Another Hijacked Desktop

Run the steps in the below link and post the smitfiles.txt log as an attachment

Smitfraud, SpySheriff, SpyAxe & PSGuard Removal

 

Some of the stuff is in you MS Antispyware Quarantine. You should just empty that.

You can boot into safe mode and use Windows Explorer to delete the below:
C:\WINDOWS\SYSTEM32\MYDLL.dll

I would also suggest posting a new HJT log now so we can continue with additional cleanup.

 

You last log was from safe mode. We alway need logs from normal boot mode except in special circumstances (and we would tell you that). You also have not disabled using msconfig to control startups as requested when you follow the links in step 7 of the READ ME. Please select Normal Startup. Also Spybot should not be running when getting you HJT log. Why is it running at startup?

Did you know you still have Symantec Security Center installed and running?

Please address the above an post a new HJT log from normal boot mode.

 

You should goto Add/Remove programs and uninstall Viewpoint Manager. This was covered in step 0 of the READ ME.

Are the below lines for something you installed?
O4 - HKLM\..\Run: [stockmat] C:\Program Files\Stockmat\StockMatClient.exe
O4 - HKCU\..\Run: [EmergencyAutoRun] C:\DigiNet_Center\EmergencyMonitor.exe
O9 - Extra button: IESideBar - {DFEFF09F-785E-4191-8E5D-A7650A1C4F9A} - shdocvw.dll (file missing)
O9 - Extra 'Tools' menuitem: IESideBar - {DFEFF09F-785E-4191-8E5D-A7650A1C4F9A} - shdocvw.dll (file missing)

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v4/vet_install_popup.pl?1&6&04.00.09.13&unknown&unknown&http://www.sonystyle.com/is-bin/INTERSHOP.enfinity/eCS/Store/en/-/USD/SY_DisplayProductInformation-Start?ProductSKU=KDE42XBR950&Dept=tvvideo&CategoryName=tv_hdtv_flatpanel

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O18 - Filter: text/html - (no CLSID) - (no file)
O18 - Filter: text/plain - (no CLSID) - (no file)

After clicking Fix, exit HJT.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

Reminder Note: Once we have determine you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Viewpoint is in an O4 line:

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

If it is not in the Add/Remove programs list, just add that line to the fix list of HJT.

Okay you need EmergencyAutoRun but what are the others that you do not need? You should uninstall if not needed?

 

Please answer my previous question:

Your log is clean. Are you having anymore malware problems?