Vundo migrating to other problems

I am using Windows XP Pro and first got into trouble when I disable SpwareDoctor because it was prohibiting entry into site I need to go. Then things exploded. Now however, scanning with MalwareBytes using all scanning options results in no problems found. But there are still problems. I have many logs over the last two weeks from both MB and HyjackThis.

Something still lurks in the background. For instance, I cannot do a scan using renamed Gmer. In the early phases of Vundo, Windows Installer kept flashing indicating it wanted to install a program I downloaded for setting pressure limits in a reverse osmossis system. It kept flashing so often I could not do anything using the keyboard. So I deleted all parts of that program. THE INSTALLER STILL FLASHES but without naming the progam it would like to install.

I did get some help from an antivirus provider that has not solved the problem. I will provide the name of the provider in a PM but my intention is to not blemish his product in a public forum. Also I was asked to scan using Combofix along wiht Eset. Neither worked. Combo would get the start of scanning and then hang up. This also prevented a normal shutdown of the computer. I HAVE THE SAME PROBEM WITH GMER. Eset loads, takes a long time and then ends with a 2002 error found.

Keyboard typing--- I am not a fast typer but many times toooo fast for my computer. words just stop getting typed.

Point of interest--- before yesterday or so, MB scans found 7 faults, about 6 of them Vundo. After purging, they seemed to come right back but with a new name that appeared to be made up of random letters such as:

HKCU\\\RUN\yaxxxxaudio (Trojan.agent)
HKLM\\\RUN\getbaxyaudio(Trojan.Vundo)
Hkuser\\\yabxxyaudio(Trojan.Vundo)

I do have a bundh of logs since the problem first started; I have attached one at random.


I do beleive that the Windows Installer problem is representative of some other problem. So now when i scan with MB, everything is fine, that is it is reported to be fine. I was able to do the needed Windows driver file update required before submitting this thread. I was able to do a DDS scan and have the log which I have attached along with the latest HyjackThis file.

I hope I do not need to purge Windows and reload because I will lose a Quickbooks program. I have the backup but will need to repurchase the program itself.

Thank you just for reading this far.

Foggy

Hello ,
And to the Bleeping Computer Malware Removal Forum. My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown here.
-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
• Save it to your desktop.
• Double click on the icon on your desktop.
• Click the "Scan All Users" checkbox.
• Push the Quick Scan button.
• Two reports will open, copy and paste them in a reply here:
  • OTListIt.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

Please Download Rootkit Unhooker Save it to your desktop.

• extract RKUnhooker to your desktop
  Note** it is zipped up in a .rar file - If you do not have a program to unzip this type of file -
  you can get a free one from here - http://www.7-zip.org/

• Now double-click on RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan.
• Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
• Wait till the scanner has finished and then click File, Save Report.
• Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".

-------------------------------------------------------------
In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
• A new OTL log (don't forget extra.txt)
• RKU log

Thanks and again sorry for the delay.

Due to lack of feedback, this topic is now closed.

If you are the original topic starter and you need this topic reopened, please send me a PM.

Everyone else, please start a new topic.