New Poly Win32 Infection

I was having a problem with that whenever flash player opened internet explorer would shut down. Ran Ad-Aware SE Personal and removed 3 occurrences of virtumonde. This resolved the flash player problem. Then McAfee gave me an alert that New Poly Win32 had been detected. I could not clean nor quarantine the infection. Researched the virus and took the following course of action ran SpSeHjfix it showed no infection, ran CWSredder it showed no problems, ran CleanUp!--Not sure if this was right or not--Ran an online Trend Micro adware scan and found and removed a downloader (no details provided). FOUND READ & RUN ME FIRST Before Asking for Support AND FOLLOWED PROCEDURE!
Note: Clean.txt is a copy of READ & RUN ME FIRST Before Asking for Support. Removed WildedTangentDriver, Demo Games associated with it, and removed MySearchWeb from Add/Remove Programs. Primary Question: is New Poly Win32 gone, while run the procedures McAfee stopped a script from opening a file (I had never seen this type of warning before). Secondary Question: How do I remove weather bug, zango, and funweb? Thanks.

 

Here are the rest of the logs.

 

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O11 - Options group: [INTERNATIONAL] International*

O20 - Winlogon Notify: jkklm - C:\WINDOWS\system32\jkklm.dll (file missing)

Again, make sure ALL browser windows are closed when you click FIX.

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Next, run CCleaner to clean up cookies and temp files.

Next Reset Web Settings & Default Security Settings

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.

After you complete the above, I need you to run one more CounterSpy scan and this time remove all found infections then attach the log with a fresh HJT log. Also please let me know how things are running.

 

I have followed your instructions and things are running well with one exception. CounterSpy keeps giving this messages, "ActiveProtection has allowed the change of your Local Page to C:\WINDOWS\systems32\blank.htm. Sometimes this message goes into a endless loop and I have to restart. Also I have downloaded ie7(sp2) and before installation I am to desable programs like CounterSpy and I have no idea how to disable CounterSpy. By the way, provided that everything checks out, after I toggle the XP restore fuction should I rehide my system files. Thanks.

 

Your logs look good, if you installed CounterSpy as part of the READ ME you can now uninstall it.

You can also rehide your system files, actually I would just "Default" the settings.

Are you having any further problems?