C:\Users\gwengoetter\AppData\Local\Temp\sxxoiiv\sjgudmy\wow.dll
C:\Users\gwengoetter\AppData\Local\Temp\sxxoiiv
HKCU\...\Run: [Vougowloypqiuxg] - C:\Users\gwengoetter\AppData\Roaming\Ubxyumy\udnia.exe [203884 2013-01-27] ()
HKCU\...\Run: [Iproanvaelmuy] - C:\Users\gwengoetter\AppData\Roaming\Pyixih\wytyiz.exe
HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume4\Users\GWENGO~1\AppData\Local\Temp\sxxoiiv\sjgudmy\wow.dll ATTENTION! ====> ZeroAccess?
C:\Users\gwengoetter\AppData\Roaming\Admyaw
C:\Users\gwengoetter\AppData\Roaming\Agtime
C:\Users\gwengoetter\AppData\Roaming\Akakdio
C:\Users\gwengoetter\AppData\Roaming\Amadhe
C:\Users\gwengoetter\AppData\Roaming\Aqbudyno
C:\Users\gwengoetter\AppData\Roaming\Aruzfu
C:\Users\gwengoetter\AppData\Roaming\BabSolution
C:\Users\gwengoetter\AppData\Roaming\Baekta
C:\Users\gwengoetter\AppData\Roaming\Boeqro
C:\Users\gwengoetter\AppData\Roaming\Ceufsu
C:\Users\gwengoetter\AppData\Roaming\Daiszaco
C:\Users\gwengoetter\AppData\Roaming\Dionba
C:\Users\gwengoetter\AppData\Roaming\Edocaqa
C:\Users\gwengoetter\AppData\Roaming\Efufgyv
C:\Users\gwengoetter\AppData\Roaming\Elseokyd
C:\Users\gwengoetter\AppData\Roaming\Endyexi
C:\Users\gwengoetter\AppData\Roaming\Eqqoavf
C:\Users\gwengoetter\AppData\Roaming\Fotusui
C:\Users\gwengoetter\AppData\Roaming\Gaekyzf
C:\Users\gwengoetter\AppData\Roaming\Gaxymi
C:\Users\gwengoetter\AppData\Roaming\Gitepy
C:\Users\gwengoetter\AppData\Roaming\Hoorula
C:\Users\gwengoetter\AppData\Roaming\Hufeus
C:\Users\gwengoetter\AppData\Roaming\Huoweply
C:\Users\gwengoetter\AppData\Roaming\Idkeis
C:\Users\gwengoetter\AppData\Roaming\Inalfad
C:\Users\gwengoetter\AppData\Roaming\Irduime
C:\Users\gwengoetter\AppData\Roaming\Itpoyq
C:\Users\gwengoetter\AppData\Roaming\Ivsawo
C:\Users\gwengoetter\AppData\Roaming\Izleyqu
C:\Users\gwengoetter\AppData\Roaming\Kaodzyiq
C:\Users\gwengoetter\AppData\Roaming\Laimge
C:\Users\gwengoetter\AppData\Roaming\Lowoto
C:\Users\gwengoetter\AppData\Roaming\Luamwua
C:\Users\gwengoetter\AppData\Roaming\Lutizya
C:\Users\gwengoetter\AppData\Roaming\Luzutii
C:\Users\gwengoetter\AppData\Roaming\Myergiac
C:\Users\gwengoetter\AppData\Roaming\Nuzomuyp
C:\Users\gwengoetter\AppData\Roaming\Ogosymyf
C:\Users\gwengoetter\AppData\Roaming\Oluxin
C:\Users\gwengoetter\AppData\Roaming\Osepote
C:\Users\gwengoetter\AppData\Roaming\Osvanux
C:\Users\gwengoetter\AppData\Roaming\Otyfetce
C:\Users\gwengoetter\AppData\Roaming\Oxydesul
C:\Users\gwengoetter\AppData\Roaming\Pebylye
C:\Users\gwengoetter\AppData\Roaming\Poziic
C:\Users\gwengoetter\AppData\Roaming\Puetak
C:\Users\gwengoetter\AppData\Roaming\Qiquazo
C:\Users\gwengoetter\AppData\Roaming\Qiumho
C:\Users\gwengoetter\AppData\Roaming\Quezare
C:\Users\gwengoetter\AppData\Roaming\Rikeyfo
C:\Users\gwengoetter\AppData\Roaming\Search Protection
C:\Users\gwengoetter\AppData\Roaming\Siumta
C:\Users\gwengoetter\AppData\Roaming\Sueles
C:\Users\gwengoetter\AppData\Roaming\Tuevpy
C:\Users\gwengoetter\AppData\Roaming\Tykidiu
C:\Users\gwengoetter\AppData\Roaming\Ubxyumy
C:\Users\gwengoetter\AppData\Roaming\Udatihyc
C:\Users\gwengoetter\AppData\Roaming\Ugytah
C:\Users\gwengoetter\AppData\Roaming\Ugzadim
C:\Users\gwengoetter\AppData\Roaming\Ukusfe
C:\Users\gwengoetter\AppData\Roaming\Umqoyh
C:\Users\gwengoetter\AppData\Roaming\Uvhyez
C:\Users\gwengoetter\AppData\Roaming\Uvifcei
C:\Users\gwengoetter\AppData\Roaming\Viidfouc
C:\Users\gwengoetter\AppData\Roaming\Voymug
C:\Users\gwengoetter\AppData\Roaming\Weoqceu
C:\Users\gwengoetter\AppData\Roaming\Wyugekeh
C:\Users\gwengoetter\AppData\Roaming\Xeehlo
C:\Users\gwengoetter\AppData\Roaming\Ydxoew
C:\Users\gwengoetter\AppData\Roaming\Yfxuowve
C:\Users\gwengoetter\AppData\Roaming\Ynogivi
C:\Users\gwengoetter\AppData\Roaming\Yskuxop
C:\Users\gwengoetter\AppData\Roaming\Ysnuud
C:\Users\gwengoetter\AppData\Roaming\Zuliqyp