Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
29-Jul-2010, 05:56 AM
#1 | ||||||
| Yet another RUNDLL error message help required please!! |
| |
29-Jul-2010, 11:04 AM
#2 | ||||||
| |
01-Aug-2010, 12:22 PM
#11 | ||||||
| ComboFix 10-07-31.04 - Gary 01/08/2010 16:12:53.1.1 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.2814.2457 [GMT 1:00] Running from: c:\documents and settings\Gary\Desktop\puppy.exe AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Q4y0N4x1.exe c:\documents and settings\All Users\Application Data\Q4y0N4x1.exe_ c:\documents and settings\All Users\Desktop\Malwarebytes' Anti-Malware\mbam.exe c:\documents and settings\Gary\Application Data\7AA8EE3D52D7EDC83A862C097755E9FA c:\documents and settings\Gary\Application Data\7AA8EE3D52D7EDC83A862C097755E9FA\enemies-names.txt c:\documents and settings\Gary\Application Data\7AA8EE3D52D7EDC83A862C097755E9FA\local.ini c:\documents and settings\Gary\Application Data\7AA8EE3D52D7EDC83A862C097755E9FA\lsrslt.ini c:\documents and settings\Gary\Application Data\Sky-Banners c:\documents and settings\Gary\Local Settings\Application Data\{5C4A573A-299B-41D0-AF58-1D52C717E225} c:\documents and settings\Gary\Local Settings\Application Data\{5C4A573A-299B-41D0-AF58-1D52C717E225}\chrome.manifest c:\documents and settings\Gary\Local Settings\Application Data\{5C4A573A-299B-41D0-AF58-1D52C717E225}\chrome\content\_cfg.js c:\documents and settings\Gary\Local Settings\Application Data\{5C4A573A-299B-41D0-AF58-1D52C717E225}\chrome\content\overlay.xul c:\documents and settings\Gary\Local Settings\Application Data\{5C4A573A-299B-41D0-AF58-1D52C717E225}\install.rdf c:\documents and settings\Gary\Start Menu\Programs\Antimalware Doctor c:\documents and settings\Gary\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk c:\documents and settings\Gary\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe c:\program files\Java\jre6\bin\jusched.exe c:\program files\Microsoft Office\Office12\GrooveMonitor.exe c:\program files\QuickTime\qttask .exe c:\program files\QuickTime\qttask .exe c:\program files\QuickTime\qttask .exe c:\program files\QuickTime\qttask .exe c:\program files\QuickTime\qttask.exe c:\windows\$NtUninstallMTF1011$ c:\windows\$NtUninstallMTF1011$\apUninstall.exe c:\windows\$NtUninstallMTF1011$\zrpt.xml c:\windows\aduwesif.dll c:\windows\ahoyudaf.dll c:\windows\avutejedab.dll c:\windows\ihoyudafawinaqa.dll c:\windows\inacubuw.dll c:\windows\oneramer.dll c:\windows\oruzepufi.dll c:\windows\owaceqoz.dll c:\windows\system32\ernel32.dll c:\windows\Tasks\At10.job c:\windows\Tasks\At102.job c:\windows\ufasamav.dll c:\windows\utizewugowize.dll c:\windows\uvulowadilak.dll c:\windows\uwuwakevadazad.dll D:\AUTORUN.INF Code: <pre> c:\documents and settings\All Users\Desktop\Malwarebytes' Anti-Malware\mbam .exe --->c:\documents and settings\All Users\Desktop\Malwarebytes' Anti-Malware\mbam.exe c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe --->c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe --->c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain .exe --->c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe c:\program files\Java\jre6\bin\jusched .exe --->c:\program files\Java\jre6\bin\jusched.exe c:\program files\Microsoft Office\Office12\GrooveMonitor .exe --->c:\program files\Microsoft Office\Office12\GrooveMonitor.exe c:\program files\QuickTime\qttask .exe --->c:\program files\QuickTime\qttask.exe </pre> Infected copy of c:\windows\system32\drivers\imapi.sys was found and disinfected Restored copy from - Kitty had a snack  . ((((((((((((((((((((((((( Files Created from 2010-07-01 to 2010-08-01 ))))))))))))))))))))))))))))))) . 2010-07-29 11:31 . 2010-07-29 11:31 -------- d-----w- c:\documents and settings\Gary\Local Settings\Application Data\ESET 2010-07-29 06:55 . 2010-07-29 06:55 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET 2010-07-28 17:48 . 2010-07-28 17:48 -------- d-----w- c:\program files\ESET 2010-07-28 17:48 . 2010-07-28 17:48 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2010-07-28 15:59 . 