[Resolved] HJT, MBAM close on run; SA detects worm and vundo

Hello. I seem to be experiencing a similar problem to what alot of people are having: I've been experiencing failures and unexpected processes occurring recently. Upon inspecting the problem, I find that iexplore.exe keeps opening multiple instances of itself, along with other fake programs disguising themselves as Windows System Applications. I've managed to stymie their progress by using Process Explorer to my advantage and suspending processes while eliminating their parent processes along with them. Unfortunately, I fear the infection is already severe enough that I require assistance in order to eliminate it. AVG 8.5 says that it detects a rootkit in ndis.sys on occasion, but cannot repair it, and it continues to find similar trojans on each scan. However, using a friend's GeekSquad application, SystemAnalyzer, I was able to get a report out of it. I will attach the report, or would (It seems to not be allowed), but to put it simply, I have eight problems, the most prominent of them being a Pavelo Worm, Virtumonde, and a few Backdoor trojans. I believe the origin of these viruses comes from my college campus. The number of flash drives and portable hard drives that go in and out of every computer make it an ideal point of transfer for the worm. I have tried to follow some of the initial log-making instructions for some of the other threads (dds.pif, gmer), and gmer is currently making it's log in the event that I need it. DDS opens to a command prompt window detailing the applications function but doesn't do anything. Now, I have used Vundofix, to attempt to see my way through at least one of them, but the scan picks up nothing, so there's unfortunately no practical way, via this application, to take care of it, it seems. Therefore I must entreat this forum's help, if it's able to provide. My desktop is in your hands.

Ran Gmer for god knows how many hours, and then it crashes and gets locked. No report. Nothing accomplished.

Hi and Welcome,

NOTE:

• Malware removal is NOT instantaneous, most infections require several courses of action to completely eradicate.
• Absence of symptoms does not always mean the computer is clean
• Kindly follow my instructions in the order posted.
• Please DO NOT run any scans or fix items without my direction.

Please do the following:

NEXT

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT

Please download Sysprot Antirootkit from >>>HERE<<<

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
  
• Click on the Log tab.
• In the Write to log box select ALL ITEMS
• Look near the bottom left, and Check Hidden Objects Only
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to.
  
• Open the text file and copy/paste the log here.

I just got an email today for this, so I may be a little late. I apologize, but after about four days of waiting, I simply felt it might be better to re-image both my laptop and desktop. They probably needed it, anyways. I did make sure to install a number of suggested protections that I saw in many other topics, however. Thank you for your help. I do appreciate it, despite the circumstances.

Thank-you for letting us know.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.