My wifes computer started freezing with high CPU but I couldn’t figure out what was hogging it.  I went to Google to search the symptom and IExplorer started loading different websites.  I didn’t waste anytime shutting down the browser.  One thing you should immediately do when ever this happens.  Change the default website to something static like recomrealty.com (opportune plug).

I started IExplorer again which goes to her default web site RecomRealty.com.  From there I checked out the Manage Add-ons link under tools.  It showed the following unfamiliar add-ons enabled:

geBtSLBr.dll

gqhywr.dll

URqQKLcB.dll

I tried to disable them but they kept coming back.  I couldn’t delete them from windows/system32 in regular mode (Windows XP Pro) or safe mode.  One way to get rid of them – boot like your installing Windows XP Pro.  Go to Repair installation and into the windows/system32 directory.  Delete those DLLS.  Exit repair and boot normally.  Open regedit and search for the DLLs in question and delete them.  Search by the name without the extension.   You have to be carefull here.  The entries under local_machine are critical to machine operation so you can check a good machine or come back here for the exact entries to delete.  I’m writing this from memory which isn’t that great.

You can delete the entries that look similar to {10072CEC-8CC1-11D1-986E-0…… but when you get to local_machine BE CAREFULL.  I’ll try to duplicate it tomorrow and have more detailed instructions. 

We could not find anything on this so it’s a new adware, virus, or malware.  Why do people do this??  Just plain mean man.