userinit.exe and more. random pop-ups. slow browser...just added hijackthis

View previous topic View next topic Go down

userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 1:34 am

my computer is having so many problems.
first these random pop-ups are coming up all the time even though i have a blocker.
now some sites will not load like gmail. and now a pop-up comes up and says action aborted and won't even load the page.

how do i get rid of this?



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:58 PM, on 3/30/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\AcerTour\Reminder.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-

8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering

Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

[You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

[You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

[You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

[You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-

7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0

\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-

784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0

\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {28AED1AF-B164-44CD-B435-

CF04AA955015} - (no file)
O2 - BHO: (no name) - {71ee955d-6e78-492f-843e-3c21b86dbb32} -

C:\ProgramData\fapavifa\fapavifa.dll (file missing)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-

45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-

477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-

0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0

\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows

Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering

Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1

\LManager.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer

Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer

Assist\launcher.exe
O4 - HKLM\..\Run: [Acer Tour Reminder]

C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program

Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-

B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common

Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-

2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nilimufuhi] Rundll32.exe

"C:\ProgramData\mobeteda\mobeteda.dll",s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4

\ashDisp.exe
O4 - HKLM\..\Run: [CPM7be48fa1] Rundll32.exe

"c:\windows\system32\diperede.dll",a
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows

Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI

Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media

Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CPM7be48fa1] Rundll32.exe

"c:\windows\system32\diperede.dll",a
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows

Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe

oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows

Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3634251809-3434267622-195180976-1003

\..\Run: [] (User 'Danielle')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -

[You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-

3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12

\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: c:\windows\system32\rubelupe.dll

c:\windows\system32\diperede.dll

C:\ProgramData\wotunivo\wotunivo.dll eNetHook.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-

E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-

E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program

Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL

Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. -

C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec

Corporation - C:\Program

Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program

Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program

Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program

Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) -

Unknown owner - C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT -

C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. -

C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering

Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. -

C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner -

C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service

(LightScribeService) - Hewlett-Packard Company - C:\Program

Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1

\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) -

Unknown owner - C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-

8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility

Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) -

Unknown owner - C:\Program Files\CyberLink\Shared

Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer -

C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. -

C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8736 bytes

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 8:20 am

Hello.
Can't read that log, please switch off Word Wrap in Notepads Function menu.

Post a new log when Word Wrap is switched off.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 7:10 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:58 PM, on 3/30/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\AcerTour\Reminder.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {28AED1AF-B164-44CD-B435-CF04AA955015} - (no file)
O2 - BHO: (no name) - {71ee955d-6e78-492f-843e-3c21b86dbb32} - C:\ProgramData\fapavifa\fapavifa.dll (file missing)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nilimufuhi] Rundll32.exe "C:\ProgramData\mobeteda\mobeteda.dll",s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3634251809-3434267622-195180976-1003\..\Run: [] (User 'Danielle')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: c:\windows\system32\rubelupe.dll c:\windows\system32\diperede.dll C:\ProgramData\wotunivo\wotunivo.dll eNetHook.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8736 bytes

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 7:22 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
    O2 - BHO: (no name) - {28AED1AF-B164-44CD-B435-CF04AA955015} - (no file)
    O2 - BHO: (no name) - {71ee955d-6e78-492f-843e-3c21b86dbb32} - C:\ProgramData\fapavifa\fapavifa.dll (file missing)
    O4 - HKLM\..\Run: [nilimufuhi] Rundll32.exe "C:\ProgramData\mobeteda\mobeteda.dll",s
    O4 - HKLM\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
    O4 - HKCU\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
    O4 - HKUS\S-1-5-21-3634251809-3434267622-195180976-1003\..\Run: [] (User 'Danielle')
    O20 - AppInit_DLLs: c:\windows\system32\rubelupe.dll c:\windows\system32\diperede.dll C:\ProgramData\wotunivo\wotunivo.dll eNetHook.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 7:52 pm

Malwarebytes' Anti-Malware 1.35
Database version: 1925
Windows 6.0.6001 Service Pack 1

