Download Process Explorer by Systernals from http://www.sysinternals.com/Files/ProcessExplorerNt.zip
Download KillBox by Option^Explicit from http://www.thespykiller.co.uk/files/killbox.exe
And follow these directions so that you know how to boot into safe mode http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam
The rest of the fix will need to be done in safe mode.
Unzip Process Explorer and double click on procexp.exe
In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.
Once you see this screen click on each instance of mlljk.dll once and then click the kill button.
After you have killed all of the mlljk.dll's under winlogon click ok.
Next do a search for mlljk and look for any .ini or bak files or other dll's with either the same name or the file name in reverse (kjllm) & kill them as well (write down the name and full path of any you find, you will need to delete them later)
Now double click on explorer.exe and again click once on each instance of mlljk.dll then click the kill button.
Then also look for any .ini or bak files or reverse named dll's with either the same name or the file name in reverse & kill them as well. You may have found these already but look again.
Click on the Threads tab at the top.
Once you have done that click ok again.
Next run HijackThis and place a check beside each of the following:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com
O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\system32\mlljk.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O20 - Winlogon Notify: mlljk - C:\WINDOWS\system32\mlljk.dll
Now click fix checked and close HT.
Now click fix checked and close HijackThis.
Please copy the text in the Code box below(just the text between the lines), and paste it into a blank notepad window.
Save it as vundo.reg and in the save as type box choose all files.
Once you have saved it double click it and allow it to merge with the registry.
----------------
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}]
[-HKEY_CLASSES_ROOT\CLSID\{581F22DA-7202-4F21-AEF3-114787156016}]
[-HKEY_CLASSES_ROOT\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]
[-HKEY_CLASSES_ROOT\CLSID\{44240BB5-BD7D-4D49-A1AA-8AB0F3D3CB44}]
[-HKEY_CLASSES_ROOT\MSEvents.MSEvents]
[-HKEY_CLASSES_ROOT\MSEvents.MSEvents.1]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEvents.MSEvents]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEvents.MSEvents.1]
----------------
Now run killbox and type The FIRST ONE of the below lines into the box, select delete on reboot then press the red X button, say Yes to the prompt but No to reboot now.
C:\WINDOWS\system32\mlljk.dll
Then continue to type the lines in, in turn, and follow the above procedure every time, If it says file is missing, or if it says unable to delete then make a note of the file name and let us know when you reply.
Then repeat by typing in the full name of any of the reverse named .bak or .ini or other files that you discovered in the previous if there were any.
After you have input the last file name then click Yes to the first prompt, and Yes to Reboot now.
If your computer does not restart, restart it manually.
Also the messenger plus program you have installed often installs lop(a baddie) on your computer if it was installed with the "sponsor program'. But for now don't try to uninstall it or delete it with HT
After your computer has rebooted please run Hijackthis again and post a new HijackThis log.
