kjluknk.exe and winsystem.exe

[thirtythree]

I just reformatted with xp and I noticed there were two copies of these running when I boot up, then one of each after the first few seconds. they're both located in c:\windows\system32 and they're both protected system files. they were located in the 'run' folder in regedit though, and I've never seen system files use that. kjluknk was labeled as spoolsv.exe and winsystem was labeled as 'windows system manager.' I tried deleting them from there, but they kept coming back. I also ran spybot and norton antivirus (with updated definitions), and didn't find anything. I eventually renamed the files so they can't be run anymore, but I want to make sure they aren't anything important first. also, explorer.exe tried to access an adult site. this is my first time using a firewall, so I'm not sure if this is normal or not :s

btw, I searched google - winsystem seems to be associated with a few viruses, but I'd think norton would've caught it if it was a virus. I can't find anything about kjluknk.

typo

 

[AtTheGates]

Delete the keys and the programs and make sure your av and spyware scanners are up to date. I searched my system for winsystem.exe and there is no such file. Google says virus. spoolsv.exe is a real program but it is called spoolsv.exe not kjluknk.exe and it is not run from currentversion/run. This looks like a randomly generated name. Explorer accessing adult sites on its own is not normal.