3/31/2009 3:46:25 PM
mbam-log-2009-03-31 (15-46-25).txt

Scan type: Quick Scan
Objects scanned: 98826
Time elapsed: 4 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 5
Registry Values Infected: 4
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\Windows\System32\rubelupe.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\Windows\System32\diperede.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm7be48fa1 (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm7be48fa1 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\rubelupe.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\rubelupe.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\diperede.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\diperede.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\System32\rubelupe.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\Windows\System32\diperede.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\hajajepo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 8:03 pm

Lets go deeper. Smile


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, DDS.txt will open.
  • Save the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 8:09 pm

DDS (Ver_09-03-16.01) - NTFSx86
Run by Kristin at 16:05:37.49 on Tue 03/31/2009
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1789.955 [GMT -4:00]

AV: avast! antivirus 4.8.1335 [VPS 090329-0] *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\SndVol.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Kristin.Acer-PC\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
mDefault_Page_URL = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\windows\system32\ActiveToolBand.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: []
uRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [Acer Tour]
mRun: [SetPanel]
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [Acer Product Registration] "c:\program files\acer registration\ACE1.exe" /startup
mRun: [Acer Assist Launcher] c:\program files\acer assist\launcher.exe
mRun: [eRecoveryService]
mRun: [Acer Tour Reminder] c:\acer\acertour\Reminder.exe
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
AppInit_DLLs: eNetHook.dll
SecurityProviders: credssp.dll, mcenspc.dll
LSA: Notification Packages = scecli c:\programdata\wotunivo\wotunivo.dll

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-3-29 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-3-29 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-3-29 51792]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]
R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]

=============== Created Last 30 ================

2009-03-31 15:38 --d----- c:\users\kristi~1.ace\appdata\roaming\Malwarebytes
2009-03-31 15:38 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-31 15:38 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-31 15:38 --d----- c:\programdata\Malwarebytes
2009-03-31 15:38 --d----- c:\progra~2\Malwarebytes
2009-03-31 15:38 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-30 15:53 --d----- c:\program files\common files\Scanner
2009-03-30 15:53 --d----- c:\program files\CA Yahoo! Anti-Spy
2009-03-30 12:41 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-03-30 12:41 891,448 a------- c:\windows\system32\drivers\tcpip.sys
2009-03-30 12:41 72,192 a------- c:\windows\system32\drivers\pacer.sys
2009-03-30 12:41 15,360 a------- c:\windows\system32\pacerprf.dll
2009-03-30 12:41 147,456 a------- c:\windows\system32\Faultrep.dll
2009-03-30 12:41 125,952 a------- c:\windows\system32\wersvc.dll
2009-03-30 12:41 565,248 a------- c:\windows\system32\emdmgmt.dll
2009-03-30 12:41 625,152 a------- c:\windows\system32\drivers\dxgkrnl.sys
2009-03-30 12:41 148,480 a------- c:\windows\system32\drivers\nwifi.sys
2009-03-30 12:41 45,056 a------- c:\windows\system32\dataclen.dll
2009-03-30 12:41 36,864 a------- c:\windows\system32\cdd.dll
2009-03-30 12:40 430,080 a------- c:\windows\system32\vbscript.dll
2009-03-30 12:40 155,648 a------- c:\windows\system32\wscript.exe
2009-03-30 12:40 135,168 a------- c:\windows\system32\wshom.ocx
2009-03-30 12:40 135,168 a------- c:\windows\system32\cscript.exe
2009-03-30 12:40 90,112 a------- c:\windows\system32\wshext.dll
2009-03-30 12:40 180,224 a------- c:\windows\system32\scrobj.dll
2009-03-30 12:40 172,032 a------- c:\windows\system32\scrrun.dll
2009-03-30 07:39 --d----- C:\PerfLogs
2009-03-29 05:46 51,792 a------- c:\windows\system32\drivers\aswMonFlt.sys
2009-03-29 01:18 --d----- c:\programdata\Norton
2009-03-29 01:18 --d----- c:\progra~2\Norton
2009-03-29 01:16 --d----- c:\programdata\NortonInstaller
2009-03-29 01:16 --d----- c:\progra~2\NortonInstaller
2009-03-28 23:20 --d----- c:\programdata\vepujoto
2009-03-28 23:20 --d----- c:\programdata\nohiyizi
2009-03-28 23:20 --d----- c:\progra~2\vepujoto
2009-03-28 23:20 --d----- c:\progra~2\nohiyizi
2009-03-28 11:20 --d----- c:\programdata\zilolilo
2009-03-28 11:20 --d----- c:\programdata\wusifage
2009-03-28 11:20 --d----- c:\progra~2\zilolilo
2009-03-28 11:20 --d----- c:\progra~2\wusifage
2009-03-27 23:20 --d----- c:\programdata\lerijaye
2009-03-27 23:20 --d----- c:\programdata\fonebipi
2009-03-27 23:20 --d----- c:\progra~2\lerijaye
2009-03-27 23:20 --d----- c:\progra~2\fonebipi
2009-03-27 23:14 --d----- c:\programdata\wotunivo
2009-03-27 23:14 --d----- c:\programdata\mobeteda
2009-03-27 23:14 --d----- c:\programdata\fapavifa
2009-03-27 23:14 --d----- c:\progra~2\wotunivo
2009-03-27 23:14 --d----- c:\progra~2\mobeteda
2009-03-27 23:14 --d----- c:\progra~2\fapavifa
2009-03-16 16:26 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-03-16 16:26 23,848 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-16 16:26 --d----- c:\program files\iPod
2009-03-16 16:26 --d----- c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-16 16:26 --d----- c:\program files\iTunes
2009-03-16 16:26 --d----- c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-10 15:20 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-03-10 15:20 7,680 a------- c:\windows\system32\spwmp.dll
2009-03-10 15:20 4,096 a------- c:\windows\system32\msdxm.ocx
2009-03-10 15:20 4,096 a------- c:\windows\system32\dxmasf.dll
2009-03-10 15:20 268,288 a------- c:\windows\system32\schannel.dll
2009-03-10 15:20 2,033,152 a------- c:\windows\system32\win32k.sys
2009-03-09 17:34 --d----- C:\_OTMoveIt
2009-03-09 17:33 348,160 a------- c:\users\kristin.acer-pc\OTMoveIt3.exe
2009-03-09 17:08 --d----- c:\program files\Trend Micro
2009-03-04 06:15 97,800 a------- c:\windows\system32\infocardapi.dll
2009-03-04 06:15 105,016 a------- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-03-04 06:15 622,080 a------- c:\windows\system32\icardagt.exe
2009-03-04 06:15 43,544 a------- c:\windows\system32\PresentationHostProxy.dll
2009-03-04 06:15 37,384 a------- c:\windows\system32\infocardcpl.cpl
2009-03-04 06:15 11,264 a------- c:\windows\system32\icardres.dll
2009-03-04 06:15 781,344 a------- c:\windows\system32\PresentationNative_v0300.dll
2009-03-04 06:15 326,160 a------- c:\windows\system32\PresentationHost.exe
2009-03-04 06:14 196,608 a------- c:\windows\ocsetup_cbs_install_NetFx3.perf
2009-03-04 06:14 65,536 a------- c:\windows\ocsetup_cbs_install_NetFx3.dpx
2009-03-04 06:14 32,899,072 a------- c:\windows\ocsetup_install_NetFx3.etl
2009-03-04 06:05 96,760 a------- c:\windows\system32\dfshim.dll
2009-03-04 06:05 282,112 a------- c:\windows\system32\mscoree.dll
2009-03-04 06:05 41,984 a------- c:\windows\system32\netfxperf.dll
2009-03-04 06:04 158,720 a------- c:\windows\system32\mscorier.dll
2009-03-04 06:04 83,968 a------- c:\windows\system32\mscories.dll

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 8:09 pm

==================== Find3M ====================

2009-03-30 07:50 174 a--sh--- c:\program files\desktop.ini
2009-03-30 07:47 143,360 a------- c:\windows\inf\infstrng.dat
2009-03-30 07:47 86,016 a------- c:\windows\inf\infstor.dat
2009-03-30 07:47 51,200 a------- c:\windows\inf\infpub.dat
2009-03-30 07:39 665,600 a------- c:\windows\inf\drvindex.dat
2009-03-30 07:09 101,888 a------- c:\windows\system32\ifxcardm.dll
2009-03-30 07:09 82,432 a------- c:\windows\system32\axaltocm.dll
2009-03-29 23:21 81,408 a--sh--- c:\windows\system32\ligutafo.dll
2009-03-29 11:21 89,088 a--sh--- c:\windows\system32\duhazilu.dll
2009-03-29 11:21 81,408 -------- c:\windows\system32\denezudu.dll
2009-01-25 04:01 269,312 a------- c:\windows\system32\es.dll
2009-01-18 05:48 361,984 a------- c:\windows\system32\IPSECSVC.DLL
2009-01-18 05:48 61,440 a------- c:\windows\system32\winipsec.dll
2009-01-18 05:48 28,672 a------- c:\windows\system32\FwRemoteSvr.dll
2009-01-18 05:48 272,896 a------- c:\windows\system32\polstore.dll
2009-01-18 05:46 241,152 a------- c:\windows\system32\PortableDeviceApi.dll
2009-01-18 05:46 160,768 a------- c:\windows\system32\PortableDeviceTypes.dll
2009-01-18 05:46 94,720 a------- c:\windows\system32\PortableDeviceClassExtension.dll
2009-01-18 05:36 296,960 a------- c:\windows\system32\gdi32.dll
2009-01-18 05:33 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-01-18 05:33 2,560 a------- c:\windows\apppatch\AcRes.dll
2009-01-18 05:33 2,154,496 a------- c:\windows\apppatch\AcGenral.dll
2009-01-18 05:33 460,288 a------- c:\windows\apppatch\AcSpecfc.dll
2009-01-18 05:33 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-01-18 05:33 541,696 a------- c:\windows\apppatch\AcLayers.dll
2009-01-18 05:33 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-01-18 05:33 52,736 a------- c:\windows\apppatch\iebrshim.dll
2009-01-18 05:32 1,695,744 a------- c:\windows\system32\gameux.dll
2009-01-18 05:32 303,616 a------- c:\windows\system32\wmpeffects.dll
2009-01-18 05:30 1,191,936 a------- c:\windows\system32\msxml3.dll
2009-01-18 05:30 2,048 a------- c:\windows\system32\msxml3r.dll
2009-01-18 05:26 2,048 a------- c:\windows\system32\tzres.dll
2009-01-18 05:20 2,927,104 a------- c:\windows\explorer.exe
2009-01-18 05:13 4,164,096 a------- c:\windows\system32\NlsLexicons0002.dll
2009-01-18 05:11 6,656 a------- c:\windows\system32\kbd106n.dll
2009-01-18 05:11 988,216 a------- c:\windows\system32\winload.exe
2009-01-18 05:11 927,288 a------- c:\windows\system32\winresume.exe
2009-01-18 05:11 378,368 a------- c:\windows\system32\srcore.dll
2009-01-18 05:11 318,464 a------- c:\windows\system32\rstrui.exe
2009-01-18 05:11 40,960 a------- c:\windows\system32\srclient.dll
2009-01-18 05:11 19,000 a------- c:\windows\system32\kd1394.dll
2009-01-18 05:11 14,848 a------- c:\windows\system32\srdelayed.exe
2009-01-18 05:11 615,992 a------- c:\windows\system32\ci.dll
2009-01-18 05:11 46,592 a------- c:\windows\system32\setbcdlocale.dll
2009-01-18 05:08 712,704 a------- c:\windows\system32\WindowsCodecs.dll
2009-01-18 05:08 425,472 a------- c:\windows\system32\PhotoMetadataHandler.dll
2009-01-18 05:08 347,136 a------- c:\windows\system32\WindowsCodecsExt.dll
2009-01-18 05:06 443,392 a------- c:\windows\system32\win32spl.dll
2009-01-18 05:06 37,888 a------- c:\windows\system32\printcom.dll
2009-01-18 05:06 14,848 a------- c:\windows\system32\wshrm.dll
2009-01-18 05:04 2,868,736 a------- c:\windows\system32\mf.dll
2009-01-18 05:04 98,816 a------- c:\windows\system32\mfps.dll
2009-01-18 05:04 53,248 a------- c:\windows\system32\rrinstaller.exe
2009-01-18 05:04 2,048 a------- c:\windows\system32\mferror.dll
2009-01-18 05:04 94,720 a------- c:\windows\system32\logagent.exe
2009-01-18 05:04 24,576 a------- c:\windows\system32\mfpmp.exe
2009-01-18 05:04 996,352 a------- c:\windows\system32\WMNetMgr.dll
2009-01-18 05:03 738,304 a------- c:\windows\system32\inetcomm.dll
2009-01-18 05:03 84,480 a------- c:\windows\system32\INETRES.dll
2009-01-18 05:03 1,645,568 a------- c:\windows\system32\connect.dll
2009-01-18 05:03 1,314,816 a------- c:\windows\system32\quartz.dll
2009-01-18 05:02 3,601,464 a------- c:\windows\system32\ntkrnlpa.exe
2009-01-18 05:02 3,549,240 a------- c:\windows\system32\ntoskrnl.exe
2009-01-18 05:01 1,334,272 a------- c:\windows\system32\msxml6.dll
2009-01-18 05:01 2,048 a------- c:\windows\system32\msxml6r.dll
2009-01-17 15:47 1,524,736 a------- c:\windows\system32\wucltux.dll
2009-01-17 15:47 83,456 a------- c:\windows\system32\wudriver.dll
2009-01-17 15:46 162,064 a------- c:\windows\system32\wuwebv.dll
2009-01-17 15:46 31,232 a------- c:\windows\system32\wuapp.exe
2009-01-15 02:11 827,392 a------- c:\windows\system32\wininet.dll
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
0000-00-00 00:00 2,713 ---sh--- c:\windows\system32\jegugose.exe
0000-00-00 00:00 2,713 ---sh--- c:\windows\system32\lapomefe.exe
0000-00-00 00:00 2,713 ---sh--- c:\windows\system32\rulameja.exe

