SMVERI32.DLL trojan, unable to delete

Welcome to Major Geeks!

Why are you running this PC with no protecion???

Please only attach the logs we ask for and do not run multiple scans unless we ask you to. In the READ & RUN ME, we clearly state to only run scans once and then attach the logs.

Your Malwarebytes log shows you took no action. Did you fix what it found? Make sure you always fix before saving the log rather than the other way around.

Your MGtools logs are incomplete. Please run the fix for Error Message Type 1 in this link Using MGtools but do not rerun MGtools yet.

Did you purchase XoftSpySE ?

Now we need to use ComboFix again.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Did you apply the MGtools fix for Error Type 1? I still see the same problem in your logs which are incomplete.

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.

You only installed it on 03-27-2009 so you had nothing before that date. And this is only an antispyware program and not a very good one. It is not an antivirus program nor is it a firewall. Also since all you have installed from XoftSpySE is a scan only version of XoftSpySE, it therefore does not provide any active protection. Thus you have none of the below required protections in place:

• antivirus
• antispyware
• firewall with true bidirectional operation (the Windows firewall is not adequate)

Let's get an antivirus and real firewall on your PC now before problems come back.

Download and install this: AntiVir Personal Edition Make sure you install updates after installing. Then reboot. Run a full scan of your PC. Don't worry about detections found in C:\QooBox or C:\System Volume Information. The first folder is just the Quarantine from ComboFix and the second is System Restore which we will fix later.

Now download and install this firewall: PC Tools Firewall Plus <-- make sure you uncheck the options to install Google Toolbar and Threatfire free edition. There's is no sense in installing excess baggage.

 

Are you sure about this? Did you actually run it from the command prompt as requested? You will not see the error messages by just double clicking on it from a Windows Explorer session.

We are going to fix it again since there is a hidden driver related to it.


Delete the current version of ComboFix that you have from your Desktop. Now download the new version to your Desktop from here:
Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner to clean out only temp files and nothing else!

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Back in message number 9 I asked the below and you did not answer this. MGtools is still not running properly and we need to determine why!

I suggest that you uninstall it, reboot. And then reinstall. Note I do see a left over driver from McAfee Firewall. Did you have McAfee installed at some point in time?

They are not errors and you should not be fixing them because I did not ask you to.

Your malware appears to be gone based on the logs we have but without seeing complete logs from MGtools, I cannot say for sure that you are clean. Also If MGtools is not running, it would normally mean you have somekind of problem within Windows. Malware rarely blocks MGtools from running. It is almost always a Windows related issue of some kind.