Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Sorry if this is the wrong forum. Not sure what I am infected with


  • This topic is locked This topic is locked
12 replies to this topic

#1 markkerr101

markkerr101

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 14 August 2009 - 02:24 AM

Hello I'm truly sorry if this is the wrong forum i almost know it is. But I can't access the site any other way except this way.


My internet explorer and firefox hasn't worked in nearly 8 months. I have tried everything. A virus has turned off my ability to be the administator so i can not even do a system restore or access certain parts of my computer. It won't let me clean my computer with spybot or anything even.

Also my disc drive has been disabled it seems so i can't reinstall windows xp .

I just lucked out a few minutes ago and uninstalled ie and reinstalled it. It won't let me browse but i access the site off of google cached if that makes any sense. So I am truly sorry again if this is the wrong section.

I am not sure if this is all I need or not. But please let me know thank you

Here is my hijack this log.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:13:28 AM, on 8/14/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe
C:\WINDOWS\Q29keSBNaWxsZXI\command.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\taskmgr.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\vlc-1.0.1-win32.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\VideoLAN\VLC\uninstall.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myspace.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {361ad529-5571-4c76-93ea-3ebcac169cb1} - C:\WINDOWS\system32\godidusa.dll (file missing)
O2 - BHO: C:\WINDOWS\system32\hhs3ijndfd.dll - {c5bf49a2-94f3-42bd-f434-3604812c8955} - C:\WINDOWS\system32\hhs3ijndfd.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Mirar - {32DDD01E-2F9D-46A4-B81D-FB3907A7CC20} - C:\WINDOWS\system32\winfe77.dll
O4 - HKLM\..\Run: [Egululufujufu] rundll32.exe "C:\WINDOWS\Lniriv.dll",e
O4 - HKLM\..\Run: [Fbovotoyefuluga] rundll32.exe "C:\WINDOWS\ujetaludejemila.dll",e
O4 - HKLM\..\Run: [zinilawume] Rundll32.exe "C:\WINDOWS\system32\sutojude.dll",s
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [2c945a57] rundll32.exe "C:\WINDOWS\system32\pebuhewe.dll",b
O4 - HKLM\..\Run: [CPM2fa769cb] Rundll32.exe "c:\windows\system32\jimiwemo.dll",a
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kza23gwftftwbnj6gkyfgrk] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\z3k6fregzho.exe
O4 - HKCU\..\Run: [lg3kw9wtqg4y3aec254xy1380gkzawy6lftziduxzqf] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\l1x7czqxhfu.exe
O4 - HKCU\..\Run: [w6bukf5ami0limxoqxfbnttaatxr1] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\d1lleog8xboh.exe
O4 - HKCU\..\Run: [w94orjdi55v0jvzq95ljk723bnxlmf0idd] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ghlw8xx.exe
O4 - HKCU\..\Run: [m4vcqjc3jwy5germ] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uriwoulv.exe
O4 - HKCU\..\Run: [bq6ln7xquei6e7lq7fpfm9d7n65st5876z68ci] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mnexez.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [z3l8u6tcmgwyxgsjo3czvsmn8oobbwx] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\j68n9d8uy5.exe
O4 - HKCU\..\Run: [z2gm34awazy1qwzz5] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qgh0ad1d1ucwy.exe
O4 - HKCU\..\Run: [sp1h3r29w7tj1b] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wnqexgc4rjp.exe
O4 - HKCU\..\Run: [fo8106ibc] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\az3pylemh.exe
O4 - HKCU\..\Run: [e29ksbaae18olkn2zpe88bsmczlii] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ygnn7zpeota93.exe
O4 - HKCU\..\Run: [ymtwcgg20ydbopft4aw2msorbir] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\y8pypnols6.exe
O4 - HKCU\..\Run: [frcv1d2fnp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\di0bgf9t.exe
O4 - HKCU\..\Run: [koz7eqkeuhmg5ivd5mnbkmiqnhk0rm] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\z3lezpwx.exe
O4 - HKCU\..\Run: [hqqgbvkjod885fwz31bz] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a04kjuegwv7.exe
O4 - HKCU\..\Run: [mt8r78r39zxu0w2h2rwn] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\t2a73qlamc51.exe
O4 - HKCU\..\Run: [t3rio9lxxu1av3ww0x1ukofu7nuscl] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mvwn3v81dgwt.exe
O4 - HKCU\..\Run: [rjej66taxseg5vzzo1ymnkseptw9ij5ivliieza5m8mizqz00] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a3oduzwp2a1s.exe
O4 - HKCU\..\Run: [syai2cc5xfs8qq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\g1vxgep97mdc6.exe
O4 - HKCU\..\Run: [yg4pspab2bz13ye2ieuguirdrw72mkmvfxe0ujzdvubvo3q] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nfz5en.exe
O4 - HKCU\..\Run: [a3of7uydvm7zdeyt1cwc] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\z84mberk.exe
O4 - HKCU\..\Run: [yq26z4nkstu764gm7s58s] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ytno4ye69g.exe
O4 - HKCU\..\Run: [cwgzefy2wanp7tw0vi358rd5qij60d58voc05taj6lw] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jcco1piy7.exe
O4 - HKCU\..\Run: [xh3grjcjih2cleow1zw42zhfs] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\l11kd0uaulb6s.exe
O4 - HKCU\..\Run: [abmawzceu9fefbwc3jw19c5oa2we] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rsnqyh88.exe
O4 - HKCU\..\Run: [m0fleri3zvcoqbs8] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jpixjzq4y.exe
O4 - HKCU\..\Run: [ib9m7hwbv31a33zvwcrjiji3tnmf4r] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qt5tmw8tckc2.exe
O4 - HKCU\..\Run: [uyngz5ftjrssxhh] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qy32rrkxqb9.exe
O4 - HKCU\..\Run: [m0bahhxfu1t070hxvl60pgjlmllsjcva2usog36] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nueko3ram5q.exe
O4 - HKCU\..\Run: [nplg1a1uup95lphvzhxcqq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\o41fw2k9.exe
O4 - HKCU\..\Run: [nhhn58qjie4cqm5qlmjugp8vulgx7k4wy0ny0a] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jqgewe4u.exe
O4 - HKCU\..\Run: [cpss1kwolgt9] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\xeoy2m.exe
O4 - HKCU\..\Run: [i3ff5jqjwkmst0k5cmeliw4] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fi01jslnf.exe
O4 - HKCU\..\Run: [lq5in51148sicmv39i1tqau4d3cq46a5coxu9eej3] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gs5za95ygc.exe
O4 - HKCU\..\Run: [bibv91vqah3981lulwxzf5iho1daevtgx9zjzar] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mwaqrimt2.exe
O4 - HKCU\..\Run: [d9bhqztjs5v5k40t0q1ujhz7dyce0zgwv0eanafrf1w8] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\h8blrf.exe
O4 - HKCU\..\Run: [vtzc801ir7tbay5ov0bkoq7wq3] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\y7n8p1b4.exe
O4 - HKCU\..\Run: [rvpafmilj9lrapcgfsxh] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ws8gm5bjp.exe
O4 - HKCU\..\Run: [idl07c9i7z17pbf04hwdtrg0xroafh] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vus7a0swk1qo.exe
O4 - HKCU\..\Run: [vunlbtx6m53ngbq23t4alyuw75lshj87kghgk473cp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gwsqxaupnjqfy.exe
O4 - HKCU\..\Run: [g4hg2rt1uq6xsmbf0bsdzwppmy2fywty2p7t7dy2dv841iz] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nmqfp1js.exe
O4 - HKCU\..\Run: [z62isv6z2wlci2wymy5b1fyt6gdmsk] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\i76n90w.exe
O4 - HKCU\..\Run: [o4g9zuxl05ti4] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wdzsnpt6mg51d.exe
O4 - HKCU\..\Run: [i16rcbgtgp81xgrq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tjwi3v4wvq1f8.exe
O4 - HKCU\..\Run: [qzbq6mie6g2n5623smqb70l8yx8ucsvn8ordp6ecvm7qqf5vkp] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nujzibc81e.exe
O4 - HKCU\..\Run: [lusshbw05ph74966ksw] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\np7z2t0588uo4.exe
O4 - HKCU\..\Run: [rnkdpa814mlnc0ohzmzdsfklnei9s] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ehvtft7qg03.exe
O4 - HKCU\..\Run: [v4jodbr00wvtih] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mgvs0p.exe
O4 - HKCU\..\Run: [p9kceind9w4mt1w4yjm34x4mjonxt245c16ae2f] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ctphwtw.exe
O4 - HKCU\..\Run: [gbv3bkxewm6091lmnxsb9d4ly0k5cwndmye1qeja4nkf7] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a9r5kgr4.exe
O4 - HKCU\..\Run: [wtpd1ilbd7xrsxe9y45cy9lx191] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dg4eiukff.exe
O4 - HKCU\..\Run: [rpgiqtz7cu] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\qtcdqwmy5ydol.exe
O4 - HKCU\..\Run: [fy6rvcbjnzftpgwrhix0kezx76nhzovcxg6kv0q] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pj7fzw2n44zj.exe
O4 - HKCU\..\Run: [m5ofvrwuknck3cvnvh3n5fbq6rsrf] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mn4au3.exe
O4 - HKCU\..\Run: [g4e8epemlx8dfds] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wwhx5wexnerx.exe
O4 - HKCU\..\Run: [s18feyxf20okoajocu4y6sc5ymize] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\jpsp8k.exe
O4 - HKCU\..\Run: [mv23qg317cqv3dq] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uyxoper0bkp.exe
O4 - HKCU\..\Run: [vkki4q6yncq06d59z4c9eji0rir6goefd0009xrpm240z6hy5] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gkgpslul8.exe
O4 - HKCU\..\Run: [qp4f5xhw7jovxi319e58mgpurq6ra8oo] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\a40dw9.exe
O4 - HKCU\..\Run: [xpzjxuiiqdfow5dhlu] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\yvwvb3.exe
O4 - HKCU\..\Run: [ugsyq7pdi] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mttiwaeb4n.exe
O4 - HKCU\..\Run: [nt12uoqhb12s1qccjfkhf9aby] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\mh5it9q.exe
O4 - HKCU\..\Run: [llvwnnntj27tgkjs636qlfug8obdesafslslrefe9m] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\lksu36x3mt4yc.exe
O4 - HKCU\..\Run: [ndiwe72ci1j6zhfoka] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wc9qri64.exe
O4 - HKCU\..\Run: [jwzu15ajignynfbzq73yuvk9tbu55ve60r9vj5ybv] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dgzvjbou5ngrd.exe
O4 - HKCU\..\Run: [hngncojwo7bz15vgc37e9nslhzeew5kuo] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\z17emcufp9n8i.exe
O4 - HKCU\..\Run: [woso7d6rqez8] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\yua5ab56uu4.exe
O4 - HKCU\..\Run: [yu3hllmdcfn4s678aytkekstliupc] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sa4ict3c.exe
O4 - HKCU\..\Run: [njm7sim0mff9dau] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\bkjjxinsb.exe
O4 - HKCU\..\Run: [df5up8qfhot2] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\g4mcmdppf.exe
O4 - HKCU\..\Run: [czu15e0qs96kzl40enxfsaagcoxpddj9im] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\m3qmd6s1dvid.exe
O4 - HKCU\..\Run: [uqfes7bu2dt5pme4s] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ndo0boji7vc.exe
O4 - HKCU\..\Run: [bggxbq9fudg6] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gj0z1aukrjjz.exe
O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\taskmgr.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9e.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\docume~1\admini~1\locals~1\temp\ntdll64.dll
O10 - Unknown file in Winsock LSP: c:\docume~1\admini~1\locals~1\temp\ntdll64.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst_current.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1180454734859
O20 - AppInit_DLLs: hegfcd.dll C:\WINDOWS\system32\sutojude.dll gdpzej.dll C:\WINDOWS\system32\tidadegi.dll c:\windows\system32\jimiwemo.dll
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\jimiwemo.dll
O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - C:\WINDOWS\system32\hhs3ijndfd.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\jimiwemo.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\Q29keSBNaWxsZXI\command.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

--
End of file - 14049 bytes

BC AdBot (Login to Remove)

 


#2 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:03:02 PM

Posted 24 August 2009 - 11:24 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image

#3 markkerr101

markkerr101
  • Topic Starter

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 27 August 2009 - 04:39 PM

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 5/29/2007 4:50:54 AM
System Uptime: 8/27/2009 5:16:20 PM (0 hours ago)

Motherboard: Dell Computer Corp. | | 0TC667
Processor: Intel® Pentium® 4 CPU 2.80GHz | Microprocessor | 2793/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 71 GiB total, 3.817 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel® PRO/100 VE Network Connection
Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_019D1028&REV_02\4&1C660DD6&0&40F0
Manufacturer: Intel
Name: Intel® PRO/100 VE Network Connection
PNP Device ID: PCI\VEN_8086&DEV_1050&SUBSYS_019D1028&REV_02\4&1C660DD6&0&40F0
Service: E100B

Class GUID: {4D36E965-E325-11CE-BFC1-08002BE10318}
Description: CD-ROM Drive
Device ID: IDE\CDROMSONY_DVD_RW_DRU-820A____________________1.0B____\5&145A0A8F&0&0.0.0
Manufacturer: (Standard CD-ROM drives)
Name: SONY DVD RW DRU-820A
PNP Device ID: IDE\CDROMSONY_DVD_RW_DRU-820A____________________1.0B____\5&145A0A8F&0&0.0.0
Service: cdrom

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.0
Advertisement Service
AIM 6
Ask Toolbar
BOINC
Command
Compact Wireless-G USB Adapter
DaemonScript
Dell Driver Reset Tool
Dell Resource CD
DivX Content Uploader
DivX Web Player
Driver Genius Professional Edition 2007
ESPNMotion
HijackThis 2.0.2
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB908673)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
Intel® 537EP V9x DF PCI Modem
Intel® Extreme Graphics 2 Driver
Intel® PRO Network Connections 12.1.12.0
Java™ 6 Update 11
Microsoft .NET Framework 1.0 Hotfix (KB887998)
Microsoft .NET Framework 1.0 Hotfix (KB930494)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Visual C++ 2005 Redistributable
Mirar
Modem Helper
Mozilla Firefox (3.5.2)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Nero 7 Ultra Edition
neroxml
Network Monitor
Otto
RealPlayer
Rhapsody Player Engine
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Sonic Encoders
SoundMAX
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
TargetSaver
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update Rollup 2 for Windows XP Media Center Edition 2005
Viewpoint Media Player
VLC media player 1.0.1
Webcam Basic
WebCyberCoach 3.2 Dell
WebFldrs XP
Winamp (remove only)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format Runtime
Windows Media Player Firefox Plugin
Windows XP Hotfix - KB839210
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB884020
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Media Center Edition 2005 KB908250
WinRAR archiver
Yahoo! Anti-Spy
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar

==== Event Viewer Messages From Past Week ========

8/27/2009 5:05:24 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WUSB54GCSVC service.
8/26/2009 12:59:06 AM, error: DCOM [10005] - DCOM got error "%2" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
8/26/2009 1:02:17 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
8/23/2009 12:51:42 AM, error: Service Control Manager [7034] - The Network Monitor service terminated unexpectedly. It has done this 1 time(s).
8/23/2009 12:45:51 PM, error: Service Control Manager [7000] - The Background Intelligent Transfer Service service failed to start due to the following error: The system cannot find the file specified.
8/23/2009 12:38:43 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PxHelp20
8/23/2009 12:38:42 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
8/23/2009 12:38:32 AM, error: NetBT [4311] - Initialization failed because the driver device could not be created.
8/23/2009 1:27:09 PM, error: Service Control Manager [7028] - The wuauserv Registry key denied access to SYSTEM account programs so the Service Control Manager took ownership of the Registry key.

==== End Of File ===========================



DDS (Ver_09-07-30.01) - NTFSx86
Run by Administrator at 17:25:57.62 on Thu 08/27/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.145 [GMT -4:00]

FW: Outpost Firewall Pro *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRAM FILES\A-SQUARED ANTI-MALWARE\a2service.exe
C:\WINDOWS\Q29keSBNaWxsZXI\command.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\BOINC\boinctray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\taskmgr.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\dds(3).scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
uSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: {361ad529-5571-4c76-93ea-3ebcac169cb1} - c:\windows\system32\godidusa.dll
BHO: c:\windows\system32\hhs3ijndfd.dll: {c5bf49a2-94f3-42bd-f434-3604812c8955} - c:\windows\system32\hhs3ijndfd.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Ask Toolbar: {fe063db9-4ec0-403e-8dd8-394c54984b2c} - c:\program files\asktbar\bar\1.bin\ASKTBAR.DLL
TB: Mirar: {32ddd01e-2f9d-46a4-b81d-fb3907a7cc20} - c:\windows\system32\winfe77.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [kza23gwftftwbnj6gkyfgrk] c:\docume~1\admini~1\locals~1\temp\z3k6fregzho.exe
uRun: [lg3kw9wtqg4y3aec254xy1380gkzawy6lftziduxzqf] c:\docume~1\admini~1\locals~1\temp\l1x7czqxhfu.exe
uRun: [w6bukf5ami0limxoqxfbnttaatxr1] c:\docume~1\admini~1\locals~1\temp\d1lleog8xboh.exe
uRun: [w94orjdi55v0jvzq95ljk723bnxlmf0idd] c:\docume~1\admini~1\locals~1\temp\ghlw8xx.exe
uRun: [m4vcqjc3jwy5germ] c:\docume~1\admini~1\locals~1\temp\uriwoulv.exe
uRun: [bq6ln7xquei6e7lq7fpfm9d7n65st5876z68ci] c:\docume~1\admini~1\locals~1\temp\mnexez.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [z3l8u6tcmgwyxgsjo3czvsmn8oobbwx] c:\docume~1\admini~1\locals~1\temp\j68n9d8uy5.exe
uRun: [z2gm34awazy1qwzz5] c:\docume~1\admini~1\locals~1\temp\qgh0ad1d1ucwy.exe
uRun: [sp1h3r29w7tj1b] c:\docume~1\admini~1\locals~1\temp\wnqexgc4rjp.exe
uRun: [fo8106ibc] c:\docume~1\admini~1\locals~1\temp\az3pylemh.exe
uRun: [e29ksbaae18olkn2zpe88bsmczlii] c:\docume~1\admini~1\locals~1\temp\ygnn7zpeota93.exe
uRun: [ymtwcgg20ydbopft4aw2msorbir] c:\docume~1\admini~1\locals~1\temp\y8pypnols6.exe
uRun: [frcv1d2fnp] c:\docume~1\admini~1\locals~1\temp\di0bgf9t.exe
uRun: [koz7eqkeuhmg5ivd5mnbkmiqnhk0rm] c:\docume~1\admini~1\locals~1\temp\z3lezpwx.exe
uRun: [hqqgbvkjod885fwz31bz] c:\docume~1\admini~1\locals~1\temp\a04kjuegwv7.exe
uRun: [mt8r78r39zxu0w2h2rwn] c:\docume~1\admini~1\locals~1\temp\t2a73qlamc51.exe
uRun: [t3rio9lxxu1av3ww0x1ukofu7nuscl] c:\docume~1\admini~1\locals~1\temp\mvwn3v81dgwt.exe
uRun: [rjej66taxseg5vzzo1ymnkseptw9ij5ivliieza5m8mizqz00] c:\docume~1\admini~1\locals~1\temp\a3oduzwp2a1s.exe
uRun: [syai2cc5xfs8qq] c:\docume~1\admini~1\locals~1\temp\g1vxgep97mdc6.exe
uRun: [yg4pspab2bz13ye2ieuguirdrw72mkmvfxe0ujzdvubvo3q] c:\docume~1\admini~1\locals~1\temp\nfz5en.exe
uRun: [a3of7uydvm7zdeyt1cwc] c:\docume~1\admini~1\locals~1\temp\z84mberk.exe
uRun: [yq26z4nkstu764gm7s58s] c:\docume~1\admini~1\locals~1\temp\ytno4ye69g.exe
uRun: [cwgzefy2wanp7tw0vi358rd5qij60d58voc05taj6lw] c:\docume~1\admini~1\locals~1\temp\jcco1piy7.exe
uRun: [xh3grjcjih2cleow1zw42zhfs] c:\docume~1\admini~1\locals~1\temp\l11kd0uaulb6s.exe
uRun: [abmawzceu9fefbwc3jw19c5oa2we] c:\docume~1\admini~1\locals~1\temp\rsnqyh88.exe
uRun: [m0fleri3zvcoqbs8] c:\docume~1\admini~1\locals~1\temp\jpixjzq4y.exe
uRun: [ib9m7hwbv31a33zvwcrjiji3tnmf4r] c:\docume~1\admini~1\locals~1\temp\qt5tmw8tckc2.exe
uRun: [uyngz5ftjrssxhh] c:\docume~1\admini~1\locals~1\temp\qy32rrkxqb9.exe
uRun: [m0bahhxfu1t070hxvl60pgjlmllsjcva2usog36] c:\docume~1\admini~1\locals~1\temp\nueko3ram5q.exe
uRun: [nplg1a1uup95lphvzhxcqq] c:\docume~1\admini~1\locals~1\temp\o41fw2k9.exe
uRun: [nhhn58qjie4cqm5qlmjugp8vulgx7k4wy0ny0a] c:\docume~1\admini~1\locals~1\temp\jqgewe4u.exe
uRun: [cpss1kwolgt9] c:\docume~1\admini~1\locals~1\temp\xeoy2m.exe
uRun: [i3ff5jqjwkmst0k5cmeliw4] c:\docume~1\admini~1\locals~1\temp\fi01jslnf.exe
uRun: [lq5in51148sicmv39i1tqau4d3cq46a5coxu9eej3] c:\docume~1\admini~1\locals~1\temp\gs5za95ygc.exe
uRun: [bibv91vqah3981lulwxzf5iho1daevtgx9zjzar] c:\docume~1\admini~1\locals~1\temp\mwaqrimt2.exe
uRun: [d9bhqztjs5v5k40t0q1ujhz7dyce0zgwv0eanafrf1w8] c:\docume~1\admini~1\locals~1\temp\h8blrf.exe
uRun: [vtzc801ir7tbay5ov0bkoq7wq3] c:\docume~1\admini~1\locals~1\temp\y7n8p1b4.exe
uRun: [rvpafmilj9lrapcgfsxh] c:\docume~1\admini~1\locals~1\temp\ws8gm5bjp.exe
uRun: [idl07c9i7z17pbf04hwdtrg0xroafh] c:\docume~1\admini~1\locals~1\temp\vus7a0swk1qo.exe
uRun: [vunlbtx6m53ngbq23t4alyuw75lshj87kghgk473cp] c:\docume~1\admini~1\locals~1\temp\gwsqxaupnjqfy.exe
uRun: [g4hg2rt1uq6xsmbf0bsdzwppmy2fywty2p7t7dy2dv841iz] c:\docume~1\admini~1\locals~1\temp\nmqfp1js.exe
uRun: [z62isv6z2wlci2wymy5b1fyt6gdmsk] c:\docume~1\admini~1\locals~1\temp\i76n90w.exe
uRun: [o4g9zuxl05ti4] c:\docume~1\admini~1\locals~1\temp\wdzsnpt6mg51d.exe
uRun: [i16rcbgtgp81xgrq] c:\docume~1\admini~1\locals~1\temp\tjwi3v4wvq1f8.exe
uRun: [qzbq6mie6g2n5623smqb70l8yx8ucsvn8ordp6ecvm7qqf5vkp] c:\docume~1\admini~1\locals~1\temp\nujzibc81e.exe
uRun: [lusshbw05ph74966ksw] c:\docume~1\admini~1\locals~1\temp\np7z2t0588uo4.exe
uRun: [rnkdpa814mlnc0ohzmzdsfklnei9s] c:\docume~1\admini~1\locals~1\temp\ehvtft7qg03.exe
uRun: [v4jodbr00wvtih] c:\docume~1\admini~1\locals~1\temp\mgvs0p.exe
uRun: [p9kceind9w4mt1w4yjm34x4mjonxt245c16ae2f] c:\docume~1\admini~1\locals~1\temp\ctphwtw.exe
uRun: [gbv3bkxewm6091lmnxsb9d4ly0k5cwndmye1qeja4nkf7] c:\docume~1\admini~1\locals~1\temp\a9r5kgr4.exe
uRun: [wtpd1ilbd7xrsxe9y45cy9lx191] c:\docume~1\admini~1\locals~1\temp\dg4eiukff.exe
uRun: [rpgiqtz7cu] c:\docume~1\admini~1\locals~1\temp\qtcdqwmy5ydol.exe
uRun: [fy6rvcbjnzftpgwrhix0kezx76nhzovcxg6kv0q] c:\docume~1\admini~1\locals~1\temp\pj7fzw2n44zj.exe
uRun: [m5ofvrwuknck3cvnvh3n5fbq6rsrf] c:\docume~1\admini~1\locals~1\temp\mn4au3.exe
uRun: [g4e8epemlx8dfds] c:\docume~1\admini~1\locals~1\temp\wwhx5wexnerx.exe
uRun: [s18feyxf20okoajocu4y6sc5ymize] c:\docume~1\admini~1\locals~1\temp\jpsp8k.exe
uRun: [mv23qg317cqv3dq] c:\docume~1\admini~1\locals~1\temp\uyxoper0bkp.exe
uRun: [vkki4q6yncq06d59z4c9eji0rir6goefd0009xrpm240z6hy5] c:\docume~1\admini~1\locals~1\temp\gkgpslul8.exe
uRun: [qp4f5xhw7jovxi319e58mgpurq6ra8oo] c:\docume~1\admini~1\locals~1\temp\a40dw9.exe
uRun: [xpzjxuiiqdfow5dhlu] c:\docume~1\admini~1\locals~1\temp\yvwvb3.exe
uRun: [ugsyq7pdi] c:\docume~1\admini~1\locals~1\temp\mttiwaeb4n.exe
uRun: [nt12uoqhb12s1qccjfkhf9aby] c:\docume~1\admini~1\locals~1\temp\mh5it9q.exe
uRun: [llvwnnntj27tgkjs636qlfug8obdesafslslrefe9m] c:\docume~1\admini~1\locals~1\temp\lksu36x3mt4yc.exe
uRun: [ndiwe72ci1j6zhfoka] c:\docume~1\admini~1\locals~1\temp\wc9qri64.exe
uRun: [jwzu15ajignynfbzq73yuvk9tbu55ve60r9vj5ybv] c:\docume~1\admini~1\locals~1\temp\dgzvjbou5ngrd.exe
uRun: [hngncojwo7bz15vgc37e9nslhzeew5kuo] c:\docume~1\admini~1\locals~1\temp\z17emcufp9n8i.exe
uRun: [woso7d6rqez8] c:\docume~1\admini~1\locals~1\temp\yua5ab56uu4.exe
uRun: [yu3hllmdcfn4s678aytkekstliupc] c:\docume~1\admini~1\locals~1\temp\sa4ict3c.exe
uRun: [njm7sim0mff9dau] c:\docume~1\admini~1\locals~1\temp\bkjjxinsb.exe
uRun: [df5up8qfhot2] c:\docume~1\admini~1\locals~1\temp\g4mcmdppf.exe
uRun: [czu15e0qs96kzl40enxfsaagcoxpddj9im] c:\docume~1\admini~1\locals~1\temp\m3qmd6s1dvid.exe
uRun: [uqfes7bu2dt5pme4s] c:\docume~1\admini~1\locals~1\temp\ndo0boji7vc.exe
uRun: [bggxbq9fudg6] c:\docume~1\admini~1\locals~1\temp\gj0z1aukrjjz.exe
uRun: [Windows System Recover!] c:\docume~1\admini~1\locals~1\temp\taskmgr.exe
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
mRun: [Egululufujufu] rundll32.exe "c:\windows\Lniriv.dll",e
mRun: [Fbovotoyefuluga] rundll32.exe "c:\windows\ujetaludejemila.dll",e
mRun: [zinilawume] Rundll32.exe "c:\windows\system32\sutojude.dll",s
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [2c945a57] rundll32.exe "c:\windows\system32\pebuhewe.dll",b
mRun: [CPM2fa769cb] Rundll32.exe "c:\windows\system32\jimiwemo.dll",a
mRun: [boincmgr] "c:\program files\boinc\boincmgr.exe" /a /s
mRun: [boinctray] "c:\program files\boinc\boinctray.exe"
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
uPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
uPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
uPolicies-explorer: NoFolderOptions = 1 (0x1)
uPolicies-system: DisableTaskMgr = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: c:\docume~1\admini~1\locals~1\temp\ntdll64.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1180454734859
DPF: {8ad9c840-044e-11d1-b3e9-00805f499d93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {cafeefac-0016-0000-0011-abcdeffedcba} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {cafeefac-ffff-ffff-ffff-abcdeffedcba} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Notify: crypt - crypts.dll
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: hegfcd.dll c:\windows\system32\sutojude.dll gdpzej.dll c:\windows\system32\tidadegi.dll c:\windows\system32\jimiwemo.dll
SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\jimiwemo.dll
STS: c:\windows\system32\hhs3ijndfd.dll: {c5bf49a2-94f3-42bd-f434-3604812c8955} - c:\windows\system32\hhs3ijndfd.dll
STS: STS: {ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} - c:\windows\system32\jimiwemo.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\geBstQgd
LSA: Notification Packages = scecli c:\windows\system32\sutojude.dll c:\windows\system32\tidadegi.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\xshr9a4y.default\
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: XUL Cache: {2EA0913C-1A09-453D-8283-205BADB7DC3F} - c:\documents and settings\administrator\local settings\application data\{2EA0913C-1A09-453D-8283-205BADB7DC3F}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R2 a2AntiMalware;a-squared Anti-Malware Service;c:\program files\a-squared anti-malware\a2service.exe [2007-6-5 224888]
R2 cmdService;Command Service;c:\windows\q29kesbnawxszxi\command.exe [2008-12-19 293888]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 Network Monitor;Network Monitor;c:\program files\network monitor\netmon.exe service --> c:\program files\network monitor\netmon.exe service [?]
S3 PAC207;Webcam Basic;c:\windows\system32\drivers\PFC027.sys [2005-4-8 162176]
S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\system32\drivers\wg111v3.sys --> c:\windows\system32\drivers\wg111v3.sys [?]

=============== Created Last 30 ================

2009-08-27 17:13 <DIR> --d----- c:\program files\BOINC
2009-08-27 17:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\BOINC
2009-08-24 04:02 1,407,256 ---sh--- c:\windows\system32\ewehubep.ini2
2009-08-24 03:52 1,407,256 ---sh--- c:\windows\system32\ewehubep.tmp
2009-08-19 00:08 410,984 a------- c:\windows\system32\deploytk.dll
2009-08-19 00:08 73,728 a------- c:\windows\system32\javacpl.cpl
2009-08-14 21:49 2,098 ---sh--- c:\windows\system32\zapukasi.exe

==================== Find3M ====================

2009-08-27 17:27 101,608 a------- c:\windows\system32\drivers\b7d26705.sys
2009-07-10 14:22 109,056 a--sh--- c:\windows\system32\jimiwemo.dll
2009-07-10 14:22 100,352 a--sh--- c:\windows\system32\pebuhewe.dll
2009-06-20 00:23 1,777 a--sh--- c:\windows\system32\dgQtsBeg.ini2
2009-06-10 11:05 828,160 a------- c:\windows\boinc.scr
2005-08-02 17:46 187,904 a--shr-- c:\windows\q29kesbnawxszxi\asappsrv.dll
2005-08-02 17:58 293,888 a--shr-- c:\windows\q29kesbnawxszxi\command.exe
2005-07-29 17:24 472 a--shr-- c:\windows\q29kesbnawxszxi\kZ64ym1huqUPtrK.vbs
0000-00-00 00:00 70,656 a--sh--- c:\windows\system32\degukime.dll
2009-02-28 04:18 144,384 a--sh--- c:\windows\system32\gdpzej.dll
0000-00-00 00:00 70,656 a--sh--- c:\windows\system32\sutojude.dll
2009-02-28 04:18 109,568 a--sh--- c:\windows\system32\tilepilo.dll
2009-02-28 04:18 144,384 a--sh--- c:\windows\system32\tukejavi.dll
0000-00-00 00:00 70,656 a--sh--- c:\windows\system32\witukezo.dll
2009-03-12 07:30 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009031220090313\index.dat

============= FINISH: 17:30:16.20 ===============

#4 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 02 September 2009 - 09:29 AM

Hello markkerr101,

Welcome to BC HijackThis forum. I am farbar. I am going to assist you with your problem.

Please refrain from making any changes to your system (updating Windows, installing applications, removing files, etc.) from now on as it might prolong handling your log and make the job for both of us more difficult.

Your computer seems heavily infected and it doesn't surprises me at all as I see no antivirus installed on your computer. we have to make sure you install a good free antivirus the moment it is possible and safe.

We are going to run MBAM, if it didn't install or run please tell me and don't spend much time on it as there might be an easy workaround.

Please download Malwarebytes' Anti-Malware from MajorGeeks
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the MBAM log.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Edited by farbar, 02 September 2009 - 09:30 AM.


#5 markkerr101

markkerr101
  • Topic Starter

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 02 September 2009 - 09:18 PM

my computer will download. but it wont let me install the program. i get an icon that says invalid floating point operation

#6 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 03 September 2009 - 01:35 AM

Please try the following:
  • Rename the installer to moon.exe while choosing C: drive to save in.
  • Double Click moon.exe to install the application to its default location.
  • Make sure no checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • Using Windows Explorer (right-click start > Explorer) navigate to the following folder:C"\Program Files\Malwarebyte' Anti-Malware
  • Locate the file mbam.exe and rename it to clear.exe then double-click to run it.
  • Wait until it opens up.
  • Update it. When you get the message that it is updated successfully check under Update tab the Database version should read 2256 or above.
  • Select "Perform Quick Scan", then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the MBAM log after running it and removing what it finds, or removing files after reboot.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.


#7 markkerr101

markkerr101
  • Topic Starter

  • Members
  • 58 posts
  • OFFLINE
  •  
  • Local time:10:02 AM

Posted 03 September 2009 - 06:20 PM

that is not working either. every time i try to run the file it shows the download screen like it is running. then i get about 10 popups saying it cant run the program


ive tried ie and firefox

#8 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 03 September 2009 - 06:29 PM

I don't quite understand what do you mean. Could you please explain in detail and in sequence what you do and what happens?

#9 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 07 September 2009 - 04:45 PM

Are you still there?

#10 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 09 September 2009 - 11:59 AM

This thread will now be closed since the issue seems to be resolved.

If you need this topic reopened, please send me a PM and I will reopen it for you.

If you should have a new issue, please start a new topic.

#11 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 10 September 2009 - 03:14 AM

Topic reopened.

This is a very severely infected computer and we should be fast to see how far we go.

Download RootRepeal.exe from one of these download locations and save it to your desktop:
http://download.bleepingcomputer.com/rootr.../RootRepeal.exe
http://ad13.geekstogo.com/RootRepeal.exe
http://rootrepeal.psikotick.com/RootRepeal.exe
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Click Ok.
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.


#12 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 13 September 2009 - 05:54 AM

Are you still there?

We expect people to work actively on their log and let us know when they can't. It is now like you post a topic and then let the helper hang on and when the topic is closed you send a short PM and then disappear. There are many people waiting for help and it is not fair.

I wait until tomorrow and if I didn't get any reply I'm going to close this topic.

#13 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,688 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:02 PM

Posted 14 September 2009 - 05:56 PM

This thread will now be closed due to inactivity.

If you should have the same or a new issue, please don't sent me a PM and start a new topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users