Welcome. Thank you for using Dell Community Forums. :)

That is quite a collection of malware. I cannot guarantee that we can fix all the damage it has done, but we'll try. It will take a few days.

* Please let me know if you have posted this log on another forum.

* I will not handle your log if you are using any cracked software, so if you are, either remove it, or repost your log in a New Message so that someone else will have the option of continuing with it.

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.
Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple, file sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. Even if you change those risky default settings to a safer configuration, the act of downloading files from an anonymous source greatly increases your exposure to infection. That is because the files you are downloading may actually contain a disguised threat. Many very malicious worms and trojans, such as the Storm Worm, target and spread across P2P files sharing networks because of their known vulnerabilities.
Since I find the nature of P2P programs counter productive to restoring your PC to a healthy state, please remove all P2P file sharing programs prior to my providing you with malware removal assistance.

* Please let me know if you are an employee and this system is owned by your employer. If so, do you have permission to make changes to it?

* Please print or copy all instructions to Notepad in order to assist you when carrying out procedures.
In some cases you may be working in Safemode and you will not have the internet available to read information. Please follow all instructions in sequence.

* If your reply does not fit in one post, please reply to yourself until all text is submitted. It may take several posts.

Please download Navilog1 by IL-MAFIOSO:
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.zip

* Extract its contents to the desktop.
* Double click on navilog1.exe to install it on your computer.
* When the installation is complete, the tool will start automatically.
* If it doesn't start automatically, please double click on Navilog1 shortcut on your desktop to run it.
* Press E for English from the language Menu.
* Type 1 in the next Menu to select Search and press Enter.
* Wait for the Scan to finish (It may take a reasonable amount of time)
* Press any key as requested .
* A new document will be produced: fixnavi.txt.
* Please copy/paste the contents of this report in your next reply.

The report is also saved in the root of the directory, "% SystemDrive%\ fixnavi.txt". (usually C:\fixnavi.txt)

You did not answer my question about being an employee. Are you a homeuser?
Please check Add/Remove Programs. If AVsystemcare is listed there, uninstall it.

Please download Combofix from here:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
** Take note that the link is case sensitive

Save ComboFix to the desktop.

1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new HijackThis log.
4. Please post an an extra report:
Please launch Hijackthis again. At the Main window select "Open the misc tool section"
Then select "Open uninstall manager"
Then "save list" and save it to your desktop.

Copy and paste that list as a reply to this thread. Thanks.

Note:
Do not mouseclick Combofix's window while it is running. That may cause your system to stall/hang.
Do not proceed with the rest of the fix if you fail to run ComboFix.


Note: The above instructions have been created specifically for this user. If you are not this user, do NOT follow these directions.

These are the results of my new HijackThis scan:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:12, on 2007-10-15
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Common Files\AOL\1169982853\ee\AOLSoftware.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Mobile Action\Bluetooth Manager\MaBtSh.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O2 - BHO: (no name) - {27CF1C68-19A6-58A8-F34A-D75AF141C93E} - (no file)
O2 - BHO: (no name) - {380C904F-55CD-338E-24B0-013D0423F1B0} - (no file)
O2 - BHO: (no name) - {44E12371-18A5-CADE-1043-D0FDEEBCF1CB} - (no file)
O2 - BHO: (no name) - {50B91207-4289-28BE-FC70-4CE72F0402CB} - (no file)
O2 - BHO: (no name) - {54351455-EFE9-7EFE-3393-B2622AF47B0F} - (no file)
O2 - BHO: (no name) - {651214D8-15FD-F7BB-3AF2-BA7967C08710} - (no file)
O2 - BHO: (no name) - {6F2EB59A-6F50-8B14-0D7D-BCC43DC7177A} - (no file)
O2 - BHO: (no name) - {77A8711A-0D8F-49B8-6DFB-AE85E05A493A} - (no file)
O2 - BHO: (no name) - {7FE16BED-1E1A-0F9A-E962-90627CF19B7B} - (no file)
O2 - BHO: (no name) - {801F3199-8EAB-0036-12D6-35DEE31205DC} - (no file)
O2 - BHO: (no name) - {8F7D04CA-6D30-6286-E432-22FFB0FB128A} - (no file)
O2 - BHO: (no name) - {916EEA1B-BCB7-4A5B-522D-4623137184B4} - (no file)
O2 - BHO: (no name) - {94BD1A37-5653-88A2-1E65-7852D1BEE72F} - (no file)
O2 - BHO: (no name) - {A72F96DF-A4F3-57A8-1C3A-8C57E40658C5} - (no file)
O2 - BHO: (no name) - {D6A0E97F-3C18-7E5D-E033-44852E515B86} - (no file)
O2 - BHO: (no name) - {E00B6257-B5AF-B5AF-80E5-5F0087457F4F} - (no file)
O2 - BHO: (no name) - {F18949DB-2CBC-81C3-5DC7-B25366CB61D4} - (no file)
O2 - BHO: (no name) - {F7375AC2-A5D6-EEBC-9B5B-3DFA6FA5DD51} - (no file)
O2 - BHO: (no name) - {FA682029-FE62-181C-B031-3233A3C5A91E} - (no file)
O2 - BHO: (no name) - {FA78BCF6-1C11-1477-172D-2FA8B8257F0B} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MMTray] C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1169982853\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [MaBtSh] C:\Program Files\Mobile Action\Bluetooth Manager\MaBtSh.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {E008A543-CEFB-4559-912F-C27C2B89F13B} (Domino Web Access 7 Control) - https://domino1.ncat.edu/dwa7W.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä #·ºÄÖ`I) - Unknown owner - C:\WINDOWS\apibv.exe (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: dlbx_device - Dell - C:\WINDOWS\system32\dlbxcoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 7466 bytes

 

You're welcome. We have more to do...

Please go to Add/Remove Programs and remove these:

Shopping Wizard
Search Extender


Open Notepad and copy/paste the following bold text between the dotted lines into it. Do not copy the dotted lines.

-----------------------------------------------------------------------------------------------

File::
C:\WINDOWS\dravic.exe
C:\WINDOWS\dravis.exe
C:\WINDOWS\SYSTEM32\sulimo.dat
C:\WINDOWS\xlavra2.exe


Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{27CF1C68-19A6-58A8-F34A-D75AF141C93E}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{380C904F-55CD-338E-24B0-013D0423F1B0}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{44E12371-18A5-CADE-1043-D0FDEEBCF1CB}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{50B91207-4289-28BE-FC70-4CE72F0402CB}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{54351455-EFE9-7EFE-3393-B2622AF47B0F}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{651214D8-15FD-F7BB-3AF2-BA7967C08710}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{6F2EB59A-6F50-8B14-0D7D-BCC43DC7177A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{77A8711A-0D8F-49B8-6DFB-AE85E05A493A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{7FE16BED-1E1A-0F9A-E962-90627CF19B7B}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{801F3199-8EAB-0036-12D6-35DEE31205DC}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{8F7D04CA-6D30-6286-E432-22FFB0FB128A}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{916EEA1B-BCB7-4A5B-522D-4623137184B4}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{94BD1A37-5653-88A2-1E65-7852D1BEE72F}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{A72F96DF-A4F3-57A8-1C3A-8C57E40658C5}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{D6A0E97F-3C18-7E5D-E033-44852E515B86}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{E00B6257-B5AF-B5AF-80E5-5F0087457F4F}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{F18949DB-2CBC-81C3-5DC7-B25366CB61D4}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{F7375AC2-A5D6-EEBC-9B5B-3DFA6FA5DD51}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{FA682029-FE62-181C-B031-3233A3C5A91E}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Browser Helper Objects\{FA78BCF6-1C11-1477-172D-2FA8B8257F0B}]



--------------------------------------------------------------------------------------------------------

Save this as CFScript.txt



Referring to the picture above, drag CFScript into ComboFix.exe
You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix.
CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

When finished, a log is produced here: C:\ComboFix.txt

Please provide the contents of the new ComboFix log in your next reply along with a new HijackThis log, and let me know how things are running.

Do you know what this is?
KillUnin.bat

Two weeks ago you did not post the required logs for review, so that I could see if the infection was completely removed. Apparently it has regenerated because there were some remnants still in there.

Please download the OTMoveIt by OldTimer

• Save it to your desktop.
• Run the tool by clicking on the icon.
• Click the Cleanup button.
• The tools that we used as well as this one will be removed from your system.

After you have done that, please post a fresh Hijackthis log, so we can begin again.

According to your log, the infections that you had last month did not return. You remained vulnerable because last month's fix was not completed.
We will not be able to fix these multiple infections with delayed replies, because there is a chance that the malware will return in the interim.
Please let me know when you will have time to work on a fix that requires replies within 24 hours. Thanks.