Avira found a virus, it couldn't be deleted. I could use some help. Thanks guys

That1Kid · Nov 9, 2010

I appreciate your guys' help. You guys are awesome

Code:

[B][U]Avira said this about the virus:[/U][/B]
"The file 'C:\Windows\System32\regsvcr.dll'
contained a virus or unwanted program 'TR/Vundo.4.29' [trojan]
Action(s) taken:
An error has occurred and the file was not deleted. ErrorID: 26003.
The file could not be deleted!
Attempting to perform action using the ARK library.
The file could not be copied to quarantine!
The file could not be deleted!"

Code:

[U][B]Malwarebytes Scan Results[/B][/U]:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5079

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11/9/2010 5:45:47 AM
mbam-log-2010-11-09 (05-45-47).txt

Scan type: Full scan (C:\|E:\|G:\|)
Objects scanned: 218767
Time elapsed: 33 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Code:

[U][B]Combofix Log:[/B][/U]

ComboFix 10-11-07.A2 - Whize Guy 11/09/2010   5:49.3.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.1252.1.1033.18.3325.2252 [GMT -5:00]
Running from: c:\users\Whize Guy\Downloads\ComboFix.exe
 * Created a new restore point
.

(((((((((((((((((((((((((   Files Created from 2010-10-09 to 2010-11-09  )))))))))))))))))))))))))))))))
.

2010-11-09 10:52 . 2010-11-09 10:52	--------	d-----w-	c:\users\Public\AppData\Local\temp
2010-11-09 10:52 . 2010-11-09 10:52	--------	d-----w-	c:\users\Family.WHIZEGUY\AppData\Local\temp
2010-11-09 10:52 . 2010-11-09 10:52	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-11-09 10:33 . 2010-11-09 10:33	--------	d-----w-	C:\avrescue
2010-11-08 06:52 . 2010-11-09 10:52	--------	d-----w-	c:\users\Whize Guy\AppData\Local\temp
2010-11-08 06:06 . 2010-04-29 20:39	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-11-08 06:06 . 2010-04-29 20:39	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-11-08 06:06 . 2010-11-08 06:06	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-11-07 05:22 . 2010-11-07 05:22	--------	d-----w-	c:\program files\Common Files\Java
2010-11-06 21:38 . 2010-11-06 21:38	--------	d-----w-	c:\program files\Application Updater
2010-11-01 00:34 . 2010-11-02 07:24	--------	d-----w-	c:\users\Whize Guy\AppData\Roaming\vlc
2010-11-01 00:34 . 2010-11-01 00:34	--------	d-----w-	c:\program files\VideoLAN
2010-10-31 17:49 . 2010-11-05 20:58	--------	d-----w-	c:\users\Family.WHIZEGUY\AppData\Local\Logitech
2010-10-31 01:42 . 2010-10-31 01:42	--------	d-----w-	c:\programdata\Logitech
2010-10-31 01:29 . 2010-10-31 01:32	--------	d-----w-	c:\users\Whize Guy\AppData\Local\Logitech
2010-10-30 19:43 . 2010-10-30 19:43	--------	d-----w-	c:\users\Whize Guy\AppData\Roaming\IObit
2010-10-30 19:43 . 2010-10-30 19:43	--------	d-----w-	c:\program files\IObit
2010-10-27 17:19 . 2010-11-01 19:09	--------	d-----w-	c:\users\Whize Guy\AppData\Roaming\FrostWire
2010-10-27 17:19 . 2010-10-27 17:19	--------	d-----w-	c:\program files\FrostWire
2010-10-27 15:47 . 2010-10-27 15:47	--------	d-----w-	c:\users\Family.WHIZEGUY\AppData\Local\LogiShrd
2010-10-27 03:06 . 2010-10-27 03:06	--------	d-----w-	c:\users\Whize Guy\AppData\Local\LogiShrd
2010-10-27 03:06 . 2010-10-27 03:06	--------	d-----w-	c:\users\Whize Guy\AppData\Roaming\Leadertech
2010-10-27 03:05 . 2010-10-31 01:42	--------	d-----w-	c:\program files\Logitech
2010-10-27 03:05 . 2010-10-27 03:06	--------	d-----w-	c:\program files\Common Files\Logishrd
2010-10-27 03:05 . 2010-10-27 03:05	--------	d-----w-	c:\users\Whize Guy\AppData\Local\Downloaded Installations
2010-10-27 03:04 . 2010-10-27 03:05	--------	d-----w-	c:\programdata\LogiShrd
2010-10-27 02:30 . 2010-10-27 02:31	--------	d-----w-	c:\program files\MonitorDriver
2010-10-27 02:29 . 2010-10-27 02:29	--------	d-----w-	c:\users\Whize Guy\AppData\Roaming\InstallShield
2010-10-18 00:54 . 2010-09-15 08:50	472808	----a-w-	c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2010-10-18 00:54 . 2010-09-15 08:50	472808	----a-w-	c:\windows\system32\deployJava1.dll
2010-10-13 06:30 . 2010-06-29 05:02	1413632	----a-w-	c:\windows\system32\ole32.dll
2010-10-13 06:30 . 2010-06-29 04:57	4247040	----a-w-	c:\program files\Windows NT\Accessories\wordpad.exe

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-03 18:50 . 2010-02-19 10:10	60936	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-11-03 18:50 . 2010-02-19 10:10	126856	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-09-08 15:17 . 2010-09-08 15:17	94208	----a-w-	c:\windows\system32\QuickTimeVR.qtx
2010-09-08 15:17 . 2010-09-08 15:17	69632	----a-w-	c:\windows\system32\QuickTime.qts
2010-08-22 22:20 . 2010-10-07 15:34	27648	----a-w-	c:\program files\FileKiller.exe
2010-08-21 05:32 . 2010-09-14 23:31	316928	----a-w-	c:\windows\system32\spoolsv.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-03 98304]
"DLCXCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-16 106496]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2010-08-03 1809992]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2010-08-03 3649096]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2010-08-03 358472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SetPointII.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SetPointII.lnk
backup=c:\windows\pss\SetPointII.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Whize Guy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^CurseClientStartup.ccip]
path=c:\users\Whize Guy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
backup=c:\windows\pss\CurseClientStartup.ccip.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^Whize Guy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]
path=c:\users\Whize Guy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk
backup=c:\windows\pss\Logitech . Product Registration.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 03:07	932288	----a-r-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 08:47	35760	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-03-05 15:32	1135912	----a-w-	c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLCXCATS]
2006-10-16 04:31	106496	----a-w-	c:\windows\System32\spool\drivers\w32x86\3\dlcxtime.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcxmon.exe]
2007-01-12 15:57	292336	----a-w-	c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 13:55	55824	----a-w-	c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2009-07-24 23:05	118640	----a-w-	c:\program files\Microsoft LifeCam\LifeExp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MemoryCardManager]
2006-11-03 21:04	304008	----a-w-	c:\program files\Dell Photo AIO Printer 926\memcard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2009-11-09 03:17	180224	----a-w-	c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-09-08 15:17	421888	----a-w-	c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44	248552	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe

R2 0302531284848941mcinstcleanup;McAfee Application Installer Cleanup (0302531284848941);c:\users\WHIZEG~1\AppData\Local\Temp\030253~1.EXE [x]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [2010-05-20 88176]
R3 cpuz130;cpuz130;c:\users\WHIZEG~1\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (HID);c:\windows\system32\DRIVERS\dc3d.sys [2009-11-04 17408]
R3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2009-07-25 30560]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-02-24 1343400]
R4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [x]
S0 amacpi;Microsoft Away Mode System;c:\windows\system32\DRIVERS\null.sys [2009-07-13 4608]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-08-04 176128]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]
S2 Application Updater;Application Updater;c:\program files\Application Updater\ApplicationUpdater.exe [2010-01-08 380928]
S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-05-11 20072]
S2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe [2006-10-11 532480]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-08-04 6096384]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-08-04 214016]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 19720]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 14856]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-07-14 01:14	126464	----a-w-	c:\windows\System32\advpack.dll
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8
FF - ProfilePath - c:\users\Whize Guy\AppData\Roaming\Mozilla\Firefox\Profiles\jgsinkdn.default\
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=634471&p=
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\Wat\npWatWeb.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(4800)
c:\progra~1\mcafee\sitead~1\saHook.dll
.
Completion time: 2010-11-09  05:54:22
ComboFix-quarantined-files.txt  2010-11-09 10:54
ComboFix2.txt  2010-11-08 06:52

Pre-Run: 256,573,779,968 bytes free
Post-Run: 256,519,651,328 bytes free

- - End Of File - - 8F9AEBA562600FF7812B73308F74D62B

Code:

[U][B]HiJackThis Log[/B][/U]:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:14 AM, on 11/9/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\System32\slui.exe
C:\Windows\Explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [DLCXCATS] rundll32 C:\Windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LgDeviceAgent] "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe"
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
O23 - Service: McAfee Application Installer Cleanup (0302531284848941) (0302531284848941mcinstcleanup) - Unknown owner - C:\Users\WHIZEG~1\AppData\Local\Temp\030253~1.EXE (file missing)
O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: dlcx_device -   - C:\Windows\system32\dlcxcoms.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe

--
End of file - 4868 bytes

Thanks again guys. Any help is greatly appreciated.

Jodape · Nov 9, 2010

I would do this, SMWN run Malware Bytes and Super Anti Spyware concurrently. Boot to normal, run Hitman and TDSS Killer together reboot. If they find anything you could do a follow up scan w/ Avira and see if it is clean.

KSoD · Nov 9, 2010

This is a vundo infection. It wont be cleaned out by any program like MBAM or Super AntiSpyware. You need to run Vundofix in order to get rid of these pesky infections.

VundoFix by Atribune

That1Kid · Nov 9, 2010

Thanks for the quick replies as always, guys.

Mak, I ran VundoFix, and it didn't find any infections. I'm running Avira scan again.

KSoD · Nov 9, 2010

Then the report from Avira is incorrect. Cause according to their report this was the type of infection found.

The file 'C:\Windows\System32\regsvcr.dll'
contained a virus or unwanted program 'TR/Vundo.4.29'

So it seems that Avira has reported something that shouldnt have been reported. Cause that file/program is fully legit. That is the command used by Windows to register a DLL to get it working again. This is the same command used to re-register bits to get Windows Update working after an infection. I think Avira is pulling your leg cause that is not a bad file and it is located in the right spot.

That1Kid · Nov 9, 2010

Awesome, that's a relief. I'm growing tired of Avira. I should look into another a/v. Thanks for all your help, Mak.

joelm3103 · Nov 10, 2010

You can give MSE a try

.

Avira found a virus, it couldn't be deleted. I could use some help. Thanks guys

That1Kid

Baseband Member

Jodape

Baseband Member

KSoD

Call me Mak or K, Mod Emeritus

That1Kid

Baseband Member

KSoD

Call me Mak or K, Mod Emeritus

That1Kid

Baseband Member

joelm3103

Fully Optimized

Similar threads