What is start up item: Evayowoziqipu?

[thebobrose]

In XP (MSCONFIG) my startup list has Evayowoziqipu as an item. In the
command column it says: rundll32,exe "C:\WIN... In the location column it
says: SOFTWARE\Microsoft\Windows\Current Version\Run.

I can't delete this or make any other changes as the machine won't allow me
(Admin) to make "Admin changes."

 

[Lem]

In XP (MSCONFIG) my startup list has Evayowoziqipu as an item. In the
command column it says: rundll32,exe "C:\WIN... In the location column it
says: SOFTWARE\Microsoft\Windows\Current Version\Run.

I can't delete this or make any other changes as the machine won't allow me
(Admin) to make "Admin changes."

Almost certainly malware.

Start by downloading, updating, and running MalwareBytes AntiMalware.
http://malwarebytes.org/

Then read this advice from MVP PA Bear:

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis
log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use
(in conjuction with some other utilities). HijackThis will NOT fix
anything on its own, but it will help you to both identify and remove
any hijackware/spyware with assistance from an expert.

**Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html, or other appropriate forums for
review by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.


--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

 

[PA Bear [MS MVP]]

There is a very good chance that you are seeing the effects of a hijackware
infection!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup, http://aumha.net/viewforum.php?f=30
or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[Lem]

Lem wrote:

Use the links in PA Bear's own post. I copied from an old post of his
and some of the links may be out of date.

 

[PA Bear [MS MVP]]

<wink>

 

[Charles W Davis]

If your hard drive is the 8GB size, you will have other problems.

There is a very good chance that you are seeing the effects of a
hijackware infection!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

In XP (MSCONFIG) my startup list has Evayowoziqipu as an item. In the
command column it says: rundll32,exe "C:\WIN... In the location column it
says: SOFTWARE\Microsoft\Windows\Current Version\Run.

I can't delete this or make any other changes as the machine won't allow
me
(Admin) to make "Admin changes."

 

[Bald E Guy56]

In XP (MSCONFIG) my startup list has Evayowoziqipu as an item. In the
command column it says: rundll32,exe "C:\WIN... In the location column it
says: SOFTWARE\Microsoft\Windows\Current Version\Run.

I can't delete this or make any other changes as the machine won't allow me
(Admin) to make "Admin changes."

 

[Bald E Guy56]

In XP (MSCONFIG) my startup list has Evayowoziqipu as an item. In the
command column it says: rundll32,exe "C:\WIN... In the location column it
says: SOFTWARE\Microsoft\Windows\Current Version\Run.

I can't delete this or make any other changes as the machine won't allow me
(Admin) to make "Admin changes."

I couldn't find that 1 in the thousands of startup programs listed. May b a
nastie. http://www.superantispyware.com/download.html try the free edition.
Free but powerful. Make sure after u install it, 2 update it before your scan