Results 1 to 2 of 2

Thread: Unusual Registry Entry

  1. #1
    linseym Guest

    Default Unusual Registry Entry

    Hello,
    This week i have had two unusual entries in the "HKLM/Software/Microsoft/Windows/CurrentVersion/Run
    These are as follows:
    Value Name: GfetifuloruzifulValue Data: rundll32.exe "C:\WINDOWS\ojarazoh.dll",e
    I deleted this entry but it came back repeatedly. In the end I had to move the dll file and just reboot the system that way. It came back with an error "could not find file" (obviously)

    Today this one appeared:
    Value Name: GfetifuloruzifulValue Data: rundll32.exe "C:\WINDOWS\ugubukukaseg.dll",e
    Every time I try to delete it from the registry it comes back again! I don't want to have to keep moving DLLs as there may be nothing wrong with them.
    Does anyone know what these registry settings are or what the files are?
    Have run a virus scan and it came back clean (using zonealarm extreme)
    Thanks.

  2. #2
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Unusual Registry Entry


    <blockquote><hr>linseym wrote:
    Hello,
    This week i have had two unusual entries in the "HKLM/Software/Microsoft/Windows/CurrentVersion/Run
    These are as follows:
    Value Name: GfetifuloruzifulValue Data: rundll32.exe "C:\WINDOWS\ojarazoh.dll",e
    I deleted this entry but it came back repeatedly. In the end I had to move the dll file and just reboot the system that way. It came back with an error "could not find file" (obviously)

    Today this one appeared:
    Value Name: GfetifuloruzifulValue Data: rundll32.exe "C:\WINDOWS\ugubukukaseg.dll",e
    Every time I try to delete it from the registry it comes back again! I don't want to have to keep moving DLLs as there may be nothing wrong with them.
    Does anyone know what these registry settings are or what the files are?
    Have run a virus scan and it came back clean (using zonealarm extreme)
    Thanks.
    <hr></blockquote>


    Go to this forum:

    http://www.bleepingcomputer.com/forums/forum22.html

    then get an account there, signin and post your HJT logs (only post the HJT logs after first properly reading the sticky posts or Topic Titles).

    The malware experts at bleepingcomputer will assist you....for free and with expert advise and guidance.

    Oldsod.
    Best regards.
    oldsod

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •