] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [qlcytov] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [hcgrqxj] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [lobjufx] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [tbwcrkt] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [hpdkstj] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [dhrgflk] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [prmhbuo] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [ednwiga] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [xdqxrhg] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [vtiyypr] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [iihbnbw] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [bmmxavu] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [elecdkt] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [pdhpvrq] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [legdkii] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [fpnlvtg] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [acoeklm] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [ijxxykg] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [qhkpjbn] c:\windows\dnkgucg.exe
O4 - HKCU\..\RunServices: [fsbrxjj] c:\windows\dnkgucg.exe
O4 - HKCU\..\RunServices: [fbyoimn] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [rsniskq] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [yxknbkw] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [jsmwgdt] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [fjhwnoj] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [wmnncxn] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [ruuoxge] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [ywapadr] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\PROGRAM FILES\ICQLITE\ICQLITE.EXE -trayboot
O4 - Startup: GoBack.lnk = C:\Program Files\Wild File\GoBack\GBMenu.exe
O4 - Startup: ADSL Diagnostic Tools.LNK = C:\WINDOWS\SYSTEM\MAPIICON.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .VOB: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin4.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/SharedCont...c/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security2.norton.com/SSC/SharedCont...bin/AvSniff.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/05c62104467f6e...ip/RdxIE601.cab

BC AdBot (Login to Remove)

 


#2 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,614 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:31 AM

Posted 23 April 2005 - 12:23 AM

Print out these instructions and then close all windows including Internet Explorer.

Then I want you to fix some of those entries. Please do the following:

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then click the Fix button:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://topsearch4u.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://topsearch4u.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://topsearch4u.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://topsearch4u.com/sp.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://topsearch4u.com/index.htm
O4 - HKCU\..\Run: [lorpkwq] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [iqgvspo] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [pnqegff] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [qjorvsj] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [cttguub] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [ybdkmrx] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [jddqjrg] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [kyptcqd] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [diksjml] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [ibyeycc] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [fxocrqa] c:\windows\sxwrltg.exe
O4 - HKCU\..\Run: [rlpppkl] c:\windows\bbrdoow.exe
O4 - HKCU\..\Run: [scrbuxh] c:\windows\bbrdoow.exe
O4 - HKCU\..\Run: [adlewor] c:\windows\bbrdoow.exe
O4 - HKCU\..\Run: [sqndabo] c:\windows\lbsrwrs.exe
O4 - HKCU\..\Run: [ovaoipc] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [pihptyf] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [sctcsrn] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [fbxuoyb] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [rnpxtgh] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [vamvttm] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [jenewbc] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [rkspmiw] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [gshbncu] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [pygaeif] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [yjyipjk] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [exurgev] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [njhlswm] c:\windows\wmicekq.exe
O4 - HKCU\..\Run: [byxeyxs] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [ediebon] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [wrejtdv] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [ojqnlrm] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [jeyaqcq] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [vadyfwy] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [qbtniwa] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [aheqere] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [umubafs] c:\windows\djmvnxe.exe
O4 - HKCU\..\Run: [xiuepwv] c:\windows\pfxvdhm.exe
O4 - HKCU\..\Run: [kakijxg] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [xevragj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [bskfsad] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [jpnctkr] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [sqbrfyl] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [xvimifw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [bfbgwvj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [xvkgjgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ebaxvvk] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [jvbsjlb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [oqegiok] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ubtlglb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [eilqvjh] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [fxnwfxm] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [creulgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [cltonto] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [tcbybpw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [mgweeyd] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [aujtsxb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [bljlyon] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [hbbaihe] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [hiivkbm] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [rwskukj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [wrtbuud] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [mtbtvtp] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [sliiekb] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [hcyokqx] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [skrornj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [njenqou] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [tnikovv] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ukiyhws] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [qidsrqj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [resyvcq] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [fsemohw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [wlthdxn] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [lfnwcoa] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [kjmhliy] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [sehsupj] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [vxljlcc] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [vrhgnxe] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [kuenhmy] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [qpjeudm] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [opgkprt] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [cvgbsig] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [gnwqaum] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [adtaonn] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [mxeguyw] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [excspvq] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [rqqsycp] c:\windows\ipnwysh.exe
O4 - HKCU\..\Run: [ygefkpx] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [lxjwcoc] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [yjfcvrg] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [nynsmai] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [hbxwllb] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [apvqxji] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [afeybha] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [homxoat] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [gjurmvq] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [diqcxfw] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [vwidjrx] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [nlgyltm] c:\windows\sqoyxay.exe
O4 - HKCU\..\Run: [xfwtmqq] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [hqacitr] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [fgxntmw] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [yvrkdxx] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ycvqwxg] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ujymyxv] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [sxraluh] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [xdsuejy] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [cdaneko] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [dducgax] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [pnmpotw] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [yfkfjlk] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [hqafhpv] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ygurvgp] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [ppoxtjh] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [vhfjodb] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [xcfwoxs] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [aoidvnn] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [utedjae] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [shnovtw] c:\windows\enlkbva.exe
O4 - HKCU\..\Run: [vnprgeg] c:\windows\ortvxma.exe
O4 - HKCU\..\Run: [qlpimml] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [mikvujq] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [wdbkxnb] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [ipsflfg] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [kcpogdq] c:\windows\svoukqo.exe
O4 - HKCU\..\Run: [qpdsunu] c:\windows\ebloijj.exe
O4 - HKCU\..\Run: [txbbfyc] c:\windows\vtggpoo.exe
O4 - HKCU\..\Run: [eriepmv] c:\windows\vtggpoo.exe
O4 - HKCU\..\Run: [ofqbdnb] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [fbcfpgk] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [dhylkci] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [rpnuysx] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [klmfqkw] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [jtfwidm] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [wxnncvj] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [jfpxkwl] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [qlcytov] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [hcgrqxj] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [lobjufx] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [tbwcrkt] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [hpdkstj] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [dhrgflk] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [prmhbuo] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [ednwiga] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [xdqxrhg] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [vtiyypr] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [iihbnbw] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [bmmxavu] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [elecdkt] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [pdhpvrq] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [legdkii] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [fpnlvtg] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [acoeklm] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [ijxxykg] c:\windows\nkggawn.exe
O4 - HKCU\..\Run: [qhkpjbn] c:\windows\dnkgucg.exe
O4 - HKCU\..\Run: [fsbrxjj] c:\windows\dnkgucg.exe
O4 - HKCU\..\Run: [fbyoimn] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [rsniskq] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [yxknbkw] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [jsmwgdt] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [fjhwnoj] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [wmnncxn] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [ruuoxge] c:\windows\hptfkjd.exe
O4 - HKCU\..\Run: [ywapadr] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [lorpkwq] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [iqgvspo] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [pnqegff] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [qjorvsj] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [cttguub] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [ybdkmrx] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [jddqjrg] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [kyptcqd] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [diksjml] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [ibyeycc] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [fxocrqa] c:\windows\sxwrltg.exe
O4 - HKCU\..\RunServices: [rlpppkl] c:\windows\bbrdoow.exe
O4 - HKCU\..\RunServices: [scrbuxh] c:\windows\bbrdoow.exe
O4 - HKCU\..\RunServices: [adlewor] c:\windows\bbrdoow.exe
O4 - HKCU\..\RunServices: [sqndabo] c:\windows\lbsrwrs.exe
O4 - HKCU\..\RunServices: [ovaoipc] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [pihptyf] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [sctcsrn] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [fbxuoyb] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [rnpxtgh] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [vamvttm] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [jenewbc] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [rkspmiw] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [gshbncu] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [pygaeif] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [yjyipjk] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [exurgev] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [njhlswm] c:\windows\wmicekq.exe
O4 - HKCU\..\RunServices: [byxeyxs] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [ediebon] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [wrejtdv] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [ojqnlrm] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [jeyaqcq] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [vadyfwy] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [qbtniwa] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [aheqere] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [umubafs] c:\windows\djmvnxe.exe
O4 - HKCU\..\RunServices: [xiuepwv] c:\windows\pfxvdhm.exe
O4 - HKCU\..\RunServices: [kakijxg] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [xevragj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [bskfsad] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [jpnctkr] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [sqbrfyl] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [xvimifw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [bfbgwvj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [xvkgjgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ebaxvvk] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [jvbsjlb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [oqegiok] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ubtlglb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [eilqvjh] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [fxnwfxm] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [creulgc] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [cltonto] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [tcbybpw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [mgweeyd] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [aujtsxb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [bljlyon] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [hbbaihe] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [hiivkbm] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [rwskukj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [wrtbuud] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [mtbtvtp] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [sliiekb] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [hcyokqx] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [skrornj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [njenqou] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [tnikovv] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ukiyhws] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [qidsrqj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [resyvcq] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [fsemohw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [wlthdxn] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [lfnwcoa] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [kjmhliy] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [sehsupj] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [vxljlcc] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [vrhgnxe] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [kuenhmy] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [qpjeudm] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [opgkprt] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [cvgbsig] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [gnwqaum] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [adtaonn] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [mxeguyw] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [excspvq] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [rqqsycp] c:\windows\ipnwysh.exe
O4 - HKCU\..\RunServices: [ygefkpx] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [lxjwcoc] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [yjfcvrg] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [nynsmai] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [hbxwllb] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [apvqxji] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [afeybha] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [homxoat] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [gjurmvq] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [diqcxfw] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [vwidjrx] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [nlgyltm] c:\windows\sqoyxay.exe
O4 - HKCU\..\RunServices: [xfwtmqq] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [hqacitr] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [fgxntmw] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [yvrkdxx] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ycvqwxg] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ujymyxv] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [sxraluh] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [xdsuejy] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [cdaneko] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [dducgax] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [pnmpotw] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [yfkfjlk] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [hqafhpv] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ygurvgp] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [ppoxtjh] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [vhfjodb] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [xcfwoxs] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [aoidvnn] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [utedjae] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [shnovtw] c:\windows\enlkbva.exe
O4 - HKCU\..\RunServices: [vnprgeg] c:\windows\ortvxma.exe
O4 - HKCU\..\RunServices: [qlpimml] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [mikvujq] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [wdbkxnb] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [ipsflfg] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [kcpogdq] c:\windows\svoukqo.exe
O4 - HKCU\..\RunServices: [qpdsunu] c:\windows\ebloijj.exe
O4 - HKCU\..\RunServices: [txbbfyc] c:\windows\vtggpoo.exe
O4 - HKCU\..\RunServices: [eriepmv] c:\windows\vtggpoo.exe
O4 - HKCU\..\RunServices: [ofqbdnb] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [fbcfpgk] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [dhylkci] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [rpnuysx] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [klmfqkw] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [jtfwidm] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [wxnncvj] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [jfpxkwl] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [qlcytov] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [hcgrqxj] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [lobjufx] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [tbwcrkt] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [hpdkstj] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [dhrgflk] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [prmhbuo] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [ednwiga] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [xdqxrhg] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [vtiyypr] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [iihbnbw] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [bmmxavu] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [elecdkt] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [pdhpvrq] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [legdkii] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [fpnlvtg] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [acoeklm] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [ijxxykg] c:\windows\nkggawn.exe
O4 - HKCU\..\RunServices: [qhkpjbn] c:\windows\dnkgucg.exe
O4 - HKCU\..\RunServices: [fsbrxjj] c:\windows\dnkgucg.exe
O4 - HKCU\..\RunServices: [fbyoimn] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [rsniskq] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [yxknbkw] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [jsmwgdt] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [fjhwnoj] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [wmnncxn] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [ruuoxge] c:\windows\hptfkjd.exe
O4 - HKCU\..\RunServices: [ywapadr] c:\windows\hptfkjd.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/05c62104467f6e...ip/RdxIE601.cab

Reboot your computer into Safe Mode

Then delete these files or directories (Do not be concerned if they do not exist)

c:\windows\ortvxma.exe
c:\windows\sxwrltg.exe
c:\windows\bbrdoow.exe
c:\windows\lbsrwrs.exe
c:\windows\wmicekq.exe
c:\windows\djmvnxe.exe
c:\windows\pfxvdhm.exe
c:\windows\ipnwysh.exe
c:\windows\sqoyxay.exe
c:\windows\enlkbva.exe
c:\windows\ortvxma.exe
c:\windows\svoukqo.exe
c:\windows\ebloijj.exe
c:\windows\vtggpoo.exe
c:\windows\nkggawn.exe
c:\windows\dnkgucg.exe
c:\windows\hptfkjd.exe
c:\windows\ortvxma.exe
c:\windows\sxwrltg.exe
c:\windows\bbrdoow.exe
c:\windows\lbsrwrs.exe
c:\windows\wmicekq.exe
c:\windows\djmvnxe.exe
c:\windows\pfxvdhm.exe
c:\windows\ipnwysh.exe
c:\windows\sqoyxay.exe
c:\windows\enlkbva.exe
c:\windows\ortvxma.exe
c:\windows\svoukqo.exe
c:\windows\ebloijj.exe
c:\windows\vtggpoo.exe
c:\windows\nkggawn.exe
c:\windows\dnkgucg.exe
c:\windows\hptfkjd.exe

Reboot your computer to go back to normal mode and post a new log.

#3 McIvan

McIvan
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:31 PM

Posted 24 April 2005 - 10:21 PM

Hi Grinler, thank you very much for your help. I had already somewhat rashly deleted all the files I thought were suspect....think I missed a couple but got them the next day.....and have had no trouble for the last two days.

I carefully went through your instructions nonetheless, and here is the replacement log, which looks clean to me, and hopefully to you also.

Regards & thanks
Ivan McIntosh


Logfile of HijackThis v1.99.1
Scan saved at 15:16:52, on 04/25/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBPOLL.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\CTNOTIFY.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\PROGRAM FILES\ICQLITE\ICQLITE.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD2.EXE
C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.EXE
C:\PROGRAM FILES\MSN APPS\UPDATER\01.02.3000.1001\EN-NZ\MSNAPPAU.EXE
C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASDTSERV.EXE
C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASSERV.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\WILD FILE\GOBACK\GBMENU.EXE
C:\WINDOWS\SYSTEM\MAPIICON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nzherald.co.nz/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN APPS\MSN TOOLBAR\01.02.3000.1001\EN-US\MSNTB.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [Multi-function Keyboard] GWHotKey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE c:\windows\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb08.exe
O4 - HKLM\..\Run: [DeviceDiscovery] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [msnappau] "c:\program files\MSN Apps\Updater\01.02.3000.1001\en-nz\msnappau.exe"
O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [SUNASDTSERV] C:\PROGRAM FILES\SUNBELT SOFTWARE\COUNTERSPY CLIENT\SUNASDTSERV.exe
O4 - HKLM\..\Run: [sunasServ] C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [GoBack Polling Service] C:\Program Files\Wild File\GoBack\GBPoll.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE c:\windows\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\PROGRAM FILES\ICQLITE\ICQLITE.EXE -trayboot
O4 - Startup: GoBack.lnk = C:\Program Files\Wild File\GoBack\GBMenu.exe
O4 - Startup: ADSL Diagnostic Tools.LNK = C:\WINDOWS\SYSTEM\MAPIICON.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O12 - Plugin for .VOB: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin4.dll
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/SSC/SharedCont...c/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security2.norton.com/SSC/SharedCont...bin/AvSniff.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab

#4 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,614 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:31 AM

Posted 25 April 2005 - 12:48 AM

Looks good..how does it feel to you?

#5 McIvan

McIvan
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:11:31 PM

Posted 27 April 2005 - 03:08 AM

Still feels fine to me, thanks :) I guess we can write this one off......thanks again for the assistance!

Regards
Ivan McIntosh

#6 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,614 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:12:31 AM

Posted 27 April 2005 - 01:01 PM

Your log is clean! Great job!

Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and reenable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Renable system restore with instructions from tutorial above


Next,

This process will clean out your Temp files and your Temporary Internet Files. Please do both steps:

Step 1:Delete Temp Files
To clean out your temp files, click on Start and then run, and type %temp% and press the ok button.

This should open up the temp directory that your machine uses. Please delete all files that are found there. If you get an error when deleting a file, skip that file and delete all the others. If you had trouble deleting a file, reboot into Safe Mode and follow this step again. You should now be able to delete all the files.

Step 2: Delete Temporary Internet Files
Now I want you to open up Internet Explorer, and click on the Tools menu and then Internet Options. At the General tab, which should be the first tab you are currently on, click on the Delete Files button and put a checkmark in Delete offline content. Then press the OK button. This may take quite a while, so do not be alarmed with how long it takes. When it is done, your Temporary Internet Files will now be deleted.

Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:

Simple and easy ways to keep your computer safe and secure on the Internet


Glad I was able to help and if there any other problems related to your computer please feel free to post them in the appropriate forum. Though we help people with spyware and viruses here at BC, we also help people with other computer problems! Do not forget to tell your friends about us!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users