Infected computer - Please help!

[gabrielf]

I am remotely working on a friend's computer (with logmein) that has been infected for two weeks!

it is perfectly usable, but Malwarebytes finds two infections that it cannot remove (I attach the log for a quick scan).

Files Infected:

C:\WINDOWS\system32\Drivers\ntndis.sys (Rootkit.Agent) -> No action taken.

C:\WINDOWS\system32\ipsecndis.sys (Rootkit.Agent) -> No action taken.

AVG Free (which is running) finds about 8 infections which it cannot remove.

C:\windows\system32\drivers\ndis.sys

Trojan Horse rootkit-parkes.AA

Process name: c:\program files\trojan remover/trjscan.eve I Installed Trojan Remover to try and solve the problem and it did nothing.

AVG also finds Trojan Horse Generic17.BKS in memory affecting services.eve and svhost.eve

An online scanner with ESET does not find any infections.

I attach two logs, but GMER crashed the laptop.

Can anyone kindly advise?!!!

Thanks in advance!

Attach.zip

mbam_log_2010_08_24__10_44_05_.txt

[gabrielf]

Have managed to infections with combo fix

Then decided to uninstall AVG Free and now now network adapter detected - 10 exclamation marks in device manager.

[Gammo]

Hi,

Please note: ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert". It is NOT for unsupervised use. Please read Combofix's Disclaimer.

Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Delete your copy of ComboFix.exe from the Desktop.

Then download the latest version of ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them:
  Click me
  If you can't disable them then just continue on.
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!