What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] ARRRRGGGHHH! I HATE POP UPS!

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I have been having problems with IE pop ups for quite sometime. I think I'm getting them from online movie and entertainment sites. Anyways, here are the log files that I have saved from HJT and CF. Thanks for taking a look.






CF
ComboFix 09-01-01.02 - Jesse 2009-01-02 15:17:03.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.494.264 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Jesse\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\Jesse\LOCALS~1\Temp\tmp2.tmp
c:\windows\system32\avunetaf.ini
c:\windows\system32\dezogewi.dll
c:\windows\system32\disowowu.dll
c:\windows\system32\dunohipo.dll
c:\windows\system32\enipojev.ini
c:\windows\system32\etameneh.ini
c:\windows\system32\ewonosej.ini
c:\windows\system32\fufoyevo.dll
c:\windows\system32\gayiloba.dll
c:\windows\system32\gorofalu.dll
c:\windows\system32\hazikubu.dll
c:\windows\system32\ifabobef.ini
c:\windows\system32\kabumure.dll
c:\windows\system32\kovuduhi.dll
c:\windows\system32\lemutuja.dll
c:\windows\system32\mavasoze.dll
c:\windows\system32\nawobiti.dll
c:\windows\system32\nebiwofo.dll
c:\windows\system32\nulohonu.dll
c:\windows\system32\obosifut.ini
c:\windows\system32\ofowiben.ini
c:\windows\system32\ohototuk.ini
c:\windows\system32\oresawut.ini
c:\windows\system32\ravemuse.dll
c:\windows\system32\rayefeku.dll
c:\windows\system32\rofibere.dll
c:\windows\system32\rolivepa.dll
c:\windows\system32\tufisobo.dll
c:\windows\system32\tuwasero.dll
c:\windows\system32\ubofiduw.ini
c:\windows\system32\ulaforog.ini
c:\windows\system32\uzahejob.ini
c:\windows\system32\vizaratu.dll
c:\windows\system32\yenejesa.dll
c:\windows\system32\yezusihe.dll
c:\windows\system32\yipiveto.dll
c:\windows\system32\zodoviru.dll

.
((((((((((((((((((((((((( Files Created from 2008-12-02 to 2009-01-02 )))))))))))))))))))))))))))))))
.

2008-12-20 09:17 . 2001-08-17 22:36 80,896 –a–c— c:\windows\system32\dllcache\dc210usd.dll
2008-12-20 09:17 . 2001-08-17 22:36 80,896 –a—— c:\windows\system32\dc210usd.dll
2008-12-20 09:17 . 2001-08-17 22:36 25,600 –a–c— c:\windows\system32\dllcache\dc210_32.dll
2008-12-20 09:17 . 2001-08-17 22:36 25,600 –a—— c:\windows\system32\dc210_32.dll
2008-12-20 09:17 . 2001-08-17 13:53 6,784 –a—— c:\windows\system32\drivers\serscan.sys
2008-12-20 09:17 . 2001-08-17 13:53 6,784 –a–c— c:\windows\system32\dllcache\serscan.sys
2008-12-08 14:37 . 2008-12-08 14:36 73,728 –a—— c:\windows\system32\javacpl.cpl
2008-12-06 18:43 . 2008-12-07 20:52 d——– c:\documents and settings\Jesse\Application Data\Twain
2008-12-06 18:38 . 2008-12-06 18:38 d——– c:\program files\Webtools
2008-12-06 16:40 . 2008-12-06 16:40 d——– c:\program files\Trend Micro
2008-12-06 10:35 . 2008-12-06 10:35 d——– c:\documents and settings\Administrator
2008-12-05 18:26 . 2008-12-07 20:49 d——– C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-02 22:05 ——— d—–w c:\documents and settings\Jesse\Application Data\LimeWire
2008-12-20 23:40 ——— d—–w c:\program files\LimeWire
2008-12-08 22:36 ——— d—–w c:\program files\Java
2008-12-06 18:43 ——— d—a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-06 16:57 ——— d—–w c:\program files\SpywareBlaster
2008-11-26 17:30 ——— d—–w c:\program files\Easy CD & DVD Cover Creator
2008-11-26 03:05 ——— d—–w c:\program files\Microsoft Silverlight
2008-12-07 03:18 211,456 —-a-w c:\program files\mozilla firefox\components\srff.dll
1601-01-01 00:12 47,104 –sha-w c:\windows\system32\tupumogu.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-07_21.05.48.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-08 01:52:03 16,384 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-12-29 21:19:38 32,768 —-a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-10-08 01:52:03 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-12-29 21:19:36 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-10-08 01:52:03 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-12-29 21:19:36 32,768 —-a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-11-04 03:40:51 410,976 —-a-w c:\windows\system32\deploytk.dll
+ 2008-12-08 22:36:27 410,984 —-a-w c:\windows\system32\deploytk.dll
+ 2008-10-23 12:36:14 286,720 -c—-w c:\windows\system32\dllcache\gdi32.dll
- 2006-10-19 03:03:58 100,864 -c–a-w c:\windows\system32\dllcache\logagent.exe
+ 2008-06-18 09:09:22 100,864 -c–a-w c:\windows\system32\dllcache\logagent.exe
- 2008-08-20 05:30:53 3,067,904 -c—-w c:\windows\system32\dllcache\mshtml.dll
+ 2008-12-12 17:01:00 3,067,904 -c—-w c:\windows\system32\dllcache\mshtml.dll
- 2008-08-20 05:30:51 1,499,136 -c—-w c:\windows\system32\dllcache\shdocvw.dll
+ 2008-10-16 01:00:10 1,499,136 -c—-w c:\windows\system32\dllcache\shdocvw.dll
- 2008-04-14 00:12:07 246,814 -c–a-w c:\windows\system32\dllcache\strmdll.dll
+ 2008-10-03 10:02:42 247,326 -c–a-w c:\windows\system32\dllcache\strmdll.dll
- 2008-08-20 05:30:52 619,520 -c—-w c:\windows\system32\dllcache\urlmon.dll
+ 2008-10-16 01:00:11 619,520 -c—-w c:\windows\system32\dllcache\urlmon.dll
- 2008-08-20 05:30:51 666,112 -c—-w c:\windows\system32\dllcache\wininet.dll
+ 2008-10-16 01:00:11 666,112 -c—-w c:\windows\system32\dllcache\wininet.dll
- 2006-10-19 04:47:20 937,984 -c–a-w c:\windows\system32\dllcache\WMNetMgr.dll
+ 2008-06-18 13:03:08 938,496 -c–a-w c:\windows\system32\dllcache\WMNetmgr.dll
- 2006-10-19 04:47:22 2,450,944 -c–a-w c:\windows\system32\dllcache\wmvcore.dll
+ 2008-06-18 13:03:14 2,458,112 -c–a-w c:\windows\system32\dllcache\WMVCore.dll
- 2008-04-14 00:11:54 285,184 —-a-w c:\windows\system32\gdi32.dll
+ 2008-10-23 12:36:14 286,720 —-a-w c:\windows\system32\gdi32.dll
- 2008-11-04 03:40:51 144,792 —-a-w c:\windows\system32\java.exe
+ 2008-12-08 22:36:28 144,792 —-a-w c:\windows\system32\java.exe
- 2008-11-04 03:40:51 144,792 —-a-w c:\windows\system32\javaw.exe
+ 2008-12-08 22:36:28 144,792 —-a-w c:\windows\system32\javaw.exe
- 2008-11-04 03:40:51 148,888 —-a-w c:\windows\system32\javaws.exe
+ 2008-12-08 22:36:28 148,888 —-a-w c:\windows\system32\javaws.exe
- 2006-10-19 03:03:58 100,864 —-a-w c:\windows\system32\logagent.exe
+ 2008-06-18 09:09:22 100,864 —-a-w c:\windows\system32\logagent.exe
- 2008-11-04 02:01:16 84,661 —-a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-12-08 23:25:18 84,661 —-a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
- 2008-08-20 05:30:53 3,067,904 —-a-w c:\windows\system32\mshtml.dll
+ 2008-12-12 17:01:00 3,067,904 —-a-w c:\windows\system32\mshtml.dll
- 2008-08-20 05:30:51 1,499,136 —-a-w c:\windows\system32\shdocvw.dll
+ 2008-10-16 01:00:10 1,499,136 —-a-w c:\windows\system32\shdocvw.dll
- 2008-07-08 13:02:01 17,272 —-a-w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ——w c:\windows\system32\spmsg.dll
- 2008-04-14 00:12:07 246,814 —-a-w c:\windows\system32\strmdll.dll
+ 2008-10-03 10:02:42 247,326 —-a-w c:\windows\system32\strmdll.dll
- 2008-04-14 00:12:38 60,416 —-a-w c:\windows\system32\tzchange.exe
+ 2008-10-23 10:06:59 62,976 —-a-w c:\windows\system32\tzchange.exe
- 2008-08-20 05:30:52 619,520 —-a-w c:\windows\system32\urlmon.dll
+ 2008-10-16 01:00:11 619,520 —-a-w c:\windows\system32\urlmon.dll
- 2008-08-20 05:30:51 666,112 —-a-w c:\windows\system32\wininet.dll
+ 2008-10-16 01:00:11 666,112 —-a-w c:\windows\system32\wininet.dll
- 2006-10-19 04:47:20 937,984 —-a-w c:\windows\system32\wmnetmgr.dll
+ 2008-06-18 13:03:08 938,496 —-a-w c:\windows\system32\WMNetmgr.dll
- 2006-10-19 04:47:22 2,450,944 —-a-w c:\windows\system32\wmvcore.dll
+ 2008-06-18 13:03:14 2,458,112 —-a-w c:\windows\system32\WMVCore.dll
+ 2009-01-02 23:22:51 16,384 —-atw c:\windows\temp\Perflib_Perfdata_664.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-13 169984]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-08 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Image Zone Fast Start.lnk
backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NetAssistant.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NetAssistant.lnk
backup=c:\windows\pss\NetAssistant.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
–a—— 2005-06-06 22:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2007-10-10 19:51 39792 c:\program files\Adobe\Reader 8.0\Reader\Reader_SL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
-ra—— 2007-03-01 09:37 2321600 c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
–a—— 2008-04-13 16:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
–a—— 2003-10-01 21:19 118784 c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
–a—— 2005-02-16 22:11 49152 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
–a—— 2003-10-01 21:37 155648 c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
——— 2004-03-03 07:47 1294446 c:\program files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
–a—— 2007-07-31 17:44 271672 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
–a—— 2004-10-22 14:13 393216 c:\progra~1\NETASS~1\SMARTB~1\MotiveSB.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
–a—— 2008-04-13 16:12 1695232 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
-ra—— 2001-07-09 02:50 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2007-06-29 05:24 286720 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
–a—— 2003-12-08 17:35 32768 c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSA.exe]
–a—— 2006-05-15 09:41 1986560 c:\program files\Bell\Sympatico Security Advisor\SSA.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-12-08 14:36 136600 c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinPatrol]
——— 2008-04-25 09:31 333120 c:\program files\BillP Studios\WinPatrol\WinPatrol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"Pml Driver HPZ12"=2 (0x2)
"ose"=3 (0x3)
"MDM"=2 (0x2)
"MBAMService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"iPod Service"=3 (0x3)
"InCDsrv"=2 (0x2)
"IDriverT"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirScheduler"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Documents and Settings\\Jesse\\Desktop\\Magic\\Manalink.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iPod\\bin\\iPodService.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jqs.exe"=
"c:\\WINDOWS\\pchealth\\helpctr\\binaries\\msconfig.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\jusched.exe"=
"c:\\Program Files\\Common Files\\Adobe\\Updater5\\AdobeUpdater.exe"=

S4 MBAMService;MBAMService;"c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe" [2008-04-30 102008]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{734aea60-6293-11dd-bd4a-0018d121b1ac}]
\Shell\AutoRun\command - E:\o1.com
\Shell\explore\Command - E:\o1.com
\Shell\open\Command - E:\o1.com
.
Contents of the 'Scheduled Tasks' folder

2009-01-02 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2007-09-26 08:53]
.
- - - - ORPHANS REMOVED - - - -

BHO-{d792e03c-2eb3-4403-9c78-b4e914a4be71} - c:\windows\system32\kabumure.dll
MSConfigStartUp-avgnt - c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://firefox.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\windows\Downloaded Program Files\stg_drm.ocx - O16 -: {149E45D8-163E-4189-86FC-45022AB2B6C9}
file://c:\program files\Chocolatier\Images\stg_drm.ocx

c:\windows\Downloaded Program Files\armhelper.ocx - O16 -: {CC450D71-CC90-424C-8638-1F2DBAC87A54}
file://c:\program files\Chocolatier\Images\armhelper.ocx
FF - ProfilePath - c:\documents and settings\Jesse\Application Data\Mozilla\Firefox\Profiles\xwlt3j8x.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://addons.mozilla.org/
FF - component: c:\program files\Mozilla Firefox\components\srff.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.1.0.30716.0.dll
FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nptgeqplugin.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-02 15:26:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-02 15:30:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-02 23:29:58
ComboFix2.txt 2008-12-08 23:09:31
ComboFix3.txt 2008-12-08 05:07:38
ComboFix4.txt 2008-05-03 19:01:00

Pre-Run: 39,263,322,112 bytes free
Post-Run: 39,254,716,416 bytes free

284 — E O F — 2008-12-18 06:11:58




HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:04, on 2009-01-02
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Jesse\LOCALS~1\Temp\Rar$EX08.671\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://firefox.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLive.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {d792e03c-2eb3-4403-9c78-b4e914a4be71} - C:\WINDOWS\system32\kabumure.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [perogevoyi] Rundll32.exe "C:\WINDOWS\system32\dezogewi.dll",s
O4 - HKLM\..\Run: [48267ce7] rundll32.exe "C:\WINDOWS\system32\nebiwofo.dll",b
O4 - HKLM\..\Run: [CPM4b154f7b] Rundll32.exe "c:\windows\system32\yenejesa.dll",a
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [perogevoyi] Rundll32.exe "C:\WINDOWS\system32\dezogewi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [perogevoyi] Rundll32.exe "C:\WINDOWS\system32\dezogewi.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Chocolatier\Images\stg_drm.ocx
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Chocolatier\Images\armhelper.ocx
O20 - AppInit_DLLs: C:\WINDOWS\system32\rolivepa.dll c:\windows\system32\yenejesa.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenejesa.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yenejesa.dll
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

–
End of file - 4355 bytes
Post #2
Hi, and Welcome to WhatTheTech :)

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through the instructions before starting to follow them to make sure you understand everything you have to do.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
Apologies in the delay in a response. We are overwhelmed with logs at the moment and there aren't enough helpers to go around. If you still require help, please do the following:

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
Please describe how your computer is behaving at the moment, listing any symptoms and problems that you are experiencing.

Thanks.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI