Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
05-May-2007, 06:30 AM
#16 | ||||||
| |
| |
05-May-2007, 01:17 PM
#20 | |||||
| Hi, cometal  1. Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\xwopsepe.dll",realset Now close all windows and browsers, other than HiJackThis, then click Fix Checked. Close Hijackthis. 2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C): Quote:
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. 3. Now, start The Avenger program by clicking on its icon on your desktop.
In addition, Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
09-May-2007, 11:50 AM
#23 | |||||
| Hi, cometal Start WinPFind3U. Copy/Paste the information in the Quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button. Code: [Kill Explorer]
[Unregister Dlls]
[Win32 Services - Non-Microsoft Only]
YN -> (FIJLOYWUR) FIJLOYWUR [Win32_Own | On_Demand | Stopped] -> %SystemDrive%\DOCUME~1\admin\LOCALS~1\Temp\FIJLOYWUR.exe
YN -> (QWG) QWG [Win32_Own | On_Demand | Stopped] -> %SystemDrive%\DOCUME~1\admin\LOCALS~1\Temp\QWG.exe
[Driver Services - Non-Microsoft Only]
YY -> (oreans32) oreans32 [Kernel | System | Running] -> %System32%\drivers\oreans32.sys
[Registry - Non-Microsoft Only]
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
YN -> ljhig -> %System32%\ljhig.dll
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {1A9087A4-FC5D-48DE-BA3E-E8DB817BB4C1} [HKLM] -> Reg Data - Value does not exist [Reg Data - Value does not exist]
YN -> {1D4FC33E-B5D3-4D04-A6F6-00F15972CCCD} [HKLM] -> %System32%\ljhig.dll [Reg Data - Value does not exist]
[Files/Folders - Created Within 60 days]
NY -> CopyFiles.bat -> %SystemDrive%\CopyFiles.bat
NY -> aygesbot.dll -> %System32%\aygesbot.dll
NY -> ayjxmfvp.ini -> %System32%\ayjxmfvp.ini
NY -> epespowx.ini -> %System32%\epespowx.ini
NY -> gihjl.bak1 -> %System32%\gihjl.bak1
NY -> gihjl.bak2 -> %System32%\gihjl.bak2
NY -> gihjl.ini -> %System32%\gihjl.ini
NY -> kgxqnhqq.dll -> %System32%\kgxqnhqq.dll
NY -> pvfmxjya.dll -> %System32%\pvfmxjya.dll
NY -> qqhnqxgk.ini -> %System32%\qqhnqxgk.ini
NY -> tobsegya.ini -> %System32%\tobsegya.ini
NY -> wlhrkuax.ini -> %System32%\wlhrkuax.ini
NY -> wyycf.ini -> %System32%\wyycf.ini
NY -> tmvsthfss.bin -> %System32%\drivers\etc\tmvsthfss.bin
NY -> tmvsthfud.bin -> %System32%\drivers\etc\tmvsthfud.bin
[Files/Folders - Modified Within 30 days]
NY -> imsins.BAK -> %SystemRoot%\imsins.BAK
NY -> aygesbot.dll -> %System32%\aygesbot.dll
NY -> ayjxmfvp.ini -> %System32%\ayjxmfvp.ini
NY -> epespowx.ini -> %System32%\epespowx.ini
NY -> gihjl.bak1 -> %System32%\gihjl.bak1
NY -> gihjl.bak2 -> %System32%\gihjl.bak2
NY -> gihjl.ini -> %System32%\gihjl.ini
NY -> kgxqnhqq.dll -> %System32%\kgxqnhqq.dll
NY -> ooxjobei.ini -> %System32%\ooxjobei.ini
NY -> pvfmxjya.dll -> %System32%\pvfmxjya.dll
NY -> qqhnqxgk.ini -> %System32%\qqhnqxgk.ini
NY -> thxcfg.ini -> %System32%\thxcfg.ini
NY -> tobsegya.ini -> %System32%\tobsegya.ini
NY -> wlhrkuax.ini -> %System32%\wlhrkuax.ini
NY -> wyycf.ini -> %System32%\wyycf.ini
NY -> tmvsthfss.bin -> %System32%\drivers\etc\tmvsthfss.bin
NY -> tmvsthfud.bin -> %System32%\drivers\etc\tmvsthfud.bin
[File String Scan - Non-Microsoft Only]
NY -> UPX! , UPX0 , -> %SystemRoot%\cygz.dll
NY -> UPX! , UPX0 , -> %SystemRoot%\g6425849.exe
NY -> UPX! , -> %SystemRoot%\retadpu1000272.exe
NY -> UPX! , -> %System32%\aygesbot.dll
NY -> UPX! , UPX0 , -> %System32%\cygz.dll
NY -> UPX! , -> %System32%\kgxqnhqq.dll
NY -> UPX! , -> %System32%\opnonno.dll
NY -> UPX! , -> %System32%\pvfmxjya.dll
NY -> UPX! , UPX0 , -> %System32%\wudb.dll
[Empty Temp Folders]
[Start Explorer]
[Reboot]
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new WinPFind3u scan and a Hijackthis log, separately (the Hijackthis can be pasted on the reply). I will review the information when it comes back in. Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.
__________________ Unanswered threads for 5 days will no longer be part of my subscriptions. |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 01:08 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile