[Jpellitt]

Hi - I've read and tried the instructions in the "before you post do this" section. My home page keeps getting reset to "W-find.com/index.htm" and favorites are added to my list. Google (and I would assume other search engines) give weird results. I've been dealing with this for about a week now, and now know about HJT logs and all sorts of things - but I still haven't been able to fix it completely. S&D finds problems, I fix them, and then they're back. Help! and Thank You!

John

HJT Log:

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Kodak Digital Science\Picture Easy Software\Program\PezDownload.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\windows\dmrtrdy.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\ZipToA.exe
C:\Program Files\America Online 9.0a\aoltray.exe
C:\Palm\HOTSYNC.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
C:\Documents and Settings\John\Desktop\HiJack This\HijackThis.exe
C:\Documents and Settings\John\Desktop\HiJack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.chaffey.c...m/welcome.html"); (C:\Documents and Settings\John\Application Data\Mozilla\Profiles\default\6ojl89y6.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\John\Application Data\Mozilla\Profiles\default\6ojl89y6.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [Picture Easy Download] C:\Program Files\Kodak Digital Science\Picture Easy Software\Program\PezDownload.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [Terminal Component] C:\WINDOWS\System32\d3d8wpa.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [blxonal] c:\windows\dmrtrdy.exe
O4 - HKCU\..\Run: [swosgwu] c:\windows\dmrtrdy.exe
O4 - HKCU\..\Run: [yfoljni] c:\windows\dmrtrdy.exe
O4 - HKCU\..\Run: [knxqimp] c:\windows\dmrtrdy.exe
O4 - HKCU\..\Run: [avmgkmt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [twstftb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vabfvkr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [cpgjkob] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tunvpvj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xwnyvdr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fsoqilb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [keognqf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kbcomwd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [potnjaw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bgulskg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [egyhwvd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [pknisqo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hwksprb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [oqhtigq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [edknlmm] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [krcmwsn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qeaqmre] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kgrwajw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dkiyhuc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [iegopey] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vbqndvp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vmkbgqj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ryocxuk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [svrmugo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [sjokegx] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [avgmkdg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uvxgkbi] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tguyvpn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [weukvbi] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xvedxfw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [whvdkvu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [smngsec] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [amxfenl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ybwxlmq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xmfiqxq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fxwdhwj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xnqnebb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tusibro] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [sutnvqa] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hlutkxb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ylqlevs] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [nkcsknc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bjfdari] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qepwflx] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ygdasbo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [iviucwo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wjmprft] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vlahcpt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ovnmbsw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [awgcmkg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [nqtybnc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [nxnjclt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [gxiadqs] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [suykjur] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vyxecjg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [mfgjdxp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vwptuiv] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uqpdqlp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [nrjqvnc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [aapawrr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jvrrcue] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dxtuaom] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [buqqrxd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wdytjff] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kmbrjxp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [immosbg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bxfpfoa] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [sfimuop] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fasflwq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uttlblc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [odyusmm] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [escoylk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [adhrvlc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dleajva] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ayerjow] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xbpriet] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [axgvaqt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [clvnhvn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [mjxedqx] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dgaahih] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uxygkae] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vyurynk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bowhfgh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [lbuujeo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jvesufd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ihxxhij] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qcenftk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fwpsfcb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [isvvifo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ewntxar] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qpriffe] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qpsjcxo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [eqseudf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ceylppy] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rydjafl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [gscouqd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jwaxvce] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wmlciht] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ddmgiya] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [oarbako] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ptfjdhp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wfrmmmj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [cxwpbdy] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uthqlnf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [borblxp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vkpgdnh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rgdygwq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tliwaho] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hkhoabr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jaxjcwg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fwisnrh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bvjiayd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vkgsooo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xqapdyp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ijxycjn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ixxchtu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [biqcqcw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [gokbhbd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fayrdwh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [nsagmtw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ntiltcs] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fppjwds] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uvbgrmj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [akafhup] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dyjflnn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [iftjwcc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [aoxxenf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [pchijlv] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hrvuqcq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [sdhkxmk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uihhijl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [cttbvxr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bioguvy] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [mrqvnma] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [lxgnnkt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bktsjcj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ntsjalu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rkyklvd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tnfbxam] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ksqrfht] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [reqmfwl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rertptl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ermxqgf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [helwole] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [agirnnt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hbkuoaa] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ahbdyfq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [mwrjttx] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [gvfigyd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [yfkfkpq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qnbeood] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [iqvnjxd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wcakeaw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wykvfyw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rrrnpsn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hthtjvi] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fhccprf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kqgcatn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dgvvxtq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [scvqmpg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ovlcubq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [woqldwj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ruutkge] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [lukqfok] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [lefeyev] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fwsxhhu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [twsaxfh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [poulbdw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [urmkmci] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [spvkwar] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vyraqge] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dhjgssv] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [esvwetc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [pofdbfu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [nmcghea] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [scpkjul] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tmeyibg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ygpexuu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tpltdel] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dixvsrj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uwitdkx] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [aubvvtq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dicpjqi] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jmlifpq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [trumneq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hbncmuk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wiuefhl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tckdind] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [heidtfj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [udoybja] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fvosdtd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kpdhpdj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [pkuphdt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [iwddorv] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ltfuwwb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ynmbyvg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ruqkdwi] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [mjaexnl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [fncsajt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hcumwqr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jkuayys] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xcvddif] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [pwtwsyo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [glisnaf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [oohdkjr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [quownxc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kbvgegb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [clcovaw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [lctkafq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ylfqwrh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [gokytpv] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ppnrayr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rylrsbi] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xclisiv] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ugwmgcg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jddilsl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [omrnwpp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jyobjwm] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [caqguob] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tsfoxil] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [gcppksa] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [chtmgqg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kbtbllb] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jnlvbac] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uhvdekp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [dfgkyec] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tnslbrw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [yfukbhp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rriivpm] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wuobpbq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [xpyepuq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vuboiqs] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [outxmgp] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jaoovyx] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rlqskpn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ypjjlsk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uellkfk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hmwmfry] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [yclodlq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ddiajbl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [mbbsodn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hrtedvo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bkctgwo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [edicoeg] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [sobkqmm] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [forefyx] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [vxbkare] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [elhdlim] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [snqiglh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [evbqokj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ybjvqxc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [namfetu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ymivevh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [srxbrjy] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wqflsqq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [krecggl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ooplkar] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [gqpexoh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hgprebn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qigwiia] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hirfpxk] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ytmxlnc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [cvdxlhe] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [bqwitca] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tafaaan] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [blnprga] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [syooymw] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ocjimgu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [tavesyh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [cgejfge] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ijqqxpd] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qyqlixc] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [ijaubyn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [acwrfny] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wirgujo] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [becfiro] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [wdohkjl] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kxusmlr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jejwjik] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [lgempkt] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [pupqrvj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [rvqwrrf] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [cpgaark] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [jicgxhq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kxydmdh] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [hydcofu] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [siokrfj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [iypqpuj] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [heylccr] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uivjcdq] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [peaqlht] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [iforsmv] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [kggjyne] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [Spyware Vanisher] c:\spywarevanisher-free\FreeScanner.exe -FastScan
O4 - HKCU\..\Run: [ewvhqsn] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [uagniut] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [qkqloam] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kwfboic] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [amjfgir] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kprmral] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kictlex] c:\windows\yftuywo.exe
O4 - HKCU\..\Run: [kdychrv] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [lcjxndx] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [ggffame] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [cdvksjw] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [ipyqdsh] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [rtmggbw] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [fhutrst] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [pofqbhu] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [eyadxmw] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [bofwljl] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [aryoynn] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [ysbngau] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [kfybqpw] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [dlwrwvw] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [oobowsf] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [pekhelq] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [wucpdwd] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [rgemgin] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [huubchc] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [ulmftws] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [trgkeed] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [bxmonoo] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [ddhgqgy] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [uahkhbk] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [bxxmtlo] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [xgwbbip] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [tdkunrp] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [agbxlcb] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [mxxdjpx] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [yxrjrbo] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [vyoerom] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [ejglpjk] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [whtbamj] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [qjctdbd] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [dqnygvn] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [qiepapo] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [hrrxlth] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [qucqxjo] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [snwmqes] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [nsnkwpl] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [cwfujxy] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [abuavqk] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [fswfyby] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [twdstio] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [iprpsdl] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [gnnywdc] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [vpcdypm] c:\windows\rqqadka.exe
O4 - HKCU\..\Run: [mselpew] c:\windows\mfpblfa.exe
O4 - HKCU\..\Run: [ypuluwx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gamafee] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [plivncw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fuotyfo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [isequrc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qyvrfcx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wqmtnax] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [eonroky] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ppliwmf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vefmnjr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [puwhdeq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nmnyuee] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fknwjbq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [odxatfp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [aodpfbd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [urdypsy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wrjlvic] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [blsphup] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [omwdkfd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [miytlmh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [khjqtwl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wfejwsr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mjkhmlh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rrceepb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fjipgnh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [souapkc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rslmino] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xuynodm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [edsatmv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tbetgnk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dgnajjc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qvuthsk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ffywqbh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [sdekhnv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vhgekqp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [botgeyi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [avopcwx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gkfggym] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jcgxgfn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vtbugvn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rtfvmnj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ukiuubh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qlpbllf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qpdphbl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pgbkkwr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ismcayk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lcwyysb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [agwbmpu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tsxiemq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [toqfjkh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ibktvyr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wdxuhgq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wfjsldx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [agaqixa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [edibvwg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ilrutut] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rrbrbdd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hlfwyli] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xjayioo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ipnwqqr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xpuirwg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [exomrtx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [flbysvg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [irecveb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vgspmjp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [aqcdcsm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cfnbguv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ctoidfn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ahqjtje] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [snwhjxe] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [uydkseh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dpknvli] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xccesar] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [npcldck] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gymlfqu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qsakqxd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [sgkiejx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [npjvfkl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yyfvpoe] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [edtlckj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [uwhuaou] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kkvldci] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mmdkkfy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cqexjwm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [riodhop] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hkkbwrc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jjmvldu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lkatawa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nirknig] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [eavysqa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pedalvi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [seqkpcu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wordpkf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tadcrsv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lntrvco] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jwdaiqf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jcpfkic] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gckvkhv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cvxjkhb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ocjavqg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [julylbm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rfmdrae] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ijkowac] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [uhljwow] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [twowsji] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cdqehbu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [exiktlu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vlqkxqd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ndpteka] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rqgnoqb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tgirysk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cntsvlf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kmblnaq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ahocfll] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tkvwmnk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kqddsev] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ulyyyff] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ipdvtcc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hedacju] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xvaoldi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fpqiuqr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kpwaqnv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lqpoabe] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ngqekht] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [aulmcyj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [egmsmll] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dowlqfx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [psoafnk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fadimiw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [muhixvs] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [oqfafrp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [veofiem] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [agaotvn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [slqylhu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [eihumxu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tyduumu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qleqnyk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nlerxmh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dwvskmp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [onkpaao] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ysrvaxp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lutlhqm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [baouwkr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ooqjfyw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ctrxsfk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rsvvibm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vijdkrk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gsejgvs] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fjqjayj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [sushgfk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dppxqtf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pvnslue] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [etncxls] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cslslqq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [elekjvn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [amacaar] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hfcosli] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yohsfba] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jotsxli] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vikpwbe] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [uhtovvc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vhuiiwv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ehdubtw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hroaloh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wjhgftx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kccbwti] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [oycmkdi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vvhibnn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cclcfid] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ayuutxp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tjwinmq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dpsawtl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bwqriwj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jbnupoa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [chenfsw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nnluphx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hdsvspd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mcxmfke] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ltlylii] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wqrryve] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vwokasr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cwvplcg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cqcyxnv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hqnsnhd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xfviyek] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [itqwune] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kbomuxv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mocekbn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qnpldvu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rxegdmu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lpqunxo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xwohxnb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rgdnngx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kxfnkya] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rgnqedi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gjsifpq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ayjfkqj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [idkqenb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rgdamtp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vdvkcap] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mdxtxuo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ndqfoxn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vyeckch] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wixoott] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rimkrfx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cgfusjw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bekityw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [smypost] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [luttpqb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ovwtodg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gjvgadp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [radauwf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qutgpmw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yvgaptw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [llxmtur] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ulwbdur] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vedqbhx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ffrgktf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yaqpsyl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jdglofi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bpbhucj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yfvomxc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [otucgwo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [spxorhn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gfrwqam] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gdottqa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tcdkynh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yvnepcp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hwflyml] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [blfynqe] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [thpqoam] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pyrojen] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ivdjrwx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gjwrybv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bflulyy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [elkhxvo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vxhdqvy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cjmtuek] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dqnmkfp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bsdfnpb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bdfkmsh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xkxjdro] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bpjwjuq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [anvksuv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pxhyhdo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xoluyhp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [iajvaup] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ajmessk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [myvqhek] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ukrmbxm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nxeqlrt] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xxyvjic] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mflelct] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kkvykie] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xcmyymg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bpjwrpf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [alyegnx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kjbseno] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ejswspf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wvhpnve] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rxxfmew] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [faggfdb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bduvlbw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [anthjjw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [conlpyi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gdrxsvi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [drojwwb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jpqeysv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nmbyuqc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [biywdyv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nuvjxqy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hivdygf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [njrhkia] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [seecpsw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lbsswyt] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dwgvrjc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rcesspj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qyefstr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ajslmsl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tpgqtiu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gxpyrha] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fuukjnv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [uhvmgrf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [npolwfw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wdufnsn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [njxpeuh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [spatnwn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rdvtjum] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jhmcmhk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ccudjdn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nqcbvbl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [iylnarj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ewlmmqg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [isctjbx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qubxycr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [uawcoxe] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gosqtly] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [overnwt] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [twhrekx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [slafqhq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rstasqy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nbhkwwm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nrqkfnv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [inavhvu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kwrdlui] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [aqsqqtx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gitqxil] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ksthqla] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vbkpluy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pybkcek] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qpeqarf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vjawrwj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pivfkbx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mwfscda] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [msmanre] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mvmeaqs] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gfeosak] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ycsuyks] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fkqwrgg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nierffa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vbufkqc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gqatyyp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [qmarqnk] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [oajyxkg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [sowmpvg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [boktfmb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wjphyhv] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xobljcw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ffephvx] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [iwmtdsw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [rkipnhb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [pswjxha] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [gomkbrf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cleohxo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hjexbye] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ymmvyvi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [cyrlsqj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vfvubim] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dwfnupc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [eutsotp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [aqatcsa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lossgqa] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nuctmwr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [euskasq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bmeamwg] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tbafyit] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [htwbpja] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [eiebrlp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mfnioua] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ilutaet] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nnqqkui] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ljieqcf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vakdccc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [botjurp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [flfslsn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ynnxivu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [htfhkrm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xkvlams] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xxrhiue] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dkcuhfp] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lslxfnj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [psuvewl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ounajfs] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kcqrtox] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [etghjtn] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jneqnej] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [axrhhet] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bkgrnlj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [bwhwjhj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [jhohlbj] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tiwevlb] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [utpfkfw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [fqbgfgd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [sqwjleu] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [tyrfrnw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [mcitdfd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yrayagd] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [crjoqpw] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [xxumuke] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wrwbxjo] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [paxprcy] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dkxsmdr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [yaglksr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [eleretr] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vmvnqap] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ofgqmsh] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wbmaoje] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [vhgkdsc] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [uhkbmcq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nfccxcf] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [ymphvvq] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [hsxstou] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [llbeqxm] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [nugrlyi] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [dqpsaul] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [kescdwl] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [lcbseso] c:\windows\jrhlfvr.exe
O4 - HKCU\..\Run: [wdavuqf] c:\windows\jrh

