Mljhihj.dll

[plasma dragon00]

i believe its a virus, or some other sort of malware. now, i know how i got it. i downloaded a keygen for a game, which didnt even work (duh now). i extracted it to my dekstop, double clicked it, and it disappeared!! i immediately booted into safe mode, and deleted some stuff from the prefetch and temp folders having to do with it (it was called keygen.exe). now i have this one part of it, mljhihj.dll still in my system, and HTJ finds it, as a BHO for IE7 which i dont use. now heres the problem - it cant fix it. i had no internet explorer windows open, not even firefox, and i even ended my explorer.exe process, and it still cant fix it. it shows up after a rescan.

im going to try to use windows system restore (i hate it though) and ill post back with results.

heres my logfile from htj before the restore. and also, explorer.exe tries to access the internet every now and then (thanks zonealarm) even when im not doing anything. i just deny it.

logfile, will scan with a bunch of my security programs again after restore.

 

[howard_hopkinso]

Your system is infected with what looks like the Vundo trojan.

It also appears you`re running two firewalls. Norton and Zonealarm, this is not recommended and can cause serious conflicts. I suggest you uninstall Zonealarm for now.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as Attachments into this thread, only after doing the above.

Also, let me know the results of the Panda Antirootkit scan.

Regards Howard

This thread is for the use of plasma dragon00 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[plasma dragon00]

thanks for replying howard long time, no see, and now its my pc thats in trouble

anyway, i did a system restore, and from looking at the hjt log, it seems to be clean, at least it doesnt have the mljhihj.dll BHO in there. ill still post the new log, though, and i'll also do all the other things mentioned.

thanks

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

viewpoint
viewpoint toolbar
viewpoint manager

Close control panel.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

Viewpoint Manager Service

Close the services window.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

C:\Program Files\Viewpoint

Reboot into normal mode and rehide your protected OS files.

Don`t forget to uninstall one firewall.

Post a fresh HJT log as well as a Combofix log.

Regards Howard

This thread is for the use of plasma dragon00 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[plasma dragon00]

viewpoint media player was the only thing in add and remove programs

other than that, nothing showed up in the other parts

combofix went to restart my pc, and as it was in the stage of rebooting, it gave me a stop error (blue screen). it disappeared so fast though, so i wasnt able to catch what it said

and heres HJT

~plasma

edit: and i took out norton so i could install avg, which took out norton firewall, so i have zonealarm right now

 

[howard_hopkinso]

Your HJT log is clean.

I notice you have gotten rid of Symantec/Norton. I think this is a very good move, but you now need to replace it. I recommend one of the AV programmes below.

AVG free or Avast antivirus programmes.

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

File::
C:\WINDOWS\system32\mljhijh.dll
C:\WINDOWS\system32\drivers\dump_wmimmc.sys

Folder::
C:\Documents and Settings\All Users\Application Data\Viewpoint

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Regards Howard

This thread is for the use of plasma dragon00 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[plasma dragon00]

done

thanks,

~plasma

 

[howard_hopkinso]

That`s clean.

Delete the following folder.

C:\qoobox.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of plasma dragon00 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[plasma dragon00]

done.

Howard, i dont know what i would do without you. this is the second time you've helped me, on my parents pc and now my own. as with last time, i cant thank you enough for the help.

you're the man howard

thanks

~plasma

This thread is now closed: If you need this thread unlocking, please pm a moderator with a link to the thread.

Only the original thread starter can do this. Anyone else, will be ignored.