Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

C:\fijifj


  • Please log in to reply
13 replies to this topic

#1 cockydevil

cockydevil

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 01 April 2008 - 12:17 PM

hi there,

i have just found a problem that happens randomly. This command window opens up randomly. and an error reads as follows:

c:\fijifj.exe
The NTVDM CPU has encountered an illegal operation.
CS:0dc9 IP:05dd OP:63 6f 6d 2f 66 Choose 'Close' to terminate the application

could someone please explain to me what fijifj is??

i have 2 screenshots to show you the incident if it will help in any way.

i dont know if there is any relation, but my pc clock was reset too, making my antivirus not functional so i had to put it back to the present date.

(i have tried to add screenshots but they dont seem to load or show up on screen...)

Edited by cockydevil, 01 April 2008 - 04:34 PM.

Posted Image

BC AdBot (Login to Remove)

 


#2 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 01 April 2008 - 04:31 PM

please could anyone help me, this problem seems to be more frequent now and is really messing with my system. all my desktop dissapers, only leaving my background... i need to logout or either restart...

thank you for reading and trying to help me.
:thumbsup:
Posted Image

#3 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 02 April 2008 - 03:57 AM

Isnt there anyone out there able to help me?
Posted Image

#4 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 02 April 2008 - 02:53 PM

this is what happens when it pops up.
Posted Image

this is where i found it.
Posted Image

Edited by cockydevil, 02 April 2008 - 02:54 PM.

Posted Image

#5 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:01:54 AM

Posted 02 April 2008 - 03:26 PM

not much help for you at present I know , but a comment I would make if I may from your screan shot ?
you are unsure whether you are infected or not ?

HOWEVER, you appear to have two instant messaging windows open which means you are in contact with at least two other computers ; do you think this is wise , knowing your present uncertain predicament ?


some ideas for you

what programs have you so far run to try to detect any unwanted guests on the computer ?

and, assuming you are on XP have you checked in your System Resotre for possibe roll back dates?

also, have you yet looked in your add remove programs to see if this 'program 'is in there?

#6 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,046 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:07:54 PM

Posted 02 April 2008 - 06:15 PM

Hello cockydevil and welcome to BC :flowers:

Sorry about the delay in response. We are all volunteers here and sometimes things slip past us.

In order to provide proper disinfection procedures, we need a bit more information.

What is your operating system: Windows XP, Vista, etc.?

What security programs do you have installed? Please name them.

I haven't been able to find much concerning the file that produces the error message, which leads me to suspect that it is a baddie.

I would like you to upload and scan that file at Jotti and at VirusTotal. Please post the results in your next reply indicating which report is from Jotti and which from VirusTotal.

Also, I see a folder called Qoobox in your second screen shot. Do you know how it got there?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Internet Security, NoScript Firefox ext.


animinionsmalltext.gif

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,530 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:54 PM

Posted 02 April 2008 - 08:01 PM

Qoobox is a folder created by Combofix to quarantine any infected files.

Uninstall ComboFix, go to to Start > Run & type in ComboFix /u
Make sure there's a space between Combofix and /
Then hit enter.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 07 April 2008 - 01:20 PM

hi everyone,

thank you all for taking the time to answer me and helping me out. I am running Windows XP, and use AVG and COMODO Personal Firewall, as well as Spybot search and destroy and ad-aware 2007. I also use CCleaner.

sorry i havent been able to scan the file/program at Jotti and at VirusTotal as i did reformat my pc today. It was the only thing i could do as i really needed my pc to work. Ok so now it seems to be ok.

Although the my internet is going bonkers now. When i connect to the internet this frequently happens

- "The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings.
To attempt fixing network connectivity problems, click Tools, and then click "Diagnose Connection Problems..." -

I do all of that, but it says my connection is fine. and it happens randomly too. when i search something on yahoo (if i can open the page) the next page shows the same message... i feel hopeless...

i also found this in the hidden folders in drive C recycle bin : S-1-5-21-1957994488-1177238915-725345543-1003

I dont know if you all understand whats happening to my pc, but im grateful for all your help so far, and am gald there is a community like this that is out there to help each other.
Posted Image

#9 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 07 April 2008 - 01:26 PM

oh yes one more thing, the reason i had to reformat my pc is because i used something called ''unlocker'' i used it to delete the infection. but its a bad infection. How i found out about it was that at a friends house i put something on my pen drive, when i brought it home, without even opening it or anything it copied itself on my pc! hiding itself it the recycle bin! ( in the hidden folders when u browse drive C) but i accidently deleted other flies i obviously shouldnt have!!! so please all, if there is something there you dont know about, dont do anything! you may really damage your system!

Anyway i restarted my pc and this is what came up

NTDLR is missing
Press CTRL+ALT+DEL to restart...
I nearly had a heart attack... thats when i went to get my friend and he reformatted my pc. :thumbsup:
Posted Image

#10 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:01:54 AM

Posted 08 April 2008 - 11:26 AM

IS this wee oddity now all sorted? :thumbsup:

#11 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 09 April 2008 - 03:59 AM

yes i do think that it has been resolved. But i suspect that i am infected otherwise now... but i cant seem to figure out what it is. As i said earlier my internet has like a 50/50 chance of working when i launch the browser and it is quite slow. is there anything i can run or scan my pc with to know if there are any process or porgrams running that i dont know or to detect these things?

As i also mentioned earlier, in the hidden files on drive c there is a file in the recycle bin that i dont know if it should be there. A friend told me its a nasty trojan that hides in the recycle bin.
Posted Image

#12 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 10 April 2008 - 01:16 PM

i know i might be persistant, but i kind of need the help plz
Posted Image

#13 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:01:54 AM

Posted 10 April 2008 - 01:40 PM

as you have not listed these two programs as ones you have run ;; try
superantispyware

http://www.superantispyware.com/superantis...efreevspro.html

free exe from http://www.superantispyware.com/downloadfi...ANTISPYWAREFREE

you will need to fully update it and I suggest you start the progoam from the desktop shortcut ; run it in your computers afe mode on a full deep scan ;

also try asquared

http://www.emsisoft.com/en/software/free/


free exe is
http://download6.emsisoft.com/a2FreeSetup.exe

again fully update the definitions, reboot in to your computers safe mode and run a full deep scan with it

these scans may take a few hours to run so be patient ; let us know what they find?

also; one hopes you are NOT using any MSN or any other instant messaging facility while you may be infected? nor I guess doing any emailing unitl you know you are clean?

you say you reformatted the pc? was this using a known 'clean' and original cd with legal licence key?

#14 cockydevil

cockydevil
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mauritius
  • Local time:03:54 AM

Posted 15 April 2008 - 05:03 AM

Thank you for the reply Ruby, i havent had internet access for a little while, i will try out what you advised me to do. I have reformatted my pc with 'clean' cd as far as i know and have my original licence key. I'll let you know the results as soon as i scan my pc.

thanks again!
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users