TechSpot

Virus problems please help

By liberlupus
Dec 26, 2008
  1. Recently my internet started to have lots of popups. I had AVG which I have subsequently discarded for Avira. I ran Hijack this and noticed several files that were not supposed to be there. I deleted them, but they came back.
    O20 - AppInit_DLLs: C:\WINDOWS\system32\lamujafi.dll c:\windows\system32\bihofiye.dll c:\windows\system32\lipemeye.dll
    O20 - Winlogon Notify: __c003E896 - C:\WINDOWS\system32\__c003E896.dat (file missing)
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\bihofiye.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\bihofiye.dll
    O
    There were several registry entries that shouldn't be there. I tried to erase them and comp said I could not use regedit. I fixed that by editing group permissions but when I delete them they come back within seconds. I tried Msconfig to start up without them but they continually select back on.
    O4 - HKLM\..\Run: [CPM3f6a8ca5] Rundll32.exe "c:\windows\system32\bihofiye.dll",a
    O4 - HKLM\..\Run: [suvulujude] Rundll32.exe "C:\WINDOWS\system32\yeyozoda.dll",s
    There is a BHO that will not disable and that I can not erase.
    O2 - BHO: (no name) - {c902a24c-5787-4768-8e7e-8730a7d1e8ae} - C:\WINDOWS\system32\saginewu.dll (file missing)

    I tried to do the 8 steps but whatever this is it is blocking some of the websites. Mostly websites involved with antivirus and malware. I uninstalled and reinstalled hijack this and rnamed it food.exe just in case =l. I got Avira downloaded and Ccleaner, but I couldn't get combofix, superantispyware, or the the firewalls, and for some reason mbam won't install.

    I ran Avira and quarantined all files it found. rerunning avira dn rebooting now... could someone help me with this please?
     
  2. liberlupus

    liberlupus TS Rookie Topic Starter

    forgot log sorry

    here it is
     
  3. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Did you try to run Malwarebytes? You log shows it running. twice I need the log from a scan:
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

    There are many entries in the HijackThis log that need to be removed, but they will come right back if the cleaning programs don't remove the malware.

    Please open Malwarebytes and run the scan, Save the log. Then run HijackThis again and attach the logs for both of these programs.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...