Dropper.lnor - can't shake it

Hi, I've had a problem for months with some malware on my wife's DELL. We used to have Norton on her machine and at startup would get "NORTON has detected a malicous script in c:\documents and settings\all users\start menu\programs\startup\microsoft windows.hta. Then I switched her AV to AVG. AVG finds two files infected (c:\ntdetect.hta and c:\System Volume Information\_restore{98.....} related to Dropper.lnor. I've tried a few spyware products which didn't help and then with a search found your site based on someone else that had a similar problem. Didn't want to assume that the recommended fixes would apply to our machine, so I carefully went through the READ & RUN ME FIRST process. After the process, I'm still getting the same infection detected with AVG. I've attached my Bitdefender, Panda, and HJT reports. Appreciate your help, Matt

 

Follow the directions for running Virtumonde aka Trojan Vundo Fix w/ Tool.

Post the Vundo Log and a fresh HijackTHis log.

 

Ran VundoFix, very encouraging - ran AVG again - only found the infection in the System Restore files. I disabled/enabled System Restore and now AVG says its gone completely. Attached is the Vundo log and the latest HJT log.
Hopefully everything else looks good. Thanks a lot! Matt

 

Reboot to Safe Mode, open Windows Explorer, navigate to and DELETE c:\windows\system32\MYDLL.dll.

Your computer should be virus free now.

 

Deleted MYDLL.dll - Looks like we're clean. Thanks again for your help,
Matt

 

You're welcome.

Lets flush all your restore points and create a new clean one for your system.

Disable And Enable System Restore

How to Protect yourself from malware!

Safe surfing.