Vundo trojans and seneka rootkits

The problem started last night when I noticed that my legitimate Google search results were occasionally being redirected to ad sites (I've seen the other threads on this, but I have other issues as well). I ran a scan with AVG and came up with a whole lot of "trojan.vundo.h", which it quarantined. I assumed that the problem was fixed and went to bed.

This morning I started up my computer (running XP home service pack 3 by the way) and found a message saying that my computer would be restarted in a minute because the "DCOM server process launcher" service had terminated. I rebooted in safe mode and scanned again with AVG, this time enabling scanning for rootkits. The restart message popped up again in the middle of the scan - scary to see this happen in safe mode - so I looked up how to stop it and ended up using this method, which worked:

Start -> Run -> type services.msc
Select "DCOM Server Process Launcher"
Right Click -> Properties
Change Startup type to Disabled
Click on Recovery Tab
Change all failures to Take No Action

After that I finished the AVG scan. It found 12 rootkits with "seneka" in the name and claimed to have removed them, but when I updated and ran Malwarebytes Anti-Malware, it found the same ones, plus more. It removed those and the latest scan shows nothing, but I am still having the issue with Google results and I'm afraid to get out of safe mode to see how things are running.

Also, looking through Malwarebytes logs, I discovered that it had caught a bunch of trojan.vundo along with some trojan.downloader and trojan.TDSS a month ago, so I wonder if this could be a re-infection somehow? Thanks in advance for any advice on all this.

Edited by littlefishy, 05 February 2009 - 06:24 PM.

I've posted in the HijackThis logs forum as well - http://www.bleepingcomputer.com/forums/t/200924/vundo-seneka-browser-redirection/

It appears that you have already posted a hijackthis log here.

Please be patient while waiting for assistance. HJT Helpers are all volunteers regardless where you post a log. While waiting for a response, you should not ask for help elsewhere or make changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc.) Any modifications you make on your own can result in system changes which may not show it the log you already posted. Further, following advice outside of that post may cause confusion for the HJT Helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

If you had posted your log here, similar rules would apply. We would ask that you be patient while awaiting a reply and refrain from asking for help elsewhere.

If you followed any other advice already, please ensure you inform the HJT Team Helper when they respond to assist you with your log. This will help them know what has been done and they probably will ask for an updated log.

To avoid confusion, I am closing this topic. If you still need assistance after your log has been reviewed and you have been cleared, please start a new topic. If you have any questions, please PM me or another moderator.

Thanks for your cooperation.