[Crossposted to WinXP General. You may have multi-posted but you didn't
crosspost; see http://www.blakjak.demon.co.uk/mul_crss.htm]

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_R...:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/...moving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.org/

Alastair MacFarlane wrote:
> Dear All,
>
> I have an irritating Adware exe file that is really causing me problems. I
> have Ad-Aware SE that does not detect it, but my IE 7 browser is getting
> highjacked by this executable in my: "C:\documents and settings\Fred\local
> settings\application data\" folder.
>
> The Ad-Aware says there is a process running (also in my start-up -
> identified through MSCONFIG) that does not appear when I browse to the
> directory (even when I view hidden files). The filename is "wpyxqi.exe"
> and
> Ad-Aware SE says that it is an "Internet Explorer_Hidden" Class. I can
> double click the entry in Ad-Aware SE for the process and it opens up the
> traditional properties form for the exe file and advises me that it is 0k
> in
> size.
>
> How can I delete the file when I cannot see it, and everytime IE7 starts
> up
> again it changes the start-up section in my registry?
>
> Thanks again.
>
> Alastair MacFarlane
>
> Cross - posted in microsoft.public.windowsxp.general &
> microsoft.public.internetexplorer.general