malware?

Hi! Since 2 days i have some prolem with strange IE windows popup... I've tried with SpyBot S&D without success (SB found virtumonde and something else , but can't succefully remove them!)
I tried also wiht other tools, finally with Karspersky Virus removal Tool...so here is my LOGCHECK.
Tanks in advance
G.

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\hohazoye.dll','');
QuarantineFile('c:\windows\system32\yoguyutu.dll','');
QuarantineFile('C:\WINDOWS\system32\yojapuye.dll','');
DelBHO('{955ce192-9e04-44cc-b186-e670b12b24b0}');
QuarantineFile('C:\WINDOWS\system32\fitozeba.dll','');
QuarantineFile('C:\WINDOWS\system32\refeyeka.dll','');
QuarantineFile('c:\windows\system32\watekoda.dll','');
DeleteFile('c:\windows\system32\watekoda.dll');
DeleteFile('C:\WINDOWS\system32\refeyeka.dll');
Deleteservice('bonjour service');
DeleteFile('c:\programmi\bonjour\mdnsresponder.exe');
DeleteFile('C:\WINDOWS\system32\fitozeba.dll');
DeleteFile('C:\WINDOWS\system32\yojapuye.dll');
DeleteFile('c:\windows\system32\yoguyutu.dll');
DeleteFile('C:\WINDOWS\system32\hohazoye.dll');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot:
- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Close all the programs and start only Internet Explorer!!!
- Repeat 3 log files in accordance with the [URL="http://virusinfo.info/showthread.php?t=9184"]rules[/URL].
- Switch Antivirus and, if you have - Firewall, on.
- Go On-Line
- Upload the quarantine over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Attach 3 logs to your new post..

Hi! I did what you said....[url]http://virusinfo.info/showthread.php?t=35953[/url]
so here is my new 3 logs.
Quarantine files already uploaded!

Thank you so much
G.
:xmas:

-[URL="http://virusinfo.info/showthread.php?t=9206"]Fix[/URL]
[CODE]
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
[/CODE] Reboot the system, [COLOR="Red"]update the database of AVZ [/COLOR]and repeat the log virusinfo_syscheck.zip and hijackthis.log

So here are my new log files (sorry...friday i forgot to update avz4 database)
:dry:

Thank you
G.

Your logs are without signs of malware now. You'd like to let only one Antivirus Solution - either ESET or Comodo- and update Java RE (the last version is 1.6_11).

But i use Comodo only like Firewall and Nod32 for Antivirus...is not correct? Do you think is better to use only one solution??
Bye
G.

[size="1"][color="#666686"][B][I]Добавлено через 51 минуту[/I][/B][/color][/size]

Ehm...maybe is nothing but Nod32 has locked and erased the follow file:
\system32\yojapuye.dll_old Win32/Agent.OOY trojan horse.
solved during an attempt to access files C:\Programmi\Mozilla Thunderbird\thunderbird.exe.
Uh?
Bye
G.

edit:
Nod 32 full scan has also fixed the follow malware problem:

C:\WINDOWS\system32\kizosewa.dll - Win32/Agent.OOY trojan horse -
C:\WINDOWS\system32\sovetayu.dll_old - una variante di Win32/Adware.Virtumonde.NDM

[QUOTE=gaianorm;325142]But i use Comodo only like Firewall and Nod32 for Antivirus...is not correct?[/QUOTE]I cannot see your settings for Comodo, but it's a Suite and includes as well as AV and FW-solutions.

yojapuye.dll - is a trojan horse, but yojapuye.dll_old is a renamed file, which not dangerous itself, but includes a malware signature. TIW ist's OK that it was been removed.