SOS even?? =)

By Miss_Wizzz
Jun 30, 2007
  1. Ok guys I got a major problem , I have a few issues with the Pc at current , seems I have a few malware etc issues , I will post Hijack This log, as im utterly lost where to even start .
    Apologies if I have posted this log in the wrong place , I looked over the forum and this seemed the only place appropriate for this .
    Thanks in advance for any help.

    Since the log is rather big i will post it in next message so it all fits.

    continued next post.........

    to be continued

    Finally thats all ............

    Thanks yet again for any help offered :) its much appreciated
  2. momok

    momok TS Rookie Posts: 2,265

    Hi Miss_Whizzz and welcome to techspot. =)

    Note: Please do not copy and paste files in the future. Instead post the .log or .txt files as attachments in your replies.

    Important: Please read this thread HERE before you decide whether to clean or reformat your system.

    Should you decide to clean your computer please do the following.

    Firstly, please save your HijackThis in its own folder in C:\Program Files\HijackThis. Then rename your HijackThis executable to analyze.exe.

    You may wish to copy and paste these instructions on notepad for easier reference later.

    Boot into safe mode under your normal user name. See how HERE

    Next turn on "Show all files and folders, including hidden and system". See how HERE

    Go to start > run and type services.msc. Press the enter key.
    Search for the following services. Double click to select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    Ultimate Fixer

    Go to start > Control Panel > Add and Remove Programs.
    Remove anything related to the following:

    Ultimate Fixer

    After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):

    O2 - BHO: (no name) - {349AE8A3-0ACC-424C-AD02-38B38F47BB90} - C:\WINDOWS\system32\jraqwgho.dll
    O2 - BHO: (no name) - {37063A94-1984-4833-BC74-61952B06C230} - C:\WINDOWS\system32\ssttu.dll
    O2 - BHO: (no name) - {54CBB12C-3481-4C5D-942D-4976C0F0A406} - C:\WINDOWS\system32\gebaywv.dll

    O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\qqgucflu.dll (file missing)
    O2 - BHO: (no name) - {643DFB23-D240-4886-8D58-C9CF33BBD492} - C:\WINDOWS\system32\jraqwgho.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {9DF6B3DB-52B9-4F34-952B-A9EFCD282B44} - C:\WINDOWS\system32\pmnnl.dll (file missing)

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [claruxeb.exe] C:\Documents and Settings\All Users\Application Data\claruxeb.exe
    O4 - HKLM\..\Run: [j0271938] rundll32 C:\WINDOWS\system32\j0271938.dll sook
    O4 - HKLM\..\Run: [SC2] C:\WINDOWS\system32\scchk32.exe
    O4 - HKLM\..\Run: [Ultimate Fixer] "C:\Program Files\Ultimate Fixer\UltimateFixer.exe" hide

    O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\jfedkcvb.dll",realset
    O4 - Startup: Kuma_Tray.lnk = D:\Kuma Games\kgsystray\Kuma_tray.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?

    O20 - Winlogon Notify: gebaywv - C:\WINDOWS\SYSTEM32\gebaywv.dll
    O20 - Winlogon Notify: ssttu - C:\WINDOWS\system32\ssttu.dll
    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ucrvsdwp.exe (file missing)

    Close HJT.

    Navigate manually in Windows Explorer and delete the following files and folders in bold.


    C:\Documents and Settings\All Users\Application Data\claruxeb.exe
    C:\Program Files\Ultimate Fixer\UltimateFixer.exe
    C:\Program Files\Ultimate Fixer\

    Reboot into normal mode and rehide your protected OS files.

    Please go ahead to Viruses/Spyware/Malware, preliminary removal instructions and follow the steps given. Do follow all the instructions exactly. They will provide logs for analysis of your system so I will know how to instruct you to proceed.

    Thereafter, please post fresh HijackThis, AVG Antispyware and Combofix logs as attachments into this thread. Do not copy and paste your logs if not it will be ignored and/or removed.

    Also, please let me know the results of the AVG Antirootkit scan

    Your friendly momok =)

    This thread is for the use of Miss_Whizzz only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...