Virus Removal Help

[Temptation]

Hi there,

I have used AnAndTech before, years ago with another virus issue and people were super helpful so I figured Id give her another go!

I have attached a full HijackThis log below (with the : \ removed due to the fact it creates smiley faces...) but I have two issues which I cant seem to remove:

O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - http://content.systemrequirementslab.com/bin/srldetect_intel_4.5.24.0.cab

and

O23 - Service: duuwysugju32 - Unknown owner - C: \ Program Files\010\duuwysugju32.exe



HijackThis has been unable to remove these, and other software I have haven't even located them at all. The second one seems really bad. Any help would be very much appreciated.

Thanks,

Mike


___________

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 1:33:38 AM, on 16/12/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17496)

Boot mode: Normal
Running processes:
CProgram Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:Users\Mike\AppData\Roaming\BitTorrent\BitTorrent.exe
CProgram Files (x86)\Skype\Phone\Skype.exe
CPrrogram Files (x86)\Common Files\Java\Java Update\jusched.exe
CPrrogram Files (x86)\Adobe\Reader 11.0\Reader\Reader_sl.exe
C:Users\Mike\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.di.fm/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O4 - HKLM\..\Run: [SunJavaUpdateSched] "CProgram Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe ARM] "CProgram Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:Users\Mike\AppData\Roaming\BitTorrent\BitTorrent.exe" /MINIMIZED
O4 - HKCU\..\Run: [Skype] "CProgram Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\RunOnce: [Adobe Speed Launcher] 1418718773
O8 - Extra context menu item: E&xport to Microsoft Excel - res://CPROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - CPROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - CPROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - CPROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - http://content.systemrequirementslab.com/bin/srldetect_intel_4.5.24.0.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - CProgram Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:Windows\System32\alg.exe (file missing)
O23 - Service: duuwysugju32 - Unknown owner - CProgram Files\010\duuwysugju32.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:Windows\system32\fxssvc.exe (file missing)
O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - CProgram Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - CProgram Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - CProgram Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - CProgram Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - CProgram Files (x86)\Common Files\Steam\SteamService.ex

 

[PliotronX]

Clean with this and then this then let's see if anything is left

 

[Temptation]

Thank you very much! The first program killed the Trojan and Malware cleaned up some other files.

 

[Chiefcrowe]

I would highly recommend restarting again, and then running the 2 programs a 2nd time just in case there are some remnants.

Thank you very much! The first program killed the Trojan and Malware cleaned up some other files.

 

[JuliaQualls]

Great to have this nice idea for the removal of virus. It is great to install the antivirus to remove the viruses.

 

[John Connor]

I have attached a full HijackThis log below (with the : \ removed due to the fact it creates smiley faces...) but I have two issues which I cant seem to remove:

If you want to make sure something like :/ isn't turned into a smiley just click Go advanced and use the advanced editor for your post and click the option Disable smilies in text.

If you keep getting viruses consider Sandboxie and Bitdefender free.

Superantispyware is a good scanner too. I use that with malwarebytes and each finds what the other doesn't. I use a bunch of scanners though about twice a month. Herdprotect uses 68 virus engines, but it will take a long time to scan. If you use OpenDNS Herdprotect won't work in the cloud. You will have to temp use a different DNS setting in your network adapter or use a VPN while Herdprotect scans the computer. I still have to find out what domains are being blocked with Herdprotect in OpenDNS so that I can unblock them.