[powerthink]

Hi guys,
I have those things in the Run section of Registry

Key Name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Class Name: <NO CLASS>
Last Write Time: 12/2/2008 - 1:07 PM
Value 0
Name: CTFMON.EXE
Type: REG_SZ
Data: C:\WINDOWS\system32\ctfmon.exe

Value 1
Name: CPMebc86926
Type: REG_SZ
Data: Rundll32.exe "c:\windows\system32\dumepiwo.dll",a

Value 2
Name: e8fb5aba
Type: REG_SZ
Data: rundll32.exe "C:\WINDOWS\system32\suvatepe.dll",b

Value 3
Name: hovevifedi
Type: REG_SZ
Data: Rundll32.exe "C:\WINDOWS\system32\lameweka.dll",s

Any idea what they are?
Thanks.

Apparently they are not there anymore, there are 3 rundll messages come up with error loading ......
Google it does not come up with anything.

Thanks.

[Advertisements]

ctfmon.exe is M$ Office file, three others, definitely indicate an infection.

I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post a HiJackThis Log in THAT forum. If you are unable to run and/or post a HJT log, then post that in your initial post in the topic you create in that forum.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

Edited by Broni, 02 December 2008 - 10:55 PM.

[Broni]

ctfmon.exe is M$ Office file, three others, definitely indicate an infection.

I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post a HiJackThis Log in THAT forum. If you are unable to run and/or post a HJT log, then post that in your initial post in the topic you create in that forum.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

Edited by Broni, 02 December 2008 - 10:55 PM.

[powerthink]

Hi Broni,
Thanks for your advice.
At this time of the year I have to reimage that laptop. But for more information that happened when an African guy plug the usb into her laptop
Cheers.

ctfmon.exe is M$ Office file, three other, definitely indicate an infection.

I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post a HiJackThis Log in THAT forum. If you are unable to run and/or post a HJT log, then post that in your initial post in the topic you create in that forum.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

[Broni]

What do you mean by reimage?

[powerthink]

Ghost Image.
Cheers.

What do you mean by reimage?

[Broni]

Your computer must be clean, first, before you create any image.