Urllogic.com +pacificpoker +[removed] + Loadingw

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»»»»»»»»»»»»»»»»»»»»» Files found in System »»»»»»»»»»»»»»»»»»»»»»» * qoologic C:\WINDOWS\System32\IEOPBS.DLL * qoologic C:\WINDOWS\System32\LCYUOI.DLL * qoologic C:\WINDOWS\System32\LHZUWX.EXE * aspack C:\WINDOWS\System32\VWIURQ.EXE * aspack C:\WINDOWS\System32\WPAUBG.DAT * urllogic C:\WINDOWS\NHNCEK.DLL »»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» * aspack C:\docume~1\alluse~1\startm~1\programs\startup\KHUGTF.EXE »»»»»»»»»»»»»»»»»»»»»»»» Registry Entries Found »»»»»»»»»»»»»»»»»»»»»»» ! REG.EXE VERSION 3.0 HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mfnyts REG_SZ {0c7d5299-26ee-4db2-ab37-101a32bd5a4a} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files REG_SZ {750fdf0e-2a26-11d1-a3ea-080036587f03} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With REG_SZ {09799AFB-AD67-11d1-ABCD-00C04FC30936} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu REG_SZ {A470F8CF-A1E8-4f65-8335-227475AA5C46} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu REG_SZ {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} REG_SZ Start Menu Pin ___________________________________________________________________ Find activesetup", version1, launched at: 06:45 HKLM\Software\Microsoft\Active Setup\Installed Components\ ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "Windows Media Player" \StubPath = "C:\WINDOWS\inf\unregmp2.exe /ShowWMP" [MS] Thanks

http://www.downloads.subratam.org/KillBox.zip

If you haven't already please download the ti your desktop, unzip the program.
Close all Browsers and programs that show in the windows taskbar
Start KillBox.exe.
place a check next to "Delete on Reboot"
Copy/Paste (not type or browse) this file into the top "Full Path of File to Delete" box.

Click the "Delete File" button which looks like a stop sign.
It will ask you if you want to reboot, select NO until the last file and select YES
Repeat those same steps for each of these files one at a time.


C:\WINDOWS\System32\IEOPBS.DLL
C:\WINDOWS\System32\LCYUOI.DLL
C:\WINDOWS\System32\LHZUWX.EXE
C:\WINDOWS\System32\VWIURQ.EXE
C:\WINDOWS\System32\WPAUBG.DAT
C:\WINDOWS\NHNCEK.DLL
C:\Documents and Settings\allusers\startmemu\programs\startup\KHUGTF.EXE

After your reboot run the qoologic programs and post fresh logs.

Had to run killbox 2x, 1st time did not empty recycle bin and they came back. Here are the logs PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. »»»»»»»»»»»»»»»»»»»»»»»» Files found in System »»»»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»»»»»»» startup files»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»» »»»»»»»»»»»»»»»»»»»»»»»» Registry Entries Found »»»»»»»»»»»»»»»»»»»»»»» ! REG.EXE VERSION 3.0 HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mfnyts REG_SZ {0c7d5299-26ee-4db2-ab37-101a32bd5a4a} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files REG_SZ {750fdf0e-2a26-11d1-a3ea-080036587f03} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With REG_SZ {09799AFB-AD67-11d1-ABCD-00C04FC30936} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu REG_SZ {A470F8CF-A1E8-4f65-8335-227475AA5C46} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Symantec.Norton.Antivirus.IEContextMenu REG_SZ {5345A4D5-41EB-4A2F-9616-CE1D4F6C35B2} HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8} REG_SZ Start Menu Pin "Find activesetup", version1, launched at: 21:40 *********************** Operating System: Windows XP SP2 HKLM\Software\Microsoft\Active Setup\Installed Components\ ">{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\(Default)" = "Windows Media Player" \StubPath = "C:\WINDOWS\inf\unregmp2.exe /ShowWMP" [MS] "bf67d911-c419-414f-a3ed-26898dbf6e6f\(Default)" = "" \StubPath = "C:\WINDOWS\system32\lhzuwx.exe" [null data]

Okay we've removed the files. You shouldn't have a problem with that file anymore. I just need a little input on what to remove from the registry. Sit tight. Are you still receiving pop-ups now that we have removed the qoologic?

Please copy the contents of the quote box save to your desktop as fixme.reg, close all your Internet Browsers and double-click the fixme.reg file. On the windows prompt click 'Yes'

REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{bf67d911-c419-414f-a3ed-26898dbf6e6f}]
[-HKEY_CLASSES_ROOT\CLSID\{bf67d911-c419-414f-a3ed-26898dbf6e6f}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{bf67d911-c419-414f-a3ed-26898dbf6e6f}]
[-HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\mfnyts]

Just to make sure everything is clean, please post 1 final Hijackthis log.

How's the computer running?

I am going to consider this thread complete.

To prevent the hijackers from taking over your system, increase the level of security on your system. Don't allow the hijackers to take you over!! Review these articles to increase the level of security.

http://www.computercops.biz/postt7736.html
http://www.markusjansson.net/eienbid.html

Also reset your restore points

Turn off System Restore.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Reboot.

Turn System Restore Back On.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK


If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.