ESET detected two trojans in memory, Win32/Olmasco.O associated with a svchost.exe process and Win32/Olmarik.TDL4 which is not associated with anything. Neither can be cleaned. I could kill the process which eliminated the Olmasco.O detection. I found a suspicious entry to start Messenger in the HKCU Run area, and deleting it eliminated the Olmasco.O on startup (although I guess that means that file has been hijacked?). Here's what ESET sees now (memory and boot sector scan):
Version of virus signature database: 7377 (20120811)
Date: 8/11/2012 Time: 5:27:39 PM
Scanned disks, folders and files: Operating memory;C:\Boot sector;E:\Boot sector
Operating memory - Win32/Olmarik.TDL4 trojan - unable to clean
Number of scanned objects: 655
Number of threats found: 1
Number of cleaned objects: 0
Time of completion: 5:28:22 PM Total scanning time: 43 sec (00:00:43)
A bunch of ugly things happened from the infection: the computer is slow, saving files takes forever, all of the icons disappeared from the Start Menu and Desktop, etc. I'm not even sure what all I did not, but I think some combination of Malwarebytes Anti-Malware and ERARemover recovered the Desktop and Start Menu. The other symptoms remain.
Most of the anti-rootkit stuff has been ineffective. TDSSKiller and aswMBR just won't run even if I rename them. GMER gives and LoadDriver error in kglyypod.sys (0xC000010E) when it starts (something about a stable subkey) and can only do some of its scans (Services, Registry, Files):
GMER 18.104.22.16841 - http://www.gmer.net
Rootkit scan 2012-08-11 17:12:09
Windows 5.1.2600 Service Pack 3
Running: 7pbixleu.exe; Driver: C:\DOCUME~1\Frank\LOCALS~1\Temp\kglyypod.sys
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0016cef1e350 (not active ControlSet)
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout 15
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota 10000
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler yes
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout 90
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota 10000
---- EOF - GMER 1.0.15 ----
Panda Anti-Rootkit found nothing. MBRCheck says that the MBR is faked. I backed it up and let it over-write, but is said the same thing when I restarted. I'm not sure this really worked, though, since the Lenovo recovery screen still came up.
I also tried to run Combofix, but it crashes after about 5 min. into the part that it says will take 10 min, and you have to re-start. No log file gets produced. It did install the recovery console.
Sadly, DDS.com also will not run. It goes though many ##'s, gives and error about js.prefs, and then a few #'s later the computer crashes. Has to be restarted, no logs. So the best I can figure out to send is the HiJackthis log, which follows at the end of this.
I am not averse to formatting the drive and starting over (might as well put Win7 on I guess), but my understanding is that if the MBR is infected, it will just immediately re-infect when I install again. So I guess I need help with that. Suggestions? Thanks a lot.
I forgot to mention that the service running inside the svchost.exe that was infected was Dnscache, in case that helps.