Really bad malware, cannot clean off.

I keep deleting those and they keep showing back up.

Boot into safe mode with networking (f8 before startup) and navigate to http://safety.live.com and preform full system scan.

  O4 - HKUS\S-1-5-19\..\Run: [luduyiriju] Rundll32.exe "C:\WINDOWS\system32\yeyozoda.dll",s
   O4 - HKUS\S-1-5-20\..\Run: [luduyiriju] Rundll32.exe "C:\WINDOWS\system32\yeyozoda.dll",s
yeyozoda.dll is a known dll that is still the remainings from the malware you have on your machine. Use Hijackthis and remove this dll file as well. Have you tried running superantispyware on that machine? Download it and run it on your computer. The link will also give you a breif description of YEYOZODA.DLL file.
http://www.superantispyware.com/malwarefiles/YEYOZODA.DLL.html

I would also download spybot and update it and run a full system scan on that computer.
http://www.safer-networking.org/index2.html

Also, if you have all of the microsoft updates another can you can use is mrt.exe lates tupdate should be aug 2009. Run this scan as well and it will search in the common windows directoy where viruses normally place themselves.

If Combofix won't run.. redownload it and rename before savng to your desktop.
and attach the resulting log here.

Try also, Malwarebyte:

www.malwarebytes.org/mbam.php

I absolutely respect all the opinions expressed above but owning several computer repair shops for over 26 years has allowed me to learn a couple of things.

No matter what you do to repair this machine, it will never work as fast and fresh as after doing a clean install.

I understand than many technicians frown on this, after all, being able to repair a severely infested machine is a challenge and a matter of pride, but at the end of the day you are providing a service to the customer and you do this as a job. Both time-wise as well as financial-wise the customer will be better served with a clean install.

I realize that we take pride when we are able to remove a terrible malware infestation and it's a "pride" thing for us to take the challenge. But really, for one, customers do not appreciate this if you are spending hours and hours on their dime and If you are doing it on your own time.... no matter how good you are .... the machine will always be limping with a registry full of leftovers and unexpected errors that will eventually come back to haunt you....

This is just food for thought......

Reformating a PC is usually my last option, especially if it's the CEO's laptop.  I just helped a neighbor last night remove the Personal Antivirus trojan using Combofix over the phone.  If running Combofix/Malwarebytes which takes maybe 45 minutes fixes the problem, that will save hours involved in a rebuild. Not to mention the fact that if you don't know how to remove the malware in the first place and it gets re-infected within a week, you're back to square one.  

Are you just going to keep rebuilding the computer over and over again?

aleinss: Maybe you didn't notice in the askers question where he mentions that he has already run Malwarebytes several times. I agree with you (and I actually allocate an hour on the average) that anything that can be done in 45min should be done.

This said, if you read the hijack log you will notice that the computer had Norton installed. Another detail with a severely infected machine is that when it starts hanging and Norton is overtaken, it usually results in corrupted files because of the continued rebooting without being able to close properly.

At the end, when you finish removing the malware you may find yourself with many applications that need to be reinstalled and a registry full a junk left over by Norton forcing you to manually get into the registry to clean it manually even after running Symantec's provided cleaning utility (CleanWipe.exe).

Again, it's all a matter of making a judgment call which will depend not only on the severity of the infestation, damage caused by unsuccessful attempts of removal, availability of the software that needs to be reinstalled and many other details and in no way is it intended to be the "Standard Procedure" for any malware infestation.

As I said on my first post, this is a highly controversial subject and it is something that should be analyzed from the customers' perspective and put in the scale weighing between costs and benefits.

lflorence,

<<<"I keep deleting those and they keep showing back up.">>>

Hijackthis can't remove those entries if the infection is still active... fixing entries in Hijackthis is only removing the loading points and when the infection is active one of the files will put them back.

You need to download Combofix and rename it before saving the file to your desktop.
What ever is left we can remove using its script function that's why we also need to look at the log.

I'm with aleinss reformatting is my last option and that is if I'm dealing with a file infector particularly virut. If virut is present in the system for a while I wouldn't even think of cleaning it up. But so far no symptoms of virut here.

lflorence:

I omitted to tell you about ComboFix.....One of the really annoying things about this application is that "unless you are properly trained".... you depend on a helper to review your log. But you can't post the log until someone asks you to post it. And then, you still have to wait till you get an answer....

If you are on a job site...the customer looking over your shoulder ....paying you by the hour.....I don't know about you, but I can't just can't sit there and wait...and wait.... First you have to find the right forum to request help.... then you have to be "asked to provide the log file"..... then you have to wait till they can help you and reply..... assuming it works at the first try.... otherwise you have to ask for help again.....

This is the disclaimer on their website:

" .....You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer....."

BitsBytesandMore,

I haven't owned "...several computer repair shops for over 26 years..." but I have run a pc repair business for 10 years.  In that time I've been presented with a very large number of infected computers and I've used Combofix countless times. I think it is fair to say that I could not do my job effectively without it. I recommend that you learn how to use it. Most of my clients don't want to pay me to take their pc away, back up data, format and re-install Windows. They want me to fix the pc and pay me for a 1.5 hour callout.  There has recently been a debate about this:

http://www.experts-exchange.com/Virus_and_Spyware/Anti-Virus/Q_24677035.html
http://www.experts-exchange.com/Software/Internet_Email/Anti_Spyware/Q_24671571.html

lflorence,

Sorry to go off-topic in your thread.

phototropic: I agree with you. Combofix is great for you and me or anyone who has taken the time to learn it. Not for lflorence which is what this thread is all about.