TechSpot

Hijack this Log. Possible Trojan

By kyle1413
Oct 5, 2008
  1. Hello! Thank you in advance for taking a look at this log to see what is going wrong.

    I came home yesterday and my brother must have downloaded something because now Spybot Search and Destroy Resident keeps notifying me of changes such as:

    10/4/2008 12:59:22 PM Denied (based on user blacklist) value "MSServer" (new data: "rundll32.exe C:\Windows\system32\opnmLfDt.dll,#1") changed in System Startup global entry!

    and

    10/4/2008 12:50:19 PM Denied (based on user blacklist) value "MSServer" (new data: "rundll32.exe C:\Windows\system32\yayaYSMg.dll,#1") changed in System Startup global entry!

    to name a few. Also my Windows Defender goes off randomly telling me im having serious threats on my computer, One of which was Vundo.

    Heres my Hijack this log

    Thanks again in advance for looking at the log and posting any help or comments!

    Kyle

    Just a second ago I restarted my computer in safe mode and deleted all the system32 files that were modified on todays date.All were able to be deleted except one, and it says i need permission and still shows up in the HJT log files.

    O2 - BHO: (no name) - {420C5476-6F77-4B49-A826-97CFF031E333} - C:\Windows\system32\aWOfFwTl.dll


    Windows Defender doesnt seem to go haywire anymore nor does Spybot Resident.

    Heres a new HJT log

    can anyone help me please?
     
  2. momok

    momok TS Rookie Posts: 2,272

    Firstly, do not post a reply if there are no posts from other people in-between unless you are bumping. In that case, please wait at least 24 hours before doing so; do understand that people on the forum work on a volunteer basis and have their own lives too. Otherwise, for everything else, there is the 'edit' button.

    Secondly, if you suspect an infection, read and run through the stickies on malware removal before posting your logs. It helps make our job here alot much easier.

    Thirdly, please do not copy and paste your logs unless specifically told to do so. Instead, use the 'attach' function. Any post count restriction can be easily gotten past if you introduce yourself in the intro section.

    Lastly, your system is indeed infected. Please read and follow the instructions on the 8 step malware removal guide (stickied at the top of this forum section) and post your required logs as attachments.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.