userinit.exe and more. random pop-ups. slow browser...just added hijackthis

my computer is having so many problems.
first these random pop-ups are coming up all the time even though i have a blocker.
now some sites will not load like gmail. and now a pop-up comes up and says action aborted and won't even load the page.

how do i get rid of this?



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:58 PM, on 3/30/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\AcerTour\Reminder.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-

8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering

Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://en.us.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-

7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0

\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-

784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0

\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {28AED1AF-B164-44CD-B435-

CF04AA955015} - (no file)
O2 - BHO: (no name) - {71ee955d-6e78-492f-843e-3c21b86dbb32} -

C:\ProgramData\fapavifa\fapavifa.dll (file missing)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-

45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-

477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-

0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0

\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows

Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering

Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1

\LManager.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer

Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer

Assist\launcher.exe
O4 - HKLM\..\Run: [Acer Tour Reminder]

C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program

Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-

B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common

Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-

2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nilimufuhi] Rundll32.exe

"C:\ProgramData\mobeteda\mobeteda.dll",s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4

\ashDisp.exe
O4 - HKLM\..\Run: [CPM7be48fa1] Rundll32.exe

"c:\windows\system32\diperede.dll",a
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows

Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI

Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media

Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CPM7be48fa1] Rundll32.exe

"c:\windows\system32\diperede.dll",a
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows

Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe

oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows

Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3634251809-3434267622-195180976-1003

\..\Run: [] (User 'Danielle')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-

3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12

\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: c:\windows\system32\rubelupe.dll

c:\windows\system32\diperede.dll

C:\ProgramData\wotunivo\wotunivo.dll eNetHook.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-

E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-

E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program

Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL

Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. -

C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec

Corporation - C:\Program

Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program

Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program

Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program

Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) -

Unknown owner - C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT -

C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. -

C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering

Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. -

C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner -

C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service

(LightScribeService) - Hewlett-Packard Company - C:\Program

Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1

\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) -

Unknown owner - C:\Program Files\Common Files\Symantec

Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-

8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility

Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) -

Unknown owner - C:\Program Files\CyberLink\Shared

Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer -

C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. -

C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8736 bytes

Hello.
Can't read that log, please switch off Word Wrap in Notepads Function menu.

Post a new log when Word Wrap is switched off.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:58 PM, on 3/30/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\AcerTour\Reminder.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {28AED1AF-B164-44CD-B435-CF04AA955015} - (no file)
O2 - BHO: (no name) - {71ee955d-6e78-492f-843e-3c21b86dbb32} - C:\ProgramData\fapavifa\fapavifa.dll (file missing)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup
O4 - HKLM\..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nilimufuhi] Rundll32.exe "C:\ProgramData\mobeteda\mobeteda.dll",s
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3634251809-3434267622-195180976-1003\..\Run: [] (User 'Danielle')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - AppInit_DLLs: c:\windows\system32\rubelupe.dll c:\windows\system32\diperede.dll C:\ProgramData\wotunivo\wotunivo.dll eNetHook.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDataSecurity Service - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8736 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
  O2 - BHO: (no name) - {28AED1AF-B164-44CD-B435-CF04AA955015} - (no file)
  O2 - BHO: (no name) - {71ee955d-6e78-492f-843e-3c21b86dbb32} - C:\ProgramData\fapavifa\fapavifa.dll (file missing)
  O4 - HKLM\..\Run: [nilimufuhi] Rundll32.exe "C:\ProgramData\mobeteda\mobeteda.dll",s
  O4 - HKLM\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
  O4 - HKCU\..\Run: [CPM7be48fa1] Rundll32.exe "c:\windows\system32\diperede.dll",a
  O4 - HKUS\S-1-5-21-3634251809-3434267622-195180976-1003\..\Run: [] (User 'Danielle')
  O20 - AppInit_DLLs: c:\windows\system32\rubelupe.dll c:\windows\system32\diperede.dll C:\ProgramData\wotunivo\wotunivo.dll eNetHook.dll
  O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
  O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\diperede.dll
  O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
  O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.35
Database version: 1925
Windows 6.0.6001 Service Pack 1

3/31/2009 3:46:25 PM
mbam-log-2009-03-31 (15-46-25).txt

Scan type: Quick Scan
Objects scanned: 98826
Time elapsed: 4 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 5
Registry Values Infected: 4
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
c:\Windows\System32\rubelupe.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\Windows\System32\diperede.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm7be48fa1 (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm7be48fa1 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\rubelupe.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\rubelupe.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\diperede.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\diperede.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\System32\rubelupe.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\Windows\System32\diperede.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\hajajepo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Lets go deeper.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

DDS (Ver_09-03-16.01) - NTFSx86
Run by Kristin at 16:05:37.49 on Tue 03/31/2009
Internet Explorer: 7.0.6001.18000
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.1789.955 [GMT -4:00]

AV: avast! antivirus 4.8.1335 [VPS 090329-0] *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Windows\system32\SndVol.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Kristin.Acer-PC\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.myspace.com/
mStart Page = hxxp://en.us.acer.yahoo.com
mDefault_Page_URL = hxxp://en.us.acer.yahoo.com
uInternet Settings,ProxyOverride = *.local
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: ShowBarObj Class: {83a2f9b1-01a2-4aa5-87d1-45b6b8505e96} - c:\windows\system32\ActiveToolBand.dll
TB: Acer eDataSecurity Management: {5cbe3b7c-1e47-477e-a7dd-396db0476e29} - c:\windows\system32\eDStoolbar.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: []
uRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [eDataSecurity Loader] c:\acer\empowering technology\edatasecurity\eDSloader.exe
mRun: [Acer Tour]
mRun: [SetPanel]
mRun: [LManager] c:\progra~1\launch~1\LManager.exe
mRun: [Acer Product Registration] "c:\program files\acer registration\ACE1.exe" /startup
mRun: [Acer Assist Launcher] c:\program files\acer assist\launcher.exe
mRun: [eRecoveryService]
mRun: [Acer Tour Reminder] c:\acer\acertour\Reminder.exe
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\empowe~1.lnk - c:\acer\empowering technology\eAPLauncher.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
AppInit_DLLs: eNetHook.dll
SecurityProviders: credssp.dll, mcenspc.dll
LSA: Notification Packages = scecli c:\programdata\wotunivo\wotunivo.dll

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-3-29 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-3-29 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2009-3-29 51792]
R2 BcmSqlStartupSvc;Business Contact Manager SQL Server Startup Service;c:\program files\microsoft small business\business contact manager\BcmSqlStartupSvc.exe [2008-1-11 30312]
R3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]

=============== Created Last 30 ================

2009-03-31 15:38 --d----- c:\users\kristi~1.ace\appdata\roaming\Malwarebytes
2009-03-31 15:38 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-31 15:38 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-31 15:38 --d----- c:\programdata\Malwarebytes
2009-03-31 15:38 --d----- c:\progra~2\Malwarebytes
2009-03-31 15:38 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-30 15:53 --d----- c:\program files\common files\Scanner
2009-03-30 15:53 --d----- c:\program files\CA Yahoo! Anti-Spy
2009-03-30 12:41 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-03-30 12:41 891,448 a------- c:\windows\system32\drivers\tcpip.sys
2009-03-30 12:41 72,192 a------- c:\windows\system32\drivers\pacer.sys
2009-03-30 12:41 15,360 a------- c:\windows\system32\pacerprf.dll
2009-03-30 12:41 147,456 a------- c:\windows\system32\Faultrep.dll
2009-03-30 12:41 125,952 a------- c:\windows\system32\wersvc.dll
2009-03-30 12:41 565,248 a------- c:\windows\system32\emdmgmt.dll
2009-03-30 12:41 625,152 a------- c:\windows\system32\drivers\dxgkrnl.sys
2009-03-30 12:41 148,480 a------- c:\windows\system32\drivers\nwifi.sys
2009-03-30 12:41 45,056 a------- c:\windows\system32\dataclen.dll
2009-03-30 12:41 36,864 a------- c:\windows\system32\cdd.dll
2009-03-30 12:40 430,080 a------- c:\windows\system32\vbscript.dll
2009-03-30 12:40 155,648 a------- c:\windows\system32\wscript.exe
2009-03-30 12:40 135,168 a------- c:\windows\system32\wshom.ocx
2009-03-30 12:40 135,168 a------- c:\windows\system32\cscript.exe
2009-03-30 12:40 90,112 a------- c:\windows\system32\wshext.dll
2009-03-30 12:40 180,224 a------- c:\windows\system32\scrobj.dll
2009-03-30 12:40 172,032 a------- c:\windows\system32\scrrun.dll
2009-03-30 07:39 --d----- C:\PerfLogs
2009-03-29 05:46 51,792 a------- c:\windows\system32\drivers\aswMonFlt.sys
2009-03-29 01:18 --d----- c:\programdata\Norton
2009-03-29 01:18 --d----- c:\progra~2\Norton
2009-03-29 01:16 --d----- c:\programdata\NortonInstaller
2009-03-29 01:16 --d----- c:\progra~2\NortonInstaller
2009-03-28 23:20 --d----- c:\programdata\vepujoto
2009-03-28 23:20 --d----- c:\programdata\nohiyizi
2009-03-28 23:20 --d----- c:\progra~2\vepujoto
2009-03-28 23:20 --d----- c:\progra~2\nohiyizi
2009-03-28 11:20 --d----- c:\programdata\zilolilo
2009-03-28 11:20 --d----- c:\programdata\wusifage
2009-03-28 11:20 --d----- c:\progra~2\zilolilo
2009-03-28 11:20 --d----- c:\progra~2\wusifage
2009-03-27 23:20 --d----- c:\programdata\lerijaye
2009-03-27 23:20 --d----- c:\programdata\fonebipi
2009-03-27 23:20 --d----- c:\progra~2\lerijaye
2009-03-27 23:20 --d----- c:\progra~2\fonebipi
2009-03-27 23:14 --d----- c:\programdata\wotunivo
2009-03-27 23:14 --d----- c:\programdata\mobeteda
2009-03-27 23:14 --d----- c:\programdata\fapavifa
2009-03-27 23:14 --d----- c:\progra~2\wotunivo
2009-03-27 23:14 --d----- c:\progra~2\mobeteda
2009-03-27 23:14 --d----- c:\progra~2\fapavifa
2009-03-16 16:26 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-03-16 16:26 23,848 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-16 16:26 --d----- c:\program files\iPod
2009-03-16 16:26 --d----- c:\programdata\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-16 16:26 --d----- c:\program files\iTunes
2009-03-16 16:26 --d----- c:\progra~2\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-10 15:20 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-03-10 15:20 7,680 a------- c:\windows\system32\spwmp.dll
2009-03-10 15:20 4,096 a------- c:\windows\system32\msdxm.ocx
2009-03-10 15:20 4,096 a------- c:\windows\system32\dxmasf.dll
2009-03-10 15:20 268,288 a------- c:\windows\system32\schannel.dll
2009-03-10 15:20 2,033,152 a------- c:\windows\system32\win32k.sys
2009-03-09 17:34 --d----- C:\_OTMoveIt
2009-03-09 17:33 348,160 a------- c:\users\kristin.acer-pc\OTMoveIt3.exe
2009-03-09 17:08 --d----- c:\program files\Trend Micro
2009-03-04 06:15 97,800 a------- c:\windows\system32\infocardapi.dll
2009-03-04 06:15 105,016 a------- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-03-04 06:15 622,080 a------- c:\windows\system32\icardagt.exe
2009-03-04 06:15 43,544 a------- c:\windows\system32\PresentationHostProxy.dll
2009-03-04 06:15 37,384 a------- c:\windows\system32\infocardcpl.cpl
2009-03-04 06:15 11,264 a------- c:\windows\system32\icardres.dll
2009-03-04 06:15 781,344 a------- c:\windows\system32\PresentationNative_v0300.dll
2009-03-04 06:15 326,160 a------- c:\windows\system32\PresentationHost.exe
2009-03-04 06:14 196,608 a------- c:\windows\ocsetup_cbs_install_NetFx3.perf
2009-03-04 06:14 65,536 a------- c:\windows\ocsetup_cbs_install_NetFx3.dpx
2009-03-04 06:14 32,899,072 a------- c:\windows\ocsetup_install_NetFx3.etl
2009-03-04 06:05 96,760 a------- c:\windows\system32\dfshim.dll
2009-03-04 06:05 282,112 a------- c:\windows\system32\mscoree.dll
2009-03-04 06:05 41,984 a------- c:\windows\system32\netfxperf.dll
2009-03-04 06:04 158,720 a------- c:\windows\system32\mscorier.dll
2009-03-04 06:04 83,968 a------- c:\windows\system32\mscories.dll

==================== Find3M ====================

2009-03-30 07:50 174 a--sh--- c:\program files\desktop.ini
2009-03-30 07:47 143,360 a------- c:\windows\inf\infstrng.dat
2009-03-30 07:47 86,016 a------- c:\windows\inf\infstor.dat
2009-03-30 07:47 51,200 a------- c:\windows\inf\infpub.dat
2009-03-30 07:39 665,600 a------- c:\windows\inf\drvindex.dat
2009-03-30 07:09 101,888 a------- c:\windows\system32\ifxcardm.dll
2009-03-30 07:09 82,432 a------- c:\windows\system32\axaltocm.dll
2009-03-29 23:21 81,408 a--sh--- c:\windows\system32\ligutafo.dll
2009-03-29 11:21 89,088 a--sh--- c:\windows\system32\duhazilu.dll
2009-03-29 11:21 81,408 -------- c:\windows\system32\denezudu.dll
2009-01-25 04:01 269,312 a------- c:\windows\system32\es.dll
2009-01-18 05:48 361,984 a------- c:\windows\system32\IPSECSVC.DLL
2009-01-18 05:48 61,440 a------- c:\windows\system32\winipsec.dll
2009-01-18 05:48 28,672 a------- c:\windows\system32\FwRemoteSvr.dll
2009-01-18 05:48 272,896 a------- c:\windows\system32\polstore.dll
2009-01-18 05:46 241,152 a------- c:\windows\system32\PortableDeviceApi.dll
2009-01-18 05:46 160,768 a------- c:\windows\system32\PortableDeviceTypes.dll
2009-01-18 05:46 94,720 a------- c:\windows\system32\PortableDeviceClassExtension.dll
2009-01-18 05:36 296,960 a------- c:\windows\system32\gdi32.dll
2009-01-18 05:33 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-01-18 05:33 2,560 a------- c:\windows\apppatch\AcRes.dll
2009-01-18 05:33 2,154,496 a------- c:\windows\apppatch\AcGenral.dll
2009-01-18 05:33 460,288 a------- c:\windows\apppatch\AcSpecfc.dll
2009-01-18 05:33 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-01-18 05:33 541,696 a------- c:\windows\apppatch\AcLayers.dll
2009-01-18 05:33 173,056 a------- c:\windows\apppatch\AcXtrnal.dll
2009-01-18 05:33 52,736 a------- c:\windows\apppatch\iebrshim.dll
2009-01-18 05:32 1,695,744 a------- c:\windows\system32\gameux.dll
2009-01-18 05:32 303,616 a------- c:\windows\system32\wmpeffects.dll
2009-01-18 05:30 1,191,936 a------- c:\windows\system32\msxml3.dll
2009-01-18 05:30 2,048 a------- c:\windows\system32\msxml3r.dll
2009-01-18 05:26 2,048 a------- c:\windows\system32\tzres.dll
2009-01-18 05:20 2,927,104 a------- c:\windows\explorer.exe
2009-01-18 05:13 4,164,096 a------- c:\windows\system32\NlsLexicons0002.dll
2009-01-18 05:11 6,656 a------- c:\windows\system32\kbd106n.dll
2009-01-18 05:11 988,216 a------- c:\windows\system32\winload.exe
2009-01-18 05:11 927,288 a------- c:\windows\system32\winresume.exe
2009-01-18 05:11 378,368 a------- c:\windows\system32\srcore.dll
2009-01-18 05:11 318,464 a------- c:\windows\system32\rstrui.exe
2009-01-18 05:11 40,960 a------- c:\windows\system32\srclient.dll
2009-01-18 05:11 19,000 a------- c:\windows\system32\kd1394.dll
2009-01-18 05:11 14,848 a------- c:\windows\system32\srdelayed.exe
2009-01-18 05:11 615,992 a------- c:\windows\system32\ci.dll
2009-01-18 05:11 46,592 a------- c:\windows\system32\setbcdlocale.dll
2009-01-18 05:08 712,704 a------- c:\windows\system32\WindowsCodecs.dll
2009-01-18 05:08 425,472 a------- c:\windows\system32\PhotoMetadataHandler.dll
2009-01-18 05:08 347,136 a------- c:\windows\system32\WindowsCodecsExt.dll
2009-01-18 05:06 443,392 a------- c:\windows\system32\win32spl.dll
2009-01-18 05:06 37,888 a------- c:\windows\system32\printcom.dll
2009-01-18 05:06 14,848 a------- c:\windows\system32\wshrm.dll
2009-01-18 05:04 2,868,736 a------- c:\windows\system32\mf.dll
2009-01-18 05:04 98,816 a------- c:\windows\system32\mfps.dll
2009-01-18 05:04 53,248 a------- c:\windows\system32\rrinstaller.exe
2009-01-18 05:04 2,048 a------- c:\windows\system32\mferror.dll
2009-01-18 05:04 94,720 a------- c:\windows\system32\logagent.exe
2009-01-18 05:04 24,576 a------- c:\windows\system32\mfpmp.exe
2009-01-18 05:04 996,352 a------- c:\windows\system32\WMNetMgr.dll
2009-01-18 05:03 738,304 a------- c:\windows\system32\inetcomm.dll
2009-01-18 05:03 84,480 a------- c:\windows\system32\INETRES.dll
2009-01-18 05:03 1,645,568 a------- c:\windows\system32\connect.dll
2009-01-18 05:03 1,314,816 a------- c:\windows\system32\quartz.dll
2009-01-18 05:02 3,601,464 a------- c:\windows\system32\ntkrnlpa.exe
2009-01-18 05:02 3,549,240 a------- c:\windows\system32\ntoskrnl.exe
2009-01-18 05:01 1,334,272 a------- c:\windows\system32\msxml6.dll
2009-01-18 05:01 2,048 a------- c:\windows\system32\msxml6r.dll
2009-01-17 15:47 1,524,736 a------- c:\windows\system32\wucltux.dll
2009-01-17 15:47 83,456 a------- c:\windows\system32\wudriver.dll
2009-01-17 15:46 162,064 a------- c:\windows\system32\wuwebv.dll
2009-01-17 15:46 31,232 a------- c:\windows\system32\wuapp.exe
2009-01-15 02:11 827,392 a------- c:\windows\system32\wininet.dll
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 08:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 08:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 05:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 05:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
0000-00-00 00:00 2,713 ---sh--- c:\windows\system32\jegugose.exe
0000-00-00 00:00 2,713 ---sh--- c:\windows\system32\lapomefe.exe
0000-00-00 00:00 2,713 ---sh--- c:\windows\system32\rulameja.exe

============= FINISH: 16:07:04.62 ===============

Hello.
Still a few things to do, this vundo is a new version. Probably explains why MBAM found so little.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\programdata\fapavifa
  c:\programdata\mobeteda
  c:\programdata\wotunivo
  c:\programdata\fonebipi
  c:\programdata\lerijaye
  c:\programdata\wusifage
  c:\programdata\zilolilo
  c:\programdata\nohiyizi
  c:\programdata\vepujoto
  c:\program files\vepujoto
  c:\program files\nohiyizi
  c:\program files\zilolilo
  c:\program files\wusifage
  c:\program files\lerijaye
  c:\program files\fonebipi
  c:\program files\wotunivo
  c:\program files\mobeteda
  c:\program files\fapavifa
  c:\windows\system32\jegugose.exe
  c:\windows\system32\lapomefe.exe
  c:\windows\system32\rulameja.exe
  
  :reg
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
  "Notification Packages"=hex(7):73,63,65,63,6c,69,00,00
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders]
  "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
c:\programdata\fapavifa moved successfully.
c:\programdata\mobeteda moved successfully.
c:\programdata\wotunivo moved successfully.
c:\programdata\fonebipi moved successfully.
c:\programdata\lerijaye moved successfully.
c:\programdata\wusifage moved successfully.
c:\programdata\zilolilo moved successfully.
c:\programdata\nohiyizi moved successfully.
c:\programdata\vepujoto moved successfully.
File/Folder c:\program files\vepujoto not found.
File/Folder c:\program files\nohiyizi not found.
File/Folder c:\program files\zilolilo not found.
File/Folder c:\program files\wusifage not found.
File/Folder c:\program files\lerijaye not found.
File/Folder c:\program files\fonebipi not found.
File/Folder c:\program files\wotunivo not found.
File/Folder c:\program files\mobeteda not found.
File/Folder c:\program files\fapavifa not found.
c:\windows\system32\jegugose.exe moved successfully.
c:\windows\system32\lapomefe.exe moved successfully.
c:\windows\system32\rulameja.exe moved successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\\"Notification Packages"|hex(7):73,63,65,63,6c,69,00,00 /E : value set successfully!
Unable to set value : HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\\"SecurityProviders"|"msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" /E!

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03312009_163015

Hello.
I think most of the malware is gone now, but I want to check out 3 suspicious looking files.

We need to unhide hidden files so you can see these files.

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.
Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.
Go to step 5.

If you are in the Control Panel Home view do the following:
Click on the Appearance and Personalization link .
Click on Show Hidden Files or Folders.
Go to step 5.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button and close My Computer.
Now Windows Vista is configured to show all hidden files.

Next, please visit [url=http://www.virustotal.com/]this site.[url]

Press the browse button, and then find each of the three following files.
c:\windows\system32\ligutafo.dll
c:\windows\system32\duhazilu.dll
c:\windows\system32\denezudu.dll

Then press Send File. Please copy and paste the report back here for each file.
Use more than one post if needed.

Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.03.31 Trojan.Win32.Vundo!IK
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
Avast 4.8.1335.0 2009.03.31 -
AVG 8.5.0.285 2009.03.31 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 Suspicious File
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 Trojan.Win32.Vundo
K7AntiVirus 7.10.687 2009.03.31 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5570 2009.03.31 -
McAfee+Artemis 5570 2009.03.31 -
McAfee-GW-Edition 6.7.6 2009.03.31 Trojan.Crypt.XPACK.Gen
Microsoft 1.4502 2009.03.31 Trojan:Win32/Vundo.gen!AM
NOD32 3978 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 Suspicious file
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 High Risk Fraudulent Security Program
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 Troj/Virtum-Gen
Sunbelt 3.2.1858.2 2009.03.31 VIPRE.Suspicious
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 TROJ_VUNDO.HGO
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 Trojan.Vundo.Gen!Pac.31
Additional information
File size: 81408 bytes
MD5...: dfc20b01b211fc8b147b4242dccb0a60
SHA1..: 2689be65acf2e32ab431646af9260ee54aaca407
SHA256: e8b7a52569ca18711c468cdd59d1cea7ef1e97ed47c817bf8d295d7d2ee9f590
SHA512: 036aa9f31ecd093e7589790af764be87d3c9af8433a63c508c157fb86dce774f
13b27da8fc0b29b7c9dc6b831e834353e45099b7948e4b2c2b08c6cd3726ec28
ssdeep: 1536:c1Ow6K39HTAoy4Y6Qo7YjWYVw/tUZAmuqXMi/hFUARku3AP2coZIGndqpWB
o:gdRk3K7CWYVC8uqci/MAD3+gV8P

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x16b2
timedatestamp.....: 0x40660329 (Sat Mar 27 22:41:45 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text3 0x1000 0x3000 0x2800 6.45 de241fb60bde2894c13627befac2722c
0x4000 0x1000 0x600 0.25 6d883b4018ca5973689fc39ec283f66e
0x5000 0x5000 0x4200 7.99 059bbefef7de601cb7fc46ebf8118315
0xa000 0x5000 0x4200 7.99 01fa7b395ea887559050169af941c188
0xf000 0x5000 0x4200 7.99 5d940119d5aa9e8b98af18fb64eac5f5
0x14000 0xf000 0x4600 7.99 1cdf772ce54dfabd99ba6bf097f3f745

( 6 imports )
> COMCTL32.dll: InitCommonControlsEx
> KERNEL32.dll: ExitProcess, GetModuleHandleW, GetSystemInfo
> USER32.dll: DispatchMessageW, TranslateMessage, LoadIconA, GetSystemMetrics
> GDI32.dll: Arc, SelectClipPath
> comdlg32.dll: PrintDlgExA
> ADVAPI32.dll: RegQueryValueExW

( 0 exports )

RDS...: NSRL Reference Data Set
-
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=9A22CA4200EDEA213E66015755966700A31FDBD0

a-squared 4.0.0.101 2009.03.31 Trojan.Win32.Vundo!IK
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.31 -
Avast 4.8.1335.0 2009.03.31 -
AVG 8.5.0.285 2009.03.31 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 Suspicious File
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.31 -
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 Trojan.Win32.Vundo
K7AntiVirus 7.10.687 2009.03.31 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5570 2009.03.31 -
McAfee+Artemis 5570 2009.03.31 -
McAfee-GW-Edition 6.7.6 2009.03.31 Trojan.Crypt.XPACK.Gen
Microsoft 1.4502 2009.03.31 Trojan:Win32/Vundo.gen!G
NOD32 3978 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 Suspicious file
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 High Risk Fraudulent Security Program
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 Troj/Virtum-Gen
Sunbelt 3.2.1858.2 2009.03.31 VIPRE.Suspicious
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 TROJ_VUNDO.HGO
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 Trojan.Vundo.Gen!Pac.31
Additional information
File size: 89088 bytes
MD5...: 9593c96262af8ea7da312c2f8fe9b5d1
SHA1..: ce5f0941a35e6a87e237ff28a3b024c7b57ddad9
SHA256: 195a6487a6807cd9b13f926f40ff7f3a5a45349c9840a7bc32bfbbf5e3766fc5
SHA512: 4a71d29fe02912109c4ed5b94b5c793b628ae4e8fdd3c0e5526f749b79aa609c
953e9721106adb4a502946327f116d32ea30a2e5f3ed95f41746b3c82889c205
ssdeep: 1536:Km1bTZ/fzdtsj1h/FX+KECxBwa68UTqq8OQ5m1c/EVLAmPBn54psZY:Km1/
Bhtsj1TfxBE9Qs19AsipsC

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.5%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x107a
timedatestamp.....: 0x402b71bf (Thu Feb 12 12:29:51 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text3 0x1000 0x3000 0x2800 6.40 c8504e66a844a35619b54a7b15f8c933
0x4000 0x1000 0x600 0.25 998fac095746171747e3f6c55a041665
0x5000 0x5000 0x4800 7.99 f74d054f47bc047d4a7c024d4fe2321f
0xa000 0x5000 0x4a00 7.99 a97f66a9b8da040b6525da793866247d
0xf000 0x5000 0x4a00 7.99 75e158c4b86d6920a804baff24912825
0x14000 0x11000 0x4e00 7.99 8897e35e1903286336094fdd3e9a1cb0

( 6 imports )
> COMCTL32.dll: InitCommonControlsEx
> KERNEL32.dll: ExitProcess, GetModuleHandleW, GetSystemInfo
> USER32.dll: DispatchMessageW, TranslateMessage, LoadIconA, GetSystemMetrics
> GDI32.dll: Arc, SelectClipPath
> comdlg32.dll: PrintDlgExA
> ADVAPI32.dll: RegQueryValueExW

( 0 exports )

RDS...: NSRL Reference Data Set
-
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=A4230C8500CCCA125C52015263766E003D7349E7

a-squared 4.0.0.101 2009.03.31 Trojan.Win32.Vundo!IK
AhnLab-V3 5.0.0.2 2009.03.31 -
AntiVir 7.9.0.129 2009.03.31 TR/Crypt.XPACK.Gen
Antiy-AVL 2.0.3.1 2009.03.31 -
Authentium 5.1.2.4 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
Avast 4.8.1335.0 2009.03.31 -
AVG 8.5.0.285 2009.03.31 -
BitDefender 7.2 2009.03.31 -
CAT-QuickHeal 10.00 2009.03.31 -
ClamAV 0.94.1 2009.03.31 -
Comodo 1092 2009.03.31 -
DrWeb 4.44.0.09170 2009.03.31 -
eSafe 7.0.17.0 2009.03.31 Suspicious File
eTrust-Vet 31.6.6427 2009.03.31 -
F-Prot 4.4.4.56 2009.03.31 W32/Virtumonde.AR.gen!Eldorado
F-Secure 8.0.14470.0 2009.03.31 -
Fortinet 3.117.0.0 2009.03.31 -
GData 19 2009.03.31 -
Ikarus T3.1.1.49.0 2009.03.31 Trojan.Win32.Vundo
K7AntiVirus 7.10.687 2009.03.31 -
Kaspersky 7.0.0.125 2009.03.31 -
McAfee 5570 2009.03.31 -
McAfee+Artemis 5570 2009.03.31 -
McAfee-GW-Edition 6.7.6 2009.03.31 Trojan.Crypt.XPACK.Gen
Microsoft 1.4502 2009.03.31 Trojan:Win32/Vundo.gen!AM
NOD32 3978 2009.03.31 -
Norman 6.00.06 2009.03.31 -
nProtect 2009.1.8.0 2009.03.31 -
Panda 10.0.0.14 2009.03.31 Suspicious file
PCTools 4.4.2.0 2009.03.31 -
Prevx1 V2 2009.03.31 High Risk Fraudulent Security Program
Rising 21.23.12.00 2009.03.31 -
Sophos 4.40.0 2009.03.31 Troj/Virtum-Gen
Sunbelt 3.2.1858.2 2009.03.31 VIPRE.Suspicious
Symantec 1.4.4.12 2009.03.31 -
TheHacker 6.3.3.9.296 2009.03.30 -
TrendMicro 8.700.0.1004 2009.03.31 TROJ_VUNDO.HGO
VBA32 3.12.10.1 2009.03.31 -
ViRobot 2009.3.31.1669 2009.03.31 -
VirusBuster 4.6.5.0 2009.03.31 Trojan.Vundo.Gen!Pac.31
Additional information
File size: 81408 bytes
MD5...: 2c768f2c491fa1fb06217cfca90376ac
SHA1..: 392f6f06a391571efba69b1c814818e8840b977a
SHA256: bb605847582917bd4378f1ac5dd0b01bc2022b6e8ee79227c18fe6fc4c7a8760
SHA512: 8a42df17cab866d10f3cfa074de4998e35a04d933d8dd3ae567f399e6e64ee81
2ff319975a2acd4b0b084a194c362a12b76530011080208b8bb3f5bb0078659e
ssdeep: 1536:J218W7SjPqbJhhL5cx+ZHZ6VeA7qxtta64qOCsjj36r7cFzLe4Q6:J2uIhL
5oT0tcjqOdK32LRd

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x11e5
timedatestamp.....: 0x404991af (Sat Mar 06 08:54:07 2004)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text3 0x1000 0x3000 0x2800 6.38 fbe08217c3489e7ba04fdc99b1fe4702
0x4000 0x1000 0x600 0.25 e4761fe4eee2e4a7455f85c9201fa417
0x5000 0x5000 0x4200 7.99 42c8a9eba7390572897d2351fe951064
0xa000 0x5000 0x4200 7.99 ce5d2a279f7106436888ae79e861f6c4
0xf000 0x5000 0x4200 7.99 c06506bb42ec839dbb58f59c19acc516
0x14000 0xf000 0x4600 7.99 673506a7c48eeb0c266ba7d46a135cfb

( 6 imports )
> COMCTL32.dll: InitCommonControlsEx
> KERNEL32.dll: ExitProcess, GetModuleHandleW, GetSystemInfo
> USER32.dll: DispatchMessageW, TranslateMessage, LoadIconA, GetSystemMetrics
> GDI32.dll: Arc, SelectClipPath
> comdlg32.dll: PrintDlgExA
> ADVAPI32.dll: RegQueryValueExW

( 0 exports )

RDS...: NSRL Reference Data Set
-
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=C60B551500A310833ECC011C2CC93E00B4D6B3EC

Thanks.
Lets nuke them with this next OTMoveIt script.

• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\windows\system32\ligutafo.dll
  c:\windows\system32\duhazilu.dll
  c:\windows\system32\denezudu.dll
  C:\Users\Kristin.Acer-PC\Desktop\dds.scr
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
DllUnregisterServer procedure not found in c:\windows\system32\ligutafo.dll
c:\windows\system32\ligutafo.dll NOT unregistered.
c:\windows\system32\ligutafo.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\duhazilu.dll
c:\windows\system32\duhazilu.dll NOT unregistered.
c:\windows\system32\duhazilu.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\denezudu.dll
c:\windows\system32\denezudu.dll NOT unregistered.
c:\windows\system32\denezudu.dll moved successfully.
C:\Users\Kristin.Acer-PC\Desktop\dds.scr moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03312009_165832

Hello.
Please delete this folder in bold:
C:\_OTMoveIt

How is the machine running now?

It is running great,

thank you, you are a life saver.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.