2010-07-28 15:59 -------- d-----w- c:\documents and settings\Gary\Application Data\Malwarebytes 2010-07-28 15:28 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-28 15:28 . 2010-07-28 15:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-07-28 15:28 . 2010-07-28 15:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-07-28 15:28 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-07-28 14:48 . 2010-07-28 14:48 -------- d-----w- C:\spoolerlogs 2010-07-27 20:13 . 2010-07-27 20:13 -------- d-s---w- c:\documents and settings\NetworkService\UserData 2010-07-27 20:06 . 2010-07-28 16:31 -------- d-----w- c:\documents and settings\Gary\Local Settings\Application Data\ljyhbaith 2010-07-27 20:01 . 2010-07-27 20:01 -------- d-----w- c:\windows\system32\LogFiles 2010-07-21 07:57 . 2010-07-21 07:57 -------- d-----w- c:\program files\Common Files\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-01 15:18 . 2010-03-29 11:45 -------- d-----w- c:\program files\QuickTime 2010-08-01 14:44 . 2010-07-30 20:17 112 ----a-w- c:\documents and settings\All Users\Application Data\0Y3g3X.dat 2010-07-31 12:36 . 2009-12-29 22:27 -------- d-----w- c:\documents and settings\Gary\Application Data\Skype 2010-07-31 12:35 . 2009-12-29 22:29 -------- d-----w- c:\documents and settings\Gary\Application Data\skypePM 2010-07-30 19:46 . 2009-12-21 10:22 -------- d-----w- c:\program files\NetWaiting 2010-07-30 19:46 . 2004-08-04 12:00 36868 ----a-w- c:\windows\system32\rundll32.exe.tmp 2010-07-29 05:04 . 2009-12-22 12:57 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-07-28 17:12 . 2009-12-26 16:23 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9 2010-07-27 20:02 . 2005-05-13 00:00 46592 ----a-w- c:\documents and settings\Gary\Application Data\fb5eb8dc.exe 2010-07-27 20:02 . 2005-05-13 00:00 46592 ----a-w- c:\documents and settings\Gary\Application Data\fb5eb8dc.exe 2010-07-14 23:04 . 2009-12-23 02:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-06-28 08:04 . 2010-03-31 07:03 439816 ----a-w- c:\documents and settings\Gary\Application Data\Real\Update\setup3.10\setup.exe 2010-06-24 14:46 . 2010-01-14 23:09 -------- d-----w- c:\program files\Common Files\Adobe 2010-06-14 14:30 . 2009-12-21 00:01 743936 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe . Code: <pre> c:\program files\Common Files\Real\Update_OB\realsched .exe c:\program files\NetWaiting\netWaiting .exe c:\windows\system32\rundll32 .exe </pre> . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2010-07-30 33284] "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-01-27 2387968] "Oqeyiyiniyetaso"="c:\windows\oneramer.dll" [N/A] "releaseversion70700.exe"="c:\documents and settings\Gary\Application Data\7AA8EE3D52D7EDC83A862C097755E9FA\releaseversion70700.exe" [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="c:\program files\QuickTime\qttask .exe -atboottime" [X] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "nwiz"="nwiz.exe" [2008-10-07 1630208] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [N/A] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-04-03 149280] "Pneyesumidini"="c:\windows\utizewugowize.dll" [N/A] "sta"="dqlgp.dll" [N/A] "MChk"="c:\windows\system32\qqlgp.exe" [N/A] "Malwarebytes Anti-Malware (reboot)"="c:\documents and settings\All Users\Desktop\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-03-29 2145000] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] c:\documents and settings\Gary\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2010-6-24 113664] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [29/03/2010 17:12 114984] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [29/03/2010 17:13 95872] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [29/03/2010 17:12 810120] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [22/12/2009 16:36 181792] S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/01/2010 20:09 135664] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2009-01-27 22:28 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder 2010-07-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2010-08-01 c:\windows\Tasks\fb5eb8dc.job - c:\documents and settings\Gary\Application Data\fb5eb8dc.exe [2005-05-13 20:02] 2010-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-10 19:09] 2010-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-01-10 19:09] 2010-08-01 c:\windows\Tasks\OGALogon.job - c:\windows\system32\OGAEXEC.exe [2009-08-03 15:07] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.co.uk/ uInternet Settings,ProxyServer = http=127.0.0.1:5643 uInternet Settings,ProxyOverride = <local> IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Gary\Application Data\Mozilla\Firefox\Profiles\i7udulqo.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk/ FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_availa ble_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); . - - - - ORPHANS REMOVED - - - - BHO-{84E716D9-B950-4F71-AE21-355C230AD248} - c:\windows\system32\dqlgp.dll Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) AddRemove-$NtUninstallMTF1011$ - c:\windows\$NtUninstallMTF1011$\apUninstall.exe AddRemove-Facebook Plug-In - c:\documents and settings\Gary\Application Data\Facebook\uninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-08-01 16:18 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2010-08-01 16:19:37 ComboFix-quarantined-files.txt 2010-08-01 15:19 Pre-Run: 133,323,956,224 bytes free Post-Run: 133,644,472,320 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] e:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - F10791D451397A708B61C706465E4B14 |
01-Aug-2010, 08:25 PM
#13 | |||||
| In Internet Explorer go to Tools - Internet Options - Connections Tab - Lan Settings and remove the reference to 127.0.0.1:5543 then uncheck "Use a proxy server for your LAN" and check "Automatically detect settings". Open Notepad and copy and paste the text in the code box below into it: Code: File:: c:\documents and settings\All Users\Application Data\0Y3g3X.dat C:\windows\system32\rundll32.exe.tmp Folder:: c:\documents and settings\Gary\Local Settings\Application Data\ljyhbaith RenV:: c:\documents and settings\All Users\Desktop\Malwarebytes' Anti-Malware\mbam .exe --->c:\documents and settings\All Users\Desktop\Malwarebytes' Anti-Malware\mbam.exe c:\program files\Adobe\Reader 9.0\Reader\Reader_sl .exe --->c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe --->c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain .exe --->c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe c:\program files\Java\jre6\bin\jusched .exe --->c:\program files\Java\jre6\bin\jusched.exe c:\program files\Microsoft Office\Office12\GrooveMonitor .exe --->c:\program files\Microsoft Office\Office12\GrooveMonitor.exe c:\program files\QuickTime\qttask .exe --->c:\program files\QuickTime\qttask.exe Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Oqeyiyiniyetaso"=- "releaseversion70700.exe"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Pneyesumidini"=- "sta"=- "MChk"=- DDS:: uInternet Settings,ProxyServer = http=127.0.0.1:5643 Referring to the picture below, drag CFScript.txt into ComboFix.exe  This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log. Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system. Also, please do this: Please go to the link below and upload the following file(s) for analysis and post the results please: http://virusscan.jotti.org/ c:\documents and settings\Gary\Application Data\fb5eb8dc.exe
__________________ Microsoft MVP - Consumer Security |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
Similar Threads | ||||
| Title | Thread Starter | Forum | Replies | Last Post |
| Rundll error - buwhtje.dll | ACCA | Virus & Other Malware Removal | 5 | 02-Aug-2010 05:02 AM |
| Solved: Yet ANOTHER Windows Movie Maker Problem | danielbier8 | Multimedia | 2 | 16-Nov-2009 01:32 AM |
| AHH! Another horrid error message! help please? | jaccqullynn | Windows XP | 2 | 17-Mar-2009 06:49 AM |
| another Rundll error message | goldenoldie | Virus & Other Malware Removal | 0 | 25-Jul-2008 09:23 PM |
| yet another Windows error message | meggiemagoo | Windows XP | 1 | 02-Jul-2008 05:00 PM |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 09:10 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile