UNSOLVED
J
Jessica200
8 Posts
0
987
May 26th, 2005 17:00
HiJackThis Log
Hello,
My computer has been hijacked by clicksearch. The log exceeds the character limit of the forum, so I'm going to do this in several posts. Someone please help!
Logfile of HijackThis v1.99.1
Scan saved at 11:32:08 AM, on 5/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hmhosf\gkjnqhri.exe
C:\WINDOWS\System32\phyttqs\htncl.exe
C:\WINDOWS\System32\phyttqs\htncl.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\program files\tvs\tvs_b.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\scrsvc.exe
C:\WINDOWS\System32\xbwm\aoqivux.exe
C:\WINDOWS\System32\axtbba\alqpdh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\jqnyy\rniui.exe
C:\WINDOWS\System32\wccd\ddgpd.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\omsv\ydvgudu.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\shfyrr\itpw.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\qqwygk\ekacyqg.exe
C:\WINDOWS\System32\lyvvnnw\jtudcpj.exe
C:\WINDOWS\System32\nkhtih\cgqufb.exe
C:\WINDOWS\System32\amwtfa\agss.exe
C:\WINDOWS\System32\ptmxeih\ntinnrb.exe
C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SVCHOST.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\pmvjv\mjichj.exe
C:\WINDOWS\System32\kivo\njhwca.exe
C:\WINDOWS\System32\jbxucgo\frtt.exe
C:\WINDOWS\System32\pxepqt\jupfno.exe
c:\windows\system32\ucwrmqu.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\inked.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\Frys\Desktop\hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
My computer has been hijacked by clicksearch. The log exceeds the character limit of the forum, so I'm going to do this in several posts. Someone please help!
Logfile of HijackThis v1.99.1
Scan saved at 11:32:08 AM, on 5/26/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hmhosf\gkjnqhri.exe
C:\WINDOWS\System32\phyttqs\htncl.exe
C:\WINDOWS\System32\phyttqs\htncl.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\program files\tvs\tvs_b.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\System32\scrsvc.exe
C:\WINDOWS\System32\xbwm\aoqivux.exe
C:\WINDOWS\System32\axtbba\alqpdh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\jqnyy\rniui.exe
C:\WINDOWS\System32\wccd\ddgpd.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\omsv\ydvgudu.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\shfyrr\itpw.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\qqwygk\ekacyqg.exe
C:\WINDOWS\System32\lyvvnnw\jtudcpj.exe
C:\WINDOWS\System32\nkhtih\cgqufb.exe
C:\WINDOWS\System32\amwtfa\agss.exe
C:\WINDOWS\System32\ptmxeih\ntinnrb.exe
C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SVCHOST.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\pmvjv\mjichj.exe
C:\WINDOWS\System32\kivo\njhwca.exe
C:\WINDOWS\System32\jbxucgo\frtt.exe
C:\WINDOWS\System32\pxepqt\jupfno.exe
c:\windows\system32\ucwrmqu.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\inked.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Documents and Settings\Frys\Desktop\hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
Jessica200
8 Posts
248
0
Posted May 28th, 2005 22:00
Thanks so much for your help. I really appreciate it. I wasn't able to run the trial version of Trojan Hunter--click search prevented me from accessing the page to download the trial. Here's the new log...
Logfile of HijackThis v1.99.1
Scan saved at 3:56:47 PM, on 5/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\totrmm\nvod.exe
C:\WINDOWS\System32\totrmm\nvod.exe
C:\WINDOWS\System32\osibm\nxgoipps.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\System32\scrsvc.exe
C:\WINDOWS\System32\tges\fijxmgla.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\jqnyy\rniui.exe
C:\WINDOWS\System32\wccd\ddgpd.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\WINDOWS\CTRegRun.EXE
C:\Program Files\Creative\Product Registration\English\InetReg.exe
C:\program files\tvs\tvs_b.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\omsv\ydvgudu.exe
C:\WINDOWS\System32\vjrkdhbt\nmcos.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\qqwygk\ekacyqg.exe
C:\WINDOWS\System32\lyvvnnw\jtudcpj.exe
C:\WINDOWS\System32\nkhtih\cgqufb.exe
C:\WINDOWS\System32\amwtfa\agss.exe
C:\WINDOWS\System32\ptmxeih\ntinnrb.exe
C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SVCHOST.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\pmvjv\mjichj.exe
C:\WINDOWS\System32\kivo\njhwca.exe
C:\WINDOWS\System32\jbxucgo\frtt.exe
C:\WINDOWS\System32\pxepqt\jupfno.exe
C:\WINDOWS\System32\xbwm\aoqivux.exe
C:\WINDOWS\System32\jjjfx\edmglb.exe
C:\WINDOWS\System32\uiohg\uajc.exe
c:\windows\system32\bghvknl.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\inked.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Frys\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/index.php?aff=9
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr6/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr6/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us8l.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 66.180.173.39 www.google.ae
O1 - Hosts: 66.180.173.39 www.google.am
O1 - Hosts: 66.180.173.39 www.google.as
O1 - Hosts: 66.180.173.39 www.google.at
O1 - Hosts: 66.180.173.39 www.google.az
O1 - Hosts: 66.180.173.39 www.google.be
O1 - Hosts: 66.180.173.39 www.google.bi
O1 - Hosts: 66.180.173.39 www.google.ca
O1 - Hosts: 66.180.173.39 www.google.cd
O1 - Hosts: 66.180.173.39 www.google.cg
O1 - Hosts: 66.180.173.39 www.google.ch
O1 - Hosts: 66.180.173.39 www.google.ci
O1 - Hosts: 66.180.173.39 www.google.cl
O1 - Hosts: 66.180.173.39 www.google.co.cr
O1 - Hosts: 66.180.173.39 www.google.co.hu
O1 - Hosts: 66.180.173.39 www.google.co.il
O1 - Hosts: 66.180.173.39 www.google.co.in
O1 - Hosts: 66.180.173.39 www.google.co.je
O1 - Hosts: 66.180.173.39 www.google.co.jp
O1 - Hosts: 66.180.173.39 www.google.co.ke
O1 - Hosts: 66.180.173.39 www.google.co.kr
O1 - Hosts: 66.180.173.39 www.google.co.ls
O1 - Hosts: 66.180.173.39 www.google.co.nz
O1 - Hosts: 66.180.173.39 www.google.co.th
O1 - Hosts: 66.180.173.39 www.google.co.ug
O1 - Hosts: 66.180.173.39 www.google.co.uk
O1 - Hosts: 66.180.173.39 www.google.co.ve
O1 - Hosts: 66.180.173.39 www.google.com
O1 - Hosts: 66.180.173.39 www.google.com.ag
O1 - Hosts: 66.180.173.39 www.google.com.ar
O1 - Hosts: 66.180.173.39 www.google.com.au
O1 - Hosts: 66.180.173.39 www.google.com.br
O1 - Hosts: 66.180.173.39 www.google.com.co
O1 - Hosts: 66.180.173.39 www.google.com.cu
O1 - Hosts: 66.180.173.39 www.google.com.do
O1 - Hosts: 66.180.173.39 www.google.com.ec
O1 - Hosts: 66.180.173.39 www.google.com.fj
O1 - Hosts: 66.180.173.39 www.google.com.gi
O1 - Hosts: 66.180.173.39 www.google.com.gr
O1 - Hosts: 66.180.173.39 www.google.com.gt
O1 - Hosts: 66.180.173.39 www.google.com.hk
O1 - Hosts: 66.180.173.39 www.google.com.ly
O1 - Hosts: 66.180.173.39 www.google.com.mt
O1 - Hosts: 66.180.173.39 www.google.com.mx
O1 - Hosts: 66.180.173.39 www.google.com.my
O1 - Hosts: 66.180.173.39 www.google.com.na
O1 - Hosts: 66.180.173.39 www.google.com.nf
O1 - Hosts: 66.180.173.39 www.google.com.ni
O1 - Hosts: 66.180.173.39 www.google.com.np
O1 - Hosts: 66.180.173.39 www.google.com.pa
O1 - Hosts: 66.180.173.39 www.google.com.pe
O1 - Hosts: 66.180.173.39 www.google.com.ph
O1 - Hosts: 66.180.173.39 www.google.com.pk
O1 - Hosts: 66.180.173.39 www.google.com.pr
O1 - Hosts: 66.180.173.39 www.google.com.py
O1 - Hosts: 66.180.173.39 www.google.com.sa
O1 - Hosts: 66.180.173.39 www.google.com.sg
O1 - Hosts: 66.180.173.39 www.google.com.sv
O1 - Hosts: 66.180.173.39 www.google.com.tr
O1 - Hosts: 66.180.173.39 www.google.com.tw
O1 - Hosts: 66.180.173.39 www.google.com.ua
O1 - Hosts: 66.180.173.39 www.google.com.uy
O1 - Hosts: 66.180.173.39 www.google.com.vc
O1 - Hosts: 66.180.173.39 www.google.com.vn
O1 - Hosts: 66.180.173.39 www.google.de
O1 - Hosts: 66.180.173.39 www.google.dj
O1 - Hosts: 66.180.173.39 www.google.dk
O1 - Hosts: 66.180.173.39 www.google.es
O1 - Hosts: 66.180.173.39 www.google.fi
O1 - Hosts: 66.180.173.39 www.google.fm
O1 - Hosts: 66.180.173.39 www.google.fr
O1 - Hosts: 66.180.173.39 www.google.gg
O1 - Hosts: 66.180.173.39 www.google.gl
O1 - Hosts: 66.180.173.39 www.google.gm
O1 - Hosts: 66.180.173.39 www.google.hn
O1 - Hosts: 66.180.173.39 www.google.ie
O1 - Hosts: 66.180.173.39 www.google.it
O1 - Hosts: 66.180.173.39 www.google.kz
O1 - Hosts: 66.180.173.39 www.google.li
O1 - Hosts: 66.180.173.39 www.google.lt
O1 - Hosts: 66.180.173.39 www.google.lu
O1 - Hosts: 66.180.173.39 www.google.lv
O1 - Hosts: 66.180.173.39 www.google.mn
O1 - Hosts: 66.180.173.39 www.google.ms
O1 - Hosts: 66.180.173.39 www.google.mu
O1 - Hosts: 66.180.173.39 www.google.mw
O1 - Hosts: 66.180.173.39 www.google.nl
O1 - Hosts: 66.180.173.39 www.google.no
O1 - Hosts: 66.180.173.39 www.google.off.ai
O1 - Hosts: 66.180.173.39 www.google.pl
O1 - Hosts: 66.180.173.39 www.google.pn
O1 - Hosts: 66.180.173.39 www.google.pt
O1 - Hosts: 66.180.173.39 www.google.ro
O1 - Hosts: 66.180.173.39 www.google.ru
O1 - Hosts: 66.180.173.39 www.google.rw
O1 - Hosts: 66.180.173.39 www.google.se
O1 - Hosts: 66.180.173.39 www.google.sh
O1 - Hosts: 66.180.173.39 www.google.sk
O1 - Hosts: 66.180.173.39 www.google.sm
O1 - Hosts: 66.180.173.39 www.google.td
O1 - Hosts: 66.180.173.39 www.google.tm
O2 - BHO: (no name) - {09AE2697-9D2E-7E38-DE88-157ABE2EEDEA} - C:\WINDOWS\System32\vxgeqakm\moslmyky.dll
O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)
O2 - BHO: (no name) - {435CEB90-7B99-236C-E868-E5F3DF0B5E54} - C:\WINDOWS\System32\gxmknbon\frcysoas.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: FlashEnhancer Ext - {5EDB03AF-0341-4e96-9E9B-3171522E4BAF} - c:\Program Files\Fla\fla.dll (file missing)
O2 - BHO: (no name) - {7BBFCD33-80B4-D28F-2B9E-B20B13B8C82E} - C:\WINDOWS\System32\bvmdnqff\lrandsds.dll
O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll
O2 - BHO: (no name) - {86851575-8AB6-F5BA-FE1F-222B66051B44} - C:\WINDOWS\System32\sqqaljbh\mqkeitsl.dll
O2 - BHO: FlashEnhancer Extnder - {A749B4BC-7621-4a80-9220-D0A283367DD5} - c:\Program Files\Fln\fln.dll (file missing)
O2 - BHO: (no name) - {BA05567F-1DD7-0A7A-E2EB-3B431D554246} - C:\WINDOWS\System32\tolfixwb\aiwcmpei.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe
O4 - HKLM\..\Run: [irwehx] C:\WINDOWS\System32\fuhlcodl\irwehx.exe
O4 - HKLM\..\Run: [cwnyidd] C:\WINDOWS\System32\fkkqspv\cwnyidd.exe
O4 - HKLM\..\Run: [lxmeitw] C:\WINDOWS\System32\ebrt\lxmeitw.exe
O4 - HKLM\..\Run: [tickhn] C:\WINDOWS\System32\rwbldru\tickhn.exe
O4 - HKLM\..\Run: [hnisujdj] C:\WINDOWS\System32\nhnfytt\hnisujdj.exe
O4 - HKLM\..\Run: [pouoyffs] C:\WINDOWS\System32\ktwauex\pouoyffs.exe
O4 - HKLM\..\Run: [qpwe] C:\WINDOWS\System32\bjtlqmme\qpwe.exe
O4 - HKLM\..\Run: [qsyycs] C:\WINDOWS\System32\dbonk\qsyycs.exe
O4 - HKLM\..\Run: [kqijimql] C:\WINDOWS\System32\ytbvtyu\kqijimql.exe
O4 - HKLM\..\Run: [cduy] C:\WINDOWS\System32\eompsyjv\cduy.exe
O4 - HKLM\..\Run: [hrnaff] C:\WINDOWS\System32\vsvf\hrnaff.exe
O4 - HKLM\..\Run: [sbjdvo] C:\WINDOWS\System32\ryitn\sbjdvo.exe
O4 - HKLM\..\Run: [tili] C:\WINDOWS\System32\spaxojx\tili.exe
O4 - HKLM\..\Run: [skdfykwf] C:\WINDOWS\System32\wlnho\skdfykwf.exe
O4 - HKLM\..\Run: [httwlh] C:\WINDOWS\System32\lluusbtn\httwlh.exe
O4 - HKLM\..\Run: [cwmj] C:\WINDOWS\System32\cgxab\cwmj.exe
O4 - HKLM\..\Run: [agbemh] C:\WINDOWS\System32\dtnx\agbemh.exe
O4 - HKLM\..\Run: [earhirek] C:\WINDOWS\System32\dben\earhirek.exe
O4 - HKLM\..\Run: [sssy] C:\WINDOWS\System32\qqbe\sssy.exe
O4 - HKLM\..\Run: [ukftqlsl] C:\WINDOWS\System32\efnlg\ukftqlsl.exe
O4 - HKLM\..\Run: [djkrq] C:\WINDOWS\System32\mdtblhs\djkrq.exe
O4 - HKLM\..\Run: [afywd] C:\WINDOWS\System32\fwsndlyj\afywd.exe
O4 - HKLM\..\Run: [oudpi] C:\WINDOWS\System32\ljiwua\oudpi.exe
O4 - HKLM\..\Run: [dxlrtt] C:\WINDOWS\System32\ktnkcf\dxlrtt.exe
O4 - HKLM\..\Run: [lxtek] C:\WINDOWS\System32\icmuafr\lxtek.exe
O4 - HKLM\..\Run: [kgalcrh] C:\WINDOWS\System32\uohynyrh\kgalcrh.exe
O4 - HKLM\..\Run: [jpgxi] C:\WINDOWS\System32\wmvjvlc\jpgxi.exe
O4 - HKLM\..\Run: [xjtk] C:\WINDOWS\System32\anii\xjtk.exe
O4 - HKLM\..\Run: [wpgrlr] C:\WINDOWS\System32\dtrpvi\wpgrlr.exe
O4 - HKLM\..\Run: [ppyp] C:\WINDOWS\System32\sosdfy\ppyp.exe
O4 - HKLM\..\Run: [batcstdt] C:\WINDOWS\System32\rqbwcao\batcstdt.exe
O4 - HKLM\..\Run: [mbqjqj] C:\WINDOWS\System32\uxqsfvi\mbqjqj.exe
O4 - HKLM\..\Run: [ssoeyok] C:\WINDOWS\System32\mwosbfc\ssoeyok.exe
O4 - HKLM\..\Run: [tjmp] C:\WINDOWS\System32\lodd\tjmp.exe
O4 - HKLM\..\Run: [nutkvo] C:\WINDOWS\System32\ilxoahf\nutkvo.exe
O4 - HKLM\..\Run: [jdutx] C:\WINDOWS\System32\adfh\jdutx.exe
O4 - HKLM\..\Run: [sfje] C:\WINDOWS\System32\kbnr\sfje.exe
O4 - HKLM\..\Run: [rwsivur] C:\WINDOWS\System32\scqa\rwsivur.exe
O4 - HKLM\..\Run: [nxga] C:\WINDOWS\System32\xwuiwxyy\nxga.exe
O4 - HKLM\..\Run: [eclxwy] C:\WINDOWS\System32\wpbh\eclxwy.exe
O4 - HKLM\..\Run: [hccq] C:\WINDOWS\System32\fmtwlll\hccq.exe
O4 - HKLM\..\Run: [mdojgctk] C:\WINDOWS\System32\yduqeq\mdojgctk.exe
O4 - HKLM\..\Run: [oailwph] C:\WINDOWS\System32\gwcnu\oailwph.exe
O4 - HKLM\..\Run: [yujxgsk] C:\WINDOWS\System32\veqnbbw\yujxgsk.exe
O4 - HKLM\..\Run: [dhvmulsa] C:\WINDOWS\System32\prapj\dhvmulsa.exe
O4 - HKLM\..\Run: [vqnnqjjl] C:\WINDOWS\System32\pxxmg\vqnnqjjl.exe
O4 - HKLM\..\Run: [jxtx] C:\WINDOWS\System32\smsoaau\jxtx.exe
O4 - HKLM\..\Run: [valtnr] C:\WINDOWS\System32\mgegera\valtnr.exe
O4 - HKLM\..\Run: [axjiqvc] C:\WINDOWS\System32\bavxd\axjiqvc.exe
O4 - HKLM\..\Run: [aafrtvpx] C:\WINDOWS\System32\epdoovy\aafrtvpx.exe
O4 - HKLM\..\Run: [phvrxx] C:\WINDOWS\System32\jsprlg\phvrxx.exe
O4 - HKLM\..\Run: [cubacbnd] C:\WINDOWS\System32\oshnrq\cubacbnd.exe
O4 - HKLM\..\Run: [C:\WINDOWS\iysisosa.exe] C:\WINDOWS\iysisosa.exe
O4 - HKLM\..\Run: [tcfuke] C:\WINDOWS\System32\ttxjvv\tcfuke.exe
O4 - HKLM\..\Run: [nnpylse] C:\WINDOWS\System32\hjgd\nnpylse.exe
O4 - HKLM\..\Run: [etwa] C:\WINDOWS\System32\gxxhean\etwa.exe
O4 - HKLM\..\Run: [skyhn] C:\DOCUME~1\Frys\LOCALS~1\Temp\tavf.exe
O4 - HKLM\..\Run: [scrsvc] C:\WINDOWS\System32\scrsvc.exe
O4 - HKLM\..\Run: [tqcnj] C:\WINDOWS\System32\tvhuswpe\tqcnj.exe
O4 - HKLM\..\Run: [pamlr] C:\WINDOWS\System32\nglsdnuj\pamlr.exe
O4 - HKLM\..\Run: [tkbdinks] C:\WINDOWS\System32\fpasp\tkbdinks.exe
O4 - HKLM\..\Run: [fmachtpq] C:\WINDOWS\System32\tknibac\fmachtpq.exe
O4 - HKLM\..\Run: [hngqy] C:\WINDOWS\System32\wfjb\hngqy.exe
O4 - HKLM\..\Run: [lrny] C:\WINDOWS\System32\xhbqdh\lrny.exe
O4 - HKLM\..\Run: [jxbmwd] C:\WINDOWS\System32\ktbmn\jxbmwd.exe
O4 - HKLM\..\Run: [xcgper] C:\WINDOWS\System32\ijhe\xcgper.exe
O4 - HKLM\..\Run: [trniy] C:\WINDOWS\System32\waway\trniy.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [edaadxit] C:\WINDOWS\System32\ggglfj\edaadxit.exe
O4 - HKLM\..\Run: [cceeil] C:\WINDOWS\System32\twukshq\cceeil.exe
O4 - HKLM\..\Run: [xbjjo] C:\WINDOWS\System32\psnecert\xbjjo.exe
O4 - HKLM\..\Run: [famgs] C:\WINDOWS\System32\soxfms\famgs.exe
O4 - HKLM\..\Run: [sbscx] C:\WINDOWS\System32\itas\sbscx.exe
O4 - HKLM\..\Run: [bajw] C:\WINDOWS\System32\dxdi\bajw.exe
O4 - HKLM\..\Run: [alqpdh] C:\WINDOWS\System32\axtbba\alqpdh.exe
O4 - HKLM\..\Run: [aeajsa] C:\WINDOWS\System32\ibpj\aeajsa.exe
O4 - HKLM\..\Run: [mvaq] C:\WINDOWS\System32\jpthv\mvaq.exe
O4 - HKLM\..\Run: [eqyhws] C:\WINDOWS\System32\bjyom\eqyhws.exe
O4 - HKLM\..\Run: [hkisonev] C:\WINDOWS\System32\lbqgysl\hkisonev.exe
O4 - HKLM\..\Run: [ngxpjbrh] C:\WINDOWS\System32\uaybmif\ngxpjbrh.exe
O4 - HKLM\..\Run: [bssp] C:\WINDOWS\System32\iqmcorib\bssp.exe
O4 - HKLM\..\Run: [jnpoyfug] C:\WINDOWS\System32\rymdyy\jnpoyfug.exe
O4 - HKLM\..\Run: [fnybwolx] C:\WINDOWS\System32\rywguyn\fnybwolx.exe
O4 - HKLM\..\Run: [shstgnj] C:\WINDOWS\System32\hrvpvfy\shstgnj.exe
O4 - HKLM\..\Run: [ehohdi] C:\WINDOWS\System32\rlstst\ehohdi.exe
O4 - HKLM\..\Run: [kvjjwe] C:\WINDOWS\System32\wppssdkr\kvjjwe.exe
O4 - HKLM\..\Run: [pjqtl] C:\WINDOWS\System32\gnblmmjp\pjqtl.exe
O4 - HKLM\..\Run: [cgxeso] C:\WINDOWS\System32\hilsoe\cgxeso.exe
O4 - HKLM\..\Run: [caiepm] C:\WINDOWS\System32\kkcb\caiepm.exe
O4 - HKLM\..\Run: [bekhhhi] C:\WINDOWS\System32\grmxccr\bekhhhi.exe
O4 - HKLM\..\Run: [plffkoa] C:\WINDOWS\System32\cgdpfeq\plffkoa.exe
O4 - HKLM\..\Run: [jsyv] C:\WINDOWS\System32\icalbub\jsyv.exe
O4 - HKLM\..\Run: [epoocgo] C:\WINDOWS\System32\lhjwo\epoocgo.exe
O4 - HKLM\..\Run: [uijp] C:\WINDOWS\System32\tuobcvq\uijp.exe
O4 - HKLM\..\Run: [ipjp] C:\WINDOWS\System32\qbajrxn\ipjp.exe
O4 - HKLM\..\Run: [teupk] C:\WINDOWS\System32\cfwdxmeq\teupk.exe
O4 - HKLM\..\Run: [mogy] C:\WINDOWS\System32\pjqvjuoe\mogy.exe
O4 - HKLM\..\Run: [galheyi] C:\WINDOWS\System32\ilqgg\galheyi.exe
O4 - HKLM\..\Run: [wkjhtd] C:\WINDOWS\System32\uhllbqw\wkjhtd.exe
O4 - HKLM\..\Run: [rgbxqjl] C:\WINDOWS\System32\cgnp\rgbxqjl.exe
O4 - HKLM\..\Run: [sbsrx] C:\WINDOWS\System32\yytq\sbsrx.exe
O4 - HKLM\..\Run: [pbws] C:\WINDOWS\System32\goqcpw\pbws.exe
O4 - HKLM\..\Run: [usoh] C:\WINDOWS\System32\cwjw\usoh.exe
O4 - HKLM\..\Run: [mbrwjdiw] C:\WINDOWS\System32\syuxoeaq\mbrwjdiw.exe
O4 - HKLM\..\Run: [kpucepw] C:\WINDOWS\System32\takubgy\kpucepw.exe
O4 - HKLM\..\Run: [stdjpk] C:\WINDOWS\System32\fpuhyhe\stdjpk.exeJessica200
8 Posts
248
0
Posted May 28th, 2005 22:00
O4 - HKLM\..\Run: [saswoc] C:\WINDOWS\System32\wgedf\saswoc.exe
O4 - HKLM\..\Run: [gdtej] C:\WINDOWS\System32\pdugft\gdtej.exe
O4 - HKLM\..\Run: [qiae] C:\WINDOWS\System32\dvgf\qiae.exe
O4 - HKLM\..\Run: [asgymhyb] C:\WINDOWS\System32\bmferrmd\asgymhyb.exe
O4 - HKLM\..\Run: [cxwvnetw] C:\WINDOWS\System32\jkdv\cxwvnetw.exe
O4 - HKLM\..\Run: [qvtwfnwc] C:\WINDOWS\System32\fmqou\qvtwfnwc.exe
O4 - HKLM\..\Run: [hmiwlck] C:\WINDOWS\System32\duwlb\hmiwlck.exe
O4 - HKLM\..\Run: [rdmwscb] C:\WINDOWS\System32\civwel\rdmwscb.exe
O4 - HKLM\..\Run: [tkklnsoe] C:\WINDOWS\System32\gyspuxg\tkklnsoe.exe
O4 - HKLM\..\Run: [C:\WINDOWS\IEXPLOR.EXE] C:\WINDOWS\IEXPLOR.EXE
O4 - HKLM\..\Run: [AtxBrw] C:\WINDOWS\IEXPLOR.exe
O4 - HKLM\..\Run: [ljamljn] C:\WINDOWS\System32\ruphhqcf\ljamljn.exe
O4 - HKLM\..\Run: [jumpk] C:\WINDOWS\System32\ppmjxd\jumpk.exe
O4 - HKLM\..\Run: [tuptnh] C:\WINDOWS\System32\jbxqgy\tuptnh.exe
O4 - HKLM\..\Run: [evnri] C:\WINDOWS\System32\elurykg\evnri.exe
O4 - HKLM\..\Run: [cuyg] C:\WINDOWS\System32\hdecrgvb\cuyg.exe
O4 - HKLM\..\Run: [rqbrm] C:\WINDOWS\System32\nrtym\rqbrm.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [yddyr] C:\WINDOWS\System32\wdvoinnq\yddyr.exe
O4 - HKLM\..\Run: [quojdaq] C:\WINDOWS\System32\vgxtgmvt\quojdaq.exe
O4 - HKLM\..\Run: [ygttws] C:\WINDOWS\System32\eustmeo\ygttws.exe
O4 - HKLM\..\Run: [wgqsim] C:\WINDOWS\System32\uibqag\wgqsim.exe
O4 - HKLM\..\Run: [grktplak] C:\WINDOWS\System32\otnisow\grktplak.exe
O4 - HKLM\..\Run: [arpity] C:\WINDOWS\System32\huigqyg\arpity.exe
O4 - HKLM\..\Run: [tnhrhvd] C:\WINDOWS\System32\rlmaa\tnhrhvd.exe
O4 - HKLM\..\Run: [xbplrp] C:\WINDOWS\System32\godc\xbplrp.exe
O4 - HKLM\..\Run: [rclnftn] C:\WINDOWS\System32\nxcaxq\rclnftn.exe
O4 - HKLM\..\Run: [vsiawosf] C:\WINDOWS\System32\oawarq\vsiawosf.exe
O4 - HKLM\..\Run: [rsgxnn] C:\WINDOWS\System32\qwketggs\rsgxnn.exe
O4 - HKLM\..\Run: [gkks] C:\WINDOWS\System32\iaahhm\gkks.exe
O4 - HKLM\..\Run: [vmesu] C:\WINDOWS\System32\yaoj\vmesu.exe
O4 - HKLM\..\Run: [ipydiiag] C:\WINDOWS\System32\xoylfav\ipydiiag.exe
O4 - HKLM\..\Run: [hlja] C:\WINDOWS\System32\cgop\hlja.exe
O4 - HKLM\..\Run: [lixox] C:\WINDOWS\System32\ocbw\lixox.exe
O4 - HKLM\..\Run: [pofrtjp] C:\WINDOWS\System32\tolgctky\pofrtjp.exe
O4 - HKLM\..\Run: [ugovmg] C:\WINDOWS\System32\quibuo\ugovmg.exe
O4 - HKLM\..\Run: [jajagosj] C:\WINDOWS\System32\hhdj\jajagosj.exe
O4 - HKLM\..\Run: [igvhmlb] C:\WINDOWS\System32\byrm\igvhmlb.exe
O4 - HKLM\..\Run: [frujoq] C:\WINDOWS\System32\bhgs\frujoq.exe
O4 - HKLM\..\Run: [iudteyhf] C:\WINDOWS\System32\dwxaga\iudteyhf.exe
O4 - HKLM\..\Run: [fmqqn] C:\WINDOWS\System32\mdeqnda\fmqqn.exe
O4 - HKLM\..\Run: [mnfq] C:\WINDOWS\System32\goyuf\mnfq.exe
O4 - HKLM\..\Run: [C:\WINDOWS\sgaugimgkq.exe] C:\WINDOWS\sgaugimgkq.exe
O4 - HKLM\..\Run: [C:\WINDOWS\ymowuiyg.exe] C:\WINDOWS\ymowuiyg.exe
O4 - HKLM\..\Run: [C:\WINDOWS\qcoseuiya.exe] C:\WINDOWS\qcoseuiya.exe
O4 - HKLM\..\Run: [qhop] C:\WINDOWS\System32\yurxyowr\qhop.exe
O4 - HKLM\..\Run: [ivknocu] C:\WINDOWS\System32\nandei\ivknocu.exe
O4 - HKLM\..\Run: [udxvf] C:\WINDOWS\System32\ibrmimyx\udxvf.exe
O4 - HKLM\..\Run: [jydkdie] C:\WINDOWS\System32\eijfv\jydkdie.exe
O4 - HKLM\..\Run: [pkdxwyn] C:\WINDOWS\System32\bqet\pkdxwyn.exe
O4 - HKLM\..\Run: [vfjq] C:\WINDOWS\System32\jvqcfx\vfjq.exe
O4 - HKLM\..\Run: [xctx] C:\WINDOWS\System32\loyfb\xctx.exe
O4 - HKLM\..\Run: [odovt] C:\WINDOWS\System32\eiyr\odovt.exe
O4 - HKLM\..\Run: [jcbdfvs] C:\WINDOWS\System32\ifkno\jcbdfvs.exe
O4 - HKLM\..\Run: [rniui] C:\WINDOWS\System32\jqnyy\rniui.exe
O4 - HKLM\..\Run: [dmhdvmm] C:\WINDOWS\System32\wgqkbp\dmhdvmm.exe
O4 - HKLM\..\Run: [cclrih] C:\WINDOWS\System32\svcpjnys\cclrih.exe
O4 - HKLM\..\Run: [ypfaima] C:\WINDOWS\System32\vdoja\ypfaima.exe
O4 - HKLM\..\Run: [bkkjmji] C:\WINDOWS\System32\cwdd\bkkjmji.exe
O4 - HKLM\..\Run: [elduo] C:\WINDOWS\System32\xaoywyf\elduo.exe
O4 - HKLM\..\Run: [hwsjd] C:\WINDOWS\System32\pxnpmlp\hwsjd.exe
O4 - HKLM\..\Run: [juat] C:\WINDOWS\System32\khykklpu\juat.exe
O4 - HKLM\..\Run: [cdfhdwfv] C:\WINDOWS\System32\eaqqcj\cdfhdwfv.exe
O4 - HKLM\..\Run: [jghf] C:\WINDOWS\System32\vevtio\jghf.exe
O4 - HKLM\..\Run: [ynqpjxx] C:\WINDOWS\System32\txvgicvf\ynqpjxx.exe
O4 - HKLM\..\Run: [yqivrh] C:\WINDOWS\System32\rssnq\yqivrh.exe
O4 - HKLM\..\Run: [xbvqp] C:\WINDOWS\System32\opagl\xbvqp.exe
O4 - HKLM\..\Run: [hadd] C:\WINDOWS\System32\wpxxgwdi\hadd.exe
O4 - HKLM\..\Run: [mmfeqq] C:\WINDOWS\System32\frlqbtka\mmfeqq.exe
O4 - HKLM\..\Run: [nbqxlt] C:\WINDOWS\System32\esagjvs\nbqxlt.exe
O4 - HKLM\..\Run: [vwkrao] C:\WINDOWS\System32\ylvgp\vwkrao.exe
O4 - HKLM\..\Run: [ayxdey] C:\WINDOWS\System32\lusfkv\ayxdey.exe
O4 - HKLM\..\Run: [wottampb] C:\WINDOWS\System32\ouoqbk\wottampb.exe
O4 - HKLM\..\Run: [ijpj] C:\WINDOWS\System32\yhto\ijpj.exe
O4 - HKLM\..\Run: [C:\WINDOWS\WinTask.exe] C:\WINDOWS\WinTask.exe
O4 - HKLM\..\Run: [qmjtky] C:\WINDOWS\System32\qesbxiyn\qmjtky.exe
O4 - HKLM\..\Run: [brfdxu] C:\WINDOWS\System32\rqhmjm\brfdxu.exe
O4 - HKLM\..\Run: [lnmu] C:\WINDOWS\System32\gotjd\lnmu.exe
O4 - HKLM\..\Run: [ungbx] C:\WINDOWS\System32\ndlcl\ungbx.exe
O4 - HKLM\..\Run: [crrai] C:\WINDOWS\System32\wruiiok\crrai.exe
O4 - HKLM\..\Run: [ddgpd] C:\WINDOWS\System32\wccd\ddgpd.exe
O4 - HKLM\..\Run: [mnyfgo] C:\WINDOWS\System32\jkcjn\mnyfgo.exe
O4 - HKLM\..\Run: [qiuxdhd] C:\WINDOWS\System32\tthvuwpq\qiuxdhd.exe
O4 - HKLM\..\Run: [abasa5jrp] C:\WINDOWS\System32\abasa5jrp.exe
O4 - HKLM\..\Run: [VF0060 STISvc] RunDLL32.exe V0060Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [fwtaeqfg] C:\WINDOWS\System32\owbkobq\fwtaeqfg.exe
O4 - HKLM\..\Run: [nelhoai] C:\WINDOWS\System32\ladyurc\nelhoai.exe
O4 - HKLM\..\Run: [bruufh] C:\WINDOWS\System32\ffid\bruufh.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitedfm32.exe
O4 - HKLM\..\Run: [tvs_b] C:\program files\tvs\tvs_b.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pmwglw] C:\WINDOWS\System32\sglby\pmwglw.exe
O4 - HKLM\..\Run: [ydvgudu] C:\WINDOWS\System32\omsv\ydvgudu.exe
O4 - HKLM\..\Run: [uhxnacw] C:\WINDOWS\System32\ebvksab\uhxnacw.exe
O4 - HKLM\..\Run: [oyqdqwtd] C:\WINDOWS\System32\vdxry\oyqdqwtd.exe
O4 - HKLM\..\Run: [shirnaqx] C:\WINDOWS\System32\rkkuj\shirnaqx.exe
O4 - HKLM\..\Run: [jiylkmvm] C:\WINDOWS\System32\fwslofi\jiylkmvm.exe
O4 - HKLM\..\Run: [mpjcphi] C:\WINDOWS\System32\trcekfg\mpjcphi.exe
O4 - HKLM\..\Run: [gjtbv] C:\WINDOWS\System32\aiiet\gjtbv.exe
O4 - HKLM\..\Run: [skptu] C:\WINDOWS\System32\ajvqw\skptu.exe
O4 - HKLM\..\Run: [flpk] C:\WINDOWS\System32\ruug\flpk.exe
O4 - HKLM\..\Run: [kafqjfia] C:\WINDOWS\System32\spuwv\kafqjfia.exe
O4 - HKLM\..\Run: [broi] C:\WINDOWS\System32\fykhxmr\broi.exe
O4 - HKLM\..\Run: [aljslvo] C:\WINDOWS\System32\rgltbq\aljslvo.exe
O4 - HKLM\..\Run: [bqxgylg] C:\WINDOWS\System32\fjln\bqxgylg.exe
O4 - HKLM\..\Run: [miqtef] C:\WINDOWS\System32\suht\miqtef.exe
O4 - HKLM\..\Run: [ispp] C:\WINDOWS\System32\jkrrg\ispp.exe
O4 - HKLM\..\Run: [ajgiddo] C:\WINDOWS\System32\nbsc\ajgiddo.exe
O4 - HKLM\..\Run: [jrao] C:\WINDOWS\System32\cbpufxyy\jrao.exe
O4 - HKLM\..\Run: [widcif] C:\WINDOWS\System32\cakk\widcif.exe
O4 - HKLM\..\Run: [FlnCPY] "C:\Program Files\Common Files\Java\flncpy.exe"
O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [sjssje] C:\WINDOWS\System32\rvhvgmv\sjssje.exe
O4 - HKLM\..\Run: [kpubtei] C:\WINDOWS\System32\jxyr\kpubtei.exe
O4 - HKLM\..\Run: [ekacyqg] C:\WINDOWS\System32\qqwygk\ekacyqg.exe
O4 - HKLM\..\Run: [jtudcpj] C:\WINDOWS\System32\lyvvnnw\jtudcpj.exe
O4 - HKLM\..\Run: [cgqufb] C:\WINDOWS\System32\nkhtih\cgqufb.exe
O4 - HKLM\..\Run: [agss] C:\WINDOWS\System32\amwtfa\agss.exe
O4 - HKLM\..\Run: [ntinnrb] C:\WINDOWS\System32\ptmxeih\ntinnrb.exe
O4 - HKLM\..\Run: [mvtqdb] C:\WINDOWS\System32\ycctgaid\mvtqdb.exe
O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SVCHOST.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [gkjnqhri] C:\WINDOWS\System32\hmhosf\gkjnqhri.exe
O4 - HKLM\..\Run: [mjichj] C:\WINDOWS\System32\pmvjv\mjichj.exe
O4 - HKLM\..\Run: [njhwca] C:\WINDOWS\System32\kivo\njhwca.exe
O4 - HKLM\..\Run: [frtt] C:\WINDOWS\System32\jbxucgo\frtt.exe
O4 - HKLM\..\Run: [jgvf] C:\WINDOWS\System32\yjeqjg\jgvf.exe
O4 - HKLM\..\Run: [htncl] C:\WINDOWS\System32\phyttqs\htncl.exe
O4 - HKLM\..\Run: [jupfno] C:\WINDOWS\System32\pxepqt\jupfno.exe
O4 - HKLM\..\Run: [aoqivux] C:\WINDOWS\System32\xbwm\aoqivux.exe
O4 - HKLM\..\Run: [itpw] C:\WINDOWS\System32\shfyrr\itpw.exe
O4 - HKLM\..\Run: [nvod] C:\WINDOWS\System32\totrmm\nvod.exe
O4 - HKLM\..\Run: [nxgoipps] C:\WINDOWS\System32\osibm\nxgoipps.exe
O4 - HKLM\..\Run: [edmglb] C:\WINDOWS\System32\jjjfx\edmglb.exe
O4 - HKLM\..\Run: [uajc] C:\WINDOWS\System32\uiohg\uajc.exe
O4 - HKLM\..\Run: [fijxmgla] C:\WINDOWS\System32\tges\fijxmgla.exe
O4 - HKLM\..\Run: [nmcos] C:\WINDOWS\System32\vjrkdhbt\nmcos.exe
O4 - HKLM\..\Run: [zcygnvb] c:\windows\system32\bghvknl.exe
O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SECURITY.EXE
O4 - HKLM\..\RunOnce: [tvs_re] c:\Program Files\Common Files\Java\tvs_re_inst.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [inked] C:\WINDOWS\System32\inked.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O14 - IERESET.INF: START_PAGE_URL=http://us8l.hpwis.com
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://eztracks.aavalue.com/EZT/Toolbar/eztdl.cab
O16 - DPF: {610D3ADB-6883-4129-93FC-41723177F7B9} - http://69.50.182.94/1/rdgUS1882.exe
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://static.35mb.com/applet/applet_y.cab
O23 - Service: aeajsaibpj - Unknown owner - C:\WINDOWS\System32\ibpj\aeajsa.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: bkkjmjicwdd - Unknown owner - C:\WINDOWS\System32\cwdd\bkkjmji.exe (file missing)
O23 - Service: bruufhffid - Unknown owner - C:\WINDOWS\System32\ffid\bruufh.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: cdfhdwfveaqqcj - Unknown owner - C:\WINDOWS\System32\eaqqcj\cdfhdwfv.exe (file missing)
O23 - Service: cwnyiddfkkqspv - Unknown owner - C:\WINDOWS\System32\fkkqspv\cwnyidd.exe
O23 - Service: dxlrttktnkcf - Unknown owner - C:\WINDOWS\System32\ktnkcf\dxlrtt.exe (file missing)
O23 - Service: frujoqbhgs - Unknown owner - C:\WINDOWS\System32\bhgs\frujoq.exe
O23 - Service: fwtaeqfgowbkobq - Unknown owner - C:\WINDOWS\System32\owbkobq\fwtaeqfg.exe (file missing)
O23 - Service: ggxmneeklsrnv - Unknown owner - C:\WINDOWS\System32\eklsrnv\ggxmne.exe (file missing)
O23 - Service: hrnaffvsvf - Unknown owner - C:\WINDOWS\System32\vsvf\hrnaff.exe (file missing)
O23 - Service: htnclphyttqs - Unknown owner - C:\WINDOWS\System32\phyttqs\htncl.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: irwehxfuhlcodl - Unknown owner - C:\WINDOWS\System32\fuhlcodl\irwehx.exe (file missing)
O23 - Service: jghfvevtio - Unknown owner - C:\WINDOWS\System32\vevtio\jghf.exe
O23 - Service: jumpkppmjxd - Unknown owner - C:\WINDOWS\System32\ppmjxd\jumpk.exe (file missing)
O23 - Service: jxbmwdktbmn - Unknown owner - C:\WINDOWS\System32\ktbmn\jxbmwd.exe (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: kpubteijxyr - Unknown owner - C:\WINDOWS\System32\jxyr\kpubtei.exe (file missing)
O23 - Service: lnmugotjd - Unknown owner - C:\WINDOWS\System32\gotjd\lnmu.exe
O23 - Service: mvaqjpthv - Unknown owner - C:\WINDOWS\System32\jpthv\mvaq.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: nelhoailadyurc - Unknown owner - C:\WINDOWS\System32\ladyurc\nelhoai.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: nutkvoilxoahf - Unknown owner - C:\WINDOWS\System32\ilxoahf\nutkvo.exe
O23 - Service: nvodtotrmm - Unknown owner - C:\WINDOWS\System32\totrmm\nvod.exe
O23 - Service: nxgoippsosibm - Unknown owner - C:\WINDOWS\System32\osibm\nxgoipps.exe
O23 - Service: pamlrnglsdnuj - Unknown owner - C:\WINDOWS\System32\nglsdnuj\pamlr.exe (file missing)
O23 - Service: qpwebjtlqmme - Unknown owner - C:\WINDOWS\System32\bjtlqmme\qpwe.exe (file missing)
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: shirnaqxrkkuj - Unknown owner - C:\WINDOWS\System32\rkkuj\shirnaqx.exe
O23 - Service: sjssjervhvgmv - Unknown owner - C:\WINDOWS\System32\rvhvgmv\sjssje.exe
O23 - Service: skptuajvqw - Unknown owner - C:\WINDOWS\System32\ajvqw\skptu.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: tnhrhvdrlmaa - Unknown owner - C:\WINDOWS\System32\rlmaa\tnhrhvd.exe
O23 - Service: tqcnjtvhuswpe - Unknown owner - C:\WINDOWS\System32\tvhuswpe\tqcnj.exe
O23 - Service: ugovmgquibuo - Unknown owner - C:\WINDOWS\System32\quibuo\ugovmg.exe
O23 - Service: vmesuyaoj - Unknown owner - C:\WINDOWS\System32\yaoj\vmesu.exe
O23 - Service: wpgrlrdtrpvi - Unknown owner - C:\WINDOWS\System32\dtrpvi\wpgrlr.exe
O23 - Service: xjtkanii - Unknown owner - C:\WINDOWS\System32\anii\xjtk.exe (file missing)
O23 - Service: yddyrwdvoinnq - Unknown owner - C:\WINDOWS\System32\wdvoinnq\yddyr.exe
O23 - Service: ypfaimavdoja - Unknown owner - C:\WINDOWS\System32\vdoja\ypfaima.exezbestwun2001
4 Apprentice
•
8831 Posts
248
0
Posted May 28th, 2005 23:00
Message Edited by zbestwun2001 on 05-28-2005 06:09 PM
zbestwun2001
4 Apprentice
•
8831 Posts
248
0
Posted May 29th, 2005 00:00
Download CWShredder then:
1. Click " Check For Update"
( If an update isn't available, skip to step #4.)
2. Click " Click here to Download the upate".
3. When the new version has been downloaded, click " Save".
4. Click " Fix ->"
Download LSPFix from here: http://www.cexx.org/lspfix.htm
and unzip to your desktop, then run it. Now, we need
to:
1. check(tick) "I know what i'm doing".
2. click on (highlight) each occurance of the following, one at a time:
flsmngr.dll
3. then click ">>",
moving each one, individually, to the 'Remove'
pane.
4. (double-check, and make sure that only the above files are in the 'Remove'pane.)
5. click "Finish >>"
Next Please Print this page, you won't be able to see it in safe mode.
please download to desktop but don't run yet:
WinsockXPFix
Copy the text inside the 'Code' box to Notepad, and save in a location of your choice as Fix.reg (make sure you save as type: 'all files')
Code:
Windows Registry Editor Version 5.00
[-HKEY_CURRENT_USER\Software\LQ]
[-HKEY_LOCAL_MACHINE\SOFTWARE\ohbbackup]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Elitum]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kalvsys"=-
Reboot into safe mode by tapping F8 at boot, then use the up/down arrows to select safe mode
Manually find and delete :
>
- the ENTIRE contents of the C:\Documents and Settings\"Your User Name"\Local Settings\Temp folder
- the EliteToolBar folder in C:\Windows
- The C:\Windows\System32\Error.dat file. if you have it.
NOTE: To avoid the risk of any of the above not being found due to them
having the 'Hidden' attribute, show all files as follows:
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
Now go to Start > Run, and type Cmd then press Enter > The Command window opens
Copy the following line:
DEL /F /Q "%windir%\system32\Kalv***32.exe"
RIGHTclick your mouse in the Command Window. The line you've copied
will get pasted into the command window. Subsequently press the ENTER
button.
*********************************************
Now Doubleclick Fix.reg you saved earlier, and answer yes when prompted to add its contents to the Registry.
Now run WinsockXPFix
When you run the program, create ReG-Backup onto desktop then click fix.
That way, if you lose Internet Connectivity you can restore from that
backup to get back online and we can try a different approach.
you're done, start your computer normally, and post a fresh log.
SteveMessage Edited by zbestwun2001 on 05-28-2005 06:11 PM
Jessica200
8 Posts
248
0
Posted May 29th, 2005 01:00
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [yddyr] C:\WINDOWS\System32\wdvoinnq\yddyr.exe
O4 - HKLM\..\Run: [quojdaq] C:\WINDOWS\System32\vgxtgmvt\quojdaq.exe
O4 - HKLM\..\Run: [ygttws] C:\WINDOWS\System32\eustmeo\ygttws.exe
O4 - HKLM\..\Run: [wgqsim] C:\WINDOWS\System32\uibqag\wgqsim.exe
O4 - HKLM\..\Run: [grktplak] C:\WINDOWS\System32\otnisow\grktplak.exe
O4 - HKLM\..\Run: [arpity] C:\WINDOWS\System32\huigqyg\arpity.exe
O4 - HKLM\..\Run: [tnhrhvd] C:\WINDOWS\System32\rlmaa\tnhrhvd.exe
O4 - HKLM\..\Run: [xbplrp] C:\WINDOWS\System32\godc\xbplrp.exe
O4 - HKLM\..\Run: [rclnftn] C:\WINDOWS\System32\nxcaxq\rclnftn.exe
O4 - HKLM\..\Run: [vsiawosf] C:\WINDOWS\System32\oawarq\vsiawosf.exe
O4 - HKLM\..\Run: [rsgxnn] C:\WINDOWS\System32\qwketggs\rsgxnn.exe
O4 - HKLM\..\Run: [gkks] C:\WINDOWS\System32\iaahhm\gkks.exe
O4 - HKLM\..\Run: [vmesu] C:\WINDOWS\System32\yaoj\vmesu.exe
O4 - HKLM\..\Run: [ipydiiag] C:\WINDOWS\System32\xoylfav\ipydiiag.exe
O4 - HKLM\..\Run: [hlja] C:\WINDOWS\System32\cgop\hlja.exe
O4 - HKLM\..\Run: [lixox] C:\WINDOWS\System32\ocbw\lixox.exe
O4 - HKLM\..\Run: [pofrtjp] C:\WINDOWS\System32\tolgctky\pofrtjp.exe
O4 - HKLM\..\Run: [ugovmg] C:\WINDOWS\System32\quibuo\ugovmg.exe
O4 - HKLM\..\Run: [jajagosj] C:\WINDOWS\System32\hhdj\jajagosj.exe
O4 - HKLM\..\Run: [igvhmlb] C:\WINDOWS\System32\byrm\igvhmlb.exe
O4 - HKLM\..\Run: [frujoq] C:\WINDOWS\System32\bhgs\frujoq.exe
O4 - HKLM\..\Run: [iudteyhf] C:\WINDOWS\System32\dwxaga\iudteyhf.exe
O4 - HKLM\..\Run: [fmqqn] C:\WINDOWS\System32\mdeqnda\fmqqn.exe
O4 - HKLM\..\Run: [mnfq] C:\WINDOWS\System32\goyuf\mnfq.exe
O4 - HKLM\..\Run: [C:\WINDOWS\sgaugimgkq.exe] C:\WINDOWS\sgaugimgkq.exe
O4 - HKLM\..\Run: [C:\WINDOWS\ymowuiyg.exe] C:\WINDOWS\ymowuiyg.exe
O4 - HKLM\..\Run: [C:\WINDOWS\qcoseuiya.exe] C:\WINDOWS\qcoseuiya.exe
O4 - HKLM\..\Run: [qhop] C:\WINDOWS\System32\yurxyowr\qhop.exe
O4 - HKLM\..\Run: [ivknocu] C:\WINDOWS\System32\nandei\ivknocu.exe
O4 - HKLM\..\Run: [udxvf] C:\WINDOWS\System32\ibrmimyx\udxvf.exe
O4 - HKLM\..\Run: [jydkdie] C:\WINDOWS\System32\eijfv\jydkdie.exe
O4 - HKLM\..\Run: [pkdxwyn] C:\WINDOWS\System32\bqet\pkdxwyn.exe
O4 - HKLM\..\Run: [vfjq] C:\WINDOWS\System32\jvqcfx\vfjq.exe
O4 - HKLM\..\Run: [xctx] C:\WINDOWS\System32\loyfb\xctx.exe
O4 - HKLM\..\Run: [odovt] C:\WINDOWS\System32\eiyr\odovt.exe
O4 - HKLM\..\Run: [jcbdfvs] C:\WINDOWS\System32\ifkno\jcbdfvs.exe
O4 - HKLM\..\Run: [rniui] C:\WINDOWS\System32\jqnyy\rniui.exe
O4 - HKLM\..\Run: [dmhdvmm] C:\WINDOWS\System32\wgqkbp\dmhdvmm.exe
O4 - HKLM\..\Run: [cclrih] C:\WINDOWS\System32\svcpjnys\cclrih.exe
O4 - HKLM\..\Run: [ypfaima] C:\WINDOWS\System32\vdoja\ypfaima.exe
O4 - HKLM\..\Run: [bkkjmji] C:\WINDOWS\System32\cwdd\bkkjmji.exe
O4 - HKLM\..\Run: [elduo] C:\WINDOWS\System32\xaoywyf\elduo.exe
O4 - HKLM\..\Run: [hwsjd] C:\WINDOWS\System32\pxnpmlp\hwsjd.exe
O4 - HKLM\..\Run: [juat] C:\WINDOWS\System32\khykklpu\juat.exe
O4 - HKLM\..\Run: [cdfhdwfv] C:\WINDOWS\System32\eaqqcj\cdfhdwfv.exe
O4 - HKLM\..\Run: [jghf] C:\WINDOWS\System32\vevtio\jghf.exe
O4 - HKLM\..\Run: [ynqpjxx] C:\WINDOWS\System32\txvgicvf\ynqpjxx.exe
O4 - HKLM\..\Run: [yqivrh] C:\WINDOWS\System32\rssnq\yqivrh.exe
O4 - HKLM\..\Run: [xbvqp] C:\WINDOWS\System32\opagl\xbvqp.exe
O4 - HKLM\..\Run: [hadd] C:\WINDOWS\System32\wpxxgwdi\hadd.exe
O4 - HKLM\..\Run: [mmfeqq] C:\WINDOWS\System32\frlqbtka\mmfeqq.exe
O4 - HKLM\..\Run: [nbqxlt] C:\WINDOWS\System32\esagjvs\nbqxlt.exe
O4 - HKLM\..\Run: [vwkrao] C:\WINDOWS\System32\ylvgp\vwkrao.exe
O4 - HKLM\..\Run: [ayxdey] C:\WINDOWS\System32\lusfkv\ayxdey.exe
O4 - HKLM\..\Run: [wottampb] C:\WINDOWS\System32\ouoqbk\wottampb.exe
O4 - HKLM\..\Run: [ijpj] C:\WINDOWS\System32\yhto\ijpj.exe
O4 - HKLM\..\Run: [C:\WINDOWS\WinTask.exe] C:\WINDOWS\WinTask.exe
O4 - HKLM\..\Run: [qmjtky] C:\WINDOWS\System32\qesbxiyn\qmjtky.exe
O4 - HKLM\..\Run: [brfdxu] C:\WINDOWS\System32\rqhmjm\brfdxu.exe
O4 - HKLM\..\Run: [lnmu] C:\WINDOWS\System32\gotjd\lnmu.exe
O4 - HKLM\..\Run: [ungbx] C:\WINDOWS\System32\ndlcl\ungbx.exe
O4 - HKLM\..\Run: [crrai] C:\WINDOWS\System32\wruiiok\crrai.exe
O4 - HKLM\..\Run: [ddgpd] C:\WINDOWS\System32\wccd\ddgpd.exe
O4 - HKLM\..\Run: [mnyfgo] C:\WINDOWS\System32\jkcjn\mnyfgo.exe
O4 - HKLM\..\Run: [qiuxdhd] C:\WINDOWS\System32\tthvuwpq\qiuxdhd.exe
O4 - HKLM\..\Run: [abasa5jrp] C:\WINDOWS\System32\abasa5jrp.exe
O4 - HKLM\..\Run: [VF0060 STISvc] RunDLL32.exe V0060Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [fwtaeqfg] C:\WINDOWS\System32\owbkobq\fwtaeqfg.exe
O4 - HKLM\..\Run: [nelhoai] C:\WINDOWS\System32\ladyurc\nelhoai.exe
O4 - HKLM\..\Run: [bruufh] C:\WINDOWS\System32\ffid\bruufh.exe
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitedfm32.exe
O4 - HKLM\..\Run: [tvs_b] C:\program files\tvs\tvs_b.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pmwglw] C:\WINDOWS\System32\sglby\pmwglw.exe
O4 - HKLM\..\Run: [ydvgudu] C:\WINDOWS\System32\omsv\ydvgudu.exe
O4 - HKLM\..\Run: [uhxnacw] C:\WINDOWS\System32\ebvksab\uhxnacw.exe
O4 - HKLM\..\Run: [oyqdqwtd] C:\WINDOWS\System32\vdxry\oyqdqwtd.exe
O4 - HKLM\..\Run: [shirnaqx] C:\WINDOWS\System32\rkkuj\shirnaqx.exe
O4 - HKLM\..\Run: [jiylkmvm] C:\WINDOWS\System32\fwslofi\jiylkmvm.exe
O4 - HKLM\..\Run: [mpjcphi] C:\WINDOWS\System32\trcekfg\mpjcphi.exe
O4 - HKLM\..\Run: [gjtbv] C:\WINDOWS\System32\aiiet\gjtbv.exe
O4 - HKLM\..\Run: [skptu] C:\WINDOWS\System32\ajvqw\skptu.exe
O4 - HKLM\..\Run: [flpk] C:\WINDOWS\System32\ruug\flpk.exe
O4 - HKLM\..\Run: [kafqjfia] C:\WINDOWS\System32\spuwv\kafqjfia.exe
O4 - HKLM\..\Run: [broi] C:\WINDOWS\System32\fykhxmr\broi.exe
O4 - HKLM\..\Run: [aljslvo] C:\WINDOWS\System32\rgltbq\aljslvo.exe
O4 - HKLM\..\Run: [bqxgylg] C:\WINDOWS\System32\fjln\bqxgylg.exe
O4 - HKLM\..\Run: [miqtef] C:\WINDOWS\System32\suht\miqtef.exe
O4 - HKLM\..\Run: [ispp] C:\WINDOWS\System32\jkrrg\ispp.exe
O4 - HKLM\..\Run: [ajgiddo] C:\WINDOWS\System32\nbsc\ajgiddo.exe
O4 - HKLM\..\Run: [jrao] C:\WINDOWS\System32\cbpufxyy\jrao.exe
O4 - HKLM\..\Run: [widcif] C:\WINDOWS\System32\cakk\widcif.exe
O4 - HKLM\..\Run: [FlnCPY] "C:\Program Files\Common Files\Java\flncpy.exe"
O4 - HKLM\..\Run: [FlaCPY] "C:\Program Files\Common Files\Java\flacpy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [sjssje] C:\WINDOWS\System32\rvhvgmv\sjssje.exe
O4 - HKLM\..\Run: [kpubtei] C:\WINDOWS\System32\jxyr\kpubtei.exe
O4 - HKLM\..\Run: [ekacyqg] C:\WINDOWS\System32\qqwygk\ekacyqg.exe
O4 - HKLM\..\Run: [jtudcpj] C:\WINDOWS\System32\lyvvnnw\jtudcpj.exe
O4 - HKLM\..\Run: [cgqufb] C:\WINDOWS\System32\nkhtih\cgqufb.exe
O4 - HKLM\..\Run: [agss] C:\WINDOWS\System32\amwtfa\agss.exe
O4 - HKLM\..\Run: [ntinnrb] C:\WINDOWS\System32\ptmxeih\ntinnrb.exe
O4 - HKLM\..\Run: [mvtqdb] C:\WINDOWS\System32\ycctgaid\mvtqdb.exe
O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SVCHOST.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [gkjnqhri] C:\WINDOWS\System32\hmhosf\gkjnqhri.exe
O4 - HKLM\..\Run: [mjichj] C:\WINDOWS\System32\pmvjv\mjichj.exe
O4 - HKLM\..\Run: [njhwca] C:\WINDOWS\System32\kivo\njhwca.exe
O4 - HKLM\..\Run: [frtt] C:\WINDOWS\System32\jbxucgo\frtt.exe
O4 - HKLM\..\Run: [jgvf] C:\WINDOWS\System32\yjeqjg\jgvf.exe
O4 - HKLM\..\Run: [htncl] C:\WINDOWS\System32\phyttqs\htncl.exe
O4 - HKLM\..\Run: [jupfno] C:\WINDOWS\System32\pxepqt\jupfno.exe
O4 - HKLM\..\Run: [aoqivux] C:\WINDOWS\System32\xbwm\aoqivux.exe
O4 - HKLM\..\Run: [itpw] C:\WINDOWS\System32\shfyrr\itpw.exe
O4 - HKLM\..\Run: [nvod] C:\WINDOWS\System32\totrmm\nvod.exe
O4 - HKLM\..\Run: [nxgoipps] C:\WINDOWS\System32\osibm\nxgoipps.exe
O4 - HKLM\..\Run: [edmglb] C:\WINDOWS\System32\jjjfx\edmglb.exe
O4 - HKLM\..\Run: [uajc] C:\WINDOWS\System32\uiohg\uajc.exe
O4 - HKLM\..\Run: [fijxmgla] C:\WINDOWS\System32\tges\fijxmgla.exe
O4 - HKLM\..\Run: [nmcos] C:\WINDOWS\System32\vjrkdhbt\nmcos.exe
O4 - HKLM\..\Run: [vxipgxk] c:\windows\system32\fbommqt.exe
O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SECURITY.EXE
O4 - HKLM\..\RunOnce: [tvs_re] c:\Program Files\Common Files\Java\tvs_re_inst.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [inked] C:\WINDOWS\System32\inked.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://us8l.hpwis.com
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://eztracks.aavalue.com/EZT/Toolbar/eztdl.cab
O16 - DPF: {610D3ADB-6883-4129-93FC-41723177F7B9} - http://69.50.182.94/1/rdgUS1882.exe
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://static.35mb.com/applet/applet_y.cab
O23 - Service: aeajsaibpj - Unknown owner - C:\WINDOWS\System32\ibpj\aeajsa.exe (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: bkkjmjicwdd - Unknown owner - C:\WINDOWS\System32\cwdd\bkkjmji.exe (file missing)
O23 - Service: bruufhffid - Unknown owner - C:\WINDOWS\System32\ffid\bruufh.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: cdfhdwfveaqqcj - Unknown owner - C:\WINDOWS\System32\eaqqcj\cdfhdwfv.exe (file missing)
O23 - Service: cwnyiddfkkqspv - Unknown owner - C:\WINDOWS\System32\fkkqspv\cwnyidd.exe
O23 - Service: dxlrttktnkcf - Unknown owner - C:\WINDOWS\System32\ktnkcf\dxlrtt.exe (file missing)
O23 - Service: frujoqbhgs - Unknown owner - C:\WINDOWS\System32\bhgs\frujoq.exe
O23 - Service: fwtaeqfgowbkobq - Unknown owner - C:\WINDOWS\System32\owbkobq\fwtaeqfg.exe (file missing)
O23 - Service: ggxmneeklsrnv - Unknown owner - C:\WINDOWS\System32\eklsrnv\ggxmne.exe (file missing)
O23 - Service: hrnaffvsvf - Unknown owner - C:\WINDOWS\System32\vsvf\hrnaff.exe (file missing)
O23 - Service: htnclphyttqs - Unknown owner - C:\WINDOWS\System32\phyttqs\htncl.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: irwehxfuhlcodl - Unknown owner - C:\WINDOWS\System32\fuhlcodl\irwehx.exe (file missing)
O23 - Service: jghfvevtio - Unknown owner - C:\WINDOWS\System32\vevtio\jghf.exe
O23 - Service: jumpkppmjxd - Unknown owner - C:\WINDOWS\System32\ppmjxd\jumpk.exe (file missing)
O23 - Service: jxbmwdktbmn - Unknown owner - C:\WINDOWS\System32\ktbmn\jxbmwd.exe (file missing)
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: kpubteijxyr - Unknown owner - C:\WINDOWS\System32\jxyr\kpubtei.exe (file missing)
O23 - Service: lnmugotjd - Unknown owner - C:\WINDOWS\System32\gotjd\lnmu.exe
O23 - Service: mvaqjpthv - Unknown owner - C:\WINDOWS\System32\jpthv\mvaq.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: nelhoailadyurc - Unknown owner - C:\WINDOWS\System32\ladyurc\nelhoai.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Jessica200
8 Posts
248
0
Posted May 29th, 2005 01:00
Ok, hopefully I did this right. Here is the new log...
Logfile of HijackThis v1.99.1
Scan saved at 7:08:45 PM, on 5/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\totrmm\nvod.exe
C:\WINDOWS\System32\osibm\nxgoipps.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\System32\scrsvc.exe
C:\WINDOWS\System32\tges\fijxmgla.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\soxfms\famgs.exe
C:\WINDOWS\System32\axtbba\alqpdh.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\osibm\nxgoipps.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\jqnyy\rniui.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wccd\ddgpd.exe
C:\WINDOWS\System32\RunDLL32.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\omsv\ydvgudu.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\vjrkdhbt\nmcos.exe
C:\WINDOWS\System32\qqwygk\ekacyqg.exe
C:\WINDOWS\System32\lyvvnnw\jtudcpj.exe
C:\WINDOWS\System32\nkhtih\cgqufb.exe
C:\WINDOWS\System32\amwtfa\agss.exe
C:\WINDOWS\System32\ptmxeih\ntinnrb.exe
C:\WINDOWS\System32\Services\{9AF9F4B7-819C-4FFA-8674-A578B4CDF24D}\SVCHOST.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\pmvjv\mjichj.exe
C:\WINDOWS\System32\kivo\njhwca.exe
C:\WINDOWS\System32\jbxucgo\frtt.exe
C:\WINDOWS\System32\pxepqt\jupfno.exe
C:\WINDOWS\System32\xbwm\aoqivux.exe
C:\WINDOWS\System32\jjjfx\edmglb.exe
C:\WINDOWS\System32\uiohg\uajc.exe
C:\Program Files\AIM\aim.exe
c:\windows\system32\fbommqt.exe
C:\WINDOWS\System32\inked.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Frys\Desktop\hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clicksearchclick.com/index.php?aff=9
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr6/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr6/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us8l.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {09AE2697-9D2E-7E38-DE88-157ABE2EEDEA} - C:\WINDOWS\System32\vxgeqakm\moslmyky.dll
O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)
O2 - BHO: (no name) - {435CEB90-7B99-236C-E868-E5F3DF0B5E54} - C:\WINDOWS\System32\gxmknbon\frcysoas.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: FlashEnhancer Ext - {5EDB03AF-0341-4e96-9E9B-3171522E4BAF} - c:\Program Files\Fla\fla.dll (file missing)
O2 - BHO: (no name) - {7BBFCD33-80B4-D28F-2B9E-B20B13B8C82E} - C:\WINDOWS\System32\bvmdnqff\lrandsds.dll
O2 - BHO: BHOmodObj Class - {7F6828CA-9E42-462C-BC60-418C8144012C} - c:\windows\system\BHOmod.dll
O2 - BHO: (no name) - {86851575-8AB6-F5BA-FE1F-222B66051B44} - C:\WINDOWS\System32\sqqaljbh\mqkeitsl.dll
O2 - BHO: FlashEnhancer Extnder - {A749B4BC-7621-4a80-9220-D0A283367DD5} - c:\Program Files\Fln\fln.dll (file missing)
O2 - BHO: (no name) - {BA05567F-1DD7-0A7A-E2EB-3B431D554246} - C:\WINDOWS\System32\tolfixwb\aiwcmpei.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [PaciSoft] C:\WINDOWS\System32\pacis.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\System32\exp.exe
O4 - HKLM\..\Run: [irwehx] C:\WINDOWS\System32\fuhlcodl\irwehx.exe
O4 - HKLM\..\Run: [cwnyidd] C:\WINDOWS\System32\fkkqspv\cwnyidd.exe
O4 - HKLM\..\Run: [lxmeitw] C:\WINDOWS\System32\ebrt\lxmeitw.exe
O4 - HKLM\..\Run: [tickhn] C:\WINDOWS\System32\rwbldru\tickhn.exe
O4 - HKLM\..\Run: [hnisujdj] C:\WINDOWS\System32\nhnfytt\hnisujdj.exe
O4 - HKLM\..\Run: [pouoyffs] C:\WINDOWS\System32\ktwauex\pouoyffs.exe
O4 - HKLM\..\Run: [qpwe] C:\WINDOWS\System32\bjtlqmme\qpwe.exe
O4 - HKLM\..\Run: [qsyycs] C:\WINDOWS\System32\dbonk\qsyycs.exe
O4 - HKLM\..\Run: [kqijimql] C:\WINDOWS\System32\ytbvtyu\kqijimql.exe
O4 - HKLM\..\Run: [cduy] C:\WINDOWS\System32\eompsyjv\cduy.exe
O4 - HKLM\..\Run: [hrnaff] C:\WINDOWS\System32\vsvf\hrnaff.exe
O4 - HKLM\..\Run: [sbjdvo] C:\WINDOWS\System32\ryitn\sbjdvo.exe
O4 - HKLM\..\Run: [tili] C:\WINDOWS\System32\spaxojx\tili.exe
O4 - HKLM\..\Run: [skdfykwf] C:\WINDOWS\System32\wlnho\skdfykwf.exe
O4 - HKLM\..\Run: [httwlh] C:\WINDOWS\System32\lluusbtn\httwlh.exe
O4 - HKLM\..\Run: [cwmj] C:\WINDOWS\System32\cgxab\cwmj.exe
O4 - HKLM\..\Run: [agbemh] C:\WINDOWS\System32\dtnx\agbemh.exe
O4 - HKLM\..\Run: [earhirek] C:\WINDOWS\System32\dben\earhirek.exe
O4 - HKLM\..\Run: [sssy] C:\WINDOWS\System32\qqbe\sssy.exe
O4 - HKLM\..\Run: [ukftqlsl] C:\WINDOWS\System32\efnlg\ukftqlsl.exe
O4 - HKLM\..\Run: [djkrq] C:\WINDOWS\System32\mdtblhs\djkrq.exe
O4 - HKLM\..\Run: [afywd] C:\WINDOWS\System32\fwsndlyj\afywd.exe
O4 - HKLM\..\Run: [oudpi] C:\WINDOWS\System32\ljiwua\oudpi.exe
O4 - HKLM\..\Run: [dxlrtt] C:\WINDOWS\System32\ktnkcf\dxlrtt.exe
O4 - HKLM\..\Run: [lxtek] C:\WINDOWS\System32\icmuafr\lxtek.exe
O4 - HKLM\..\Run: [kgalcrh] C:\WINDOWS\System32\uohynyrh\kgalcrh.exe
O4 - HKLM\..\Run: [jpgxi] C:\WINDOWS\System32\wmvjvlc\jpgxi.exe
O4 - HKLM\..\Run: [xjtk] C:\WINDOWS\System32\anii\xjtk.exe
O4 - HKLM\..\Run: [wpgrlr] C:\WINDOWS\System32\dtrpvi\wpgrlr.exe
O4 - HKLM\..\Run: [ppyp] C:\WINDOWS\System32\sosdfy\ppyp.exe
O4 - HKLM\..\Run: [batcstdt] C:\WINDOWS\System32\rqbwcao\batcstdt.exe
O4 - HKLM\..\Run: [mbqjqj] C:\WINDOWS\System32\uxqsfvi\mbqjqj.exe
O4 - HKLM\..\Run: [ssoeyok] C:\WINDOWS\System32\mwosbfc\ssoeyok.exe
O4 - HKLM\..\Run: [tjmp] C:\WINDOWS\System32\lodd\tjmp.exe
O4 - HKLM\..\Run: [nutkvo] C:\WINDOWS\System32\ilxoahf\nutkvo.exe
O4 - HKLM\..\Run: [jdutx] C:\WINDOWS\System32\adfh\jdutx.exe
O4 - HKLM\..\Run: [sfje] C:\WINDOWS\System32\kbnr\sfje.exe
O4 - HKLM\..\Run: [rwsivur] C:\WINDOWS\System32\scqa\rwsivur.exe
O4 - HKLM\..\Run: [nxga] C:\WINDOWS\System32\xwuiwxyy\nxga.exe
O4 - HKLM\..\Run: [eclxwy] C:\WINDOWS\System32\wpbh\eclxwy.exe
O4 - HKLM\..\Run: [hccq] C:\WINDOWS\System32\fmtwlll\hccq.exe
O4 - HKLM\..\Run: [mdojgctk] C:\WINDOWS\System32\yduqeq\mdojgctk.exe
O4 - HKLM\..\Run: [oailwph] C:\WINDOWS\System32\gwcnu\oailwph.exe
O4 - HKLM\..\Run: [yujxgsk] C:\WINDOWS\System32\veqnbbw\yujxgsk.exe
O4 - HKLM\..\Run: [dhvmulsa] C:\WINDOWS\System32\prapj\dhvmulsa.exe
O4 - HKLM\..\Run: [vqnnqjjl] C:\WINDOWS\System32\pxxmg\vqnnqjjl.exe
O4 - HKLM\..\Run: [jxtx] C:\WINDOWS\System32\smsoaau\jxtx.exe
O4 - HKLM\..\Run: [valtnr] C:\WINDOWS\System32\mgegera\valtnr.exe
O4 - HKLM\..\Run: [axjiqvc] C:\WINDOWS\System32\bavxd\axjiqvc.exe
O4 - HKLM\..\Run: [aafrtvpx] C:\WINDOWS\System32\epdoovy\aafrtvpx.exe
O4 - HKLM\..\Run: [phvrxx] C:\WINDOWS\System32\jsprlg\phvrxx.exe
O4 - HKLM\..\Run: [cubacbnd] C:\WINDOWS\System32\oshnrq\cubacbnd.exe
O4 - HKLM\..\Run: [C:\WINDOWS\iysisosa.exe] C:\WINDOWS\iysisosa.exe
O4 - HKLM\..\Run: [tcfuke] C:\WINDOWS\System32\ttxjvv\tcfuke.exe
O4 - HKLM\..\Run: [nnpylse] C:\WINDOWS\System32\hjgd\nnpylse.exe
O4 - HKLM\..\Run: [etwa] C:\WINDOWS\System32\gxxhean\etwa.exe
O4 - HKLM\..\Run: [skyhn] C:\DOCUME~1\Frys\LOCALS~1\Temp\tavf.exe
O4 - HKLM\..\Run: [scrsvc] C:\WINDOWS\System32\scrsvc.exe
O4 - HKLM\..\Run: [tqcnj] C:\WINDOWS\System32\tvhuswpe\tqcnj.exe
O4 - HKLM\..\Run: [pamlr] C:\WINDOWS\System32\nglsdnuj\pamlr.exe
O4 - HKLM\..\Run: [tkbdinks] C:\WINDOWS\System32\fpasp\tkbdinks.exe
O4 - HKLM\..\Run: [fmachtpq] C:\WINDOWS\System32\tknibac\fmachtpq.exe
O4 - HKLM\..\Run: [hngqy] C:\WINDOWS\System32\wfjb\hngqy.exe
O4 - HKLM\..\Run: [lrny] C:\WINDOWS\System32\xhbqdh\lrny.exe
O4 - HKLM\..\Run: [jxbmwd] C:\WINDOWS\System32\ktbmn\jxbmwd.exe
O4 - HKLM\..\Run: [xcgper] C:\WINDOWS\System32\ijhe\xcgper.exe
O4 - HKLM\..\Run: [trniy] C:\WINDOWS\System32\waway\trniy.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [edaadxit] C:\WINDOWS\System32\ggglfj\edaadxit.exe
O4 - HKLM\..\Run: [cceeil] C:\WINDOWS\System32\twukshq\cceeil.exe
O4 - HKLM\..\Run: [xbjjo] C:\WINDOWS\System32\psnecert\xbjjo.exe
O4 - HKLM\..\Run: [famgs] C:\WINDOWS\System32\soxfms\famgs.exe
O4 - HKLM\..\Run: [sbscx] C:\WINDOWS\System32\itas\sbscx.exe
O4 - HKLM\..\Run: [bajw] C:\WINDOWS\System32\dxdi\bajw.exe
O4 - HKLM\..\Run: [alqpdh] C:\WINDOWS\System32\axtbba\alqpdh.exe
O4 - HKLM\..\Run: [aeajsa] C:\WINDOWS\System32\ibpj\aeajsa.exe
O4 - HKLM\..\Run: [mvaq] C:\WINDOWS\System32\jpthv\mvaq.exe
O4 - HKLM\..\Run: [eqyhws] C:\WINDOWS\System32\bjyom\eqyhws.exe
O4 - HKLM\..\Run: [hkisonev] C:\WINDOWS\System32\lbqgysl\hkisonev.exe
O4 - HKLM\..\Run: [ngxpjbrh] C:\WINDOWS\System32\uaybmif\ngxpjbrh.exe
O4 - HKLM\..\Run: [bssp] C:\WINDOWS\System32\iqmcorib\bssp.exe
O4 - HKLM\..\Run: [jnpoyfug] C:\WINDOWS\System32\rymdyy\jnpoyfug.exe
O4 - HKLM\..\Run: [fnybwolx] C:\WINDOWS\System32\rywguyn\fnybwolx.exe
O4 - HKLM\..\Run: [shstgnj] C:\WINDOWS\System32\hrvpvfy\shstgnj.exe
O4 - HKLM\..\Run: [ehohdi] C:\WINDOWS\System32\rlstst\ehohdi.exe
O4 - HKLM\..\Run: [kvjjwe] C:\WINDOWS\System32\wppssdkr\kvjjwe.exe
O4 - HKLM\..\Run: [pjqtl] C:\WINDOWS\System32\gnblmmjp\pjqtl.exe
O4 - HKLM\..\Run: [cgxeso] C:\WINDOWS\System32\hilsoe\cgxeso.exe
O4 - HKLM\..\Run: [caiepm] C:\WINDOWS\System32\kkcb\caiepm.exe
O4 - HKLM\..\Run: [bekhhhi] C:\WINDOWS\System32\grmxccr\bekhhhi.exe
O4 - HKLM\..\Run: [plffkoa] C:\WINDOWS\System32\cgdpfeq\plffkoa.exe
O4 - HKLM\..\Run: [jsyv] C:\WINDOWS\System32\icalbub\jsyv.exe
O4 - HKLM\..\Run: [epoocgo] C:\WINDOWS\System32\lhjwo\epoocgo.exe
O4 - HKLM\..\Run: [uijp] C:\WINDOWS\System32\tuobcvq\uijp.exe
O4 - HKLM\..\Run: [ipjp] C:\WINDOWS\System32\qbajrxn\ipjp.exe
O4 - HKLM\..\Run: [teupk] C:\WINDOWS\System32\cfwdxmeq\teupk.exe
O4 - HKLM\..\Run: [mogy] C:\WINDOWS\System32\pjqvjuoe\mogy.exe
O4 - HKLM\..\Run: [galheyi] C:\WINDOWS\System32\ilqgg\galheyi.exe
O4 - HKLM\..\Run: [wkjhtd] C:\WINDOWS\System32\uhllbqw\wkjhtd.exe
O4 - HKLM\..\Run: [rgbxqjl] C:\WINDOWS\System32\cgnp\rgbxqjl.exe
O4 - HKLM\..\Run: [sbsrx] C:\WINDOWS\System32\yytq\sbsrx.exe
O4 - HKLM\..\Run: [pbws] C:\WINDOWS\System32\goqcpw\pbws.exe
O4 - HKLM\..\Run: [usoh] C:\WINDOWS\System32\cwjw\usoh.exe
O4 - HKLM\..\Run: [mbrwjdiw] C:\WINDOWS\System32\syuxoeaq\mbrwjdiw.exe
O4 - HKLM\..\Run: [kpucepw] C:\WINDOWS\System32\takubgy\kpucepw.exe
O4 - HKLM\..\Run: [stdjpk] C:\WINDOWS\System32\fpuhyhe\stdjpk.exe
O4 - HKLM\..\Run: [saswoc] C:\WINDOWS\System32\wgedf\saswoc.exe
O4 - HKLM\..\Run: [gdtej] C:\WINDOWS\System32\pdugft\gdtej.exe
O4 - HKLM\..\Run: [qiae] C:\WINDOWS\System32\dvgf\qiae.exe
O4 - HKLM\..\Run: [asgymhyb] C:\WINDOWS\System32\bmferrmd\asgymhyb.exe
O4 - HKLM\..\Run: [cxwvnetw] C:\WINDOWS\System32\jkdv\cxwvnetw.exe
O4 - HKLM\..\Run: [qvtwfnwc] C:\WINDOWS\System32\fmqou\qvtwfnwc.exe
O4 - HKLM\..\Run: [hmiwlck] C:\WINDOWS\System32\duwlb\hmiwlck.exe
O4 - HKLM\..\Run: [rdmwscb] C:\WINDOWS\System32\civwel\rdmwscb.exe
O4 - HKLM\..\Run: [tkklnsoe] C:\WINDOWS\System32\gyspuxg\tkklnsoe.exe
O4 - HKLM\..\Run: [C:\WINDOWS\IEXPLOR.EXE] C:\WINDOWS\IEXPLOR.EXE
O4 - HKLM\..\Run: [AtxBrw] C:\WINDOWS\IEXPLOR.exe
O4 - HKLM\..\Run: [ljamljn] C:\WINDOWS\System32\ruphhqcf\ljamljn.exe
O4 - HKLM\..\Run: [jumpk] C:\WINDOWS\System32\ppmjxd\jumpk.exe
O4 - HKLM\..\Run: [tuptnh] C:\WINDOWS\System32\jbxqgy\tuptnh.exe
O4 - HKLM\..\Run: [evnri] C:\WINDOWS\System32\elurykg\evnri.exe
O4 - HKLM\..\Run: [cuyg] C:\WINDOWS\System32\hdecrgvb\cuyg.exe
O4 - HKLM\..\Run: [rqbrm] C:\WINDOWS\System32\nrtym\rqbrm.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Startzbestwun2001
4 Apprentice
•
8831 Posts
248
0
Posted May 29th, 2005 13:00
Did you do the online scans?
Stevezbestwun2001
4 Apprentice
•
8831 Posts
248
0
Posted May 29th, 2005 15:00
Jessica
I would be wonderful if you would follow my instructions and do those scans.
Go to this site here:a href=http://home.filternet.nl/~hansp21/LQFix.bat
Save this to your desktop as All Files.
Reboot into Safe Mode and double click and merge this into your registy when it asks if you want to do this.
Then do 3 scans in normal mode, and post a fresh log from normal mode.
Stevezbestwun2001
4 Apprentice
•
8831 Posts
54
0
Posted May 29th, 2005 16:00
What I suggest is you do the other scans that require an Active X function using IE, it will work fine.
Please give me the log of what Trend Micro found.
Steve
zbestwun2001
4 Apprentice
•
8831 Posts
248
0
Posted May 26th, 2005 18:00
Let's see if we can clean this up with some scans.
Here are 3 online virus scans, run atleast 2 of them. Delete all that they find.
eTrust AntiVirus Web Scanner
Panda ActiveScan
Trend Micro
Then go to www.trojanhunter.com and download their trial version of Trojan Hunter and run it and have it clean whatever it finds.
After that could you please go here and download AdAwareSE and delete what it finds. Then go here here and download its VX2 cleaner. Run it and delete what it finds.
After that go here and download SpyBot and run it. When Spybot is complete, it will be showing RED entries, BLACK entries, and GREEN entries in the window. Put a check mark beside the RED entries ONLY. Choose Fix Selected Problems and allow Spybot to fix the RED only entries.
Now go to here and download HiJackThis to its own folder that you create on your C:\ drive.
After it is downloaded open the program and click Scan and Save to log.
Post the NEW log that it generates here.
Steve