============= FINISH: 16:07:04.62 ===============

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 8:22 pm

Hello.
Still a few things to do, this vundo is a new version. Probably explains why MBAM found so little.

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    c:\programdata\fapavifa
    c:\programdata\mobeteda
    c:\programdata\wotunivo
    c:\programdata\fonebipi
    c:\programdata\lerijaye
    c:\programdata\wusifage
    c:\programdata\zilolilo
    c:\programdata\nohiyizi
    c:\programdata\vepujoto
    c:\program files\vepujoto
    c:\program files\nohiyizi
    c:\program files\zilolilo
    c:\program files\wusifage
    c:\program files\lerijaye
    c:\program files\fonebipi
    c:\program files\wotunivo
    c:\program files\mobeteda
    c:\program files\fapavifa
    c:\windows\system32\jegugose.exe
    c:\windows\system32\lapomefe.exe
    c:\windows\system32\rulameja.exe

    :reg
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Notification Packages"=hex(7):73,63,65,63,6c,69,00,00
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders]
    "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 8:30 pm

========== FILES ==========
c:\programdata\fapavifa moved successfully.
c:\programdata\mobeteda moved successfully.
c:\programdata\wotunivo moved successfully.
c:\programdata\fonebipi moved successfully.
c:\programdata\lerijaye moved successfully.
c:\programdata\wusifage moved successfully.
c:\programdata\zilolilo moved successfully.
c:\programdata\nohiyizi moved successfully.
c:\programdata\vepujoto moved successfully.
File/Folder c:\program files\vepujoto not found.
File/Folder c:\program files\nohiyizi not found.
File/Folder c:\program files\zilolilo not found.
File/Folder c:\program files\wusifage not found.
File/Folder c:\program files\lerijaye not found.
File/Folder c:\program files\fonebipi not found.
File/Folder c:\program files\wotunivo not found.
File/Folder c:\program files\mobeteda not found.
File/Folder c:\program files\fapavifa not found.
c:\windows\system32\jegugose.exe moved successfully.
c:\windows\system32\lapomefe.exe moved successfully.
c:\windows\system32\rulameja.exe moved successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\\"Notification Packages"|hex(7):73,63,65,63,6c,69,00,00 /E : value set successfully!
Unable to set value : HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\\"SecurityProviders"|"msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" /E!

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03312009_163015

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 8:38 pm

Hello.
I think most of the malware is gone now, but I want to check out 3 suspicious looking files.

We need to unhide hidden files so you can see these files.

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.
Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.
Go to step 5.

If you are in the Control Panel Home view do the following:
Click on the Appearance and Personalization link .
Click on Show Hidden Files or Folders.
Go to step 5.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and close My Computer.
Now Windows Vista is configured to show all hidden files.

Next, please visit [url=http://www.virustotal.com/]this site.[url]

Press the browse button, and then find each of the three following files.
c:\windows\system32\ligutafo.dll
c:\windows\system32\duhazilu.dll
c:\windows\system32\denezudu.dll

Then press Send File. Please copy and paste the report back here for each file.
Use more than one post if needed.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 8:49 pm

Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.31 Trojan.Win32.Vundo!IK
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
Avast 4.8.1335.0 2009.03.31 -
AVG 8.5.0.285 2009.03.31 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 Suspicious File
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 Trojan.Win32.Vundo
K7AntiVirus 7.10.687 2009.03.31 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5570 2009.03.31 -
McAfee+Artemis 5570 2009.03.31 -
McAfee-GW-Edition 6.7.6 2009.03.31 Trojan.Crypt.XPACK.Gen
Microsoft 1.4502 2009.03.31 Trojan:Win32/Vundo.gen!AM
NOD32 3978 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 Suspicious file
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 High Risk Fraudulent Security Program
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 Troj/Virtum-Gen
Sunbelt 3.2.1858.2 2009.03.31 VIPRE.Suspicious
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 TROJ_VUNDO.HGO
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 Trojan.Vundo.Gen!Pac.31
Additional information
File size: 81408 bytes
MD5...: dfc20b01b211fc8b147b4242dccb0a60
SHA1..: 2689be65acf2e32ab431646af9260ee54aaca407
SHA256: e8b7a52569ca18711c468cdd59d1cea7ef1e97ed47c817bf8d295d7d2ee9f590
SHA512: 036aa9f31ecd093e7589790af764be87d3c9af8433a63c508c157fb86dce774f
13b27da8fc0b29b7c9dc6b831e834353e45099b7948e4b2c2b08c6cd3726ec28
ssdeep: 1536:c1Ow6K39HTAoy4Y6Qo7YjWYVw/tUZAmuqXMi/hFUARku3AP2coZIGndqpWB
o:gdRk3K7CWYVC8uqci/MAD3+gV8P

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x16b2
timedatestamp.....: 0x40660329 (Sat Mar 27 22:41:45 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text3 0x1000 0x3000 0x2800 6.45 de241fb60bde2894c13627befac2722c
0x4000 0x1000 0x600 0.25 6d883b4018ca5973689fc39ec283f66e
0x5000 0x5000 0x4200 7.99 059bbefef7de601cb7fc46ebf8118315
0xa000 0x5000 0x4200 7.99 01fa7b395ea887559050169af941c188
0xf000 0x5000 0x4200 7.99 5d940119d5aa9e8b98af18fb64eac5f5
0x14000 0xf000 0x4600 7.99 1cdf772ce54dfabd99ba6bf097f3f745

( 6 imports )
> COMCTL32.dll: InitCommonControlsEx
> KERNEL32.dll: ExitProcess, GetModuleHandleW, GetSystemInfo
> USER32.dll: DispatchMessageW, TranslateMessage, LoadIconA, GetSystemMetrics
> GDI32.dll: Arc, SelectClipPath
> comdlg32.dll: PrintDlgExA
> ADVAPI32.dll: RegQueryValueExW

( 0 exports )

RDS...: NSRL Reference Data Set
-
Prevx info: [You must be registered and logged in to see this link.]

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 8:53 pm

a-squared 4.0.0.101 2009.03.31 Trojan.Win32.Vundo!IK
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.31 -
Avast 4.8.1335.0 2009.03.31 -
AVG 8.5.0.285 2009.03.31 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 Suspicious File
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.31 -
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 Trojan.Win32.Vundo
K7AntiVirus 7.10.687 2009.03.31 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5570 2009.03.31 -
McAfee+Artemis 5570 2009.03.31 -
McAfee-GW-Edition 6.7.6 2009.03.31 Trojan.Crypt.XPACK.Gen
Microsoft 1.4502 2009.03.31 Trojan:Win32/Vundo.gen!G
NOD32 3978 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 Suspicious file
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 High Risk Fraudulent Security Program
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 Troj/Virtum-Gen
Sunbelt 3.2.1858.2 2009.03.31 VIPRE.Suspicious
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 TROJ_VUNDO.HGO
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 Trojan.Vundo.Gen!Pac.31
Additional information
File size: 89088 bytes
MD5...: 9593c96262af8ea7da312c2f8fe9b5d1
SHA1..: ce5f0941a35e6a87e237ff28a3b024c7b57ddad9
SHA256: 195a6487a6807cd9b13f926f40ff7f3a5a45349c9840a7bc32bfbbf5e3766fc5
SHA512: 4a71d29fe02912109c4ed5b94b5c793b628ae4e8fdd3c0e5526f749b79aa609c
953e9721106adb4a502946327f116d32ea30a2e5f3ed95f41746b3c82889c205
ssdeep: 1536:Km1bTZ/fzdtsj1h/FX+KECxBwa68UTqq8OQ5m1c/EVLAmPBn54psZY:Km1/
Bhtsj1TfxBE9Qs19AsipsC

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.5%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x107a
timedatestamp.....: 0x402b71bf (Thu Feb 12 12:29:51 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text3 0x1000 0x3000 0x2800 6.40 c8504e66a844a35619b54a7b15f8c933
0x4000 0x1000 0x600 0.25 998fac095746171747e3f6c55a041665
0x5000 0x5000 0x4800 7.99 f74d054f47bc047d4a7c024d4fe2321f
0xa000 0x5000 0x4a00 7.99 a97f66a9b8da040b6525da793866247d
0xf000 0x5000 0x4a00 7.99 75e158c4b86d6920a804baff24912825
0x14000 0x11000 0x4e00 7.99 8897e35e1903286336094fdd3e9a1cb0

( 6 imports )
> COMCTL32.dll: InitCommonControlsEx
> KERNEL32.dll: ExitProcess, GetModuleHandleW, GetSystemInfo
> USER32.dll: DispatchMessageW, TranslateMessage, LoadIconA, GetSystemMetrics
> GDI32.dll: Arc, SelectClipPath
> comdlg32.dll: PrintDlgExA
> ADVAPI32.dll: RegQueryValueExW

( 0 exports )

RDS...: NSRL Reference Data Set
-
Prevx info: [You must be registered and logged in to see this link.]

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 8:55 pm

a-squared 4.0.0.101 2009.03.31 Trojan.Win32.Vundo!IK
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
Avast 4.8.1335.0 2009.03.31 -
AVG 8.5.0.285 2009.03.31 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 Suspicious File
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 Trojan.Win32.Vundo
K7AntiVirus 7.10.687 2009.03.31 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5570 2009.03.31 -
McAfee+Artemis 5570 2009.03.31 -
McAfee-GW-Edition 6.7.6 2009.03.31 Trojan.Crypt.XPACK.Gen
Microsoft 1.4502 2009.03.31 Trojan:Win32/Vundo.gen!AM
NOD32 3978 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 Suspicious file
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 High Risk Fraudulent Security Program
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 Troj/Virtum-Gen
Sunbelt 3.2.1858.2 2009.03.31 VIPRE.Suspicious
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 TROJ_VUNDO.HGO
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 Trojan.Vundo.Gen!Pac.31
Additional information
File size: 81408 bytes
MD5...: 2c768f2c491fa1fb06217cfca90376ac
SHA1..: 392f6f06a391571efba69b1c814818e8840b977a
SHA256: bb605847582917bd4378f1ac5dd0b01bc2022b6e8ee79227c18fe6fc4c7a8760
SHA512: 8a42df17cab866d10f3cfa074de4998e35a04d933d8dd3ae567f399e6e64ee81
2ff319975a2acd4b0b084a194c362a12b76530011080208b8bb3f5bb0078659e
ssdeep: 1536:J218W7SjPqbJhhL5cx+ZHZ6VeA7qxtta64qOCsjj36r7cFzLe4Q6:J2uIhL
5oT0tcjqOdK32LRd

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x11e5
timedatestamp.....: 0x404991af (Sat Mar 06 08:54:07 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text3 0x1000 0x3000 0x2800 6.38 fbe08217c3489e7ba04fdc99b1fe4702
0x4000 0x1000 0x600 0.25 e4761fe4eee2e4a7455f85c9201fa417
0x5000 0x5000 0x4200 7.99 42c8a9eba7390572897d2351fe951064
0xa000 0x5000 0x4200 7.99 ce5d2a279f7106436888ae79e861f6c4
0xf000 0x5000 0x4200 7.99 c06506bb42ec839dbb58f59c19acc516
0x14000 0xf000 0x4600 7.99 673506a7c48eeb0c266ba7d46a135cfb

( 6 imports )
> COMCTL32.dll: InitCommonControlsEx
> KERNEL32.dll: ExitProcess, GetModuleHandleW, GetSystemInfo
> USER32.dll: DispatchMessageW, TranslateMessage, LoadIconA, GetSystemMetrics
> GDI32.dll: Arc, SelectClipPath
> comdlg32.dll: PrintDlgExA
> ADVAPI32.dll: RegQueryValueExW

( 0 exports )

RDS...: NSRL Reference Data Set
-
Prevx info: [You must be registered and logged in to see this link.]

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 8:57 pm

Thanks.
Lets nuke them with this next OTMoveIt script.


  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    c:\windows\system32\ligutafo.dll
    c:\windows\system32\duhazilu.dll
    c:\windows\system32\denezudu.dll
    C:\Users\Kristin.Acer-PC\Desktop\dds.scr


  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 8:59 pm

========== FILES ==========
DllUnregisterServer procedure not found in c:\windows\system32\ligutafo.dll
c:\windows\system32\ligutafo.dll NOT unregistered.
c:\windows\system32\ligutafo.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\duhazilu.dll
c:\windows\system32\duhazilu.dll NOT unregistered.
c:\windows\system32\duhazilu.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\denezudu.dll
c:\windows\system32\denezudu.dll NOT unregistered.
c:\windows\system32\denezudu.dll moved successfully.
C:\Users\Kristin.Acer-PC\Desktop\dds.scr moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03312009_165832

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 9:01 pm

Hello.
Please delete this folder in bold:
C:\_OTMoveIt

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by kristin05 on Tue Mar 31, 2009 9:03 pm

It is running great,

thank you, you are a life saver.

kristin05
Novice
Novice

Posts Posts : 19
Joined Joined : 2009-03-09
OS OS : windows
Points Points : 28303
# Likes # Likes : 0

View user profile

Back to top Go down

Re: userinit.exe and more. random pop-ups. slow browser...just added hijackthis

Post by Belahzur on Tue Mar 31, 2009 9:04 pm

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum