Trojans

Hi brown1950,
Welcome to the TomCoyote Forums
My name is mschroe919 and I am going to read your log.
Sorry about the delay in responding we are quite busy. I would like to help you So if you would….
Please post back a new log if you still need help. Would like a latest log to review. Or if don't need help let us know too. Also let us know how your Pc is doing at this time.
Thanks mschroe919

Also herewith latest Ewido log :- ——————————————————– ewido anti-spyware - Scan Report ——————————————————— + Created at: 20:08:12 20/07/2006 + Scan result: C:\WINDOWS\Temp\bw2.com -> Adware.AdURL : Cleaned with backup (quarantined). C:\WINDOWS\icont.exe -> Adware.AdURL : Cleaned with backup (quarantined). C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\EH07PIFH\AppWrap[1].exe -> Adware.AdURL : Cleaned with backup (quarantined). C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\H1A0TWHT\AppWrap[1].exe -> Adware.AdURL : Cleaned with backup (quarantined). C:\WINDOWS\system32\fp4m03h1e.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\WINDOWS\system32\j4j60e1seh.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\WINDOWS\system32\mdisip.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\WINDOWS\system32\modtcuiu.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\WINDOWS\system32\mwxmlr.dll -> Adware.Look2Me : Cleaned with backup (quarantined). C:\WINDOWS\system32\sRfrslv.dll -> Adware.Look2Me : Cleaned with backup (quarantined). [668] C:\WINDOWS\system32\mwxmlr.dll -> Adware.Look2Me : Error during cleaning. [752] C:\WINDOWS\system32\mtr2c.dll -> Adware.Look2Me : Error during cleaning. [884] C:\WINDOWS\system32\mtr2c.dll -> Adware.Look2Me : Error during cleaning. C:\WINDOWS\system32\fcccaxx.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\gebxuvs.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\ljjgeba.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\pmkhi.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\urqqpmj.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\config\drxvp.exe -> Downloader.Adload.cw : Cleaned with backup (quarantined). C:\WINDOWS\MTE3NDI6ODoxNg.exe -> Downloader.Small.buy : Cleaned with backup (quarantined). C:\Documents and Settings\Chris Brownhill\Cookies\chris [removed][2].txt -> TrackingCookie.Webtrendslive : Cleaned with backup (quarantined). C:\Documents and Settings\Chris Brownhill\Cookies\chris [removed][1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined). ::Report end

Hi brown1950

welcome back to the TC Forums.

I have read your log. Let me suggest you copy and paste these instructions into word pad, and print it out so you can follow the steps in order.
Please read through this post since I am asking you to download specific software to assist you.
=============================================
Download VundoFix.exe to your desktop.

http://www.atribune.org/ccount/click.php?id=4

1. Double-click VundoFix.exe to run it.
2. Click the Scan for Vundo button.
3. Once it's done scanning, click the Remove Vundo button.
4. You will receive a prompt asking if you want to remove the files, click YES.
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, it will prompt that it will shutdown your computer, click OK.
7. Turn your computer back on.

A log is created and found in C:\vundofix.txt
==================================
NEXT:

Restart your computer in normal mode and please post the C:\vundofix.txt in your reply,
as well as a new HijackThis log.
Also let us know how your pc is doing now.
Good luck
mschroe919

Thank you for your prompt reply. As reqyested herewith Vundofix log :- VundoFix V4.2.84 Checking Java version… Sun Java not detected Scan started at 00:06:14 06/07/2006 Listing files found while scanning…. C:\WINDOWS\system32\byxvtrq.dll C:\WINDOWS\system32\xayxx.bak1 C:\WINDOWS\system32\xayxx.ini C:\WINDOWS\system32\xxyax.dll Attempting to delete C:\WINDOWS\system32\byxvtrq.dll C:\WINDOWS\system32\byxvtrq.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\xayxx.bak1 C:\WINDOWS\system32\xayxx.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\xayxx.ini C:\WINDOWS\system32\xayxx.ini Could not be deleted. Attempting to delete C:\WINDOWS\system32\xxyax.dll C:\WINDOWS\system32\xxyax.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:02:47 10/07/2006 Listing files found while scanning…. C:\windows\system32\awtrpon.dll C:\windows\system32\awtturs.dll C:\windows\system32\awtussq.dll C:\windows\system32\byxvtrq.dll C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxyvvt.dll C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcyxvu.dll C:\windows\system32\efcbyay.dll C:\windows\system32\fccayya.dll C:\windows\system32\fcccccd.dll C:\windows\system32\gebxvtr.dll C:\windows\system32\gebyaxx.dll C:\windows\system32\hggffcd.dll C:\windows\system32\hgggdaw.dll C:\windows\system32\hggghff.dll C:\windows\system32\iifcbyx.dll C:\windows\system32\iifdabc.dll C:\windows\system32\iifdefe.dll C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkkhed.dll C:\windows\system32\khfebab.dll C:\windows\system32\khfebby.dll C:\windows\system32\khfeecb.dll C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjjged.dll C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnmljh.dll C:\windows\system32\opnkkll.dll C:\windows\system32\opnklii.dll C:\windows\system32\opnlige.dll C:\windows\system32\opnljkh.dll C:\windows\system32\opnmnmm.dll C:\windows\system32\opnnljg.dll C:\windows\system32\opnnool.dll C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak2 C:\windows\system32\qomjggh.dll C:\windows\system32\qomjigf.dll C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkjk.dll C:\windows\system32\qomkllk.dll C:\windows\system32\qomlmml.dll C:\windows\system32\qommmjg.dll C:\windows\system32\qomnmki.dll C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrspon.dll C:\windows\system32\rqrsqnl.dll C:\windows\system32\ssqpqoo.dll C:\windows\system32\tuvsqpo.dll C:\windows\system32\urqomlk.dll C:\windows\system32\urqooll.dll C:\windows\system32\vturonl.dll C:\windows\system32\vtuurst.dll C:\windows\system32\vtuuuro.dll C:\windows\system32\wvurrst.dll C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyax.dll C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.tmp C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyyyxw.dll C:\windows\system32\yayaaxx.dll C:\windows\system32\yayawxy.dll C:\windows\system32\yayayaw.dll C:\windows\system32\yayyvwx.dll VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:11:21 10/07/2006 Listing files found while scanning…. C:\windows\system32\awtrpon.dll C:\windows\system32\awtturs.dll C:\windows\system32\awtussq.dll C:\windows\system32\byxvtrq.dll C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxyvvt.dll C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcyxvu.dll C:\windows\system32\efcbyay.dll C:\windows\system32\fccayya.dll C:\windows\system32\fcccccd.dll C:\windows\system32\gebxvtr.dll C:\windows\system32\gebyaxx.dll C:\windows\system32\hggffcd.dll C:\windows\system32\hgggdaw.dll C:\windows\system32\hggghff.dll C:\windows\system32\iifcbyx.dll C:\windows\system32\iifdabc.dll C:\windows\system32\iifdefe.dll C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkkhed.dll C:\windows\system32\khfebab.dll C:\windows\system32\khfebby.dll C:\windows\system32\khfeecb.dll C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjjged.dll C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnmljh.dll C:\windows\system32\opnkkll.dll C:\windows\system32\opnklii.dll C:\windows\system32\opnlige.dll C:\windows\system32\opnljkh.dll C:\windows\system32\opnmnmm.dll C:\windows\system32\opnnljg.dll C:\windows\system32\opnnool.dll C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak2 C:\windows\system32\qomjggh.dll C:\windows\system32\qomjigf.dll C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkjk.dll C:\windows\system32\qomkllk.dll C:\windows\system32\qomlmml.dll C:\windows\system32\qommmjg.dll C:\windows\system32\qomnmki.dll C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrspon.dll C:\windows\system32\rqrsqnl.dll C:\windows\system32\ssqpqoo.dll C:\windows\system32\tuvsqpo.dll C:\windows\system32\urqomlk.dll C:\windows\system32\urqooll.dll C:\windows\system32\vturonl.dll C:\windows\system32\vtuurst.dll C:\windows\system32\vtuuuro.dll C:\windows\system32\wvurrst.dll C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyax.dll C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.tmp C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyyyxw.dll C:\windows\system32\yayaaxx.dll C:\windows\system32\yayawxy.dll C:\windows\system32\yayayaw.dll C:\windows\system32\yayyvwx.dll VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:16:26 10/07/2006 Listing files found while scanning…. C:\windows\system32\awtrpon.dll C:\windows\system32\awtturs.dll C:\windows\system32\awtussq.dll C:\windows\system32\byxvtrq.dll C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxyvvt.dll C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcyxvu.dll C:\windows\system32\efcbyay.dll C:\windows\system32\fccayya.dll C:\windows\system32\fcccccd.dll C:\windows\system32\gebxvtr.dll C:\windows\system32\gebyaxx.dll C:\windows\system32\hggffcd.dll C:\windows\system32\hgggdaw.dll C:\windows\system32\hggghff.dll C:\windows\system32\iifcbyx.dll C:\windows\system32\iifdabc.dll C:\windows\system32\iifdefe.dll C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkkhed.dll C:\windows\system32\khfebab.dll C:\windows\system32\khfebby.dll C:\windows\system32\khfeecb.dll C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjjged.dll C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnmljh.dll C:\windows\system32\opnkkll.dll C:\windows\system32\opnklii.dll C:\windows\system32\opnlige.dll C:\windows\system32\opnljkh.dll C:\windows\system32\opnmnmm.dll C:\windows\system32\opnnljg.dll C:\windows\system32\opnnool.dll C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak2 C:\windows\system32\qomjggh.dll C:\windows\system32\qomjigf.dll C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkjk.dll C:\windows\system32\qomkllk.dll C:\windows\system32\qomlmml.dll C:\windows\system32\qommmjg.dll C:\windows\system32\qomnmki.dll C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrspon.dll C:\windows\system32\rqrsqnl.dll C:\windows\system32\ssqpqoo.dll C:\windows\system32\tuvsqpo.dll C:\windows\system32\urqomlk.dll C:\windows\system32\urqooll.dll C:\windows\system32\vturonl.dll C:\windows\system32\vtuurst.dll C:\windows\system32\vtuuuro.dll C:\windows\system32\wvurrst.dll C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyax.dll C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.tmp C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyyyxw.dll C:\windows\system32\yayaaxx.dll C:\windows\system32\yayawxy.dll C:\windows\system32\yayayaw.dll C:\windows\system32\yayyvwx.dll Beginning removal… The process smss.exe could not be stopped Vundofix may not be able to delete some files that were found. The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\awtrpon.dll C:\windows\system32\awtrpon.dll Has been deleted! Attempting to delete C:\windows\system32\awtturs.dll C:\windows\system32\awtturs.dll Has been deleted! Attempting to delete C:\windows\system32\awtussq.dll C:\windows\system32\awtussq.dll Has been deleted! Attempting to delete C:\windows\system32\byxvtrq.dll C:\windows\system32\byxvtrq.dll Has been deleted! Attempting to delete C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxvtrr.dll Has been deleted! Attempting to delete C:\windows\system32\cbxyvvt.dll C:\windows\system32\cbxyvvt.dll Has been deleted! Attempting to delete C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcbxxu.dll Has been deleted! Attempting to delete C:\windows\system32\ddcyxvu.dll C:\windows\system32\ddcyxvu.dll Has been deleted! Attempting to delete C:\windows\system32\efcbyay.dll C:\windows\system32\efcbyay.dll Has been deleted! Attempting to delete C:\windows\system32\fccayya.dll C:\windows\system32\fccayya.dll Has been deleted! Attempting to delete C:\windows\system32\fcccccd.dll C:\windows\system32\fcccccd.dll Has been deleted! Attempting to delete C:\windows\system32\gebxvtr.dll C:\windows\system32\gebxvtr.dll Has been deleted! Attempting to delete C:\windows\system32\gebyaxx.dll C:\windows\system32\gebyaxx.dll Has been deleted! Attempting to delete C:\windows\system32\hggffcd.dll C:\windows\system32\hggffcd.dll Has been deleted! Attempting to delete C:\windows\system32\hgggdaw.dll C:\windows\system32\hgggdaw.dll Has been deleted! Attempting to delete C:\windows\system32\hggghff.dll C:\windows\system32\hggghff.dll Has been deleted! Attempting to delete C:\windows\system32\iifcbyx.dll C:\windows\system32\iifcbyx.dll Has been deleted! Attempting to delete C:\windows\system32\iifdabc.dll C:\windows\system32\iifdabc.dll Has been deleted! Attempting to delete C:\windows\system32\iifdefe.dll C:\windows\system32\iifdefe.dll Has been deleted! Attempting to delete C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkjigg.dll Has been deleted! Attempting to delete C:\windows\system32\jkkkhed.dll C:\windows\system32\jkkkhed.dll Has been deleted! Attempting to delete C:\windows\system32\khfebab.dll C:\windows\system32\khfebab.dll Has been deleted! Attempting to delete C:\windows\system32\khfebby.dll C:\windows\system32\khfebby.dll Has been deleted! Attempting to delete C:\windows\system32\khfeecb.dll C:\windows\system32\khfeecb.dll Has been deleted! Attempting to delete C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjijjh.dll Has been deleted! Attempting to delete C:\windows\system32\ljjjged.dll C:\windows\system32\ljjjged.dll Has been deleted! Attempting to delete C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnljgh.dll Has been deleted! Attempting to delete C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnlkjg.dll Has been deleted! Attempting to delete C:\windows\system32\nnnmljh.dll C:\windows\system32\nnnmljh.dll Has been deleted! Attempting to delete C:\windows\system32\opnkkll.dll C:\windows\system32\opnkkll.dll Has been deleted! Attempting to delete C:\windows\system32\opnklii.dll C:\windows\system32\opnklii.dll Has been deleted! Attempting to delete C:\windows\system32\opnlige.dll C:\windows\system32\opnlige.dll Has been deleted! Attempting to delete C:\windows\system32\opnljkh.dll C:\windows\system32\opnljkh.dll Has been deleted! Attempting to delete C:\windows\system32\opnmnmm.dll C:\windows\system32\opnmnmm.dll Has been deleted! Attempting to delete C:\windows\system32\opnnljg.dll C:\windows\system32\opnnljg.dll Has been deleted! Attempting to delete C:\windows\system32\opnnool.dll C:\windows\system32\opnnool.dll Has been deleted! Attempting to delete C:\windows\system32\oppoo.dll C:\windows\system32\oppoo.dll Could not be deleted. Attempting to delete C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.ini Has been deleted! Attempting to delete C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak1 Has been deleted! Attempting to delete C:\windows\system32\ooppo.bak2 C:\windows\system32\ooppo.bak2 Has been deleted! Attempting to delete C:\windows\system32\qomjggh.dll C:\windows\system32\qomjggh.dll Has been deleted! Attempting to delete C:\windows\system32\qomjigf.dll C:\windows\system32\qomjigf.dll Has been deleted! Attempting to delete C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkhi.dll Has been deleted! Attempting to delete C:\windows\system32\qomjkjk.dll C:\windows\system32\qomjkjk.dll Has been deleted! Attempting to delete C:\windows\system32\qomkllk.dll C:\windows\system32\qomkllk.dll Has been deleted! Attempting to delete C:\windows\system32\qomlmml.dll C:\windows\system32\qomlmml.dll Has been deleted! Attempting to delete C:\windows\system32\qommmjg.dll C:\windows\system32\qommmjg.dll Has been deleted! Attempting to delete C:\windows\system32\qomnmki.dll C:\windows\system32\qomnmki.dll Has been deleted! Attempting to delete C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrpmnl.dll Has been deleted! Attempting to delete C:\windows\system32\rqrspon.dll C:\windows\system32\rqrspon.dll Has been deleted! Attempting to delete C:\windows\system32\rqrsqnl.dll C:\windows\system32\rqrsqnl.dll Has been deleted! Attempting to delete C:\windows\system32\ssqpqoo.dll C:\windows\system32\ssqpqoo.dll Has been deleted! Attempting to delete C:\windows\system32\tuvsqpo.dll C:\windows\system32\tuvsqpo.dll Has been deleted! Attempting to delete C:\windows\system32\urqomlk.dll C:\windows\system32\urqomlk.dll Has been deleted! Attempting to delete C:\windows\system32\urqooll.dll C:\windows\system32\urqooll.dll Has been deleted! Attempting to delete C:\windows\system32\vturonl.dll C:\windows\system32\vturonl.dll Has been deleted! Attempting to delete C:\windows\system32\vtuurst.dll C:\windows\system32\vtuurst.dll Has been deleted! Attempting to delete C:\windows\system32\vtuuuro.dll C:\windows\system32\vtuuuro.dll Has been deleted! Attempting to delete C:\windows\system32\wvurrst.dll C:\windows\system32\wvurrst.dll Has been deleted! Attempting to delete C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyaabb.dll Has been deleted! Attempting to delete C:\windows\system32\xxyax.dll C:\windows\system32\xxyax.dll Has been deleted! Attempting to delete C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.ini Has been deleted! Attempting to delete C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.bak2 Has been deleted! Attempting to delete C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.ini2 Has been deleted! Attempting to delete C:\windows\system32\xayxx.tmp C:\windows\system32\xayxx.tmp Has been deleted! Attempting to delete C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyvssp.dll Has been deleted! Attempting to delete C:\windows\system32\xxyyyxw.dll C:\windows\system32\xxyyyxw.dll Has been deleted! Attempting to delete C:\windows\system32\yayaaxx.dll C:\windows\system32\yayaaxx.dll Has been deleted! Attempting to delete C:\windows\system32\yayawxy.dll C:\windows\system32\yayawxy.dll Has been deleted! Attempting to delete C:\windows\system32\yayayaw.dll C:\windows\system32\yayayaw.dll Has been deleted! Attempting to delete C:\windows\system32\yayyvwx.dll C:\windows\system32\yayyvwx.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:21:16 10/07/2006 Listing files found while scanning…. C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini Beginning removal… The process smss.exe could not be stopped Vundofix may not be able to delete some files that were found. The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\oppoo.dll C:\windows\system32\oppoo.dll Could not be deleted. Attempting to delete C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.ini Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:59:03 10/07/2006 Listing files found while scanning…. C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 7:51:02 PM 7/17/2006 Listing files found while scanning…. C:\windows\system32\byxxxvs.dll C:\windows\system32\hgghhef.dll C:\windows\system32\khfeebb.dll C:\windows\system32\khfggfe.dll C:\windows\system32\mljgfgf.dll C:\windows\system32\nnnkjii.dll C:\windows\system32\nnnlmji.dll C:\windows\system32\qommnlj.dll C:\windows\system32\ssqnklm.dll C:\windows\system32\tuvssst.dll C:\windows\system32\vtuvust.dll C:\windows\system32\wvuvsqn.dll C:\windows\system32\wvuvurq.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\byxxxvs.dll C:\windows\system32\byxxxvs.dll Has been deleted! Attempting to delete C:\windows\system32\hgghhef.dll C:\windows\system32\hgghhef.dll Has been deleted! Attempting to delete C:\windows\system32\khfeebb.dll C:\windows\system32\khfeebb.dll Has been deleted! Attempting to delete C:\windows\system32\khfggfe.dll C:\windows\system32\khfggfe.dll Has been deleted! Attempting to delete C:\windows\system32\mljgfgf.dll C:\windows\system32\mljgfgf.dll Has been deleted! Attempting to delete C:\windows\system32\nnnkjii.dll C:\windows\system32\nnnkjii.dll Has been deleted! Attempting to delete C:\windows\system32\nnnlmji.dll C:\windows\system32\nnnlmji.dll Has been deleted! Attempting to delete C:\windows\system32\qommnlj.dll C:\windows\system32\qommnlj.dll Has been deleted! Attempting to delete C:\windows\system32\ssqnklm.dll C:\windows\system32\ssqnklm.dll Has been deleted! Attempting to delete C:\windows\system32\tuvssst. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 20:00:44 17/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 9:14:04 PM 7/17/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 10:45:03 PM 7/17/2006 Listing files found while scanning…. C:\windows\system32\byxxvst.dll C:\windows\system32\tuvusro.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 6:55:13 PM 7/18/2006 Listing files found while scanning…. C:\windows\system32\efcbcby.dll C:\windows\system32\tuvvuvv.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\efcbcby.dll C:\windows\system32\efcbcby.dll Has been deleted! Attempting to delete C:\windows\system32\tuvvuvv.dll C:\windows\system32\tuvvuvv.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 7:57:08 PM 7/18/2006 Listing files found while scanning…. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 8:08:09 PM 7/18/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 21:54:33 18/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 01:14:36 21/07/2006 Listing files found while scanning…. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 1:15:15 AM 7/21/2006 Listing files found while scanning…. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 08:35:57 21/07/2006 Listing files found while scanning…. C:\windows\system32\awtsqnk.dll C:\windows\system32\iifcbyw.dll C:\windows\system32\ljjkifg.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\awtsqnk.dll C:\windows\system32\awtsqnk.dll Has been deleted! Attempting to delete C:\windows\system32\iifcbyw.dll C:\windows\system32\iifcbyw.dll Has been deleted! Attempting to delete C:\windows\system32\ljjkifg.dll C:\windows\system32\ljjkifg.dll Has been deleted! Performing Repairs to the registry. Done!

Hi brown1950,

You have a difficult infection called "DollarRevenue" . We need a little more work to fix it.

You got Ewido, Lets make sure it's up to date, Then boot in safe mode, and open Ewido run a scan, & let Ewido delete all it finds.

Save the report.

Boot in normal mode, and post the Ewido report and a new hjt log.

There will be more to do as soon as I see the new logs

Good luck mschroe919

As requested herewith lates ewido report := ewido anti-spyware - Scan Report ——————————————————— + Created at: 09:21:06 22/07/2006 + Scan result: C:\Documents and Settings\Chris Brownhill\My Documents\My Received Files\New Folder\backups\backup-20060721-205246-696.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\Documents and Settings\Chris Brownhill\My Documents\My Received Files\New Folder\backups\backup-20060721-205444-484.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\Documents and Settings\Chris Brownhill\My Documents\My Received Files\New Folder\backups\backup-20060721-205444-539.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\pmkhi.dll -> Adware.Virtumonde : Cleaned with backup (quarantined). C:\WINDOWS\system32\xpfilesys.exe -> Backdoor.Rbot.bcj : Cleaned with backup (quarantined). C:\Documents and Settings\Chris Brownhill\Local Settings\Temporary Internet Files\Content.IE5\YRJM4M4C\lightxp[1].exe -> Downloader.VB.afq : Cleaned with backup (quarantined). C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2B7HQ1HO\lightxp[1].exe -> Downloader.VB.afq : Cleaned with backup (quarantined). C:\lightxp.exe -> Downloader.VB.afq : Cleaned with backup (quarantined). C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2B7HQ1HO\stp[1].exe -> Trojan.LowZones.dv : Cleaned with backup (quarantined). C:\winpatch.exe -> Trojan.LowZones.dv : Cleaned with backup (quarantined). ::Report end

Hi brown1950,
Welcome back seems like we have a stubborn one here.

The first vundo fix didn't work try this:
Please download VundoFix.exe to your desktop.
From here:
http://www.atribune.org/ccount/click.php?id=4

* Double-click VundoFix.exe to run it.
* Put a check next to Run VundoFix as a task.
* You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
* When VundoFix re-opens,Click Scan for Vundo button.
* Once the scan is complete, Right Click inside the listbox (white box) and click add more files
* Copy&Paste the entry below into the top 2 boxes

C:\windows\system32\pmkhi.dll

* Click Add Files and Click Close Window
* Click the Remove Vundo button.
* You will receive a prompt asking if you want to remove the files, click YES
* Once you click yes, your desktop will go blank as it starts removing Vundo.
* When completed, it will prompt that it will shutdown your computer, click OK.
* Turn your computer back on.


===========================================================

Run HijackThis
Click on do a system scan only
Place a checkmark next to these lines(if still present)

O2 - BHO: (no name) - {9D69FE6E-A357-4FFF-8051-C54D14D9314B} - c:\windows\system32\pmkhi.dll
O15 - Trusted Zone: *.Microsoft updates
O20 - Winlogon Notify: ljjgeba - ljjgeba.dll (file missing)
O20 - Winlogon Notify: pmkhi - c:\windows\system32\pmkhi.dll
O23 - Service: Windows Process Viewer (The Windows Process Viewer) - Unknown owner - C:\WINDOWS\winlogon.exe (file missing)
O23 - Service: Microsoft Windows Protection (Windows Protection Service) - Unknown owner - C:\WINDOWS\winlogon.exe (file missing)

Then close all windows except Hijackthis and click Fix Checked

Reveal Hidden Files

1. Click Start.
2. Open My Computer.
3. SelectTools menu
4. Click Folder Options.
5. Select the View Tab.
6. Select Show hidden files and folders in the Hidden files and
folders section.
7. Uncheck Hide protected operating system files (recommended) option.
8. Uncheck the Hide file extensions for known file types option.
9. Click Yes.
10. Click OK.

Restart

Use windows explorer to find and delete these files in RED if still there:

c:\windows\system32\pmkhi.dll
C:\WINDOWS\system32\ljjgeba.dll

* Please post the contents of C:\vundofix.txt and a new HiJackThis log.

There will be more to do after I see new log.
Good luck mschroe919

Herewith copy of latest Vundofix log . Could not delete some of the files in HJT ! VundoFix V4.2.84 Checking Java version… Sun Java not detected Scan started at 00:06:14 06/07/2006 Listing files found while scanning…. C:\WINDOWS\system32\byxvtrq.dll C:\WINDOWS\system32\xayxx.bak1 C:\WINDOWS\system32\xayxx.ini C:\WINDOWS\system32\xxyax.dll Attempting to delete C:\WINDOWS\system32\byxvtrq.dll C:\WINDOWS\system32\byxvtrq.dll Could not be deleted. Attempting to delete C:\WINDOWS\system32\xayxx.bak1 C:\WINDOWS\system32\xayxx.bak1 Has been deleted! Attempting to delete C:\WINDOWS\system32\xayxx.ini C:\WINDOWS\system32\xayxx.ini Could not be deleted. Attempting to delete C:\WINDOWS\system32\xxyax.dll C:\WINDOWS\system32\xxyax.dll Could not be deleted. Performing Repairs to the registry. Done! VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:02:47 10/07/2006 Listing files found while scanning…. C:\windows\system32\awtrpon.dll C:\windows\system32\awtturs.dll C:\windows\system32\awtussq.dll C:\windows\system32\byxvtrq.dll C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxyvvt.dll C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcyxvu.dll C:\windows\system32\efcbyay.dll C:\windows\system32\fccayya.dll C:\windows\system32\fcccccd.dll C:\windows\system32\gebxvtr.dll C:\windows\system32\gebyaxx.dll C:\windows\system32\hggffcd.dll C:\windows\system32\hgggdaw.dll C:\windows\system32\hggghff.dll C:\windows\system32\iifcbyx.dll C:\windows\system32\iifdabc.dll C:\windows\system32\iifdefe.dll C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkkhed.dll C:\windows\system32\khfebab.dll C:\windows\system32\khfebby.dll C:\windows\system32\khfeecb.dll C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjjged.dll C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnmljh.dll C:\windows\system32\opnkkll.dll C:\windows\system32\opnklii.dll C:\windows\system32\opnlige.dll C:\windows\system32\opnljkh.dll C:\windows\system32\opnmnmm.dll C:\windows\system32\opnnljg.dll C:\windows\system32\opnnool.dll C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak2 C:\windows\system32\qomjggh.dll C:\windows\system32\qomjigf.dll C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkjk.dll C:\windows\system32\qomkllk.dll C:\windows\system32\qomlmml.dll C:\windows\system32\qommmjg.dll C:\windows\system32\qomnmki.dll C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrspon.dll C:\windows\system32\rqrsqnl.dll C:\windows\system32\ssqpqoo.dll C:\windows\system32\tuvsqpo.dll C:\windows\system32\urqomlk.dll C:\windows\system32\urqooll.dll C:\windows\system32\vturonl.dll C:\windows\system32\vtuurst.dll C:\windows\system32\vtuuuro.dll C:\windows\system32\wvurrst.dll C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyax.dll C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.tmp C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyyyxw.dll C:\windows\system32\yayaaxx.dll C:\windows\system32\yayawxy.dll C:\windows\system32\yayayaw.dll C:\windows\system32\yayyvwx.dll VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:11:21 10/07/2006 Listing files found while scanning…. C:\windows\system32\awtrpon.dll C:\windows\system32\awtturs.dll C:\windows\system32\awtussq.dll C:\windows\system32\byxvtrq.dll C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxyvvt.dll C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcyxvu.dll C:\windows\system32\efcbyay.dll C:\windows\system32\fccayya.dll C:\windows\system32\fcccccd.dll C:\windows\system32\gebxvtr.dll C:\windows\system32\gebyaxx.dll C:\windows\system32\hggffcd.dll C:\windows\system32\hgggdaw.dll C:\windows\system32\hggghff.dll C:\windows\system32\iifcbyx.dll C:\windows\system32\iifdabc.dll C:\windows\system32\iifdefe.dll C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkkhed.dll C:\windows\system32\khfebab.dll C:\windows\system32\khfebby.dll C:\windows\system32\khfeecb.dll C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjjged.dll C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnmljh.dll C:\windows\system32\opnkkll.dll C:\windows\system32\opnklii.dll C:\windows\system32\opnlige.dll C:\windows\system32\opnljkh.dll C:\windows\system32\opnmnmm.dll C:\windows\system32\opnnljg.dll C:\windows\system32\opnnool.dll C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak2 C:\windows\system32\qomjggh.dll C:\windows\system32\qomjigf.dll C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkjk.dll C:\windows\system32\qomkllk.dll C:\windows\system32\qomlmml.dll C:\windows\system32\qommmjg.dll C:\windows\system32\qomnmki.dll C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrspon.dll C:\windows\system32\rqrsqnl.dll C:\windows\system32\ssqpqoo.dll C:\windows\system32\tuvsqpo.dll C:\windows\system32\urqomlk.dll C:\windows\system32\urqooll.dll C:\windows\system32\vturonl.dll C:\windows\system32\vtuurst.dll C:\windows\system32\vtuuuro.dll C:\windows\system32\wvurrst.dll C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyax.dll C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.tmp C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyyyxw.dll C:\windows\system32\yayaaxx.dll C:\windows\system32\yayawxy.dll C:\windows\system32\yayayaw.dll C:\windows\system32\yayyvwx.dll VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:16:26 10/07/2006 Listing files found while scanning…. C:\windows\system32\awtrpon.dll C:\windows\system32\awtturs.dll C:\windows\system32\awtussq.dll C:\windows\system32\byxvtrq.dll C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxyvvt.dll C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcyxvu.dll C:\windows\system32\efcbyay.dll C:\windows\system32\fccayya.dll C:\windows\system32\fcccccd.dll C:\windows\system32\gebxvtr.dll C:\windows\system32\gebyaxx.dll C:\windows\system32\hggffcd.dll C:\windows\system32\hgggdaw.dll C:\windows\system32\hggghff.dll C:\windows\system32\iifcbyx.dll C:\windows\system32\iifdabc.dll C:\windows\system32\iifdefe.dll C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkkhed.dll C:\windows\system32\khfebab.dll C:\windows\system32\khfebby.dll C:\windows\system32\khfeecb.dll C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjjged.dll C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnmljh.dll C:\windows\system32\opnkkll.dll C:\windows\system32\opnklii.dll C:\windows\system32\opnlige.dll C:\windows\system32\opnljkh.dll C:\windows\system32\opnmnmm.dll C:\windows\system32\opnnljg.dll C:\windows\system32\opnnool.dll C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak2 C:\windows\system32\qomjggh.dll C:\windows\system32\qomjigf.dll C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkjk.dll C:\windows\system32\qomkllk.dll C:\windows\system32\qomlmml.dll C:\windows\system32\qommmjg.dll C:\windows\system32\qomnmki.dll C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrspon.dll C:\windows\system32\rqrsqnl.dll C:\windows\system32\ssqpqoo.dll C:\windows\system32\tuvsqpo.dll C:\windows\system32\urqomlk.dll C:\windows\system32\urqooll.dll C:\windows\system32\vturonl.dll C:\windows\system32\vtuurst.dll C:\windows\system32\vtuuuro.dll C:\windows\system32\wvurrst.dll C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyax.dll C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.tmp C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyyyxw.dll C:\windows\system32\yayaaxx.dll C:\windows\system32\yayawxy.dll C:\windows\system32\yayayaw.dll C:\windows\system32\yayyvwx.dll Beginning removal… The process smss.exe could not be stopped Vundofix may not be able to delete some files that were found. The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\awtrpon.dll C:\windows\system32\awtrpon.dll Has been deleted! Attempting to delete C:\windows\system32\awtturs.dll C:\windows\system32\awtturs.dll Has been deleted! Attempting to delete C:\windows\system32\awtussq.dll C:\windows\system32\awtussq.dll Has been deleted! Attempting to delete C:\windows\system32\byxvtrq.dll C:\windows\system32\byxvtrq.dll Has been deleted! Attempting to delete C:\windows\system32\cbxvtrr.dll C:\windows\system32\cbxvtrr.dll Has been deleted! Attempting to delete C:\windows\system32\cbxyvvt.dll C:\windows\system32\cbxyvvt.dll Has been deleted! Attempting to delete C:\windows\system32\ddcbxxu.dll C:\windows\system32\ddcbxxu.dll Has been deleted! Attempting to delete C:\windows\system32\ddcyxvu.dll C:\windows\system32\ddcyxvu.dll Has been deleted! Attempting to delete C:\windows\system32\efcbyay.dll C:\windows\system32\efcbyay.dll Has been deleted! Attempting to delete C:\windows\system32\fccayya.dll C:\windows\system32\fccayya.dll Has been deleted! Attempting to delete C:\windows\system32\fcccccd.dll C:\windows\system32\fcccccd.dll Has been deleted! Attempting to delete C:\windows\system32\gebxvtr.dll C:\windows\system32\gebxvtr.dll Has been deleted! Attempting to delete C:\windows\system32\gebyaxx.dll C:\windows\system32\gebyaxx.dll Has been deleted! Attempting to delete C:\windows\system32\hggffcd.dll C:\windows\system32\hggffcd.dll Has been deleted! Attempting to delete C:\windows\system32\hgggdaw.dll C:\windows\system32\hgggdaw.dll Has been deleted! Attempting to delete C:\windows\system32\hggghff.dll C:\windows\system32\hggghff.dll Has been deleted! Attempting to delete C:\windows\system32\iifcbyx.dll C:\windows\system32\iifcbyx.dll Has been deleted! Attempting to delete C:\windows\system32\iifdabc.dll C:\windows\system32\iifdabc.dll Has been deleted! Attempting to delete C:\windows\system32\iifdefe.dll C:\windows\system32\iifdefe.dll Has been deleted! Attempting to delete C:\windows\system32\jkkjigg.dll C:\windows\system32\jkkjigg.dll Has been deleted! Attempting to delete C:\windows\system32\jkkkhed.dll C:\windows\system32\jkkkhed.dll Has been deleted! Attempting to delete C:\windows\system32\khfebab.dll C:\windows\system32\khfebab.dll Has been deleted! Attempting to delete C:\windows\system32\khfebby.dll C:\windows\system32\khfebby.dll Has been deleted! Attempting to delete C:\windows\system32\khfeecb.dll C:\windows\system32\khfeecb.dll Has been deleted! Attempting to delete C:\windows\system32\ljjijjh.dll C:\windows\system32\ljjijjh.dll Has been deleted! Attempting to delete C:\windows\system32\ljjjged.dll C:\windows\system32\ljjjged.dll Has been deleted! Attempting to delete C:\windows\system32\nnnljgh.dll C:\windows\system32\nnnljgh.dll Has been deleted! Attempting to delete C:\windows\system32\nnnlkjg.dll C:\windows\system32\nnnlkjg.dll Has been deleted! Attempting to delete C:\windows\system32\nnnmljh.dll C:\windows\system32\nnnmljh.dll Has been deleted! Attempting to delete C:\windows\system32\opnkkll.dll C:\windows\system32\opnkkll.dll Has been deleted! Attempting to delete C:\windows\system32\opnklii.dll C:\windows\system32\opnklii.dll Has been deleted! Attempting to delete C:\windows\system32\opnlige.dll C:\windows\system32\opnlige.dll Has been deleted! Attempting to delete C:\windows\system32\opnljkh.dll C:\windows\system32\opnljkh.dll Has been deleted! Attempting to delete C:\windows\system32\opnmnmm.dll C:\windows\system32\opnmnmm.dll Has been deleted! Attempting to delete C:\windows\system32\opnnljg.dll C:\windows\system32\opnnljg.dll Has been deleted! Attempting to delete C:\windows\system32\opnnool.dll C:\windows\system32\opnnool.dll Has been deleted! Attempting to delete C:\windows\system32\oppoo.dll C:\windows\system32\oppoo.dll Could not be deleted. Attempting to delete C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.ini Has been deleted! Attempting to delete C:\windows\system32\ooppo.bak1 C:\windows\system32\ooppo.bak1 Has been deleted! Attempting to delete C:\windows\system32\ooppo.bak2 C:\windows\system32\ooppo.bak2 Has been deleted! Attempting to delete C:\windows\system32\qomjggh.dll C:\windows\system32\qomjggh.dll Has been deleted! Attempting to delete C:\windows\system32\qomjigf.dll C:\windows\system32\qomjigf.dll Has been deleted! Attempting to delete C:\windows\system32\qomjkhi.dll C:\windows\system32\qomjkhi.dll Has been deleted! Attempting to delete C:\windows\system32\qomjkjk.dll C:\windows\system32\qomjkjk.dll Has been deleted! Attempting to delete C:\windows\system32\qomkllk.dll C:\windows\system32\qomkllk.dll Has been deleted! Attempting to delete C:\windows\system32\qomlmml.dll C:\windows\system32\qomlmml.dll Has been deleted! Attempting to delete C:\windows\system32\qommmjg.dll C:\windows\system32\qommmjg.dll Has been deleted! Attempting to delete C:\windows\system32\qomnmki.dll C:\windows\system32\qomnmki.dll Has been deleted! Attempting to delete C:\windows\system32\rqrpmnl.dll C:\windows\system32\rqrpmnl.dll Has been deleted! Attempting to delete C:\windows\system32\rqrspon.dll C:\windows\system32\rqrspon.dll Has been deleted! Attempting to delete C:\windows\system32\rqrsqnl.dll C:\windows\system32\rqrsqnl.dll Has been deleted! Attempting to delete C:\windows\system32\ssqpqoo.dll C:\windows\system32\ssqpqoo.dll Has been deleted! Attempting to delete C:\windows\system32\tuvsqpo.dll C:\windows\system32\tuvsqpo.dll Has been deleted! Attempting to delete C:\windows\system32\urqomlk.dll C:\windows\system32\urqomlk.dll Has been deleted! Attempting to delete C:\windows\system32\urqooll.dll C:\windows\system32\urqooll.dll Has been deleted! Attempting to delete C:\windows\system32\vturonl.dll C:\windows\system32\vturonl.dll Has been deleted! Attempting to delete C:\windows\system32\vtuurst.dll C:\windows\system32\vtuurst.dll Has been deleted! Attempting to delete C:\windows\system32\vtuuuro.dll C:\windows\system32\vtuuuro.dll Has been deleted! Attempting to delete C:\windows\system32\wvurrst.dll C:\windows\system32\wvurrst.dll Has been deleted! Attempting to delete C:\windows\system32\xxyaabb.dll C:\windows\system32\xxyaabb.dll Has been deleted! Attempting to delete C:\windows\system32\xxyax.dll C:\windows\system32\xxyax.dll Has been deleted! Attempting to delete C:\windows\system32\xayxx.ini C:\windows\system32\xayxx.ini Has been deleted! Attempting to delete C:\windows\system32\xayxx.bak2 C:\windows\system32\xayxx.bak2 Has been deleted! Attempting to delete C:\windows\system32\xayxx.ini2 C:\windows\system32\xayxx.ini2 Has been deleted! Attempting to delete C:\windows\system32\xayxx.tmp C:\windows\system32\xayxx.tmp Has been deleted! Attempting to delete C:\windows\system32\xxyvssp.dll C:\windows\system32\xxyvssp.dll Has been deleted! Attempting to delete C:\windows\system32\xxyyyxw.dll C:\windows\system32\xxyyyxw.dll Has been deleted! Attempting to delete C:\windows\system32\yayaaxx.dll C:\windows\system32\yayaaxx.dll Has been deleted! Attempting to delete C:\windows\system32\yayawxy.dll C:\windows\system32\yayawxy.dll Has been deleted! Attempting to delete C:\windows\system32\yayayaw.dll C:\windows\system32\yayayaw.dll Has been deleted! Attempting to delete C:\windows\system32\yayyvwx.dll C:\windows\system32\yayyvwx.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:21:16 10/07/2006 Listing files found while scanning…. C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini Beginning removal… The process smss.exe could not be stopped Vundofix may not be able to delete some files that were found. The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\oppoo.dll C:\windows\system32\oppoo.dll Could not be deleted. Attempting to delete C:\windows\system32\ooppo.ini C:\windows\system32\ooppo.ini Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.1 Checking Java version… Sun Java not detected Scan started at 23:59:03 10/07/2006 Listing files found while scanning…. C:\windows\system32\oppoo.dll C:\windows\system32\ooppo.ini VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 7:51:02 PM 7/17/2006 Listing files found while scanning…. C:\windows\system32\byxxxvs.dll C:\windows\system32\hgghhef.dll C:\windows\system32\khfeebb.dll C:\windows\system32\khfggfe.dll C:\windows\system32\mljgfgf.dll C:\windows\system32\nnnkjii.dll C:\windows\system32\nnnlmji.dll C:\windows\system32\qommnlj.dll C:\windows\system32\ssqnklm.dll C:\windows\system32\tuvssst.dll C:\windows\system32\vtuvust.dll C:\windows\system32\wvuvsqn.dll C:\windows\system32\wvuvurq.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\byxxxvs.dll C:\windows\system32\byxxxvs.dll Has been deleted! Attempting to delete C:\windows\system32\hgghhef.dll C:\windows\system32\hgghhef.dll Has been deleted! Attempting to delete C:\windows\system32\khfeebb.dll C:\windows\system32\khfeebb.dll Has been deleted! Attempting to delete C:\windows\system32\khfggfe.dll C:\windows\system32\khfggfe.dll Has been deleted! Attempting to delete C:\windows\system32\mljgfgf.dll C:\windows\system32\mljgfgf.dll Has been deleted! Attempting to delete C:\windows\system32\nnnkjii.dll C:\windows\system32\nnnkjii.dll Has been deleted! Attempting to delete C:\windows\system32\nnnlmji.dll C:\windows\system32\nnnlmji.dll Has been deleted! Attempting to delete C:\windows\system32\qommnlj.dll C:\windows\system32\qommnlj.dll Has been deleted! Attempting to delete C:\windows\system32\ssqnklm.dll C:\windows\system32\ssqnklm.dll Has been deleted! Attempting to delete C:\windows\system32\tuvssst. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 20:00:44 17/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 9:14:04 PM 7/17/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 10:45:03 PM 7/17/2006 Listing files found while scanning…. C:\windows\system32\byxxvst.dll C:\windows\system32\tuvusro.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 6:55:13 PM 7/18/2006 Listing files found while scanning…. C:\windows\system32\efcbcby.dll C:\windows\system32\tuvvuvv.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\efcbcby.dll C:\windows\system32\efcbcby.dll Has been deleted! Attempting to delete C:\windows\system32\tuvvuvv.dll C:\windows\system32\tuvvuvv.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 7:57:08 PM 7/18/2006 Listing files found while scanning…. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 8:08:09 PM 7/18/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 21:54:33 18/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 01:14:36 21/07/2006 Listing files found while scanning…. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 1:15:15 AM 7/21/2006 Listing files found while scanning…. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 08:35:57 21/07/2006 Listing files found while scanning…. C:\windows\system32\awtsqnk.dll C:\windows\system32\iifcbyw.dll C:\windows\system32\ljjkifg.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\awtsqnk.dll C:\windows\system32\awtsqnk.dll Has been deleted! Attempting to delete C:\windows\system32\iifcbyw.dll C:\windows\system32\iifcbyw.dll Has been deleted! Attempting to delete C:\windows\system32\ljjkifg.dll C:\windows\system32\ljjkifg.dll Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 13:56:17 21/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 15:28:45 21/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 17:18:53 21/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 19:23:12 21/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 20:04:56 21/07/2006 Listing files found while scanning…. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 8:05:22 PM 7/21/2006 Listing files found while scanning…. No infected files were found. No infected files were found. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 10:05:04 PM 7/22/2006 Listing files found while scanning…. C:\windows\system32\fccywtu.dll C:\windows\system32\vtusrqr.dll Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 10:57:05 PM 7/22/2006 Listing files found while scanning…. C:\WINDOWS\system32\Drivers\DP.sys Beginning removal… The process smss.exe was successfully stopped The process winlogon.exe could not be stopped Vundofix may not be able to delete some files that were found. The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\WINDOWS\system32\Drivers\DP.sys C:\WINDOWS\system32\Drivers\DP.sys Has been deleted! Performing Repairs to the registry. Done! VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 01:34:52 23/07/2006 Listing files found while scanning…. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 9:22:06 PM 7/23/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Checking Java version… Sun Java not detected Scan started at 21:33:44 23/07/2006 Listing files found while scanning…. No infected files were found. VundoFix V5.1.4 Running as SYSTEM from c:\windows\system32\VundoFix.exe Checking Java version… Sun Java not detected Scan started at 10:15:12 PM 7/23/2006 Listing files found while scanning…. No infected files were found.

Hi brown1950,
Some problem dealing with this infection. Lets try this:

Download L2mfix from one of these two locations:

l2mfix.exe (© Shadowwar)
http://www.atribune.org/downloads/l2mfix.exe

l2mfix.exe (© Shadowwar)
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.

l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing .

This will scan your computer and it may appear nothing is happening, then, after a minute or 2, Notepad will open with a log.

Copy/paste the contents of that log into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder!

Please post a new HijackThis! log, and a Look2Mefix log.

DO NOT REBOOT AFTER POSTING THE LOGS!!!

I will post a "fix" shortly.

If you reboot before attempting the fix, we'll have to start over
mschroe919