Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Hjt


  • This topic is locked This topic is locked
3 replies to this topic

#1 empalmer007

empalmer007

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:39 PM

Posted 29 November 2006 - 12:45 PM

Logfile of HijackThis v1.99.1
Scan saved at 9:29:32 AM, on 11/29/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Service.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Turtle Beach\AudioAdvantageMicro\TBAA.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Eric\My Documents\malware\hijackthis[2]\HijackThis11.exe

O4 - HKLM\..\Run: [Turtle Beach Audio Advantage Micro] "C:\Program Files\Turtle Beach\AudioAdvantageMicro\TBAA.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O20 - Winlogon Notify: aspdksdt - C:\WINDOWS\SYSTEM32\aspdksdt.dll
O20 - Winlogon Notify: bdqbqhpr - C:\WINDOWS\SYSTEM32\bdqbqhpr.dll
O20 - Winlogon Notify: bswxmbcm - C:\WINDOWS\SYSTEM32\bswxmbcm.dll
O20 - Winlogon Notify: bvbxtehd - C:\WINDOWS\SYSTEM32\bvbxtehd.dll
O20 - Winlogon Notify: bygdlgoc - C:\WINDOWS\SYSTEM32\bygdlgoc.dll
O20 - Winlogon Notify: ccgdnrrs - C:\WINDOWS\SYSTEM32\ccgdnrrs.dll
O20 - Winlogon Notify: ciurgssi - C:\WINDOWS\SYSTEM32\ciurgssi.dll
O20 - Winlogon Notify: cjtcpwww - C:\WINDOWS\SYSTEM32\cjtcpwww.dll
O20 - Winlogon Notify: ckblfdwd - C:\WINDOWS\SYSTEM32\ckblfdwd.dll
O20 - Winlogon Notify: dkmkduox - C:\WINDOWS\SYSTEM32\dkmkduox.dll
O20 - Winlogon Notify: ebhanabx - C:\WINDOWS\SYSTEM32\ebhanabx.dll
O20 - Winlogon Notify: eebvuadh - C:\WINDOWS\SYSTEM32\eebvuadh.dll
O20 - Winlogon Notify: enicfsxt - C:\WINDOWS\SYSTEM32\enicfsxt.dll
O20 - Winlogon Notify: ffhkohli - C:\WINDOWS\SYSTEM32\ffhkohli.dll
O20 - Winlogon Notify: ftifoteb - C:\WINDOWS\SYSTEM32\ftifoteb.dll
O20 - Winlogon Notify: gohukssq - C:\WINDOWS\SYSTEM32\gohukssq.dll
O20 - Winlogon Notify: gpfiurrd - C:\WINDOWS\SYSTEM32\gpfiurrd.dll
O20 - Winlogon Notify: guypgjuw - C:\WINDOWS\SYSTEM32\guypgjuw.dll
O20 - Winlogon Notify: hvgqimxc - C:\WINDOWS\SYSTEM32\hvgqimxc.dll
O20 - Winlogon Notify: ibiywhhv - C:\WINDOWS\SYSTEM32\ibiywhhv.dll
O20 - Winlogon Notify: isnxighv - C:\WINDOWS\SYSTEM32\isnxighv.dll
O20 - Winlogon Notify: itimnfkx - C:\WINDOWS\SYSTEM32\itimnfkx.dll
O20 - Winlogon Notify: jeifarfg - C:\WINDOWS\SYSTEM32\jeifarfg.dll
O20 - Winlogon Notify: joobrvxy - C:\WINDOWS\SYSTEM32\joobrvxy.dll
O20 - Winlogon Notify: jrxbnuoe - C:\WINDOWS\SYSTEM32\jrxbnuoe.dll
O20 - Winlogon Notify: kbsbdoaa - C:\WINDOWS\SYSTEM32\kbsbdoaa.dll
O20 - Winlogon Notify: kdykbect - C:\WINDOWS\SYSTEM32\kdykbect.dll
O20 - Winlogon Notify: kkcnckjq - C:\WINDOWS\SYSTEM32\kkcnckjq.dll
O20 - Winlogon Notify: kuhqaxnp - C:\WINDOWS\SYSTEM32\kuhqaxnp.dll
O20 - Winlogon Notify: ljtrbnxe - C:\WINDOWS\SYSTEM32\ljtrbnxe.dll
O20 - Winlogon Notify: lmifowhv - C:\WINDOWS\SYSTEM32\lmifowhv.dll
O20 - Winlogon Notify: ltmulkqe - C:\WINDOWS\SYSTEM32\ltmulkqe.dll
O20 - Winlogon Notify: lvaaglhw - C:\WINDOWS\SYSTEM32\lvaaglhw.dll
O20 - Winlogon Notify: lvjmphmu - C:\WINDOWS\SYSTEM32\lvjmphmu.dll
O20 - Winlogon Notify: maiofvkw - C:\WINDOWS\SYSTEM32\maiofvkw.dll
O20 - Winlogon Notify: mcgtrbnj - C:\WINDOWS\SYSTEM32\mcgtrbnj.dll
O20 - Winlogon Notify: mcmqoasj - C:\WINDOWS\SYSTEM32\mcmqoasj.dll
O20 - Winlogon Notify: meftjami - C:\WINDOWS\SYSTEM32\meftjami.dll
O20 - Winlogon Notify: mifnurls - C:\WINDOWS\SYSTEM32\mifnurls.dll
O20 - Winlogon Notify: mvimpwvx - C:\WINDOWS\SYSTEM32\mvimpwvx.dll
O20 - Winlogon Notify: mxkgovih - C:\WINDOWS\SYSTEM32\mxkgovih.dll
O20 - Winlogon Notify: mxykljmp - C:\WINDOWS\SYSTEM32\mxykljmp.dll
O20 - Winlogon Notify: ncxthary - C:\WINDOWS\SYSTEM32\ncxthary.dll
O20 - Winlogon Notify: nfnjrdvm - C:\WINDOWS\SYSTEM32\nfnjrdvm.dll
O20 - Winlogon Notify: noyuvcpn - C:\WINDOWS\SYSTEM32\noyuvcpn.dll
O20 - Winlogon Notify: nqdtsqmn - C:\WINDOWS\SYSTEM32\nqdtsqmn.dll
O20 - Winlogon Notify: nrqwwqqm - C:\WINDOWS\SYSTEM32\nrqwwqqm.dll
O20 - Winlogon Notify: nucifgyk - C:\WINDOWS\SYSTEM32\nucifgyk.dll
O20 - Winlogon Notify: nvlryvke - C:\WINDOWS\SYSTEM32\nvlryvke.dll
O20 - Winlogon Notify: okrhmhxk - C:\WINDOWS\SYSTEM32\okrhmhxk.dll
O20 - Winlogon Notify: oobonhjy - C:\WINDOWS\SYSTEM32\oobonhjy.dll
O20 - Winlogon Notify: ovbcljgs - C:\WINDOWS\SYSTEM32\ovbcljgs.dll
O20 - Winlogon Notify: ovjhkhsm - C:\WINDOWS\SYSTEM32\ovjhkhsm.dll
O20 - Winlogon Notify: owxhkvhj - C:\WINDOWS\SYSTEM32\owxhkvhj.dll
O20 - Winlogon Notify: oyrpbwnq - C:\WINDOWS\SYSTEM32\oyrpbwnq.dll
O20 - Winlogon Notify: psxewyos - C:\WINDOWS\SYSTEM32\psxewyos.dll
O20 - Winlogon Notify: qhufjyfo - C:\WINDOWS\SYSTEM32\qhufjyfo.dll
O20 - Winlogon Notify: qjuofocg - C:\WINDOWS\SYSTEM32\qjuofocg.dll
O20 - Winlogon Notify: qphyhjxo - C:\WINDOWS\SYSTEM32\qphyhjxo.dll
O20 - Winlogon Notify: qrnttmss - C:\WINDOWS\SYSTEM32\qrnttmss.dll
O20 - Winlogon Notify: qvctwjxu - C:\WINDOWS\SYSTEM32\qvctwjxu.dll
O20 - Winlogon Notify: rcbqaldn - C:\WINDOWS\SYSTEM32\rcbqaldn.dll
O20 - Winlogon Notify: rdcaanfl - C:\WINDOWS\SYSTEM32\rdcaanfl.dll
O20 - Winlogon Notify: reecaehk - C:\WINDOWS\SYSTEM32\reecaehk.dll
O20 - Winlogon Notify: rirpvdsf - C:\WINDOWS\SYSTEM32\rirpvdsf.dll
O20 - Winlogon Notify: rjgyekrk - C:\WINDOWS\SYSTEM32\rjgyekrk.dll
O20 - Winlogon Notify: rphnwafx - C:\WINDOWS\SYSTEM32\rphnwafx.dll
O20 - Winlogon Notify: rrtbvmaj - C:\WINDOWS\SYSTEM32\rrtbvmaj.dll
O20 - Winlogon Notify: rvuqwnjt - C:\WINDOWS\SYSTEM32\rvuqwnjt.dll
O20 - Winlogon Notify: rxhjnwcy - C:\WINDOWS\SYSTEM32\rxhjnwcy.dll
O20 - Winlogon Notify: salheacy - C:\WINDOWS\SYSTEM32\salheacy.dll
O20 - Winlogon Notify: schlneem - C:\WINDOWS\SYSTEM32\schlneem.dll
O20 - Winlogon Notify: syqnsxwx - C:\WINDOWS\SYSTEM32\syqnsxwx.dll
O20 - Winlogon Notify: tgbpyldp - C:\WINDOWS\SYSTEM32\tgbpyldp.dll
O20 - Winlogon Notify: uiiiagvd - C:\WINDOWS\SYSTEM32\uiiiagvd.dll
O20 - Winlogon Notify: unotsdgq - C:\WINDOWS\SYSTEM32\unotsdgq.dll
O20 - Winlogon Notify: utqrvlah - C:\WINDOWS\SYSTEM32\utqrvlah.dll
O20 - Winlogon Notify: uuyfimxb - C:\WINDOWS\SYSTEM32\uuyfimxb.dll
O20 - Winlogon Notify: vyochoom - C:\WINDOWS\SYSTEM32\vyochoom.dll
O20 - Winlogon Notify: wapflhcb - C:\WINDOWS\SYSTEM32\wapflhcb.dll
O20 - Winlogon Notify: wpetcwtm - C:\WINDOWS\SYSTEM32\wpetcwtm.dll
O20 - Winlogon Notify: wtbyvstk - C:\WINDOWS\SYSTEM32\wtbyvstk.dll
O20 - Winlogon Notify: xjxnbccq - C:\WINDOWS\SYSTEM32\xjxnbccq.dll
O20 - Winlogon Notify: xstybkua - C:\WINDOWS\SYSTEM32\xstybkua.dll
O20 - Winlogon Notify: xuuscbrl - C:\WINDOWS\SYSTEM32\xuuscbrl.dll
O20 - Winlogon Notify: ypphcnmn - C:\WINDOWS\SYSTEM32\ypphcnmn.dll
O20 - Winlogon Notify: yqtjycbi - C:\WINDOWS\SYSTEM32\yqtjycbi.dll
O20 - Winlogon Notify: yuqfqvqq - C:\WINDOWS\SYSTEM32\yuqfqvqq.dll
O20 - Winlogon Notify: yvbaswbo - C:\WINDOWS\SYSTEM32\yvbaswbo.dll
O20 - Winlogon Notify: yvgkxbdf - C:\WINDOWS\SYSTEM32\yvgkxbdf.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RUJCbGU\command.exe (file missing)
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe

BC AdBot (Login to Remove)

 


m

#2 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 30 November 2006 - 12:18 PM

Hello empalmer007, and welcome to BleepingComputer. My name is Charles and I will be dealing with your log today.

Please take note of the following:
  • I will start working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine
  • The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
Please give me some time to look over your log and I will get back to you as soon as possible.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#3 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 30 November 2006 - 12:59 PM

Hello there empalmer007.

Please print off a copy of these instructions, and also save them to a Notepad file on your desktop, so they are easily accessible, especially whilst in Safe Mode (you can't use the Internet)

======

From your log it appears that you are missing one important program; an antivirus.
This is somewhat suicidal in today's digital world.
You need to install an antivirus program as soon as you can and run a complete scan of the computer:Install it and then run a full scan. Let it quarantine/delete anything it finds. Let me know if there is anything that it reports but can not remove.

======

I have noticed that you do not have a firewall installed!
This is an essential piece of software that acts as an extra layer of security, which restricts access to your computer from the outside world.
Therefore, please download one of these free firewalls:
Zone Alarm
Sygate
Kerio
If you would like some more information about firewalls and how to use them effectively, take a look here.

======

Go to Start | Control Panel | Add/Remove Programs and remove the following (if they exist):

Command Service

======

Copy and paste the following text into Notepad:
sc delete cmdService
del services.bat
Save this as "services.bat" Choose to save as *all files and place it on your Desktop.
Double-click services.bat. Soon it should disappear from your Desktop; this is fine.

======

Scan again with HijackThis and put a checkmark next to each of the following entries (if present):

O20 - Winlogon Notify: aspdksdt - C:\WINDOWS\SYSTEM32\aspdksdt.dll
O20 - Winlogon Notify: bdqbqhpr - C:\WINDOWS\SYSTEM32\bdqbqhpr.dll
O20 - Winlogon Notify: bswxmbcm - C:\WINDOWS\SYSTEM32\bswxmbcm.dll
O20 - Winlogon Notify: bvbxtehd - C:\WINDOWS\SYSTEM32\bvbxtehd.dll
O20 - Winlogon Notify: bygdlgoc - C:\WINDOWS\SYSTEM32\bygdlgoc.dll
O20 - Winlogon Notify: ccgdnrrs - C:\WINDOWS\SYSTEM32\ccgdnrrs.dll
O20 - Winlogon Notify: ciurgssi - C:\WINDOWS\SYSTEM32\ciurgssi.dll
O20 - Winlogon Notify: cjtcpwww - C:\WINDOWS\SYSTEM32\cjtcpwww.dll
O20 - Winlogon Notify: ckblfdwd - C:\WINDOWS\SYSTEM32\ckblfdwd.dll
O20 - Winlogon Notify: dkmkduox - C:\WINDOWS\SYSTEM32\dkmkduox.dll
O20 - Winlogon Notify: ebhanabx - C:\WINDOWS\SYSTEM32\ebhanabx.dll
O20 - Winlogon Notify: eebvuadh - C:\WINDOWS\SYSTEM32\eebvuadh.dll
O20 - Winlogon Notify: enicfsxt - C:\WINDOWS\SYSTEM32\enicfsxt.dll
O20 - Winlogon Notify: ffhkohli - C:\WINDOWS\SYSTEM32\ffhkohli.dll
O20 - Winlogon Notify: ftifoteb - C:\WINDOWS\SYSTEM32\ftifoteb.dll
O20 - Winlogon Notify: gohukssq - C:\WINDOWS\SYSTEM32\gohukssq.dll
O20 - Winlogon Notify: gpfiurrd - C:\WINDOWS\SYSTEM32\gpfiurrd.dll
O20 - Winlogon Notify: guypgjuw - C:\WINDOWS\SYSTEM32\guypgjuw.dll
O20 - Winlogon Notify: hvgqimxc - C:\WINDOWS\SYSTEM32\hvgqimxc.dll
O20 - Winlogon Notify: ibiywhhv - C:\WINDOWS\SYSTEM32\ibiywhhv.dll
O20 - Winlogon Notify: isnxighv - C:\WINDOWS\SYSTEM32\isnxighv.dll
O20 - Winlogon Notify: itimnfkx - C:\WINDOWS\SYSTEM32\itimnfkx.dll
O20 - Winlogon Notify: jeifarfg - C:\WINDOWS\SYSTEM32\jeifarfg.dll
O20 - Winlogon Notify: joobrvxy - C:\WINDOWS\SYSTEM32\joobrvxy.dll
O20 - Winlogon Notify: jrxbnuoe - C:\WINDOWS\SYSTEM32\jrxbnuoe.dll
O20 - Winlogon Notify: kbsbdoaa - C:\WINDOWS\SYSTEM32\kbsbdoaa.dll
O20 - Winlogon Notify: kdykbect - C:\WINDOWS\SYSTEM32\kdykbect.dll
O20 - Winlogon Notify: kkcnckjq - C:\WINDOWS\SYSTEM32\kkcnckjq.dll
O20 - Winlogon Notify: kuhqaxnp - C:\WINDOWS\SYSTEM32\kuhqaxnp.dll
O20 - Winlogon Notify: ljtrbnxe - C:\WINDOWS\SYSTEM32\ljtrbnxe.dll
O20 - Winlogon Notify: lmifowhv - C:\WINDOWS\SYSTEM32\lmifowhv.dll
O20 - Winlogon Notify: ltmulkqe - C:\WINDOWS\SYSTEM32\ltmulkqe.dll
O20 - Winlogon Notify: lvaaglhw - C:\WINDOWS\SYSTEM32\lvaaglhw.dll
O20 - Winlogon Notify: lvjmphmu - C:\WINDOWS\SYSTEM32\lvjmphmu.dll
O20 - Winlogon Notify: maiofvkw - C:\WINDOWS\SYSTEM32\maiofvkw.dll
O20 - Winlogon Notify: mcgtrbnj - C:\WINDOWS\SYSTEM32\mcgtrbnj.dll
O20 - Winlogon Notify: mcmqoasj - C:\WINDOWS\SYSTEM32\mcmqoasj.dll
O20 - Winlogon Notify: meftjami - C:\WINDOWS\SYSTEM32\meftjami.dll
O20 - Winlogon Notify: mifnurls - C:\WINDOWS\SYSTEM32\mifnurls.dll
O20 - Winlogon Notify: mvimpwvx - C:\WINDOWS\SYSTEM32\mvimpwvx.dll
O20 - Winlogon Notify: mxkgovih - C:\WINDOWS\SYSTEM32\mxkgovih.dll
O20 - Winlogon Notify: mxykljmp - C:\WINDOWS\SYSTEM32\mxykljmp.dll
O20 - Winlogon Notify: ncxthary - C:\WINDOWS\SYSTEM32\ncxthary.dll
O20 - Winlogon Notify: nfnjrdvm - C:\WINDOWS\SYSTEM32\nfnjrdvm.dll
O20 - Winlogon Notify: noyuvcpn - C:\WINDOWS\SYSTEM32\noyuvcpn.dll
O20 - Winlogon Notify: nqdtsqmn - C:\WINDOWS\SYSTEM32\nqdtsqmn.dll
O20 - Winlogon Notify: nrqwwqqm - C:\WINDOWS\SYSTEM32\nrqwwqqm.dll
O20 - Winlogon Notify: nucifgyk - C:\WINDOWS\SYSTEM32\nucifgyk.dll
O20 - Winlogon Notify: nvlryvke - C:\WINDOWS\SYSTEM32\nvlryvke.dll
O20 - Winlogon Notify: okrhmhxk - C:\WINDOWS\SYSTEM32\okrhmhxk.dll
O20 - Winlogon Notify: oobonhjy - C:\WINDOWS\SYSTEM32\oobonhjy.dll
O20 - Winlogon Notify: ovbcljgs - C:\WINDOWS\SYSTEM32\ovbcljgs.dll
O20 - Winlogon Notify: ovjhkhsm - C:\WINDOWS\SYSTEM32\ovjhkhsm.dll
O20 - Winlogon Notify: owxhkvhj - C:\WINDOWS\SYSTEM32\owxhkvhj.dll
O20 - Winlogon Notify: oyrpbwnq - C:\WINDOWS\SYSTEM32\oyrpbwnq.dll
O20 - Winlogon Notify: psxewyos - C:\WINDOWS\SYSTEM32\psxewyos.dll
O20 - Winlogon Notify: qhufjyfo - C:\WINDOWS\SYSTEM32\qhufjyfo.dll
O20 - Winlogon Notify: qjuofocg - C:\WINDOWS\SYSTEM32\qjuofocg.dll
O20 - Winlogon Notify: qphyhjxo - C:\WINDOWS\SYSTEM32\qphyhjxo.dll
O20 - Winlogon Notify: qrnttmss - C:\WINDOWS\SYSTEM32\qrnttmss.dll
O20 - Winlogon Notify: qvctwjxu - C:\WINDOWS\SYSTEM32\qvctwjxu.dll
O20 - Winlogon Notify: rcbqaldn - C:\WINDOWS\SYSTEM32\rcbqaldn.dll
O20 - Winlogon Notify: rdcaanfl - C:\WINDOWS\SYSTEM32\rdcaanfl.dll
O20 - Winlogon Notify: reecaehk - C:\WINDOWS\SYSTEM32\reecaehk.dll
O20 - Winlogon Notify: rirpvdsf - C:\WINDOWS\SYSTEM32\rirpvdsf.dll
O20 - Winlogon Notify: rjgyekrk - C:\WINDOWS\SYSTEM32\rjgyekrk.dll
O20 - Winlogon Notify: rphnwafx - C:\WINDOWS\SYSTEM32\rphnwafx.dll
O20 - Winlogon Notify: rrtbvmaj - C:\WINDOWS\SYSTEM32\rrtbvmaj.dll
O20 - Winlogon Notify: rvuqwnjt - C:\WINDOWS\SYSTEM32\rvuqwnjt.dll
O20 - Winlogon Notify: rxhjnwcy - C:\WINDOWS\SYSTEM32\rxhjnwcy.dll
O20 - Winlogon Notify: salheacy - C:\WINDOWS\SYSTEM32\salheacy.dll
O20 - Winlogon Notify: schlneem - C:\WINDOWS\SYSTEM32\schlneem.dll
O20 - Winlogon Notify: syqnsxwx - C:\WINDOWS\SYSTEM32\syqnsxwx.dll
O20 - Winlogon Notify: tgbpyldp - C:\WINDOWS\SYSTEM32\tgbpyldp.dll
O20 - Winlogon Notify: uiiiagvd - C:\WINDOWS\SYSTEM32\uiiiagvd.dll
O20 - Winlogon Notify: unotsdgq - C:\WINDOWS\SYSTEM32\unotsdgq.dll
O20 - Winlogon Notify: utqrvlah - C:\WINDOWS\SYSTEM32\utqrvlah.dll
O20 - Winlogon Notify: uuyfimxb - C:\WINDOWS\SYSTEM32\uuyfimxb.dll
O20 - Winlogon Notify: vyochoom - C:\WINDOWS\SYSTEM32\vyochoom.dll
O20 - Winlogon Notify: wapflhcb - C:\WINDOWS\SYSTEM32\wapflhcb.dll
O20 - Winlogon Notify: wpetcwtm - C:\WINDOWS\SYSTEM32\wpetcwtm.dll
O20 - Winlogon Notify: wtbyvstk - C:\WINDOWS\SYSTEM32\wtbyvstk.dll
O20 - Winlogon Notify: xjxnbccq - C:\WINDOWS\SYSTEM32\xjxnbccq.dll
O20 - Winlogon Notify: xstybkua - C:\WINDOWS\SYSTEM32\xstybkua.dll
O20 - Winlogon Notify: xuuscbrl - C:\WINDOWS\SYSTEM32\xuuscbrl.dll
O20 - Winlogon Notify: ypphcnmn - C:\WINDOWS\SYSTEM32\ypphcnmn.dll
O20 - Winlogon Notify: yqtjycbi - C:\WINDOWS\SYSTEM32\yqtjycbi.dll
O20 - Winlogon Notify: yuqfqvqq - C:\WINDOWS\SYSTEM32\yuqfqvqq.dll
O20 - Winlogon Notify: yvbaswbo - C:\WINDOWS\SYSTEM32\yvbaswbo.dll
O20 - Winlogon Notify: yvgkxbdf - C:\WINDOWS\SYSTEM32\yvgkxbdf.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\RUJCbGU\command.exe (file missing)


Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.

======

Download KillBox from the following link :
http://www.bleepingcomputer.com/files/killbox.php
Unzip the folder to your Desktop.

Start Killbox.exe
Select the "Delete on Reboot" option.
Click on the "All Files" button,which will then flash green.
Copy the complete text in bold below to the clipboard by highlighting the filepaths and pressing Control + C:

C:\WINDOWS\SYSTEM32\aspdksdt.dll
C:\WINDOWS\SYSTEM32\bdqbqhpr.dll
C:\WINDOWS\SYSTEM32\bswxmbcm.dll
C:\WINDOWS\SYSTEM32\bvbxtehd.dll
C:\WINDOWS\SYSTEM32\bygdlgoc.dll
C:\WINDOWS\SYSTEM32\ccgdnrrs.dll
C:\WINDOWS\SYSTEM32\ciurgssi.dll
C:\WINDOWS\SYSTEM32\cjtcpwww.dll
C:\WINDOWS\SYSTEM32\ckblfdwd.dll
C:\WINDOWS\SYSTEM32\dkmkduox.dll
C:\WINDOWS\SYSTEM32\ebhanabx.dll
C:\WINDOWS\SYSTEM32\eebvuadh.dll
C:\WINDOWS\SYSTEM32\enicfsxt.dll
C:\WINDOWS\SYSTEM32\ffhkohli.dll
C:\WINDOWS\SYSTEM32\ftifoteb.dll
C:\WINDOWS\SYSTEM32\gohukssq.dll
C:\WINDOWS\SYSTEM32\gpfiurrd.dll
C:\WINDOWS\SYSTEM32\guypgjuw.dll
C:\WINDOWS\SYSTEM32\hvgqimxc.dll
C:\WINDOWS\SYSTEM32\ibiywhhv.dll
C:\WINDOWS\SYSTEM32\isnxighv.dll
C:\WINDOWS\SYSTEM32\itimnfkx.dll
C:\WINDOWS\SYSTEM32\jeifarfg.dll
C:\WINDOWS\SYSTEM32\joobrvxy.dll
C:\WINDOWS\SYSTEM32\jrxbnuoe.dll
C:\WINDOWS\SYSTEM32\kbsbdoaa.dll
C:\WINDOWS\SYSTEM32\kdykbect.dll
C:\WINDOWS\SYSTEM32\kkcnckjq.dll
C:\WINDOWS\SYSTEM32\kuhqaxnp.dll
C:\WINDOWS\SYSTEM32\ljtrbnxe.dll
C:\WINDOWS\SYSTEM32\lmifowhv.dll
C:\WINDOWS\SYSTEM32\ltmulkqe.dll
C:\WINDOWS\SYSTEM32\lvaaglhw.dll
C:\WINDOWS\SYSTEM32\lvjmphmu.dll
C:\WINDOWS\SYSTEM32\maiofvkw.dll
C:\WINDOWS\SYSTEM32\mcgtrbnj.dll
C:\WINDOWS\SYSTEM32\mcmqoasj.dll
C:\WINDOWS\SYSTEM32\meftjami.dll
C:\WINDOWS\SYSTEM32\mifnurls.dll
C:\WINDOWS\SYSTEM32\mvimpwvx.dll
C:\WINDOWS\SYSTEM32\mxkgovih.dll
C:\WINDOWS\SYSTEM32\mxykljmp.dll
C:\WINDOWS\SYSTEM32\ncxthary.dll
C:\WINDOWS\SYSTEM32\nfnjrdvm.dll
C:\WINDOWS\SYSTEM32\noyuvcpn.dll
C:\WINDOWS\SYSTEM32\nqdtsqmn.dll
C:\WINDOWS\SYSTEM32\nrqwwqqm.dll
C:\WINDOWS\SYSTEM32\nucifgyk.dll
C:\WINDOWS\SYSTEM32\nvlryvke.dll
C:\WINDOWS\SYSTEM32\okrhmhxk.dll
C:\WINDOWS\SYSTEM32\oobonhjy.dll
C:\WINDOWS\SYSTEM32\ovbcljgs.dll
C:\WINDOWS\SYSTEM32\ovjhkhsm.dll
C:\WINDOWS\SYSTEM32\owxhkvhj.dll
C:\WINDOWS\SYSTEM32\oyrpbwnq.dll
C:\WINDOWS\SYSTEM32\psxewyos.dll
C:\WINDOWS\SYSTEM32\qhufjyfo.dll
C:\WINDOWS\SYSTEM32\qjuofocg.dll
C:\WINDOWS\SYSTEM32\qphyhjxo.dll
C:\WINDOWS\SYSTEM32\qrnttmss.dll
C:\WINDOWS\SYSTEM32\qvctwjxu.dll
C:\WINDOWS\SYSTEM32\rcbqaldn.dll
C:\WINDOWS\SYSTEM32\rdcaanfl.dll
C:\WINDOWS\SYSTEM32\reecaehk.dll
C:\WINDOWS\SYSTEM32\rirpvdsf.dll
C:\WINDOWS\SYSTEM32\rjgyekrk.dll
C:\WINDOWS\SYSTEM32\rphnwafx.dll
C:\WINDOWS\SYSTEM32\rrtbvmaj.dll
C:\WINDOWS\SYSTEM32\rvuqwnjt.dll
C:\WINDOWS\SYSTEM32\rxhjnwcy.dll
C:\WINDOWS\SYSTEM32\salheacy.dll
C:\WINDOWS\SYSTEM32\schlneem.dll
C:\WINDOWS\SYSTEM32\syqnsxwx.dll
C:\WINDOWS\SYSTEM32\tgbpyldp.dll
C:\WINDOWS\SYSTEM32\uiiiagvd.dll
C:\WINDOWS\SYSTEM32\unotsdgq.dll
C:\WINDOWS\SYSTEM32\utqrvlah.dll
C:\WINDOWS\SYSTEM32\uuyfimxb.dll
C:\WINDOWS\SYSTEM32\vyochoom.dll
C:\WINDOWS\SYSTEM32\wapflhcb.dll
C:\WINDOWS\SYSTEM32\wpetcwtm.dll
C:\WINDOWS\SYSTEM32\wtbyvstk.dll
C:\WINDOWS\SYSTEM32\xjxnbccq.dll
C:\WINDOWS\SYSTEM32\xstybkua.dll
C:\WINDOWS\SYSTEM32\xuuscbrl.dll
C:\WINDOWS\SYSTEM32\ypphcnmn.dll
C:\WINDOWS\SYSTEM32\yqtjycbi.dll
C:\WINDOWS\SYSTEM32\yuqfqvqq.dll
C:\WINDOWS\SYSTEM32\yvbaswbo.dll
C:\WINDOWS\SYSTEM32\yvgkxbdf.dll


Open 'File' in the menu on top and choose Paste from clipboard
You must use the File menu--pasting by right-clicking the mouse will only enter one file.
Then press the button that looks like a red circle with a white X in it.
Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click Yes.
Click OK at any Pending File Rename Operations prompt, let me know if they appear.
If you don't get that message, reboot manually.
Your computer should reboot now.

======

Next, please find and delete the following folder (if present):

C:\WINDOWS\RUJCbGU <--Folder

======

Please run Panda's ActiveScan.
Once you are on the Panda site click the Scan your PC button
A new window will open, click the Check Now button.
Enter your personal details.
Click the big Scan Now button.
It will ask to install various content - please allow this.
It will start downloading the files it requires for the scan, which may take a while.
When download is complete, click on Local Disks to start the scan.
When the scan completes, click the See Report button.
Click Save Report and save the file to your desktop, so you can post this log in your next reply.

======

Please post me back a new HijackThis log and the Panda report.
Thanks,
Charles

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#4 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:02:39 AM

Posted 08 December 2006 - 12:47 PM

Due to lack of feedback, this topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users