efcyyvt.dll is kicking my butt!
I'm really hoping that someone can give me a 2nd opinion. There must be *something* I'm missing and it's becoming a very unhealthy obsession. LOL (At least that's what my husband tells me!)
We rebuild my system last week. Prior to moving any of my files from the old PC to the new, I ran scans and checks on everything making sure it was clean. Also, I wasn't having infection problems on my old system so I'm relatively sure this is a new problem and not something I transferred from system to system.
I am running Windows XP - service pack 2 is installed.
My virus scanner is McAffee Total Protection and is up-to-date with all updates.
Ad-Aware 2007 version 0012.0000 is installed and up-to-date.
Spybot-Search and Destroy 1.4 is installed and up-to-date.
IE is my default browser - however 99% of the time I use Firefox. (I noticed an immediate decline in the number of pop-ups I had to deal with by using Firefox instead of IE.
However, when Firefox was set as my default browser - I had just as many.)
History, temporary internet files and cookies are deleted everytime I close the browser.
I am running Spyware Blaster version 3.5.1 - updates complete and all protections are enabled.
ATF-Cleaner is installed and I use it, frequently.
Trend Micro Hijack This - version 2 is installed in its own directory, not on the desktop.
Vundo Fix is run daily.
Online virus scanner - CA
08-03-07 found the following:
css4[1] Win32/Vundo!generic deleted C:\Documents and Settings\Kellie\Local Settings\Temporary Internet Files\Content.IE5\5SENU1JG\
css4[1] Win32/Vundo!generic deleted C:\Documents and Settings\Kellie\Local
Settings\Temporary Internet Files\Content.IE5\HZOA35FU\
css4[1] Win32/Vundo!generic deleted C:\Documents and Settings\Kellie\Local
Settings\Temporary Internet Files\Content.IE5\ZV2LOJI5\
backup-20070801-164032-702.dll Win32/Chisyne!generic deleted C:\Hijack\backups\
awtss.dll.bad Win32/Vundo!generic deleted C:\VundoFix Backups\
ddccc.dll.bad Win32/Vundo!generic deleted C:\VundoFix Backups\
geedc.dll.bad Win32/Vundo!generic deleted C:\VundoFix Backups\
qespsxle.exe.bad Win32/Secdrop.OF deleted C:\VundoFix Backups\
sstts.dll.bad Win32/Vundo!generic deleted C:\VundoFix Backups\
efcyyvt.dll Win32/Chisyne!generic cannot delete C:\WINDOWS\system32\
jquhytda.dll Win32/Darksma!generic deleted C:\WINDOWS\system32\
pmnll.dll Win32/Vundo!generic cannot delete C:\WINDOWS\system32\
rkficesp.dll Win32/Darksma!generic deleted C:\WINDOWS\system32\
yjwericp.dll Win32/Darksma!generic deleted C:\WINDOWS\system32\
14 viruses detected - 12 were deleted
remaining infected files:
c:\windows\system32\efcyyvt.dll
c:\windows\system32\pmn.dll
*The thing I found interesting with this is that the only website I went to was the online CA virus scanning page. I had cleared my temporary internet files BEFORE the scan began, yet the scan found and deleted additional files.
I then attempted to run Spybot Search and Destroy in safe mode - however, the program ran for an hour and never actually did anything.
I then attempted to log in in safe mode with a c prompt to delete efcyyvt.dll and pmn.dll - but I wasn't able to either delete or rename the files because they were both in use by another program. According to task manager the only thing that was running was explorer and task manager.
Should I be deleting the Hijack This backup files?
Ugggh.
Here is my Hijack This log:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 3:30:18 PM, on 8/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myagttry.exe
C:\Program Files\SiteAdvisor\6021\SiteAdv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
C:\Program Files\SiteAdvisor\6021\SAService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Hijack\HiJackThis_v2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.kelliewaltondesigns.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program
Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program
Files\SiteAdvisor\6021\SiteAdv.dll
O2 - BHO: (no name) - {2D4813F9-0D51-4273-9784-BFC15C3FB9F3} - (no file)
O2 - BHO: (no name) - {52AAE82D-7178-4673-8525-5A6AEE00D0DB} - C:\WINDOWS\system32\sstts.dll
(file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {67475B4D-150D-44A4-B5DD-BC80D4C9361F} -
C:\WINDOWS\system32\efcyyvt.dll
O2 - BHO: (no name) - {CA15C5D6-2BD4-4794-93B8-520A5E6570EC} - C:\WINDOWS\system32\awtss.dll
(file missing)
O2 - BHO: (no name) - {ECA2687F-3232-49D5-9D63-731E8F36F6C9} - C:\WINDOWS\system32\ddccc.dll
(file missing)
O2 - BHO: (no name) - {F80D34EC-A282-4CA8-881B-66FD837A2659} - C:\WINDOWS\system32\pmnll.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program
Files\SiteAdvisor\6021\SiteAdv.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe
O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed
VirusScan\Agent\myagttry.exe"
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6021\SiteAdv.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader
8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft
Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search &
Destroy\TeaTimer.exe
O4 - Global Startup: Free WebSite Tools.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) -
http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/wind...b_site.cab?118
5663719436
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -
http://www.ca.com/us/securityadvisor...fo/webscan.cab
O20 - Winlogon Notify: ddccc - C:\WINDOWS\
O20 - Winlogon Notify: efcyyvt - C:\WINDOWS\SYSTEM32\efcyyvt.dll
O20 - Winlogon Notify: pmnll - C:\WINDOWS\system32\pmnll.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} -
C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon -
{8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program
Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common
Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McShield - McAfee, Inc. - C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe
O23 - Service: McAfee Virus and Spyware Protection Service (myAgtSvc) - McAfee, Inc. -
C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program
Files\SiteAdvisor\6021\SAService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices,
Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 6195 bytes
Here is my VundoFix log. Note - this morning it was completely clean, then after I ran it after the CA online virus scan (the only website I visited) it found 3 vundo files, deleted them and now it's again clean.
VundoFix V6.5.6
Checking Java version...
Scan started at 8:17:43 AM 8/3/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.6
Checking Java version...
Scan started at 3:32:31 PM 8/3/2007
Listing files found while scanning....
C:\WINDOWS\system32\llnmp.bak1
C:\WINDOWS\system32\llnmp.ini
C:\WINDOWS\system32\pmnll.dll
Beginning removal...
Attempting to delete C:\WINDOWS\system32\llnmp.bak1
C:\WINDOWS\system32\llnmp.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\llnmp.ini
C:\WINDOWS\system32\llnmp.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\pmnll.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.6
Checking Java version...
Scan started at 3:37:33 PM 8/3/2007
Listing files found while scanning....
No infected files were found.
Then I ran Ad-Aware, 13 cookies was all that was found and removed. (I didn't post the log because it was huge, but I can do so if needed.)
Search & Destroy reports no immediate threats were found.
So, to the best of my knowledge - the only thing remaining on my PC is this stupid efcyyvt.dll that I can't seem to make disappear. Any suggestions?
I'm no longer getting IE pop-ups but I am getting pop ups from Search and Destroy that something is trying to change a registry setting. This happens if my sytem is idle for 20 minutes or so. If I walk away and come back - it's pretty much guarenteed I'm going to get that notification.
Also, is there something else that I should be doing browser-wise? I just don't understand why all of a sudden everytime I go online I get a vundo infection. Between spywareblaster and high security settings in my browser (along with my obsessive scanning!) plus a virus scanner and a router - I just would have thought I had all my bases covered.
Thanks in advance - the restoring of my sanity will be greatly appreciated.
Kellie.
