vosemuji.dll,tuvujuka.dll et al

Since I cannot disable the Antivirus software that is copy/pasted with each set of instructions I will gladly and hopefully uninstall this program. As I have stated before, I have no was to disable this program as the menu is "Greyed" out.

AVG uninstalled. No more issues.

ComboFix 10-02-04.01 - Colin 02/04/2010 16:59:51.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.1193 [GMT -7:00]
Running from: c:\documents and settings\Colin\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Colin\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\ginuzefa.dll"
"c:\windows\system32\kelinepe.dll"
"c:\windows\system32\kevidobi.dll"
"c:\windows\system32\vosemuji.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ginuzefa.dll
c:\windows\system32\kelinepe.dll
c:\windows\system32\kevidobi.dll
c:\windows\system32\vosemuji.dll

.
((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.

2010-02-04 17:15 . 2010-01-07 23:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-04 17:15 . 2010-02-04 17:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-04 17:15 . 2010-02-04 23:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-04 17:15 . 2010-01-07 23:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-03 17:38 . 2010-02-03 17:38 -------- d-sh--w- c:\documents and settings\Colin\IECompatCache
2010-02-01 04:28 . 2010-02-01 04:28 -------- d-----w- c:\windows\Sun
2010-02-01 04:27 . 2010-02-01 04:27 -------- d-----w- c:\program files\Common Files\Java
2010-02-01 04:27 . 2010-02-01 04:27 -------- d-----w- c:\program files\Java
2010-02-01 04:24 . 2010-02-01 04:24 503808 ----a-w- c:\documents and settings\Colin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3753eed7-n\msvcp71.dll
2010-02-01 04:24 . 2010-02-01 04:24 499712 ----a-w- c:\documents and settings\Colin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3753eed7-n\jmc.dll
2010-02-01 04:24 . 2010-02-01 04:24 348160 ----a-w- c:\documents and settings\Colin\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3753eed7-n\msvcr71.dll
2010-02-01 04:23 . 2010-02-01 04:23 61440 ----a-w- c:\documents and settings\Colin\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-12f9502c-n\decora-sse.dll
2010-02-01 04:23 . 2010-02-01 04:23 12800 ----a-w- c:\documents and settings\Colin\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-12f9502c-n\decora-d3d.dll
2010-02-01 04:23 . 2010-02-01 04:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-02-01 04:15 . 2010-02-01 04:15 -------- d-----w- c:\documents and settings\Colin\Application Data\Malwarebytes
2010-02-01 02:25 . 2010-02-01 02:25 388096 ----a-r- c:\documents and settings\Colin\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-01 02:25 . 2010-02-01 02:25 -------- d-----w- c:\program files\TrendMicro
2010-02-01 00:01 . 2010-02-01 00:01 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2010-01-31 23:05 . 2010-01-31 23:05 -------- d-----w- c:\documents and settings\Momi-Justincase\Application Data\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 05:49 . 2009-07-12 00:59 -------- d-----w- c:\program files\IObit
2010-01-03 01:30 . 2009-07-12 00:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-02 23:44 . 2010-01-02 22:56 -------- d-----w- c:\program files\Sony Online Entertainment
2009-12-14 17:42 . 2009-07-12 00:46 20896 ----a-w- c:\documents and settings\Momi-Justincase\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-29 02:13 . 2009-10-04 01:13 3695616 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2009-11-27 23:18 . 2009-11-27 23:18 78848 ----a-w- c:\windows\system32\drivers\SSHDRV85.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 3"="e:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-11-20 2335880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-04-28 61440]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/11/2009 6:13 PM 64160]
R1 SSHDRV85;SSHDRV85;c:\windows\system32\drivers\SSHDRV85.sys [11/27/2009 4:18 PM 78848]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 7:49 AM 1028432]
.
Contents of the 'Scheduled Tasks' folder

2010-01-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 01:13]
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Colin\Application Data\Mozilla\Firefox\Profiles\9a2jhh1m.default\
FF - prefs.js: browser.startup.homepage - hxxp://m.www.yahoo.com/_ylt=A9G_erRCKSVLDZEA2wCbvZx4/SIG=10ptb89tu/**http%3A//my.yahoo.com/
FF - plugin: c:\program files\Sony Online Entertainment\Station Launcher\npsoe.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-04 17:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...


c:\windows\system32\mucltui.dll 274288 bytes executable
c:\windows\system32\mucltui.dll.mui 16736 bytes executable

scan completed successfully
hȋdden files: 2

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(548)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3400)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\msiexec.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
.
**************************************************************************
.
Completion time: 2010-02-04 17:09:46 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-05 00:09
ComboFix2.txt 2010-02-04 22:59

Pre-Run: 3,870,638,080 bytes free
Post-Run: 3,838,840,832 bytes free

- - End Of File - - AC3A6FB9A9161E4F1487F6EDEBCD6586

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?

It looks great, thank you.

Any recommendations for Anti-virus software that doesn't get nullified as easy as AVG??

You aren't running Anti Virus Software

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Thank you for the info, I'll get this installed on his computer today.

I guess we can consider this matter done.

Thanks again for a fast response and reƖative painless cure.

Well I thought it was over; the AV has picked up something. Full scan is not complete yet.

Okay, it might be a leftover; system restore point, or temp files perhaps.

Note: Avira also picks up on locked files, one will be pagefile.sys, it's legit and nothing to worry about.

Dumb question - can this AV be left running while gaming? My son is into Evercrack 2 and I would like to keep this in the background while he plays.

In theory, yes, but I wouldn't recommend it. The scan will be over faster if you let Avira use your CPU as needed. Playing games while it's doing this will cause the scan to take longer and the games will likely lag.

D'oh my bad, I meant while the AV is running in the background normally, not scanning, can he play online without significant lag issues in the game?

Sorry about not being clear.

When scanning the computers I have nothing running but the AV program.

An AV should be left running all the time, an AV is your first defence aside from a firewall, if your AV is switched off, then what's gonna stop the malware returning?

If it's just the real-time shield that's left running, then yes you can.

Thanks a bunch. THe issues found were in may restore points, so I have deleted to old ones, using System Restore software, and will recreate a new one in a few minutes.

Thanks for the help and answers to my questions.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

Thank you for the follow up.

Restore Point already created using your process. I will get the other programs loaded on his computer.

IE is not used on his computer, only Firefox, (we are currently test-driving Chrome as an alternate). IE is used for MS Updates only.

I would hope I never have to speak with you guys again, however there is always hackers who try to make up repeaters.