Hi WhatTheTech,

I came here for a virus problem once before, and this web site saved me. Sadly (happily?) I'm back for more.

A few weeks ago, my McAfee thing started popping up saying that it was finding Trojans. This concerned me, so I decided to download a new McAfee too just to make sure. (Sorry for the lack of details here; this was a few weeks ago, and I'm not fully recalling everything I did). In a general clean-up mood, I downloaded RevoUninstaller, which helped me to uninstall some things that didn't look terribly important to my un-educated eyes. Even as I type this, that sounds dumb.

Several days later, I started experiencing regular – like, several times per minute sometimes, though sometimes I'll go 15-20 minutes without it – pop-ups that say something along the lines of " A file that is required to run search companion cannot be found. You may need to run setup." This pop-up repeats over itself several times if I ignore it, though I can "X" out if it too. Every maybe 10th time (I haven't counted, but that sounds right), there will be a message saying that a [something I didn't think to copy] .exe is having an error. The .exe starts with 'x' and I will write down the whole series of numbers next time I see it. Grrr.

Oh, and thanks to Dell's lovely pre-installation policy, I do not have the Windows XP CDs to even try to run Setup.

So, oh wise ones, any words of advice? Or is this the excuse I've been waiting for to by a shiny new mac? :) Hijack this log is below:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:14 PM, on 9/7/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3

(6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program

Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common

Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTr

ay.exe
C:\Program Files\Common

Files\AOL\1147558229\ee\AOLSoftware.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common

Framework\UdaterUI.exe
C:\Program Files\McAfee\Common

Framework\McTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google

Updater\GoogleUpdater.exe
C:\Program Files\Common Files\Apple\Mobile

Device

Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
C:\Program Files\McAfee\Common

Framework\FrameworkService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfSe

rvice.exe
C:\Program

Files\Dell\NICCONFIGSVC\NICCONFIGSVC.ex

e
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAg

ent.exe
C:\WINDOWS\eHome\ehmsas.exe
c:\program files\common

files\installshield\updateservice\isuspm.exe
C:\Program Files\Common

Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Common

Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend

Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://www.netflix.com/WatchNow?lnkctr=mhW

N
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet

Connection Wizard,ShellNext =

http://www.dell.com/
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

- C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) -

{0E11766B-A755-45DC-9BCE-A6548922301C} -

C:\Program Files\Messenger\meroxed4444.dll

(file missing)
O2 - BHO: (no name) -

{17463E59-97E9-4281-B325-85F7E41223F1} -

C:\WINDOWS\system32\pmnnm.dll (file

missing)
O2 - BHO: McAfee Anti-Phishing Filter -

{41D68ED8-4CFF-4115-88A6-6EBB8AF19000} -

c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: DriveLetterAccess -

{5CA3D70E-1895-11CF-8E15-001234567890} -

C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: scriptproxy -

{7DB2D5A0-7241-4E79-B68D-6309F01C5231} -

C:\Program Files\McAfee\VirusScan

Enterprise\scriptcl.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO -

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

- C:\Program

Files\Google\GoogleToolbarNotifier\2.1.1119.173

6\swg.dll
O2 - BHO:

{e8dba601-6333-74da-fd04-6c77d325ba7c} -

{c7ab523d-77c6-40df-ad47-3336106abd8e} -

C:\WINDOWS\system32\wwgtwxnx.dll (file

missing)
O2 - BHO: (no name) -

{FBA6FC02-0A43-4726-90C8-328A9E3C6E47} -

C:\Program Files\Messenger\meroxed83122.dll

(file missing)
O3 - Toolbar: McAfee VirusScan -

{BA52B914-B692-46c4-B683-905236F6F655} -

c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [ehTray]

C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [igfxtray]

C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd]

C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers]

C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager

UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp]

stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program

Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program

Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla]

C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup]

"c:\Program Files\Common

Files\InstallShield\UpdateService\isuspm.exe"

-startup
O4 - HKLM\..\Run: [ISUSScheduler]

"C:\Program Files\Common

Files\InstallShield\UpdateService\issch.exe"

-start
O4 - HKLM\..\Run: [VSOCheckTask]

"C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.ex

e" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program

Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe]

c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe]

c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe]

C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.

exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE]

C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.e

xe
O4 - HKLM\..\Run: [BuildBU]

c:\dell\bldbubg.exe
O4 - HKLM\..\Run: [VirusScan Online]

C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe]

C:\PROGRA~1\McAfee.com\PERSON~1\MpfTr

ay.exe
O4 - HKLM\..\Run: [HostManager] C:\Program

Files\Common

Files\AOL\1147558229\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program

Files\Common

Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program

Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [50189318] rundll32.exe

"C:\WINDOWS\system32\noopsbbu.dll",b
O4 - HKLM\..\Run: [googletalk] C:\Program

Files\Google\Google Talk\googletalk.exe

/autostart
O4 - HKLM\..\Run: [Adobe Reader Speed

Launcher] "C:\Program Files\Adobe\Reader

8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Google Desktop Search]

"C:\Program Files\Google\Google Desktop

Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AppleSyncNotifier]

C:\Program Files\Common Files\Apple\Mobile

Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task]

"C:\Program Files\QuickTime\QTTask.exe"

-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program

Files\McAfee\VirusScan

Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI]

"C:\Program Files\McAfee\Common

Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKCU\..\Run: [ModemOnHold]

C:\PROGRAM

FILES\NETWAITING\NETWAITING.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program

Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Google Updater.lnk =

C:\Program Files\Google\Google

Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to

Microsoft Excel -

res://C:\PROGRA~1\MICROS~4\OFFICE11\EX

CEL.EXE/3000
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program

Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program

Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) -

{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} -

c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee

Anti-Phishing Filter -

{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} -

c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~4\OFFICE11\REFIE

BAR.DLL
O9 - Extra button: Share in Hello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} -

C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello -

{B13B4423-2647-4cfc-A4B3-C7D56CB83487} -

C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Real.com -

{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem:

@xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger

- {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O16 - DPF:

{05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8}

(Office Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF:

{17492023-C23A-453E-A040-C7C580BBF700}

(Windows Genuine Advantage Validation Tool) -

http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF:

{5F8469B4-B055-49DD-83F7-62B522420ECC}

(Facebook Photo Uploader Control) -

http://upload.facebook.com/controls/FacebookP

hotoUploader.cab
O18 - Protocol: skype4com -

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1

.DLL
O20 - AppInit_DLLs:

C:\PROGRA~1\Google\GO333C~1\GOEC62~1.

DLL
O20 - Winlogon Notify: gfuctoan - gfuctoan.dll

(file missing)
O20 - Winlogon Notify: pmnommk -

pmnommk.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. -

C:\Program Files\Common Files\Apple\Mobile

Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: DSBrokerService - Unknown

owner - C:\Program

Files\DellSupport\brkrsvc.exe
O23 - Service: Google Desktop Manager

5.7.805.16405

(GoogleDesktopManager-051608-133132) -

Google - C:\Program Files\Google\Google

Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) -

Google - C:\Program

Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager

(IDriverT) - Macrovision Corporation -

C:\Program Files\Common

Files\InstallShield\Driver\1050\Intel

32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. -

C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service

(McAfeeFramework) - McAfee, Inc. - C:\Program

Files\McAfee\Common

Framework\FrameworkService.exe
O23 - Service: McAfee WSC Integration

(McDetect.exe) - McAfee, Inc - c:\program

files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee McShield (McShield) -

Unknown owner - C:\Program

Files\McAfee\VirusScan Enterprise\mcshield.exe

(file missing)
O23 - Service: McAfee Task Manager

(McTaskManager) - Unknown owner -

C:\Program Files\McAfee\VirusScan

Enterprise\vstskmgr.exe (file missing)
O23 - Service: McAfee Task Scheduler

(McTskshd.exe) - McAfee, Inc -

c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update

Manager (mcupdmgr.exe) - McAfee, Inc -

C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.ex

e
O23 - Service: McAfee Personal Firewall Service

(MpfService) - McAfee Corporation -

C:\PROGRA~1\McAfee.com\PERSON~1\MpfSe

rvice.exe
O23 - Service: NICCONFIGSVC - Dell Inc. -

C:\Program

Files\Dell\NICCONFIGSVC\NICCONFIGSVC.ex

e
O23 - Service: Dell Wireless WLAN Tray Service

(wltrysvc) - Unknown owner -

C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 11172 bytes