Pain in the neck virus

[Maniaman]

Got a computer in that belongs to a friend, and it seems to have gotten some pesky persistant little virus. Wasn't showing any symptoms other than redirecting Google searches.

I have run the following:
-TDSSKiller
-ComboFix
-Malwarebytes
-SuperAntiSpyware
-Microsoft Security Essentials offline
-Recovery console fixboot/fixmbr

Everything came back clean except the offline MSE scan which found a Vundo trojan that it cleaned, but the problem still persists. I'm really surprised ComboFix didn't find anything.

One of my other techs took a stab at it and was able to get it to stop the Google redirects. However when trying to run MSE (the antivirus that was originally installed on the computer), the program launches for a split second and then gets closed/killed. Tried reinstalling it which didn't help, leading me to believe the virus is still hiding out somewhere.

Any other suggestions? Normally I'd recommend a data backup & wipe/reinstall, but want to avoid that route if at all possible

 

[NYJimbo]

Not saying this is the situation here but sometimes after you kill a virus there are remnants that are not active viruses but that still give you fits.

Be sure to reset IE (even if they don't use IE). Be sure to check on ALL addons even after reset. Check hosts file, tcp/ip stuff, proxy settings. Check startups with CCleaner including scheduled tasks.

Try other tools like JRT, Adwcleaner, Roguekiller, sometimes they spot things even the big guys don't.

Sometimes your computer is running something that is not seen as a virus but as an addon.

Get a tool to look at the system logs for things at the time of running MSE, it might be dying because of problems with the system and not actual live viruses.

 

[mr m]

Did you run these tools in safe mode? Try running them in normal mode.

Also give MBAR Beta a shot. This is my new favorite anti rootkit tool.

Don't forget to check for rogue partitions.

 

[Boston Pro Comp Serv LLC]

You deff want to get rid of temp files and other toolbars and addons. Once your sure you've got the malware and it's remnants I'd do a SFC on it. Make sure your not missing any system files. You will probably have to check the typical services like BITS (just to name the most obvious one) and make sure they still exist.

 

[Mr.Mike]

Did you run these tools in safe mode? Try running them in normal mode.

Also give MBAR Beta a shot. This is my new favorite anti rootkit tool.

Don't forget to check for rogue partitions.

^^^^^^^^^
+1 on using MBAR. Also the Avast Boot scan has worked well for me several times.