Spyware / Malware / Virus Removal

[Closed] Ligijupu.dll, dajuzobiza, minuzudi.dll and so on

10 min read

Looking for the outcome? Ask AI

Paxbrother Topic Starter

Post #1May 13, 2009, 9:39 PM UTC

Hi, received a 'Warning! Security' pop-up telling me to download Registry Cleaner as well as opening numerous IE windows.

I ran MBAM, deleted the errors found and rebooted, the pop-up has now gone however "Error Loading ligizpu.dll The specific module could not be found"
Winpatrol and Spybot Search and Destroy are also constantly blocking dajuzobiz.dll and minuzusi.dll.

I am unable to go back to a restore point, most recent HijackLog below -

Log created by WinPatrol version 12.1.2007.5:12.1.2007.5
Scan saved at 10:06:08 PM, on 5/13/2009
Platform: Windows XP SP3 Home Edition Service Pack 3 (Build 2600)
MSIE: Internet Explorer (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\PROGRAM FILES\Intel\MODEM EVENT MONITOR\IntelMEM.exe
C:\PROGRAM FILES\Dell\MEDIA EXPERIENCE\PCMSERVICE.EXE
C:\WINDOWS\SYSTEM32\DSentry.exe
C:\PROGRAM FILES\Thomson\SPEEDTOUCH USB\dragdiag.exe
C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
C:\PROGRAM FILES\Logitech\Video\LogiTray.exe
C:\PROGRAM FILES\COMMON FILES\Sonic\UPDATE MANAGER\sgtray.exe
C:\Program Files\Sony\SonicStage\SSAAD.exe
C:\PROGRAM FILES\COMMON FILES\INSTALLSHIELD\UPDATESERVICE\issch.exe
C:\PROGRAM FILES\Grisoft\AVG ANTI-SPYWARE 7.5\avgas.exe
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\PROGRAM FILES\iTunes\ITUNESHELPER.EXE
C:\PROGRAM FILES\Kontiki\KHost.exe
C:\PROGRAM FILES\Java\jre6\bin\jusched.exe
C:\PROGRAM FILES\Google\GOOGLETOOLBARNOTIFIER\GOOGLETOOLBARNOTIFIER.EXE
C:\WINDOWS\SYSTEM32\ctfmon.exe
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TeaTimer.exe
C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\wmpnscfg.exe
C:\PROGRAM FILES\Adobe\ACROBAT 7.0\Reader\READER_SL.EXE
C:\PROGRAM FILES\RALINK\Common\RaUI.exe
F:\PROGRAM FILES\MAGICDISC\MAGICDISC.EXE
C:\PROGRAM FILES\SPYWAREGUARD\sgmain.exe
C:\PROGRAM FILES\Logitech\Video\FxSvr2.exe
C:\PROGRAM FILES\COMMON FILES\Apple\MOBILE DEVICE SUPPORT\bin\APPLEMOBILEDEVICESERVICE.EXE
C:\PROGRAM FILES\Bonjour\MDNSRESPONDER.EXE
C:\PROGRAM FILES\SPYWAREGUARD\sgbhp.exe
C:\PROGRAM FILES\Java\jre6\bin\jqs.exe
C:\PROGRAM FILES\Kontiki\KService.exe
C:\Program Files\McAfee.com\VSO\mcvsrte.exe
C:\WINDOWS\SYSTEM32\PnkBstrA.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRAM FILES\COMMON FILES\SONY SHARED\AVLib\SSScsiSV.exe
C:\PROGRAM FILES\iPod\bin\IPODSERVICE.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROLEX.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Sky Broadband
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: minuzudi - {0d3c8bef-d82d-4d63-aefe-a0e9cc1fe6af} - C:\WINDOWS\system32\minuzudi.dll
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\Program Files\McAfee.com\VSO\mcvsshl.dll
O4 - HKLM\..\Run: [IntelMeM]C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [PCMService]C:\Program Files\Dell\Media Experience\PCMService.exe
O4 - HKLM\..\Run: [DVDSentry]C:\WINDOWS\SYSTEM32\DSentry.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics]C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe /icon
O4 - HKLM\..\Run: [LVCOMSX]C:\WINDOWS\SYSTEM32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair]C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray]C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [ATIPTA]C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager]C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe /r
O4 - HKLM\..\Run: [SsAAD.exe]C:\Program Files\Sony\SonicStage\SSAAD.exe
O4 - HKLM\..\Run: [ISUSPM Startup]C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler]C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start
O4 - HKLM\..\Run: [Sony Ericsson PC Suite]F:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe /startoptions
O4 - HKLM\..\Run: [!AVG Anti-Spyware]C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe /minimized
O4 - HKLM\..\Run: [WinPatrol]C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [QuickTime Task]C:\Program Files\QuickTime\QTTask.exe -atboottime
O4 - HKLM\..\Run: [iTunesHelper]C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [4oD]C:\Program Files\Kontiki\KHost.exe -all
O4 - HKLM\..\Run: [SunJavaUpdateSched]C:\Program Files\Java\jre6\bin\jusched.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate]C:\Program Files\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [swg]C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe]C:\WINDOWS\SYSTEM32\ctfmon.exe
O4 - HKCU\..\Run: [kdx]C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [SpybotSD TeaTimer]C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG]C:\Program Files\Windows Media Player\wmpnscfg.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk=C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AOL 8.0 Tray Icon.lnk=C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk=C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ralink Wireless Utility.lnk=C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: MagicDisc.lnk=F:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: PowerReg Scheduler V3.exe=C:\Documents and Settings\Simon\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
O4 - Global Startup: SpywareGuard.lnk=C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: + &Download Express: download this file - f:\Program Files\Download Express\add_url.htm
O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [Java (Sun)] Java (Sun) - C:\Program Files\Java\jre6\bin
O11 - Options group: [] -
O14 - IERESET.INF: START_PAGE_URL = http://www.freeserve.com/
O14 - IERESET.INF: SEARCH_PAGE_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
O14 - IERESET.INF:HKCU, Start Page = %START_PAGE_URL%
O14 - IERESET.INF:HKLM, Default_Page_URL = %START_PAGE_URL%
O14 - IERESET.INF:HKLM, Default_Search_URL = %SEARCH_PAGE_URL%
O14 - IERESET.INF:HKLM, Search Page = %SEARCH_PAGE_URL%
O14 - IERESET.INF:HKCU, Search Page = %SEARCH_PAGE_URL%
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} (http://static.windupdates.com/cab/DownloadAccess/ie/bridge-c11) - http://static.windupdates.com/cab/Download…/bridge-c11.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://fpdownload.macromedia.com/get/shock…director/sw.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} (http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo) - http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) - http://sib1.od2.com/common/Member/ClientIn…6/OCI/setup.exe
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} (http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller) - http://a1540.g.akamai.net/7/1540/52/200404…meInstaller.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1127126653289
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_13) - http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/s…er/PROFILER.CAB
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab Class) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) - http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) - http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) - http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} (Java Plug-in 1.6.0_13) - http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_13) - http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\torayiya.dll

O21 - WPDShServiceObj - WPDShServiceObj Class - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\SYSTEM32\WPDShServiceObj.dll
O23 - Service: Alerter - Microsoft Corporation - C:\WINDOWS\SYSTEM32\alrsvc.dll
O23 - Service: Application Layer Gateway Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\alg.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Application Management - - C:\WINDOWS\System32\appmgmts.dll
O23 - Service: ASP.NET State Service - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\SYSTEM32\ati2evxx.exe
O23 - Service: ATI Smart - - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Windows Audio - Microsoft Corporation - C:\WINDOWS\SYSTEM32\audiosrv.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Background Intelligent Transfer Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\qmgr.dll
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Computer Browser - Microsoft Corporation - C:\WINDOWS\SYSTEM32\browser.dll
O23 - Service: Indexing Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\cisvc.exe
O23 - Service: ClipBook - Microsoft Corporation - C:\WINDOWS\SYSTEM32\clipsrv.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 - Microsoft Corporation - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
O23 - Service: COM+ System Application - - C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
O23 - Service: Cryptographic Services - Microsoft Corporation - C:\WINDOWS\SYSTEM32\cryptsvc.dll
O23 - Service: DCOM Server Process Launcher - Microsoft Corporation - C:\WINDOWS\SYSTEM32\rpcss.dll
O23 - Service: DHCP Client - Microsoft Corporation - C:\WINDOWS\SYSTEM32\dhcpcsvc.dll
O23 - Service: Logical Disk Manager Administrative Service - - C:\WINDOWS\System32\dmadmin.exe /com
O23 - Service: Logical Disk Manager - Microsoft Corp. - C:\WINDOWS\SYSTEM32\dmserver.dll
O23 - Service: DNS Client - Microsoft Corporation - C:\WINDOWS\SYSTEM32\dnsrslvr.dll
O23 - Service: Wired AutoConfig - Microsoft Corporation - C:\WINDOWS\SYSTEM32\dot3svc.dll
O23 - Service: Extensible Authentication Protocol Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\eapsvc.dll
O23 - Service: Error Reporting Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\ersvc.dll
O23 - Service: Event Log - Microsoft Corporation - C:\WINDOWS\SYSTEM32\services.exe
O23 - Service: COM+ Event System - Microsoft Corporation - C:\WINDOWS\SYSTEM32\es.dll
O23 - Service: Fast User Switching Compatibility - Microsoft Corporation - C:\WINDOWS\SYSTEM32\shsvcs.dll
O23 - Service: Help and Support - Microsoft Corporation - C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
O23 - Service: Human Interface Device Access - - C:\WINDOWS\System32\hidserv.dll
O23 - Service: Health Key and Certificate Management Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\kmsvc.dll
O23 - Service: HTTP SSL - Microsoft Corporation - C:\WINDOWS\SYSTEM32\w3ssl.dll
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - F:\Program Files\ISOrecorder\ImapiHelper.exe
O23 - Service: IMAPI CD-Burning COM Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\imapi.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter - - C:\Program Files\Java\jre6\bin\jqs.exe -service -config C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: Server - Microsoft Corporation - C:\WINDOWS\SYSTEM32\srvsvc.dll
O23 - Service: Workstation - Microsoft Corporation - C:\WINDOWS\SYSTEM32\wkssvc.dll
O23 - Service: TCP/IP NetBIOS Helper - Microsoft Corporation - C:\WINDOWS\SYSTEM32\lmhsvc.dll
O23 - Service: McAfee.com McShield - - c:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine - - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe /Embedding
O23 - Service: Messenger - Microsoft Corporation - C:\WINDOWS\SYSTEM32\msgsvc.dll
O23 - Service: NetMeeting Remote Desktop Sharing - Microsoft Corporation - C:\WINDOWS\SYSTEM32\mnmsrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Distributed Transaction Coordinator - Microsoft Corporation - C:\WINDOWS\SYSTEM32\msdtc.exe
O23 - Service: Windows Installer - - C:\WINDOWS\system32\msiexec.exe /V
O23 - Service: Network Access Protection Agent - Microsoft Corporation - C:\WINDOWS\SYSTEM32\qagentrt.dll
O23 - Service: Network DDE - Microsoft Corporation - C:\WINDOWS\SYSTEM32\netdde.exe
O23 - Service: Network DDE DSDM - Microsoft Corporation - C:\WINDOWS\SYSTEM32\netdde.exe
O23 - Service: Net Logon - Microsoft Corporation - C:\WINDOWS\SYSTEM32\lsass.exe
O23 - Service: Network Connections - Microsoft Corporation - C:\WINDOWS\SYSTEM32\netman.dll
O23 - Service: Intel NCS NetService - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Network Location Awareness (NLA) - Microsoft Corporation - C:\WINDOWS\SYSTEM32\mswsock.dll
O23 - Service: NT LM Security Support Provider - Microsoft Corporation - C:\WINDOWS\SYSTEM32\lsass.exe
O23 - Service: Removable Storage - Microsoft Corporation - C:\WINDOWS\SYSTEM32\ntmssvc.dll
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Plug and Play - Microsoft Corporation - C:\WINDOWS\SYSTEM32\services.exe
O23 - Service: PnkBstrA - - C:\WINDOWS\SYSTEM32\PnkBstrA.exe
O23 - Service: IPSEC Services - Microsoft Corporation - C:\WINDOWS\SYSTEM32\lsass.exe
O23 - Service: Protected Storage - Microsoft Corporation - C:\WINDOWS\SYSTEM32\lsass.exe
O23 - Service: Remote Access Auto Connection Manager - Microsoft Corporation - C:\WINDOWS\SYSTEM32\rasauto.dll
O23 - Service: Remote Access Connection Manager - Microsoft Corporation - C:\WINDOWS\SYSTEM32\rasmans.dll
O23 - Service: Remote Desktop Help Session Manager - Microsoft Corporation - C:\WINDOWS\SYSTEM32\sessmgr.exe
O23 - Service: Routing and Remote Access - Microsoft Corporation - C:\WINDOWS\SYSTEM32\mprdim.dll
O23 - Service: Remote Procedure Call (RPC) Locator - Microsoft Corporation - C:\WINDOWS\SYSTEM32\locator.exe
O23 - Service: Remote Procedure Call (RPC) - Microsoft Corporation - C:\WINDOWS\SYSTEM32\rpcss.dll
O23 - Service: QoS RSVP - Microsoft Corporation - C:\WINDOWS\SYSTEM32\RSVP.EXE
O23 - Service: Security Accounts Manager - Microsoft Corporation - C:\WINDOWS\SYSTEM32\lsass.exe
O23 - Service: Smart Card - Microsoft Corporation - C:\WINDOWS\SYSTEM32\scardsvr.exe
O23 - Service: Task Scheduler - Microsoft Corporation - C:\WINDOWS\SYSTEM32\schedsvc.dll
O23 - Service: Secondary Logon - Microsoft Corporation - C:\WINDOWS\SYSTEM32\seclogon.dll
O23 - Service: System Event Notification - Microsoft Corporation - C:\WINDOWS\SYSTEM32\sens.dll
O23 - Service: Windows Firewall/Internet Connection Sharing (ICS) - Microsoft Corporation - C:\WINDOWS\SYSTEM32\ipnathlp.dll
O23 - Service: Shell Hardware Detection - Microsoft Corporation - C:\WINDOWS\SYSTEM32\shsvcs.dll
O23 - Service: Print Spooler - Microsoft Corporation - C:\WINDOWS\SYSTEM32\spoolsv.exe
O23 - Service: Sony SPTI Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: System Restore Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\srsvc.dll
O23 - Service: SSDP Discovery Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\ssdpsrv.dll
O23 - Service: SonicStage SCSI Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Windows Image Acquisition (WIA) - Microsoft Corporation - C:\WINDOWS\SYSTEM32\wiaservc.dll
O23 - Service: MS Software Shadow Copy Provider - - C:\WINDOWS\System32\dllhost.exe /Processid:{F79A1568-D6C5-4C69-A086-936CF52DBBE3}
O23 - Service: Performance Logs and Alerts - Microsoft Corporation - C:\WINDOWS\SYSTEM32\smlogsvc.exe
O23 - Service: Telephony - Microsoft Corporation - C:\WINDOWS\SYSTEM32\tapisrv.dll
O23 - Service: Terminal Services - Microsoft Corporation - C:\WINDOWS\SYSTEM32\termsrv.dll
O23 - Service: Themes - Microsoft Corporation - C:\WINDOWS\SYSTEM32\shsvcs.dll
O23 - Service: Distributed Link Tracking Client - Microsoft Corporation - C:\WINDOWS\SYSTEM32\trkwks.dll
O23 - Service: Universal Plug and Play Device Host - Microsoft Corporation - C:\WINDOWS\SYSTEM32\upnphost.dll
O23 - Service: Uninterruptible Power Supply - Microsoft Corporation - C:\WINDOWS\SYSTEM32\ups.exe
O23 - Service: Volume Shadow Copy - Microsoft Corporation - C:\WINDOWS\SYSTEM32\vssvc.exe
O23 - Service: Windows Time - Microsoft Corporation - C:\WINDOWS\SYSTEM32\w32time.dll
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: WebClient - Microsoft Corporation - C:\WINDOWS\SYSTEM32\webclnt.dll
O23 - Service: Windows Management Instrumentation - Microsoft Corporation - C:\WINDOWS\SYSTEM32\WBEM\wmisvc.dll
O23 - Service: Portable Media Serial Number Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\mspmsnsv.dll
O23 - Service: WMI Performance Adapter - Microsoft Corporation - C:\WINDOWS\SYSTEM32\WBEM\wmiapsrv.exe
O23 - Service: Windows Media Player Network Sharing Service - Microsoft Corporation - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: Security Center - Microsoft Corporation - C:\WINDOWS\SYSTEM32\wscsvc.dll
O23 - Service: Automatic Updates - Microsoft Corporation - C:\WINDOWS\SYSTEM32\wuauserv.dll
O23 - Service: Windows Driver Foundation - User-mode Driver Framework - Microsoft Corporation - C:\WINDOWS\SYSTEM32\WudfSvc.dll
O23 - Service: Wireless Zero Configuration - Microsoft Corporation - C:\WINDOWS\SYSTEM32\wzcsvc.dll
O23 - Service: Network Provisioning Service - Microsoft Corporation - C:\WINDOWS\SYSTEM32\xmlprov.dll

— Additional WinPatrol Info —
Default Browser: Firefox - Firefox version 3.0.10
MSIE: Internet Explorer (7.00.6000.16827)
Firefox 3.0.10 installed in C:\Program Files\Mozilla Firefox.
41 IE Cookies in Folder: C:\Documents and Settings\Simon\Cookies\
0 Mozilla Cookies in Folder: C:\Documents and Settings\Simon\Application Data\Mozilla\FireFox\Profiles\mjwfozk6.default

WP00 - HKLM\CS1: BootExecute = autocheck autochk *
WP00 - HKLM\CCS: BootExecute = autocheck autochk *
WP00 - HKLM\CS3: BootExecute = autocheck autochk *
WP02 - HKLM\CCS: Command = C:\WINDOWS\system32\cmd.exe

WP31 - Scheduled Tasks: [AppleSoftwareUpdate.job]C:\Program Files\Apple Software Update\SoftwareUpdate.exe Never

WP32 - Hidden File: C:\BOOT.INI
WP32 - Hidden File: C:\BOOTSECT.DOS
WP32 - Hidden File: C:\DELL.SDR
WP32 - Hidden File: C:\hiberfil.sys
WP32 - Hidden File: C:\IO.SYS
WP32 - Hidden File: C:\IPH.PH
WP32 - Hidden File: C:\MSDOS.SYS
WP32 - Hidden File: C:\NTDETECT.COM
WP32 - Hidden File: C:\NTLDR
WP32 - Hidden File: C:\pagefile.sys
WP32 - Hidden File: C:\WINDOWS\pcconfig.dat
WP32 - Hidden File: C:\WINDOWS\QTFont.qfn
WP32 - Hidden File: C:\WINDOWS\WindowsShell.Manifest
WP32 - Hidden File: C:\WINDOWS\WINNT.BMP
WP32 - Hidden File: C:\WINDOWS\WINNT256.BMP
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\bijiviwu
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\cdplayer.exe.manifest
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SAM.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\TempKey.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\CONFIG\USERDIFF.LOG
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\ie.log
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\logonui.exe.manifest
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\ncpa.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\nwc.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\Restore\filelist.xml
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\sapi.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\torayiya.dll
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\WindowsLogon.manifest
WP32 - Hidden File: C:\WINDOWS\SYSTEM32\wuaucpl.cpl.manifest
WP32 - Hidden File: C:\Documents and Settings\Simon\Local Settings\Temp\etilqs_i9aSWIksNQbItYASkL9o

WP33 - File Type .AVI: [Video Clip]C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:8 /Open %L
WP33 - File Type .BAT: [MS-DOS Batch File]%1 %*
WP33 - File Type .CAB: [WinRAR archive]C:\Program Files\WinRAR\WinRAR.exe %1
WP33 - File Type .CAT: [Security Catalog]rundll32.exe cryptext.dll,CryptExtOpenCAT %1
WP33 - File Type .CHM: [Compiled HTML Help file]C:\WINDOWS\hh.exe %1
WP33 - File Type .COM: [MS-DOS Application]%1 %*
WP33 - File Type .CMD: [Windows NT Command Script]%1 %*
WP33 - File Type .DOC: [Microsoft Word Document]C:\Program Files\Microsoft Office\Office\WINWORD.EXE /n
WP33 - File Type .EML: [Internet E-Mail Message]C:\Program Files\Outlook Express\msimn.exe /eml:%1
WP33 - File Type .EXE: [Application]%1 %*
WP33 - File Type .INF: [Setup Information]C:\WINDOWS\System32\NOTEPAD.EXE %1
WP33 - File Type .JS: [JScript Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .LOG: [Text Document]C:\WINDOWS\system32\NOTEPAD.EXE %1
WP33 - File Type .MSI: [Windows Installer Package]C:\WINDOWS\System32\msiexec.exe /i %1 %*
WP33 - File Type .MSG: [Outlook Item]C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE /f %1
WP33 - File Type .MID: [MIDI Sequence]C:\Program Files\Windows Media Player\wmplayer.exe /Open %L
WP33 - File Type .MP3: [MP3 Format Sound]C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:6 /Open %L
WP33 - File Type .PIF: [Shortcut to MS-DOS Program]%1 %*
WP33 - File Type .RAM: [RealMedia File]C:\Program Files\Media Player Classic\mplayerc.exe %1
WP33 - File Type .REG: [Registration Entries]regedit.exe %1
WP33 - File Type .RTF: [Rich Text Format]C:\Program Files\Microsoft Office\Office\WINWORD.EXE /n
WP33 - File Type .SBS: [Spyware supplemental file]C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe %1
WP33 - File Type .SCR: [Screen Saver]%1 /S
WP33 - File Type .TXT: [Text Document]C:\WINDOWS\system32\NOTEPAD.EXE %1
WP33 - File Type .URL: [Internet Shortcut]rundll32.exe ieframe.dll,OpenURL %l
WP33 - File Type .VBS: [VBScript Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .VBE: [VBScript Encoded Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .WSF: [Windows Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .WSH: [Windows Script Host Settings File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .XLS: [Microsoft Excel Worksheet]C:\Program Files\Microsoft Office\Office\EXCEL.EXE /e

Memory currently in use: 48%
Physical Memory Free: 543,676 KB
Paging File Free: 2,137,984 KB
Virtual Memory Free: 2,055,612 KB

–
End of file

Any help greatly appreciated!

CatByte

Post #2May 14, 2009, 12:10 PM UTC

Hi

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
Do not mouse-click Combofix's window while it is running. That may cause it to stall.
Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

Paxbrother

Post #3May 14, 2009, 5:44 PM UTC

Many thanks, see log below -

ComboFix 09-05-13.04 - Simon 14/05/2009 18:27.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.705 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Simon\Local Settings\Temporary Internet Files\fbk.sts
c:\windows\2.log
c:\windows\jestertb.dll
c:\windows\system32\comrepl.exe
c:\windows\system32\drivers\ovfsthgrqblkonkvrviovqmupafetnmmovhoos.sys
c:\windows\system32\fituzafi.dll
c:\windows\system32\ifazutif.ini
c:\windows\system32\kumeweva.dll
c:\windows\system32\msn.dlx
c:\windows\system32\ovfsthdwjwnyuqskslojdbbbpfmjuwhexamyie.dat
c:\windows\system32\ovfsthrcxeoniquwpbqyonogwkivkksaqyibri.dll
c:\windows\system32\ovfsthsquxjrvdyquweltaqnyebdodrbajlycu.dll
c:\windows\system32\ovfsthxcybkuwprlphatrilflkipwttcxuypwx.dat
c:\windows\system32\ovfsthxfxcocvpxwdoxjhcjatfavltphyyhprj.dll
c:\windows\system32\rekomeve.dll
c:\windows\system32\rumerubo.dll
c:\windows\system32\tmp.reg
c:\windows\system32\torayiya.dll.tmp
c:\windows\system32\wonizaki.dll
c:\windows\system32\yaluvufa.dll
F:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_ovfsthrjnkolobrsiltitwtsrqrmybwuwpkmlq

((((((((((((((((((((((((( Files Created from 2009-04-14 to 2009-05-14 )))))))))))))))))))))))))))))))
.

2009-05-13 17:48 . 2009-05-13 18:03 ——– d—–w c:\documents and settings\Simon\Application Data\ptidle
2009-05-12 17:52 . 2005-10-17 18:50 245376 —-a-w c:\windows\system32\drivers\rt2500usb.SYS
2009-05-12 17:52 . 2005-05-17 14:24 311296 —-a-w c:\windows\system32\AegisI5.exe
2009-05-12 17:52 . 2006-01-18 12:55 290918 —-a-w c:\windows\system32\Install7x.dll
2009-05-12 17:52 . 2005-11-30 10:33 2048 —-a-w c:\windows\system32\drivers\rt73.bin
2009-05-12 17:52 . 2006-03-08 16:28 255232 —-a-w c:\windows\system32\drivers\rt73.sys
2009-05-12 17:51 . 2009-05-12 17:51 20747 —-a-w c:\windows\system32\drivers\AegisP.sys
2009-05-10 17:27 . 2009-05-10 17:27 ——– d—–w c:\program files\iTunes
2009-05-10 11:55 . 2009-02-24 17:42 116736 —-a-w c:\windows\system32\drivers\mcdbus.sys
2009-04-16 21:54 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-16 21:54 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-16 21:54 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 21:54 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-16 21:54 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 21:54 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 21:53 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 21:53 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 21:53 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 21:53 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 21:52 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 21:52 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 22:30 . 2009-01-28 21:04 ——– d—–w c:\program files\burst
2009-05-12 17:51 . 2008-08-22 18:55 ——– d—–w c:\program files\RALINK
2009-05-12 17:45 . 2004-05-19 13:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-04-13 19:52 . 2004-05-19 13:22 ——– d—–w c:\program files\Java
2009-04-09 18:25 . 2009-04-09 18:25 ——– d—–w c:\program files\Spotify
2009-03-09 04:19 . 2008-12-30 01:53 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2002-08-29 04:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-02-06 17:05 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-21 22:58 . 2009-02-21 22:58 4096 —-a-w c:\windows\d3dx.dat
2009-02-20 18:09 . 2004-08-04 07:56 78336 —-a-w c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2003-08-26 204800]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-05-21 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-06-01 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-06-01 217088]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 81920]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-09-23 292152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\SYSTEM32\narrator.exe [2008-04-14 53760]

c:\documents and settings\Simon\Start Menu\Programs\Startup\
MagicDisc.lnk - f:\program files\MagicDisc\MagicDisc.exe [2009-5-10 576000]
PowerReg Scheduler V3.exe [2005-3-14 225280]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
AOL 8.0 Tray Icon.lnk - c:\program files\AOL 8.0\aoltray.exe [2004-5-19 36937]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-5-12 593920]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\yaluvufa.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\My Games\\Supreme Commander\\Supreme Commander\\bin\\SupremeCommander.exe"=
"f:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\program files\\itunes\\iTunes.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\burst\\core-new1.1.3\\btdownloadheadless.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\Program Files\\Star Wars Galactic Battleground\\Game\\Battlegrounds.exe"=
"c:\\WINDOWS\\SYSTEM32\\dplaysvr.exe"=
"c:\\ComboFix\\NirCmd.cfexe"=

S3 lgmcbus;LGE Mobile driver (WDM);c:\windows\system32\DRIVERS\lgmcbus.sys –> c:\windows\system32\DRIVERS\lgmcbus.sys [?]
S3 lgmcmdfl;LGE Mobile USB WMC Modem Filter;c:\windows\system32\DRIVERS\lgmcmdfl.sys –> c:\windows\system32\DRIVERS\lgmcmdfl.sys [?]
S3 lgmcmdm;LGE Mobile USB WMC Modem Driver;c:\windows\system32\DRIVERS\lgmcmdm.sys –> c:\windows\system32\DRIVERS\lgmcmdm.sys [?]
S3 lgmcmgmt;LGE Mobile USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\lgmcmgmt.sys –> c:\windows\system32\DRIVERS\lgmcmgmt.sys [?]
S3 lgmcnd5;LGE Mobile USB WMC Ethernet ELDA (NDIS);c:\windows\system32\DRIVERS\lgmcnd5.sys –> c:\windows\system32\DRIVERS\lgmcnd5.sys [?]
S3 lgmcobex;LGE Mobile USB WMC OBEX Interface;c:\windows\system32\DRIVERS\lgmcobex.sys –> c:\windows\system32\DRIVERS\lgmcobex.sys [?]
S3 lgmcunic;LGE Mobile USB WMC Ethernet ELDA (WDM);c:\windows\system32\DRIVERS\lgmcunic.sys –> c:\windows\system32\DRIVERS\lgmcunic.sys [?]
S3 NaiFiltr;NaiFiltr;c:\windows\SYSTEM32\DRIVERS\NaiFiltr.sys [15/06/2004 19:36 23296]
.
Contents of the 'Scheduled Tasks' folder

2009-01-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{0d3c8bef-d82d-4d63-aefe-a0e9cc1fe6af} - c:\windows\system32\kumeweva.dll
HKCU-Run-Steam - (no file)
HKLM-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe
HKLM-Run-Sony Ericsson PC Suite - f:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
HKLM-Run-CPMdf924eb7 - c:\windows\system32\rumerubo.dll
HKLM-Run-dajuzobiza - c:\windows\system32\rekomeve.dll
HKLM-Run-dca17d2b - c:\windows\system32\fituzafi.dll
SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\rumerubo.dll
SSODL-SSODL-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\rumerubo.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://news.bbc.co.uk/
uSearch Page = hxxp://www.google.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = ;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: + &Download Express: download this file - f:\program files\Download Express\Add_Url.htm
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
TCP: {FE44C195-FC17-47B9-A44B-D0884D6CA916} = 212.135.1.36,195.40.1.36
Name-Space Handler: ftp\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - f:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: http\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - f:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: https\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - f:\progra~1\DOWNLO~1\mdpph.dll
DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - hxxp://static.windupdates.com/cab/DownloadAccess/ie/bridge-c11.cab
DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab
FF - ProfilePath - c:\documents and settings\Simon\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.bbc.co.uk/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Simon\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\extensions\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}\components\mpint.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-14 18:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1648002289-3947860720-1545137810-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:21,9f,be,bd,63,0f,34,82,cd,84,4e,26,3c,0f,cd,83,fe,a7,67,d3,eb,52,5d,
3a,88,05,96,cd,99,25,30,ae,b5,9b,23,e6,a8,4e,7f,52,c8,c1,ff,63,31,09,ed,b8,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(960)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2668)
c:\windows\system32\mshtml.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Kontiki\KService.exe
c:\progra~1\McAfee.com\VSO\mcvsrte.exe
c:\windows\SYSTEM32\PnkBstrA.exe
c:\windows\wanmpsvc.exe
c:\program files\Logitech\Video\FxSvr2.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-14 18:39 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-14 17:39
ComboFix2.txt 2007-10-12 17:51

Pre-Run: 17,172,578,304 bytes free
Post-Run: 18,162,827,264 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

239 — E O F — 2009-05-14 17:34

Everything appears to be sorted now, no random internet windows popping up or suggesting Disc Cleaning downloads etc….

CatByte

Post #4May 14, 2009, 7:44 PM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Ligijupu_dll_dajuzobiza_minuzudi_dll_so_t103036.html&view=findpost&p=558624#entry558624

Collect::
c:\windows\system32\yaluvufa.dll

Folder::
c:\documents and settings\Simon\Application Data\ptidle

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Paxbrother

Post #5May 15, 2009, 12:43 AM UTC

Many thanks for the help!

See log below -

ComboFix 09-05-14.03 - Simon 15/05/2009 1:29.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.608 [GMT 1:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Simon\Desktop\cfscript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Simon\Application Data\ptidle
c:\documents and settings\Simon\Application Data\ptidle\ptidle.exe
c:\documents and settings\Simon\Application Data\ptidle\ptidle.exe60q

.
((((((((((((((((((((((((( Files Created from 2009-04-15 to 2009-05-15 )))))))))))))))))))))))))))))))
.

2009-05-12 17:52 . 2005-10-17 18:50 245376 —-a-w c:\windows\system32\drivers\rt2500usb.SYS
2009-05-12 17:52 . 2005-05-17 14:24 311296 —-a-w c:\windows\system32\AegisI5.exe
2009-05-12 17:52 . 2006-01-18 12:55 290918 —-a-w c:\windows\system32\Install7x.dll
2009-05-12 17:52 . 2005-11-30 10:33 2048 —-a-w c:\windows\system32\drivers\rt73.bin
2009-05-12 17:52 . 2006-03-08 16:28 255232 —-a-w c:\windows\system32\drivers\rt73.sys
2009-05-12 17:51 . 2009-05-12 17:51 20747 —-a-w c:\windows\system32\drivers\AegisP.sys
2009-05-10 17:27 . 2009-05-10 17:27 ——– d—–w c:\program files\iTunes
2009-05-10 11:55 . 2009-02-24 17:42 116736 —-a-w c:\windows\system32\drivers\mcdbus.sys
2009-04-16 21:54 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-16 21:54 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-16 21:54 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-16 21:54 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-16 21:54 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-16 21:54 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-16 21:53 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-16 21:53 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-16 21:53 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-16 21:53 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-16 21:52 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-16 21:52 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-14 18:54 . 2009-01-28 21:04 ——– d—–w c:\program files\burst
2009-05-12 17:51 . 2008-08-22 18:55 ——– d—–w c:\program files\RALINK
2009-05-12 17:45 . 2004-05-19 13:25 ——– d–h–w c:\program files\InstallShield Installation Information
2009-04-13 19:52 . 2004-05-19 13:22 ——– d—–w c:\program files\Java
2009-04-09 18:25 . 2009-04-09 18:25 ——– d—–w c:\program files\Spotify
2009-03-09 04:19 . 2008-12-30 01:53 410984 —-a-w c:\windows\system32\deploytk.dll
2009-03-06 14:22 . 2002-08-29 04:00 284160 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-02-06 17:05 826368 —-a-w c:\windows\system32\wininet.dll
2009-02-21 22:58 . 2009-02-21 22:58 4096 —-a-w c:\windows\d3dx.dat
2009-02-20 18:09 . 2004-08-04 07:56 78336 —-a-w c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-14_17.33.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-14 22:07 . 2009-05-14 22:07 16384 c:\windows\Temp\Perflib_Perfdata_394.dat
+ 2009-05-14 22:07 . 2009-05-14 22:07 16384 c:\windows\Temp\Perflib_Perfdata_35c.dat
+ 2009-05-14 20:57 . 2009-05-06 23:16 24699336 c:\windows\SYSTEM32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-06-01 196608]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"kdx"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 1460560]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"Steam"="" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2003-08-26 204800]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"LVCOMSX"="c:\windows\System32\LVCOMSX.EXE" [2004-05-21 221184]
"LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-06-01 458752]
"LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-06-01 217088]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-06-03 81920]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"!AVG Anti-Spyware"="c:\program files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-09-23 292152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"4oD"="c:\program files\Kontiki\KHost.exe" [2007-04-23 1032640]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" - c:\windows\SYSTEM32\narrator.exe [2008-04-14 53760]

c:\documents and settings\Simon\Start Menu\Programs\Startup\
MagicDisc.lnk - f:\program files\MagicDisc\MagicDisc.exe [2009-5-10 576000]
PowerReg Scheduler V3.exe [2005-3-14 225280]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
AOL 8.0 Tray Icon.lnk - c:\program files\AOL 8.0\aoltray.exe [2004-5-19 36937]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2009-5-12 593920]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\My Games\\Supreme Commander\\Supreme Commander\\bin\\SupremeCommander.exe"=
"f:\\Program Files\\THQ\\Gas Powered Games\\Supreme Commander\\GPGNet\\GPG.Multiplayer.Client.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\program files\\itunes\\iTunes.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\burst\\core-new1.1.3\\btdownloadheadless.exe"=
"c:\\Program Files\\Spotify\\spotify.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"f:\\Program Files\\Star Wars Galactic Battleground\\Game\\Battlegrounds.exe"=
"c:\\WINDOWS\\SYSTEM32\\dplaysvr.exe"=
"c:\\ComboFix\\NirCmd.cfexe"=

S3 lgmcbus;LGE Mobile driver (WDM);c:\windows\system32\DRIVERS\lgmcbus.sys –> c:\windows\system32\DRIVERS\lgmcbus.sys [?]
S3 lgmcmdfl;LGE Mobile USB WMC Modem Filter;c:\windows\system32\DRIVERS\lgmcmdfl.sys –> c:\windows\system32\DRIVERS\lgmcmdfl.sys [?]
S3 lgmcmdm;LGE Mobile USB WMC Modem Driver;c:\windows\system32\DRIVERS\lgmcmdm.sys –> c:\windows\system32\DRIVERS\lgmcmdm.sys [?]
S3 lgmcmgmt;LGE Mobile USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\lgmcmgmt.sys –> c:\windows\system32\DRIVERS\lgmcmgmt.sys [?]
S3 lgmcnd5;LGE Mobile USB WMC Ethernet ELDA (NDIS);c:\windows\system32\DRIVERS\lgmcnd5.sys –> c:\windows\system32\DRIVERS\lgmcnd5.sys [?]
S3 lgmcobex;LGE Mobile USB WMC OBEX Interface;c:\windows\system32\DRIVERS\lgmcobex.sys –> c:\windows\system32\DRIVERS\lgmcobex.sys [?]
S3 lgmcunic;LGE Mobile USB WMC Ethernet ELDA (WDM);c:\windows\system32\DRIVERS\lgmcunic.sys –> c:\windows\system32\DRIVERS\lgmcunic.sys [?]
S3 NaiFiltr;NaiFiltr;c:\windows\SYSTEM32\DRIVERS\NaiFiltr.sys [15/06/2004 19:36 23296]
.
Contents of the 'Scheduled Tasks' folder

2009-01-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{0d3c8bef-d82d-4d63-aefe-a0e9cc1fe6af} - (no file)

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://news.bbc.co.uk/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = ;*.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: + &Download Express: download this file - f:\program files\Download Express\Add_Url.htm
IE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.skybroadband.com
TCP: {FE44C195-FC17-47B9-A44B-D0884D6CA916} = 212.135.1.36,195.40.1.36
Name-Space Handler: ftp\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - f:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: http\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - f:\progra~1\DOWNLO~1\mdpph.dll
Name-Space Handler: https\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - f:\progra~1\DOWNLO~1\mdpph.dll
DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab
FF - ProfilePath - c:\documents and settings\Simon\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.bbc.co.uk/
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Simon\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\extensions\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}\components\mpint.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-15 01:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1648002289-3947860720-1545137810-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:21,9f,be,bd,63,0f,34,82,cd,84,4e,26,3c,0f,cd,83,fe,a7,67,d3,eb,52,5d,
3a,88,05,96,cd,99,25,30,ae,b5,9b,23,e6,a8,4e,7f,52,c8,c1,ff,63,31,09,ed,b8,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(948)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-05-15 1:35
ComboFix-quarantined-files.txt 2009-05-15 00:34
ComboFix2.txt 2009-05-14 17:39
ComboFix3.txt 2007-10-12 17:51

Pre-Run: 18,079,784,960 bytes free
Post-Run: 18,066,067,456 bytes free

180 — E O F — 2009-05-14 20:58

CatByte

Post #6May 15, 2009, 12:49 AM UTC

Hi,

Please do the following:

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

In your next reply please include

MBAM Log
Kaspersky report

Paxbrother

Post #7May 19, 2009, 4:31 PM UTC

Malwarebytes' Anti-Malware 1.29 Database version: 1306 Windows 5.1.2600 Service Pack 3 17/05/2009 19:03:58 mbam-log-2009-05-17 (19-03-58).txt Scan type: Quick Scan Objects scanned: 54397 Time elapsed: 5 minute(s), 38 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, May 18, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Sunday, May 17, 2009 18:37:34 Records in database: 2188594 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics: Files scanned: 143098 Threat name: 11 Infected objects: 28 Suspicious objects: 0 Duration of the scan: 05:15:38 File name / Threat name / Threats count C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a Infected: Trojan-Dropper.Java.Beyond.g 1 C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a Infected: Exploit.Java.ByteVerify 1 C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a Infected: Trojan-Downloader.Java.OpenConnection.ac 1 C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\60\69f833fc-7d259aac Infected: Trojan-Downloader.Java.OpenConnection.ao 2 C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\60\69f833fc-7d259aac Infected: Trojan.Java.ClassLoader.au 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\ovfsthgrqblkonkvrviovqmupafetnmmovhoos.sys.vir Infected: Trojan.Win32.Tdss.aalf 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\fituzafi.dll.vir Infected: Packed.Win32.Krap.q 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kumeweva.dll.vir Infected: Packed.Win32.Krap.q 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthrcxeoniquwpbqyonogwkivkksaqyibri.dll.vir Infected: Trojan.Win32.Tdss.aalc 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthsquxjrvdyquweltaqnyebdodrbajlycu.dll.vir Infected: Trojan.Win32.Tdss.aalg 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthxfxcocvpxwdoxjhcjatfavltphyyhprj.dll.vir Infected: Trojan.Win32.Tdss.aald 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\rekomeve.dll.vir Infected: Packed.Win32.Krap.q 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\rumerubo.dll.vir Infected: Packed.Win32.Krap.q 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\torayiya.dll.tmp.vir Infected: Packed.Win32.Krap.q 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\wonizaki.dll.vir Infected: Packed.Win32.Krap.q 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\yaluvufa.dll.vir Infected: Packed.Win32.Krap.q 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065572.sys Infected: Trojan.Win32.Tdss.aalf 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065573.dll Infected: Trojan.Win32.Tdss.aalc 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065574.dll Infected: Trojan.Win32.Tdss.aalg 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065575.dll Infected: Trojan.Win32.Tdss.aald 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065598.dll Infected: Packed.Win32.Krap.q 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065600.dll Infected: Packed.Win32.Krap.q 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065601.dll Infected: Packed.Win32.Krap.q 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065602.dll Infected: Packed.Win32.Krap.q 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065603.dll Infected: Packed.Win32.Krap.q 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP212\A0065604.dll Infected: Packed.Win32.Krap.q 1 C:\WINDOWS\SYSTEM32\ie.log Infected: Rootkit.Win32.Agent.dzn 1 The selected area was scanned. Sorry for the delay on this - my wireless internet is unable to connect (finds the connection, then loses it within 10 seconds, repeat) so I am posting from another PC. I don't think this is related.

CatByte

Post #8May 19, 2009, 4:53 PM UTC

Hi,

Please do the following:

Try this for your connection problems:
go to Start > Run > type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste:

ipconfig /flushdns

(note the space between “..g /f…” it needs to be there)
Hit Enter.
You will get a confirmation that the flush was successful.
Close the command box.

NEXT

Please reset Internet Explorer

Go to Start > Control Panel, and choose Network Connections.
Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and choose Properties.
Click the Networking tab
Double-click on the Internet Protocol (TCP/IP) item.
Write down the settings in case you should need to change them back.
Select the radio button that says "Obtain DNS servers automatically".
Click OK twice to get out of the properties screen and restart your computer.
If not prompted to reboot go ahead and reboot manually.

In Internet Explorer

Check internet options settings.
Tools > Internet Options > Connections
LAN settings
Choose "automatically detect settings"
uncheck both proxy settings boxes

Please advise if that resolves the internet connection issues.

NEXT

Please download the OTMoveIt3 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).

Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

(Do Not copy the word CODE note the fix starts with the colon in front of the word:Processes)

:Processes
explorer.exe

:Services

:Reg

:Files
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a 
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a 
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a 
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\60\69f833fc-7d259aac 
C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\60\69f833fc-7d259aac 
C:\WINDOWS\SYSTEM32\ie.log 

:Commands
[Purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

*Make sure you allow OTMOVEIT3 to reboot your computer when prompted.

Post a fresh HJT log along with the OTMI3 Log and describe how your computer is running now

Paxbrother

Post #9May 19, 2009, 8:10 PM UTC

========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a moved successfully. File/Folder C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a not found. File/Folder C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\27\4a8fde9b-1fec9f3a not found. C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\60\69f833fc-7d259aac moved successfully. File/Folder C:\Documents and Settings\Simon\Application Data\Sun\Java\Deployment\cache\6.0\60\69f833fc-7d259aac not found. C:\WINDOWS\SYSTEM32\ie.log moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\Simon\LOCALS~1\Temp\etilqs_3ONUrLQG5ADh2KbFCkze scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Simon\LOCALS~1\Temp\~DF33D8.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\Simon\LOCALS~1\Temp\~DF81D0.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\Simon\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_668.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_718.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\urlclassifier3.sqlite-journal scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05192009_205718 Files moved on Reboot… File C:\DOCUME~1\Simon\LOCALS~1\Temp\etilqs_3ONUrLQG5ADh2KbFCkze not found! C:\DOCUME~1\Simon\LOCALS~1\Temp\~DF33D8.tmp moved successfully. C:\DOCUME~1\Simon\LOCALS~1\Temp\~DF81D0.tmp moved successfully. File C:\WINDOWS\temp\Perflib_Perfdata_668.dat not found! File C:\WINDOWS\temp\Perflib_Perfdata_718.dat not found! C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\urlclassifier3.sqlite moved successfully. File C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\urlclassifier3.sqlite-journal not found! C:\Documents and Settings\Simon\Local Settings\Application Data\Mozilla\Firefox\Profiles\mjwfozk6.default\XUL.mfl moved successfully. Computer seems fine, however the internet did come back online but after the reboot it has failed, stating "the network has limited or no connectivity"

CatByte

Post #10May 19, 2009, 8:27 PM UTC

Hi, That doesn't sound malware related necessarily, can you post a fresh HJT log so I can make sure you are clean. Then I can clean up out tools and then I suggest posting in our Internet forum to see if the tech experts can shed some light on the issue

CatByte

Post #11May 24, 2009, 9:50 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Ligijupu.dll, dajuzobiza, minuzudi.dll and so on

✨ Ask AI

Ask AI