My Computer is Dying!! Please Help Me!

KnoNothingAboutComputers · Apr 24, 2009

I have some kind of virus on my computer that is automatically uninstalling Norton 360 after it is installed and preventing me from going to Norton, Mcafee, and Trendmicro's websites. It keeps messing with my registry editor too. I now have 19 items I was able to download hijack this. This is the log that I ran, but not in safemode. I'm sure there are girls that are great at computers, but I am definitely NOT one of them. I'd really appreciate any help on what to do. Thanks!!

TimW · Apr 24, 2009

Yes you are seriously infected.

Run HJT (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system32\ntos.exe,C:\WINDOWS\system32\windres.exe,
O2 - BHO: (no name) - {2cd1752d-0560-4d6d-bede-a3ecc8ebb7e0} - C:\WINDOWS\system32\sibidapi.dll
O2 - BHO: C:\WINDOWS\system32\yaubfh983ind.dll - {a5af42a3-94f3-42bd-f634-0604832c897d} - C:\WINDOWS\system32\yaubfh983ind.dll
O4 - HKLM\..\Run: [Acuzogoloputuye] rundll32.exe "C:\WINDOWS\Tbepujumuqoboxe.dat",e
O4 - HKLM\..\Run: [CPM031e4ca0] Rundll32.exe "c:\windows\system32\kapihiwo.dll",a
O4 - HKLM\..\Run: [mogiluhehe] Rundll32.exe "C:\WINDOWS\system32\bijikahu.dll",s
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKUS\.DEFAULT\..\Run: [Diagnostic Manager] C:\WINDOWS\TEMP\4165951864.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [reader_s] C:\Documents and Settings\Kate\reader_s.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [] C:\WINDOWS\TEMP\uylrk2xnz.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Windows Resurections] C:\WINDOWS\TEMP\uylrk2xnz.exe (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - AppInit_DLLs: C:\WINDOWS\system32\pomefeya.dll c:\windows\system32\kapihiwo.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kapihiwo.dll
O22 - SharedTaskScheduler: sdfg54y54yhhgth6w4efvrg - {E2BA40A2-74F3-42BD-F434-2604812C8953} - C:\WINDOWS\system32\sdfgerfgf3f.dll
O22 - SharedTaskScheduler: as3iur98wajkef3wgf3 - {A5AF42A3-94F3-42BD-F634-0604832C897D} - C:\WINDOWS\system32\yaubfh983ind.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\kapihiwo.dll
Click to expand...

NOTE: HJT may popup an error about the AppInit_DLLs line. Ignore it and click OK to continue.

After clicking Fix, exit HJT.

Now download The Avenger by Swandog469, and save it to your Desktop.

* Extract avenger.exe from the Zip file and save it to your desktop
* Run avenger.exe by double-clicking on it.
* Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\WINDOWS\system32\windres.exe
C:\WINDOWS\system32\sibidapi.dll
C:\WINDOWS\system32\yaubfh983ind.dll
C:\WINDOWS\Tbepujumuqoboxe.dat
c:\windows\system32\kapihiwo.dll
C:\WINDOWS\system32\bijikahu.dll
C:\WINDOWS\System32\reader_s.exe
C:\WINDOWS\TEMP\4165951864.exe
C:\Documents and Settings\Kate\reader_s.exe
C:\WINDOWS\TEMP\uylrk2xnz.exe
C:\WINDOWS\system32\pomefeya.dll
C:\WINDOWS\system32\sdfgerfgf3f.dll
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now please follow the instructions here:
READ & RUN ME FIRST. Malware Removal Guide

Log in or Sign up

My Computer is Dying!! Please Help Me!

KnoNothingAboutComputers Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member