When the machine was first brought to me, I used UBCD4WIN to scan for malware with Spybot S&D. After updating and scanning with SB S&D, Virtumunde was found along with the koobface worm. Both seemed to be removed with the scan. After removing the UBCD disk and rebooting the computer, I attempted to go online, and a popup occurred notifying of a $1,000.00 Walmart gift card. Also, any Google search got redirected to crazy sites...
I downloaded ComboFix, and scanned. It found TDL3 rootkit. I removed ComboFix and all logs. Rebooted machine. Browser still hijacked. Downloaded SB S&D and installed on infected machine. After update and scan, the program found no infection. Machine already had MBAM installed, so updated and scanned with MBAM, found nothing. Used my computer to search for Google Redirect Virus, and found information regarding TDSSKiller, downloaded it and it found TDSS.TDL4, and I made sure "Cure" was selected, and allowed TDSSKiller to do its thing.
I then put ComboFix back on the "infected" machine, and attempted a scan. It came back clear, so I uninstalled CF and deleted all logs.
I was going to install Comodo Internet Security (CIS) on the machine. After downloading and installing CIS, the machine reboots, and Windows installer starts trying to modify another program, namely "The Print Shop 22." Also CIS will not update the antivirus database.
After uninstalling CIS, and rebooting the computer, Windows installer does not try to modify The Print Shop 22 anymore, but reinstalling CIS causes this strange behavior again. I am certain that there is a registry key that is causing this problem, and have a feeling that this machine is not clean yet. Any help will be appreciated. I am attaching DDS logs, defogger log, and GMER log with this post.
What to do next?
DDS.txt 5.75KB 3 downloads
Attach.txt 10.18KB 1 downloads
ark.txt 963bytes 2 downloads
defogger_disable.log 472bytes 1 downloads
Edit: Moved topic from XP to the more appropriate forum. ~ Animal
Edit: Sorry about the initial wrong forum post. ~ ET1
Edited by et1swcnet, 14 December 2010 - 05:21 AM.