Cannot remove mllji.dll and pmnnn.dll

Posted 12/6/2005 2:07 PM
#24626
User avatar

BJ007 Advanced member

Date Joined Nov 2016
Total Posts: 38
Can someone please help me remove the above two dll files from my computer. I have tried with Hijackthis and also I have tried to remove them manually from the registry but all to no avail. <br/>Here is my Hijackthis log <br/> <br/>Logfile of HijackThis v1.99.0 <br/>Scan saved at 14:59:31, on 06.12.2005 <br/>Platform: Windows XP SP2 (WinNT 5.01.2600) <br/>MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) <br/> <br/>Running processes: <br/>C:\WINDOWS\System32\smss.exe <br/>C:\WINDOWS\system32\winlogon.exe <br/>C:\WINDOWS\system32\services.exe <br/>C:\WINDOWS\system32\lsass.exe <br/>C:\WINDOWS\system32\svchost.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\WINDOWS\system32\spoolsv.exe <br/>C:\Programme\AVPersonal\AVWUPSRV.EXE <br/>C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe <br/>C:\Programme\Analog Devices\SoundMAX\SMAgent.exe <br/>C:\WINDOWS\Explorer.EXE <br/>C:\WINDOWS\System32\igfxtray.exe <br/>C:\WINDOWS\System32\hkcmd.exe <br/>C:\Programme\Analog Devices\SoundMAX\SMTray.exe <br/>C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe <br/>C:\Programme\QuickTime\qttask.exe <br/>C:\WINDOWS\system32\ctfmon.exe <br/>C:\Programme\Messenger\msmsgs.exe <br/>C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe <br/>C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe <br/>C:\Programme\WinZip\WZQKPICK.EXE <br/>C:\Programme\Hardcopy\hardcopy.exe <br/>C:\Programme\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe <br/>C:\WINDOWS\regedit.exe <br/>C:\Install\HijackThis.exe <br/> <br/>R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kleinwalsertal.com/de/som/index.asp <br/>O2 - BHO: (no name) - {00DBDAC8-4691-4797-8E6A-7C6AB89BC441} - C:\WINDOWS\system32\mllji.dll <br/>O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx <br/>O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\System32\pmnnn.dll <br/>O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe <br/>O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe <br/>O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe <br/>O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe <br/>O4 - HKLM\..\Run: [StatusClient] C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto <br/>O4 - HKLM\..\Run: [TomcatStartup] C:\Programme\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe <br/>O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime <br/>O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe <br/>O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background <br/>O4 - Startup: Hardcopy.LNK = C:\Programme\Hardcopy\hardcopy.exe <br/>O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe <br/>O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe <br/>O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE <br/>O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE <br/>O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 <br/>O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe <br/>O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe <br/>O17 - HKLM\System\CCS\Services\Tcpip\..\{5E6227CE-C8FC-4511-A693-D49679062C5E}: NameServer = 195.3.96.67,195.3.96.68 <br/>O17 - HKLM\System\CS1\Services\Tcpip\..\{5E6227CE-C8FC-4511-A693-D49679062C5E}: NameServer = 195.3.96.67,195.3.96.68 <br/>O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE <br/>O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe <br/>O23 - Service: SoundMAX Agent Service - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe <br/> <br/>Thanks <br/>BJ007
Posted 12/6/2005 3:33 PM
#24628
User avatar

Touch Advanced member

Date Joined Nov 2016
Total Posts: 12976
Hey :smile: <br/> <br/> <br/> <br/> <br/> <br/><SPAN lang=EN-GB style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB">Download Free Trial of Spysweeper<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p> <br/> <br/><SPAN lang=EN-GB style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB">[color=#0000ff>Spysweeper</FONT>[/url]<o:p></o:p> <br/> <br/><SPAN lang=EN-GB style="COLOR: black; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB"> <br/><SPAN lang=EN-GB style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB">Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper) <br/>You will be prompted to check for updated definitions, please do so. <br/>(This may take several minutes)<SPAN lang=EN-GB style="mso-ansi-language: EN-GB">Click on "Options > Sweep Options" and check "Sweep all Folders on Selected drives". Check "Local Disc C". <br/>Under What to Sweep: check all of the boxes except Sweep Contents of Compressed Files and do not Sweep Systemrestore Folder.<o:p></o:p>[/3][/color] <br/><SPAN lang=EN-GB style="FONT-SIZE: 9pt; mso-ansi-language: EN-GB"> <br/> <br/>Click on Sweep and allow it to fully scan your system. <br/> <br/>When the sweep has finished, click "Remove". Click "Select All" and then "Next". <br/> <br/><SPAN lang=EN-GB style="mso-ansi-language: EN-GB">Spy Sweeper initially quarantines the spyware it finds on your computer. DO NOT remove items from Quarantine, until after you verify your system still functions properly once spyware has been quarantined. Reboot and ensure important programs still work before you remove any items from Quarantine. <br/> <br/><SPAN lang=EN-GB style="mso-ansi-language: EN-GB"> <br/> <br/><SPAN lang=EN-GB style="mso-ansi-language: EN-GB">Reboot, download newest hijackthis- <br/><SPAN lang=EN-GB style="mso-ansi-language: EN-GB"> <br/><SPAN class=spnmessagetext><SPAN lang=EN-GB style="FONT-SIZE: 9pt; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB">Hijackthis<SPAN lang=EN-GB style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB"><o:p></o:p> <br/> <br/><SPAN lang=EN-GB style="FONT-SIZE: 9pt; COLOR: black; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB"> <o:p></o:p> <br/> <br/><SPAN lang=EN-GB style="FONT-SIZE: 9pt; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB">Run Hijackthis exe- <SPAN class=postbody>Push - Do a systemscan and save a logfile – button<o:p></o:p> <br/> <br/><SPAN lang=EN-GB style="FONT-SIZE: 9pt; FONT-FAMILY: Verdana; mso-ansi-language: EN-GB"> <br/><SPAN class=postbody>Post log here. <br/> <br/><o:p></o:p>

[color=black face="Courier New" sab="311">[2]Click here: Before-posting-a-log[/2][/url]

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
[/color]
Do not PM me with logfiles. They will be deleted.


Posted 12/6/2005 4:48 PM
#24633
User avatar

BJ007 Advanced member

Date Joined Nov 2016
Total Posts: 38
Thanks Touch. Will follow through on what you recommended and will post the new Hijackthis log tomorrow.
Posted 12/7/2005 3:12 PM
#24694
User avatar

BJ007 Advanced member

Date Joined Nov 2016
Total Posts: 38
Hi Touch, <br/>I installed the trial version of Spy Sweeper, updated it and completed a scan. It found somewhere around 450 cases of spyware. <br/>It then said it cuold not delete one or two due to them running in memory. I therefore started in Safe mode and ran it again. Success at first but when I started the computer again the dll files and a trojan-downloader were present still. <br/>I then downloaded a file called vundofix.exe. Installed it and restarted in safemode. Ran vundofix.exe with the entries C:\windows\system32\mllji.dll and the 2nd entry of C:\winodws\system32\ijllm.dll.*. This deleted the file. Ran HiJack this and deleted the BHO entries and now my new Hi-Jackthis log is as follows. <br/> <br/>Logfile of HijackThis v1.99.1 <br/>Scan saved at 12:09:44, on 07.12.2005 <br/>Platform: Windows XP SP2 (WinNT 5.01.2600) <br/>MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) <br/> <br/>Running processes: <br/>C:\WINDOWS\System32\smss.exe <br/>C:\WINDOWS\system32\winlogon.exe <br/>C:\WINDOWS\system32\services.exe <br/>C:\WINDOWS\system32\lsass.exe <br/>C:\WINDOWS\system32\svchost.exe <br/>C:\WINDOWS\System32\svchost.exe <br/>C:\WINDOWS\system32\spoolsv.exe <br/>C:\Programme\AVPersonal\AVWUPSRV.EXE <br/>C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe <br/>C:\Programme\Analog Devices\SoundMAX\SMAgent.exe <br/>C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe <br/>C:\WINDOWS\Explorer.EXE <br/>C:\WINDOWS\System32\igfxtray.exe <br/>C:\WINDOWS\System32\hkcmd.exe <br/>C:\Programme\Analog Devices\SoundMAX\SMTray.exe <br/>C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe <br/>C:\Programme\QuickTime\qttask.exe <br/>C:\WINDOWS\system32\ctfmon.exe <br/>C:\Programme\Messenger\msmsgs.exe <br/>C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe <br/>C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe <br/>C:\Programme\WinZip\WZQKPICK.EXE <br/>C:\Programme\Hardcopy\hardcopy.exe <br/>C:\Programme\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe <br/>C:\Install\HijackThis.exe <br/>C:\WINDOWS\system32\NOTEPAD.EXE <br/> <br/>R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kleinwalsertal.com/de/som/index.asp <br/>O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx <br/>O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe <br/>O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe <br/>O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe <br/>O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe <br/>O4 - HKLM\..\Run: [StatusClient] C:\Programme\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto <br/>O4 - HKLM\..\Run: [TomcatStartup] C:\Programme\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe <br/>O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime <br/>O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe <br/>O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background <br/>O4 - Startup: Hardcopy.LNK = C:\Programme\Hardcopy\hardcopy.exe <br/>O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Adobe\Acrobat 5.0\Distillr\AcroTray.exe <br/>O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe <br/>O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE <br/>O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE <br/>O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 <br/>O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe <br/>O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe <br/>O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab <br/>O17 - HKLM\System\CCS\Services\Tcpip\..\{5E6227CE-C8FC-4511-A693-D49679062C5E}: NameServer = 10.59.0.1 <br/>O17 - HKLM\System\CS1\Services\Tcpip\..\{5E6227CE-C8FC-4511-A693-D49679062C5E}: NameServer = 10.59.0.1 <br/>O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll <br/>O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll <br/>O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE <br/>O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe <br/>O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe <br/>O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Programme\Webroot\Spy Sweeper\WRSSSDK.exe <br/> <br/>Success I think?? <br/> <br/>BJ007
  • Unread posts or replies
  • No unread posts or replies
  • Unread Posts (Read Only Forum)
  • No Unread Posts (Read Only Forum)

Forum Information

Currently it is Monday, December 5, 2016, 3:43 PM (GMT +1)
There are a total of 61,160 posts in 13,449 threads.
In the last 3 days there were 2 new threads and 3 reply posts.

Who's online

This forum has 37,965 registered members. Please welcome our newest member, Old shape.
There are currently no users on-line.