PSEXESVC.EXE registry deletion failed

Unfortunately, because this is my boss's computer and not my own, I can't give you much information about the behavior that may have triggered these problems. The computer did not have any sort of anti-virus/spyware software whatsoever - for how long I don't know (it does now though). Looking at the creation date of several malware items, it appears there was a lot of activity on the 10 & 11 Dec.

My boss was also not terribly clear about what exact problems he was encountering, but I'm told that every time he went to Google, he would be redirected and otherwise, a number of error notifications came up - none of which got written down. I barely let the computer touch the internet once I got it, so I didn't witness any of this behavior firsthand.

I was unable to complete Run & Read Me step 2 (enable viewing of hidden files, system files and file extensions) because some malware was preventing me from seeing Folder Options in both the Tools drop down menu and Control Panel (or accessing the registry editor). However, after running the Spybot S&D scan, I was able to see Folder Options and make files viewable. I also initially was unable to install Super AntiSpyware; I was given a generic Windows error telling me that the file could not be run - nothing to do with the System Admin disabling privileges. Sorry, I actually forget exactly how I fixed this, but I followed some advice from a thread on this forum that involved going to the Device Manager and disabling a certain virtual device.

After going through this whole process, everything is running a lot better and all of the malware I saw before is gone. I also installed Avast, Spyware Terminator (only in anti-spyware mode, not antivirus), and AdAware (free versions). Scanning with Avast found nothing and AdAware found 1 MRU object which it successfully deleted. Spyware Terminator found a couple tracking cookies and 2 more items that concern me.

On the Full Scan it found:

Sensis Toolbar (Remaining items of toolbar)
Registry HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
(registry key deletion failed)

APPL/PsExec.E (Unclassified Threat)
File C:\WINDOWS/PSEXESVC.EXE

On the Fast Scan following the Full Scan and restart it found again:

Sensis Toolbar (Remaining items of toolbar)
Registry HKCR\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
(registry key deletion failed)

I can post these scan reports if needed.

I realize these logs seem a little old but I haven't had time to post them until now. The computer has also been off (99% of the time) and not connected to the internet since then. Obviously I can run scans again if need be.

Thank you in advance!

 

final log upload

MGlogs.zip

 

Sorry, I forgot to change the thread title to something more comprehensible. I realize (or at least I think) they're separate issues.

 

Well, it looks like I got infected again in the brief time I connected the computer to the internet to download/update Antivirus stuff. Aside from the items found in the SAS log, I found several malware items created late on 12/17 in C:WINDOWS - SWXCACLS.exe, VFIND.EXE, fdsv.exe, among others. I'm guessing this has something to do with that silent downloader you had me delete.

I actually already deleted ComboFix and MGtools.exe after I first finished everything and thought I was clean, but let me know if I need to go through everything again. System Restore has also been off since before I started anything and I don't plan on turning it on again.

Thanks for your help!

 

Well that's excellent! I guess I should have figured that out since that was when I was installing ComboFix (apparently the first page of Google can be fallible). I updated SAS and Malwarebytes and ran scans which came up totally clean, as you can see. Thank you so much for all your help!! Let me know if there's anything else I should do - otherwise have a happy and malware-free New Year!

 

A new Spyware Terminator full scan also turned up nothing, for what it's worth.

Thanks again!