MBR Rootkit and Mirar remnants

Hi. I'm so grateful that there are people like you taking time to address the issues of the somewhat "less clueful" such as myself.

My issues involve Mirar in my add-remove programs list, a presumably orphan Type Lib Ref that CCleaner thinks it has deleted but which keeps showing up, and MBR Rootkit detected in C and D drives during a RootRepeal scan.

About two weeks ago our browser got hijacked, and, when I was resetting everything through the "manage add-ons" tool, the Mirar toolbar wanted to come along for the ride. I deleted it from the add-ons, and temporarily everything seemed to have returned to normal. But I discovered that things were running slower, popups were--well--popping up, and sometimes the internet connection would freeze up. A few Norton scans reduced the number of incidents, but things still weren't perfect.

That's when I discovered Mirar in my add-remove programs list, although the uninstall tool (which I presume belongs to Mirar, and they don't want me to uninstall in the first place) says it can't find Mirar on my system.

So I decided to run CCleaner, including the registry cleaner. But one entry, which the registry cleaner keeps telling me it has deleted, keeps showing up on the next subsequent scan. I don't know if it's related to Mirar--or if it's even a problem at all--but its persistence is puzzling. The line reads:

Missing Type Lib Reference
Data: IWinPwdSvc-{BD726167-A7B6-48d7-BC7F-165855EDF956}
Reg Key: HKCR\Interface\{C0282E26-E060-44c9-B0FF-1AC71180D653}

I then decided to consult you folks, and first followed the instructions in the READ ME FIRST post. That's when I discovered, during the RootRepeal scan, the message that, in Volume C:\ and Volume D:\, "MBR Rootkit detected!" All the other sectors (1 through 62 in both C and D) said "sector mismatch" (huh?).

By the way, I ended up running MGtools from the desktop because the computer said only the administrator was authorized to create a C:\ file, however the user name I was using is also the administrator, so, again, "huh?". Oh, well.

I'm attaching the first four logs as per the READ ME FIRST post, and will attach the fifth log to a second post.

Thank you for whatever help you can provide and for the time you spend doing this stuff for all of us.

By the way, I had to ru

 

MBR Rootkit & Mirar - 5th log attachment

Hi, here's the attachment with the MGtools log. Thanks.

 

Thank you so much. I guess I'm stuck having Mirar in my add-delete programs list, since there seems to be no way to remove it, but at least I know now that, as with the RootRepeal report, the scary implication is invalid.

Vis a vis the registry cleaner, I ran that before I came to your site. I was hoping that if the Mirar title in the programs list was actually an orphan, the reg cleaner might remove it, but no such luck. I gather you don't recommend registry cleaning at any time.

Thanks again, from another happy "customer".

 

Yea, I received a success message, and yes, Mirar has disappeared from my add-remove programs list. Thanks again.