Wat zijn wij aan het doen?

26 mei 2013

Het, om groter bereik, even in het Engels aan het zeggen:

got weird problem. Need help.

Problem description:

friend has Vista Home Edition. Anytime he downloads anything, it disappears upon download completion. A non-descript dialog appears telling him "This file contains a virus and has therefore been deleted.". Also, in all of his browsers (them being MSIE8, Firefox and Chrome) he can reach everything but any Microsoft domain. Attempts always deliver 'site not found'. Tracert dies at first hop. DNS cacheflush did not help. There is nothing in the hosts file, but the default two lines.

So. It looks like a Trojan like DNSChanger (but that's not what it is).

From Safe Mode, I already ran:

1. AntiMalwareBytes (found and killed some viruses; it now gives the system a clean bill of health, but problem above has not gone away)
2. SuperAntiSpyware (found and killed some viruses; it now gives the system a clean bill of health, but problem above has not gone away)
3. several Microsoft FixIts supposed to attack rootkitstuff like Blaster and DNSChanger - they all found nothing

I also ran the external Trend Micro Housecall. It finds nothing and gives the system a clean bill of health, but problem above has not gone away.

From a USB-stick prepared on a different, clean system, I also tried to run Hitman Pro's Kickstart version. This failed. It boots, goes to first option, then freezes (possibly because of the rootkit virus we're dealing with). Hitman Pro, when installed on the system itself, found and killed some viruses; it now gives the system a clean bill of health, but problem above has not gone away.

And I installed Microsoft Security Essentials instead of the outdated Norton that used to be there. MSE gives the system a clean bill of health, but the problem above has not gone away.

Any ideas, anyone? I'd be most grateful for any help via any of my communication channels.

Post Scriptum
Nobody had any, so we gave up and performed a clean install of Windows 7.