Any help gratefully accepted with trojans

Hi All

I'm having real problems with a trojan and a worm:

Troj rootkit e which is showing as C:\winnt\system 32\rdriv.sys

Worm sdbot BJX which is showing as c:\winnt\image.exe

I can't see either of these files and I'm having real difficulty removing them. If i boot up in safe mode, I can run A2 and remove rdriv.sys. However when I connect to the internet I get a pop up saying AVG has detected dialer 11 ay. I run AVG and it finds nothing. Then most bizarrely a dos window opens and a script runs which then directs my browser to Symantec's site????

At this point I disconnect and shut down. When I boot up in safe mode again rdriv.sys is back.

My OS is windows 2000, and I run AVG, Avast, Ad aware, Spybot, A2 and spydoctor on my PC. My Hijack this log is below.

Thanks for taking the time to read and hopefully help me.

Edit by bjgarrick: Unrequested, Inline, Out dated HJT log removed!

 

Please follow standard cleanup procedures as given below:

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps below:



http://www.majorgeeks.com/images/grenade.gif Download HijackThis 1.99.1

http://www.majorgeeks.com/images/grenade.gif Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

http://www.majorgeeks.com/images/grenade.gif Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

http://www.majorgeeks.com/images/grenade.gifBefore running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

http://www.majorgeeks.com/images/grenade.gifRun HijackThis and save your log file.

http://www.majorgeeks.com/images/grenade.gif Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

http://www.majorgeeks.com/images/grenade.gifNeed help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting