Shiraz16 I used your suggestions from a previous post to try to remove this virus. I ran Malwarebytes once, but it seems that the virus is still on my computer. Could you tell me what else I need to do to get rid of it? Back to Top
Touch Forum Moderator Hello
Please download Combofix:
And save to the desktop.
Close all other browser windows.
Go to Start->Run and copy/paste: ComboFix /snapshot and hit OK. It should run Combofix.
Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.
When finished, it will produce a logfile located at C:\combofix.txt.
Post the contents of that log in your next reply
NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer.. We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 I've tried to run Combofix many times. The first time I ran it, MicroAV came back with a vengeance. Then MicroAV kept popping up and prevented Combofix from making a logfile. So I ran Malwarebytes again and now my computer keeps saying that I have no 'winupdate' and Combofix won't even load properly anymore. What should I do? Back to Top
Shiraz16 I tried to run Combofix in Safe Mode. It did the same thing it does when the computer is in normal boot mode. It looks it's starting up and then it suddenly disappears. When I tried to restart my computer though, an error message popped up saying that it couldn't stop the process 'C:Windows\system32\cmd.cfexe' . For some reason, Combofix stopped working completely once I uninstalled Spybot, which was preventing it from making a logfile in the first place. Back to Top
Touch Forum Moderator Ok, try this scanner then ->
Download random's system information tool (RSIT) by random/random from here and save it to your desktop. Double click on RSIT.exe to run RSIT . Click Continue at the disclaimer screen. Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized ) and info.txt (<<will be minimized )
Click on Format and Uncheck Word wrap , if checked.
Post back with both the resulting logs.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 Here is the log.txt: Back to Top
Shiraz16 Also, I now have Symantec Antivirus which seems to be keeping the virus at bay, but I'm still getting the winupdate.exe error message whenever I boot my computer. Back to Top
Touch Forum Moderator Ok. Rightclick on hijackthis exe and rename it to hjt exe
Post new hijackthis log
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 Logfile of Trend Micro HijackThis v2.0.2 Back to Top
Touch Forum Moderator Run a scan with HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): F3 - REG:win.ini: run="C:\WINDOWS\system32\winupdate.exe"
O2 - BHO: (no name) - {21c456a6-6a42-4577-b67f-d8216acfc637} - C:\WINDOWS\system32\fumupofo.dll (file missing)
O2 - BHO: QXK Olive - {F79654F3-6D43-4262-A3A5-EDDDBEB42C29} - C:\WINDOWS\dfmlxbpkleq.dll (file missing)
O4 - HKLM\..\Run: [denehikili] Rundll32.exe "C:\WINDOWS\system32\lonayemu.dll",s
O20 - AppInit_DLLs: C:\WINDOWS\system32\pihuwali.dll
Delete these files, if present:
C:\WINDOWS\system32\winupdate.exe lonayemu.dll pihuwali.dll
Reboot normally, post new hijackthis log
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 Thank you for all your help so far! I stopped getting the error message for C:\Windows\system32\winupdate.exe, but I'm still getting an error message for C:\Windows\system32\lonayemu.dll when I boot the computer. Back to Top
Touch Forum Moderator Ok, avenger should be able to fix it ->
Please download The Avenger by Swandog46 to your Desktop. Click on Avenger.zip to open the file
Extract avenger2.exe to your desktop
Start Avenger
Quote->
-------------------------------------
Files to delete:
C:\WINDOWS\system32\lonayemu.dll
Registry values to replace with dummy:
------------------------------------------------------
Copy/Paste all the text in the above quote box into the main window
Click Execute
The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions.
This log file will be located at C:\avenger.txt
Post C:\avenger.txt in next reply, along with new hijackthis log
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 I still got the lonayemu error message when I rebooted. Back to Top
Touch Forum Moderator Run a scan with HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any): O2 - BHO: (no name) - {21c456a6-6a42-4577-b67f-d8216acfc637} - C:\WINDOWS\system32\fumupofo.dll (file missing)
O4 - HKLM\..\Run: [denehikili] Rundll32.exe "C:\WINDOWS\system32\lonayemu.dll",s
O4 - HKUS\S-1-5-19\..\Run: [denehikili] Rundll32.exe "C:\WINDOWS\system32\lonayemu.dll",s (User 'LOCAL SERVICE')
The following are not spyware/malware, but I suggest you place a check mark next to the following entries, as these programs may be taking up system resources.O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe\" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] \"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe\" O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
Reboot, and tell how things are running now ?
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 I didn't get an error message when I booted! Back to Top
Touch Forum Moderator It looks clean
To completely and immediately remove any infected file or files in the data store, turn off and then turn on System Restore. To do so, follow these steps: System Restore
Uninstall ComboFix Start ->Run , and type in ComboFix /u ComboFix and /u Enter This will ->
Uninstall ComboFix. Delete its related folders and files.
Reset your clock settings. Hide file extensions.
Hide the system/hidden files. And resets System Restore again.
--------------------------------------------------------------------------------------------------------
I notice that you do not seem to be running antivirus software.This is somewhat suicidal in today's digital world.
Avast! makes an excellent free antivirus client.
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 Thanks for all your help! I actually have Symantec Antivirus and I downloaded those two programs you suggested. I do every once in a while hear that sound that usually accompanies an error message, but then nothing pops up. Do you know what that might mean? Back to Top
Shiraz16 Well, I don't know if the virus was not fully cleared from my system or whether I was hit with another one, but now my computer is running VERY slowly. As in, it takes hours for it to boot up. I tried booting it in safe mode and it would list a bunch of drivers and then I would get the blue screen of death. I'm trying to get you at least a Malwarebytes' logfile, but it's going to take me a while. Back to Top
Touch Forum Moderator Ok. See if these tips help ->
Optimize XP:
Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.
Back to Top
Shiraz16 I can't do any of those tips because my computer takes hours to boot up and then freezes whenever I try to run any kind of program. I'm just going to reformat my harddrive; my cousin is going to bring me an extra XP Pro installation disk that he has. Back to Top
Forum Information Currently it is Saturday, March 13, 2010 5:21 AM (GMT +1)View Active Threads Who's Online This forum has 31124 registered members. Please welcome our newest member, teddy .Details 5 Latest Threads
Codecs (remove only)-->C:\Program Files\Theorica Divx 
|