TechSpot

I keep getting this sagipsul pop up

By madaccord
Dec 27, 2008
  1. i've tried ad-aware, anti spy, and have no idea what to do.
    this is my last resort before i will reformat the whole computer
     

    Attached Files:

  2. gillianbrown

    gillianbrown Banned Posts: 141

    Your system is badly infected.

    If you use your system for online banking/credit card use etc, you should immediately disconnect from the net and reformat your system. Then, contact you bank etc and tell them your system has been compromised.

    If you only use your system for gaming/music etc, then cleaning may be a better option.

    If you wish to clean your system, please do the following.

    Go HERE, follow the instructions and post the log files once done.

    .
     
  3. madaccord

    madaccord TS Rookie Topic Starter

    this is my malwarebytes log
     

    Attached Files:

  4. gillianbrown

    gillianbrown Banned Posts: 141

    Ok, please follow the rest of the instructions and post the other log files.
     
  5. madaccord

    madaccord TS Rookie Topic Starter

    here is the superantispyware the hijackthis is coming soon
     
  6. madaccord

    madaccord TS Rookie Topic Starter

    here is the latest hijackthis log
     
  7. madaccord

    madaccord TS Rookie Topic Starter

    thanks in advance alot
     
  8. gillianbrown

    gillianbrown Banned Posts: 141

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKUS\S-1-5-19\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'LOCAL SERVICE')

    O4 - HKUS\S-1-5-20\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'NETWORK SERVICE')

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

    O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)

    O15 - Trusted Zone: *.simnetenterprise.com (HKLM)

    O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Burger Island\Images\armhelper.ocx

    O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll

    O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)

    O20 - AppInit_DLLs: nmdncw.dll

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or folders(if there).

    C:\WINDOWS\System32\febobafi.dll
    C:\WINDOWS\System32\nmdncw.dll

    Reboot into normal mode and rehide your protected OS files.

    Post a fresh HJT log and let us know if you're still having problems.
     
  9. madaccord

    madaccord TS Rookie Topic Starter

    O4 - HKUS\S-1-5-19\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'NETWORK SERVICE')
    C:\WINDOWS\System32\febobafi.dll
    C:\WINDOWS\System32\nmdncw.dll


    i could not find these files anywhere
     
  10. madaccord

    madaccord TS Rookie Topic Starter

    nvm in the scan i got the 04-hkus and fixed them
     
  11. gillianbrown

    gillianbrown Banned Posts: 141

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    viewpoint

    Close control panel.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    Viewpoint Manager Service

    Close the services window.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

    O2 - BHO: Catcher Class - {ADECBED6-0366-4377-A739-E69DFBA04663} - C:\Program Files\Moyea\FLV Downloader\MoyeaCth.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe

    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

    O4 - HKUS\S-1-5-19\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'LOCAL SERVICE')

    O4 - HKUS\S-1-5-20\..\Run: [lugayogula] Rundll32.exe "C:\WINDOWS\System32\febobafi.dll",s (User 'NETWORK SERVICE')

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

    O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\RICKY\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk

    O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\RICKY\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk

    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or folders(if there).


    C:\Program Files\Viewpoint<Delete the entire folder.

    Reboot your system and post a fresh HJT log.
     
  12. madaccord

    madaccord TS Rookie Topic Starter

    hopefully this is everything gone,
    thanks alot so far
     
  13. gillianbrown

    gillianbrown Banned Posts: 141

    Your log is clean.

    Please download OTMoveIt by OldTimer OTMoveIt.exe, unzip it and place it on your desktop.

    1. Double click OTMoveIt.exe to launch it.
    2. Click on the CleanUp! button.
    3. OTMoveIt will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
    4. You will be prompted to allow the clean up procedure, click Yes
    5. When finished exit out of OTMoveIt

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...