[Advertisements]

Hi Jpellitt and Welcome to the Geeks to Go Help Forum!

Could you try copying that HijackThis log to Notepad and Save it to your Desktop!

Then Attach to the Next post!

What programs have you downloaded to contend with this?

[Wizard]

Hi Jpellitt and Welcome to the Geeks to Go Help Forum!

Could you try copying that HijackThis log to Notepad and Save it to your Desktop!

Then Attach to the Next post!

What programs have you downloaded to contend with this?

[Jpellitt]

Hi - I have Ad-Aware SE, Cleanup40, CWShredder214, Hijack This, Spybot-S&D, SpywareBlaster, and McAfee Virusscan and firewall. I've run them all, they all find some problems which are then cleaned, but the problem remains. Thank you for any help! Attached is the HJT log.
JPellitt

Attached Files

•  hjt_Jpellitt.txt   43.44KB   137 downloads

[Wizard]

Still didnt get it all!!!

Locate the 04 that looks like this

O4 - HKCU\..\Run: [xjmwtio]c:\windows\jrhlfvr.exe

Post the rest of the log from there!

[Jpellitt]

Ok - found it and deleted it - here's a new log. Thanx!
-Jpellitt

Attached Files

•  HJT_JP_2.txt   150.79KB   148 downloads

[Wizard]

OK,Now I got something to work with!!!

Lets use the Folder you have HijackThis stored in to place anything I ask you to download!

Please do not run these until I ask!

Download Ewido Security Suite, install then from within the program check for updates BUT dont scan yet
Ewido Security Suite:
http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu". When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK.
We will fix this in a moment.

From the main Ewido screen, Click on Update in the left menu, then click the Start Update button.

After the Update finishes (the status bar at the bottom will display "Update successful"), Now close the program.

If you have problems updating see here
http://www.ewido.net...wnload/updates/

AdawareSE 1.05
http://www.bleepingc...showtutorial=48

The link will tell you how to Install>Update>Configure and Scan!

CleanUp! 4.0
http://downloads.ste...p/CleanUp40.exe

If that Link doesnt work,just go to Google.com and Search for CleanUp!

CWShredder
http://cwshredder.ne.../CWShredder.exe

Double Click CWShredder.exe to run it>>Click Check Check For Update
Close it out once updated,We will run it in Safe Mode!

Download "The Hoster" from here
http://www.funkytoad...load/hoster.zip

LSPFix
http://cexx.org/lspfix.htm

Reboot into SAFE MODE(Tap F8 when restarting)
Here is a link on how to boot into Safe Mode:
http://service1.syma...src=sec_doc_nam

After restarting in Safe Mode,Configure Windows to Show All Hidden Files and Folders,this must be done after restarting in Safe Mode!!

Here is a link to help with that:
http://www.bleepingc...showtutorial=62

Be sure to follow the directions that apply to your Operating System!

Please Run the Programs in the oreder Specified!

"LSPFix"
Run the program and follow these directions

1. Run LSPFix.
2. Check "I know what I'm doing".
3. Select all instances of flsmngr.dll[/B]
4. Drag flsmngr.dll to the "Remove" page.
5. Click "Finished".
6.Close out LSPFix.

"The Hoster"

Press "Restore Original Hosts" and press "OK". Exit Program.

Please Locate and Delete

C:\Windows\System32\flsmngr.dll<< File Only!

C:\WINDOWS\System32\odbcdpl1.dll<< File Only!

c:\windows\dmrtrdy.exe<< File Only!

c:\windows\yftuywo.exe<< File Only!

c:\windows\rqqadka.exe<< File Only!

c:\windows\mfpblfa.exe<< File Only!

c:\windows\jrhlfvr.exe<< File Only!

c:\windows\coqtxvk.exe<< File Only!

c:\windows\kwcmwiu.exe<< File Only!

c:\spywarevanisher-free<< Folder!

c:\freescan<< Folder!

Open HijackThis and put a check by these but DO NOT hit the Fix Checked button yet!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://w-find.com/index.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://w-find.com/index.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://w-find.com/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://w-find.com/index.htm

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.chaffey.c...m/welcome.html"); (C:\Documents and Settings\John\Application Data\Mozilla\Profiles\default\6ojl89y6.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\John\Application Data\Mozilla\Profiles\default\6ojl89y6.slt\prefs.js)

O4 - HKCU\..\Run: [blxonal] c:\windows\dmrtrdy.exe<< All the O4s like that!

O4 - HKCU\..\Run: [avmgkmt] c:\windows\yftuywo.exe<< All the O4s like that!

O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan

O4 - HKCU\..\Run: [Spyware Vanisher] c:\spywarevanisher-free\FreeScanner.exe -FastScan

O4 - HKCU\..\Run: [kdychrv] c:\windows\rqqadka.exe<< All the O4s like that!

O4 - HKCU\..\Run: [mselpew] c:\windows\mfpblfa.exe

O4 - HKCU\..\Run: [ypuluwx] c:\windows\jrhlfvr.exe<< All the O4s like that!

O4 - HKCU\..\Run: [vhvfekx] c:\windows\coqtxvk.exe<< All the O4s like that!

O4 - HKCU\..\Run: [olnyjtl] c:\windows\kwcmwiu.exe<< All the O4s like that!

O21 - SSODL: Address Component - {9A5826AB-84D1-4940-B514-E7BF122D6FD1} - C:\WINDOWS\System32\odbcdpl1.dll (file missing)

Now Make sure ALL WINDOWS and BROWSERS are CLOSED and hit the Fix Checked Button!!

Scan the System with Ewido Security Suite>Make sure to Save the Log it produces!

Now Run Ad Aware SE 1.05 and Remove all
it finds and make sure to Remove the "Quaratine Files"!

Run CWShredder

Click "Fix" and click "OK" at the prompt.
CWShredder will scan and clean your system of CWS files.
Click "Next" and then "Exit"

Run CleanUp!

Click "Cleanup" and it will Scan and Remove all available Temp files>Click "Close">Click "NO" to Logoff and "Exit"

Run MSCONFIG and enable everything in the startup area. To get to MSCONFIG, click on Start -> Run -> type in MSCONFIG -> click OK!

Under the "General" Tab
Make Sure Normal Startup is Checked!!

Click Apply>>OK>>Follow the Prompts to Restart!!

Restart Normal and have the PC Scanned here
Panda Active Scan

[b]You will need to be using Internet Explorer for the Scan to work!

Save the Report it generates!

[b]Once all is Completed,I will need you to post these

Ewido Security Suite Log

Panda Active Scan Log

Fresh HijackThis Log



Note: It appears that the offending files are Morphing so if there are more 04s than I listed that look that reandomly generated,make sure to add them to the list for removal from HijackThis and make sure to add them to list of files to delete!

[Jpellitt]

Whew! O.K. - a couple of notes for you:

1) C:\Windows\System32\flsmngr.dll << would not let me delete ("Cannot delete, access denied" No other windows were open, btw.)

2) C:\Windows\System32\odbcdpl1.dll was not there

3) c:\spywarevanisher-free was not there

4) c:\freescan was not there (btw, I checked the box "show hidden files" if that matters)

5) O4 - HKCU\..\Run: [mselpew] c:\windows\mfpblfa.exe was not there

Attached are the logs for Ewido, Panda, and a fresh HJT. Thanks!

Attached Files

•  Activescan.txt   4.04KB   147 downloads
•  Scan_report_20050524.txt.txt   3.88KB   159 downloads
•  HJT_JP_3.txt   7.83KB   193 downloads

[Wizard]

Now that looks much better,still a little bit to go!

Go to Safe Mode and Unregister these DLLs>To do this:

Click Start>>>Click Run>>>Copy&Paste the Text below into the Text Box and Click OK!

regsvr32 /u flsmngr.dll
If you get an error message,try it like this:
regsvr32 /u C:\WINDOWS\system32\flsmngr.dll

Do the same for this one

regsvr32 /u thun.dll
or
regsvr32 /u C:\WINDOWS\system32\thun.dll


In this order Locate and Delete

C:\WINDOWS\smdat32a.sys<< File!

C:\WINDOWS\system32\MSINET.OCX<< File!

C:\WINDOWS\System32\d3d8wpa.exe

C:\WINDOWS\system32\thun.dll<< File!

C:\WINDOWS\system32\flsmngr.dll<< File!

C:\Documents and Settings\All Users\Start Menu\Programs\Gain Publishing<< Folder!

C:\Documents and Settings\John\Favorites\ Free Hidden Cams World - Realtime.url<< Folder!

C:\Documents and Settings\John\Favorites\ Free Spy Cam - Realtime.url<< Folder!

Open HijackThis and put a check by these but DO NOT hit the Fix Checked button yet!

O4 - HKLM\..\Run: [Terminal Component] C:\WINDOWS\System32\d3d8wpa.exe

O4 - Startup: PowerReg Scheduler V3.exe

O4 - Startup: PowerReg SchedulerV2.exe

Now Make sure ALL WINDOWS and BROWSERS are CLOSED and hit the Fix Checked Button!!

Click Start>>Run>>Type in CMD and Click OK!

Copy &Paste the below text into the Command Prompt Window

cd\ [Enter]
then
attrib -h -s c:\recycler [Enter]
then
del c:\recycler [Enter]

Restart back in Normal Mode and Scan with Ewido and Save that log!

Please Download these 2 to assist Inrternet Explorer and Mozilla FireFox!

SpywareBlaster:
http://www.javacools...areblaster.html
Update Immediatly!

IE Spyad:
http://www.bleepingc...showtutorial=53
There is a direct download inside and great tutorial also!

Post Back with the Ewido log and let me know how the PC is running!

[Jpellitt]

OK - here's the scoop:

1) regsvr32 /u flsmngr.dll and the other one both returned error messages ("Srver entry point not found")

2) regsvr32 /u thun.dll and other one gave "not executable file and no register help available" So I'm assuming neither got where we wanted them to go

3) All files you mentioned are deleted, everything else went fine.

Spywareblaster wouldn't update - "component MSINET.OCX or one of it's dependencies is not correctly registered; a file is missing or invalid"

Attached is a new Ewido log. Thank you!

I haven't had any symptoms - google seems to be working o.k., no resetting of homepage! Life is good! Please let me know if there is a way to get those files out.

Attached Files

•  Scan_report_20050525.txt.txt   1.95KB   90 downloads

[Wizard]

Adware:Adware/BrilliantDigitalNo disinfected C:\WINDOWS\system32\MSINET.OCX

Thats from the Panda Log????

Now thats weird!

You did find all the files listed for Deletion?

As for the Unregisters....Dont worry about that at all!

Just me double checking!

Everything looks OK to me and I assume all is running well?

Go ahead and Disable System Restore
http://service1.syma...src=sec_doc_nam

Post back and let me know about the files!

[Jpellitt]

You:
Adware:Adware/BrilliantDigitalNo disinfected C:\WINDOWS\system32\MSINET.OCX

Thats from the Panda Log????

Now thats weird!
----------------------------------------
Me: If you say so, I'm not sure what you're talking about...?
----------------------------------------
You: You did find all the files listed for Deletion?
-------------------------------------------
Me: Yes, that all seemed to work fine
--------------------------------------------
You: As for the Unregisters....Dont worry about that at all!
---------------------------------------------
Me: Ok
------------------------------------------
You: Just me double checking!

Everything looks OK to me and I assume all is running well?
-------------------------------------------
Me: Yes, except spywareblaster doesn't work
---------------------------------------------
You: Go ahead and Disable System Restore
http://service1.syma...src=sec_doc_nam

Post back and let me know about the files!
------------------------------------------------
Me: I went to do this, and it was already disabled. The files all went o.k. Is there something else I should do?
thanks again for all this help! You're a genius!

[Wizard]

Double Click this Link
http://activex.micro.../vb6/msinet.cab

Please Copy both Files to the System32 Folder!

Once in the System32 folder,right click MSINET.INF and Click "Install"

Retstart the PC and Try to Update Spyware Blaster and let me know if it works!

[Jpellitt]

Yes, it seems to have worked. I think everything is cool now (I keep finding new things to delete with the different malware software, but I guess that's o.k.) Thank you so much for your help!