Hello Garmanma,
Thanks for your help thus far. So here's what's happened. I tried to open the RootRepeal file from all of the links that you provided and I keep getting the following error:
RootRepeal Error
Attempt to write to address 0x00000000
Also, RootRepeal says that it is Initializing the Application and then freezes. (I even did the renaming thing) My computer then says that I don't have enough virtual memory. After this, I have to do a hard reset.
Also, now my Malwarebytes takes way too long to run. It went from taking about 2 hours for a full scan to taking 9 hours. Below please see my latest Malware scan log.
Please can you help me. I don't know what else to do. Do I run Combofix? I dunno. I'll try to wait on ya to get back to me before I do anything else. Oh and th ensrbgxod.bak file finally deleted. So I thought I was virus free, but it turns out that I'm not.
******************************************************************
Malwarebytes' Anti-Malware 1.41
Database version: 2982
Windows 5.1.2600 Service Pack 3
10/26/2009 9:44:18 PM
mbam-log-2009-10-26 (21-44-18).txt
Scan type: Full Scan (C:\|)
Objects scanned: 280412
Time elapsed: 9 hour(s), 3 minute(s), 28 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 2
Registry Values Infected: 6
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 9
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
c:\WINDOWS\SYSTEM32\nayazezi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\kihinuga.dll (Trojan.Vundo) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{a772cb7b-bd96-491e-a085-87ec2b3677f2} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{eae2d417-2895-498b-b83e-4ef6000ee827} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pasobiguh (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{a772cb7b-bd96-491e-a085-87ec2b3677f2} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\filebezub (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{eae2d417-2895-498b-b83e-4ef6000ee827} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ranikupaw (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\calc (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\nayazezi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\nayazezi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\SYSTEM32\nayazezi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\LocalService\ntuser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Firstname Lastname\ntuser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Firstname Lastname\Start Menu\Programs\Startup\scandisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\ntuser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Start Menu\Programs\Startup\scandisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Firstname Lastname\Start Menu\Programs\Startup\scandisk.lnk (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\kihinuga.dll (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\Firstname Lastname\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> Quarantined and deleted successfully.
Edited by shamrocka, 27 October 2009 - 03:36 PM.