Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Trojan problems

  • Please log in to reply
1 reply to this topic

#1 Kanos


  • Members
  • 1 posts
  • Gender:Male
  • Local time:12:45 AM

Posted 10 July 2011 - 10:36 PM

Hey, guys! This is my first post here, hopefully I won't need to post another one.

Let's cut to the chase, shall we? Basically, I have a Trojan on my system. Whenever I boot my Windows 7 computer up, I get messages that worry me: Norton Security pops up with the message: "Norton has blocked Trojan.Zefarch", and a RunDLL message that says that "C:\Windows\system32\config\systemprofile\AppData\Local\aqevomuyixu.dll" could not be run, access is denied.

First, it was only the Norton alert. I did a couple of Norton Full scans, and a Malwarebytes scan. Both came up with absolutely nothing wrong with my system. So, I set off on my own to see how I could get rid of it. I found the "How to remove a Trojan, Virus, Worm, or other Malware" Tutorial on this site: http://www.bleepingcomputer.com/tutorials/how-to-remove-a-trojan-virus-worm-or-malware/

I followed the directions up to the point where I have installed and run Autoruns. The only entries I noticed that I couldn't recognize or find on the "Startup Program Database" (http://www.bleepingcomputer.com/startups/) were these two:
"Thagiviyiyimevoc File not found: C:\Windows\system32\config\systemprofile\AppData\Local\aqevomuyixu.dll"
"Thagiviyiyimevoc c:\users\chris\appdata\local\uvezevaxik.dll

Note that the first entry's image path is the same as the alert I've been receiving. Anyway, because it looked suspicious, I searched the Startup Database on Thagiviyiyimevoc, but came up with nothing. I did innumerable Google searches on anything related to those entries, and I got nothing. So I figured that those must be the Trojans, but I don't really know enough about computers to make that call.

So I decided to post my problem here. Mostly, I just want to make sure these aren't vitally important to my computer, and that in removing them I am turning my nice computer into a worthless pile of metal, silicon, and plastic. :)

I added all the information I can think of, but if you need any more, I'm sure I can find it. Thanks for helping me.

BC AdBot (Login to Remove)


#2 Broni


    The Coolest BC Computer

  • BC Advisor
  • 42,738 posts
  • Gender:Male
  • Location:Daly City, CA
  • Local time:10:45 PM

Posted 10 July 2011 - 11:28 PM

Welcome aboard Posted Image

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List last 10 Event Viewer log
  • List Users, Partitions and Memory size
Click Go and post the result.


Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt


Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users