Articles

Search redirect virus-with a twist!

Samsung
December 3, 2008 at 17:29:53
Specs: Windows XP Home edition V, 1.60GHz, 896MB RAM

Hi,

So I've caught the redirect search virus as well: the search results that come up from every search engine opens a pop-up ad. It also blocks antivirus websites, and blocked the MalwareBytes download links I've seen posted as a solution for this. I've been using a proxy-site to bypass all of this.

Also, I am running in Safe Mode, because everytime I try running Windows normally, a blue screen with some text flashes within a minute of booting up and causes my computer to restart. System restore won't run properly, nor will CHKDSK.

Any help would be greatly appreciated. In the meantime, I will run MalwareBytes.

Thanks!
jstnc


See More: Search redirect virus-with a twist!

Report •


#1
December 3, 2008 at 17:52:44

Please post the Malwarebytes log.

Please download and install the latest version of HijackThis v2.0.2:


Download the "HijackThis" Installer from this link:
Hijack This


1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.


Report •

#2
December 3, 2008 at 18:20:00

Wow, thanks for the quick reply!

However, I can't seem to install MalwareBytes. Nothing happens when I double click the mbam-setup.exe. It appears on the processes list for a few minutes then disappears. I don't know what to do..


Report •

#3
December 3, 2008 at 18:25:04

Rename the mbam.exe file then try to run it again, if still no luck rename all the .exe files in the MAlwarebytes' Anti-Malware folder and try to run it again.

Report •

Related Solutions

#4
December 3, 2008 at 19:01:22

Thanks a lot, here are the log files.
However I could not update MalwareBytes before I began the scan.


Malwarebytes' Anti-Malware 1.31
Database version: 1456
Windows 5.1.2600 Service Pack 2

12/3/2008 9:47:54 PM
mbam-log-2008-12-03 (21-47-54).txt

Scan type: Quick Scan
Objects scanned: 59220
Time elapsed: 5 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\drivers\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Justin\Local Settings\Temp\opr1B3.tmp (Heuristics.Malware) -> Quarantined and deleted successfully.


_______________________________________________


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:49:35 PM, on 12/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Justin\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Justin\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://ISAArraymain.wincoll.local/a...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG8\avgssie.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [EDS] C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [MagicKeyboard] C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Documents and Settings\Justin\Desktop\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Justin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Startup: YzDock.lnk = C:\Program Files\Y'z Dock\YzDock.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/Div...
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binar...
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG8\avgwdsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\BlueSoleil\BTNtService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 7476 bytes


Report •

#5
December 3, 2008 at 19:16:30

Download SDFix.exe and save it to your Desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with SDFix or remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Remember to re-enable the protection again afterwards before connecting to the Internet.

1.Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
2. Open the c:\SDFix folder and double click RunThis.cmd to start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
3. Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
4. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt


Report •

#6
December 3, 2008 at 19:35:31

ok, will do. But just before I start, thanks for your help, and a few questions:

-Is the 4th O2 entry on the HijackThis log file nothing to worry about? (O2 - BHO: WormRadar.com ......)

- My computer is already in Safe Mode, do I still have to reboot after installing SDFix?

- I'm afraid that after I run RunThis.cmd and reboot normally, the blue screen of death will come up and restart the system before SDFix can do its stuff (Since I don't know if the two are related). Should I reboot in Safe Mode?


Report •

#7
December 3, 2008 at 19:43:24

O2 - BHO: WormRadar.com can be removed with Hijack This but is nothing to worry about.

I'm afraid that after I run RunThis.cmd and reboot normally, the blue screen of death will come up and restart the system before SDFix can do its stuff (Since I don't know if the two are related).Has the computer been booting to a blue sceen in normal made or since you run SDFIx and/orhave you run SDFix yet?


Report •

#8
December 3, 2008 at 19:49:57

not yet. i'm just being cautious/ worrying too much

I'll go ahead and run RunThis.bat, restart, and see what happens


Report •

#9
December 3, 2008 at 20:05:38

Because I am running Safe Mode, I can only use AVG 8.0 Anti-Virus command line scanner. I don't know where to go to turn AVG Resident Shield off... what should I do?

Report •

#10
December 3, 2008 at 20:17:28

You should be logged in under your usual account so that your desktop appears as the safe mode desktop.

Double click the avg icon on the safe mode desktop> right click the resident shield> click open> uncheck resident shield active> save shanges.


Report •

#11
December 3, 2008 at 20:29:18

there is no avg icon on my desktop, neither as an icon or in the tray. There are also no avg processes running in windows task manager. I also tried opening various AVG applications in program files, but nothing happens. Would it be possible to just go ahead and run RunThis.bat?

Report •

#12
December 3, 2008 at 20:33:20

Yes, go ahead and run it from safe mode.

Report •

#13
December 3, 2008 at 20:57:22

Wow, my computer seems to be running fine in normal mode, ie no blue screen of death, no bogus search results, no blocked websites. Thank you very much for your help!

Here's the report from SDFix:


[b]SDFix: Version 1.240 [/b]
Run by Justin on Wed 12/03/2008 at 11:39 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]:

Trojan Files Found:

C:\WINDOWS\system32\drivers\TDSSnhhy.sys - Deleted
C:\WINDOWS\system32\TDSSnaah.dll - Deleted
C:\WINDOWS\system32\TDSSoiqh.dll - Deleted
C:\WINDOWS\system32\TDSSosvn.dll - Deleted
C:\WINDOWS\system32\TDSSnrse.dll - Deleted
C:\WINDOWS\system32\TDSSlbqp.dll - Deleted
C:\WINDOWS\system32\TDSSmqxt.dat - Deleted
C:\WINDOWS\system32\TDSSsbhc.log - Deleted

Removing Temp Files

[b]ADS Check [/b]:


[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

http://www.gmer.net
Rootkit scan 2008-12-03 23:47:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell

Extensions\Approved\{0456346E-3103-2EC0-B9B8-063504A44E2C}]
"iaigfphpnkfijogdnp"=hex:6b,61,64,66,68,63,6a,62,70,69,6c,6a,66,6b,62,62,6b,64,6c,64,70,..
"haoghopighfikcab"=hex:6b,61,64,66,63,64,6a,61,66,63,70,6e,6f,69,66,64,6a,70,6f,69,67,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:


Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewal

lpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32

\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network

Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google

Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program

Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\BlueSoleil\\BlueSoleil.exe"="C:\\Program

Files\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows

Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows

Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program

Files\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Program Files\\AVG8\\avgemc.exe"="C:\\Program Files\\AVG8

\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG8

\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program

Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\SopCast\\SopCast.exe"="C:\\Program

Files\\SopCast\\SopCast.exe:*:Enabled:SopCast Main Application"
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"="C:\\Program

Files\\SopCast\\adv\\SopAdver.exe:*:Enabled:SopCast Adver"
"C:\\Documents and Settings\\Justin\\Application Data\\Macromedia\\Flash

Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"="C:\\Documents and

Settings\\Justin\\Application Data\\Macromedia\\Flash

Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe:*:Enabled:Octoshape add-in for

Adobe Flash Player"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet

Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\Documents and Settings\\Justin\\Local Settings\\Application Data\\Google\\Google Talk

Plugin\\googletalkplugin.dll"="C:\\Documents and Settings\\Justin\\Local Settings\\Application

Data\\Google\\Google Talk Plugin\\googletalkplugin.dll:*:Enabled:Google Talk Plugin"
"C:\\Documents and Settings\\Justin\\Local Settings\\Application Data\\Google\\Google Talk

Plugin\\googletalkplugin.exe"="C:\\Documents and Settings\\Justin\\Local Settings\\Application

Data\\Google\\Google Talk Plugin\\googletalkplugin.exe:*:Enabled:Google Talk Plugin"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program

Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program

Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\WINDOWS\\system32\\drivers\\svchost.exe"="C:\\WINDOWS\\system32

\\drivers\\svchost.exe:*:Disabled:svchost"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewal

lpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32

\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network

Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows

Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows

Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 18 Nov 2004 28,672 A..H. --- "C:\WINDOWS\SEC\SECINSTALL.EXE"
Mon 31 Mar 2008 4,348 A.SH. --- "C:\Documents and Settings\All

Users\DRM\DRMv1.bak"
Sun 16 Mar 2008 0 A.SH. --- "C:\Documents and Settings\All

Users\DRM\Cache\Indiv01.tmp"
Fri 14 Dec 2007 27,136 A..H. --- "C:\Documents and Settings\Justin\My

Documents\Uni\AppEssays\Stanford\~WRL0620.tmp"

[b]Finished![/b]


Report •

#14
December 3, 2008 at 21:25:45

A few things left to do, you are not out of the woods yet.

Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your AVG antivirus, and any antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.


Report •

#15
December 3, 2008 at 21:45:26

Here's the Combofix log:


ComboFix 08-12-02.02 - Justin 2008-12-04 0:35:26.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.249 [GMT -5:00]
Running from: c:\documents and settings\Justin\Desktop\dl\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\setup.inf
c:\windows\system32\AutoRun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS


((((((((((((((((((((((((( Files Created from 2008-11-04 to 2008-12-04 )))))))))))))))))))))))))))))))
.

2008-12-03 23:36 . 2008-12-03 23:37 <DIR> d-------- c:\windows\ERUNT
2008-12-03 22:38 . 2008-12-03 23:50 <DIR> d-------- C:\SDFix
2008-12-03 21:40 . 2008-12-03 21:40 <DIR> d-------- c:\documents and settings\Justin\Application Data\Malwarebytes
2008-12-03 21:30 . 2008-12-03 21:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-03 21:30 . 2008-12-03 19:54 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-03 21:30 . 2008-12-03 19:54 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-03 17:17 . 2008-12-03 17:17 <DIR> d-------- c:\documents and settings\Administrator.-JUSTIN-.000\Contacts
2008-12-03 15:13 . 2008-12-03 15:13 <DIR> d-------- c:\documents and settings\Administrator.-JUSTIN-.000\Application Data\Media Player Classic
2008-12-03 14:51 . 2007-10-20 09:19 <DIR> d-------- c:\documents and settings\Administrator.-JUSTIN-.000\Application Data\Symantec
2008-12-03 14:51 . 2008-12-03 17:17 <DIR> d-------- c:\documents and settings\Administrator.-JUSTIN-.000
2008-12-03 14:29 . 2008-12-03 14:29 <DIR> d-------- c:\documents and settings\Administrator.-JUSTIN-
2008-12-01 16:16 . 2008-12-01 16:16 410,976 --a------ c:\windows\system32\deploytk.dll
2008-12-01 14:28 . 2008-12-01 14:28 <DIR> d-------- c:\program files\iPod
2008-12-01 14:28 . 2008-12-01 14:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-01 14:25 . 2008-12-01 14:26 <DIR> d-------- c:\program files\QuickTime
2008-12-01 10:48 . 1998-10-29 17:45 306,688 --a------ c:\windows\IsUninst.exe
2008-12-01 10:48 . 2008-12-01 10:48 264 --a------ c:\windows\_delis32.ini
2008-11-21 20:25 . 2008-11-21 20:25 <DIR> d-------- c:\program files\Common Files\snp2std
2008-11-21 20:25 . 2006-11-08 14:57 12,006,784 --a------ c:\windows\system32\drivers\snp2sxp.sys
2008-11-21 20:25 . 2006-09-15 13:21 675,840 --a------ c:\windows\vsnp2std.exe
2008-11-21 20:25 . 2005-01-26 15:45 349,472 --a------ c:\windows\WindowsXP-KB822603-x86.exe
2008-11-21 20:25 . 2006-10-03 14:35 249,856 --a------ c:\windows\system32\vsnp2std.dll
2008-11-21 20:25 . 2006-10-12 17:21 151,552 --a------ c:\windows\system32\rsnp2std.dll
2008-11-21 20:25 . 2006-11-16 15:57 77,824 --a------ c:\windows\system32\csnp2std.dll
2008-11-21 20:25 . 2006-11-13 17:27 24,832 --a------ c:\windows\system32\drivers\sncamd.sys
2008-11-21 20:25 . 2004-12-09 17:23 15,497 --a------ c:\windows\snp2std.ini
2008-11-21 20:25 . 2004-12-09 17:23 13,022 --a------ c:\windows\snp2std.src
2008-11-21 20:24 . 2008-11-21 20:24 <DIR> d-------- c:\documents and settings\Justin\Application Data\InstallShield
2008-11-15 23:11 . 2008-12-01 14:35 398 --a------ c:\windows\AudioConverter.INI
2008-11-15 23:06 . 2008-11-15 23:07 <DIR> d-------- c:\program files\EaseAudioConverter
2008-11-13 03:01 . 2008-11-13 03:01 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-04 10:30 . 2008-11-04 10:30 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx
2008-11-04 10:30 . 2008-11-04 10:30 57,344 --a------ c:\windows\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-04 05:37 --------- d-----w c:\program files\AVG8
2008-12-04 05:21 --------- d-----w c:\program files\Google
2008-12-04 05:15 --------- d-----w c:\documents and settings\All Users\Application Data\Bluetooth
2008-12-01 21:16 --------- d-----w c:\program files\Java
2008-12-01 19:28 --------- d-----w c:\program files\iTunes
2008-12-01 19:24 --------- d-----w c:\program files\Common Files\Apple
2008-12-01 18:30 --------- d-----w c:\documents and settings\Justin\Application Data\Skype
2008-12-01 15:49 --------- d-----w c:\program files\Common Files\Logitech
2008-11-23 22:39 --------- d-----w c:\documents and settings\Justin\Application Data\dvdcss
2008-11-22 01:25 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-17 04:28 --------- d-----w c:\documents and settings\Justin\Application Data\Azureus
2008-11-13 08:04 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-10 20:05 --------- d-----w c:\program files\Azureus
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 18:37 --------- d-----w c:\program files\Native Instruments
2008-10-18 21:08 --------- d-----w c:\program files\Common Files\Adobe
2008-10-14 16:25 --------- d-----w c:\documents and settings\Justin\Application Data\Amazon
2008-10-14 16:24 --------- d-----w c:\program files\Amazon
2008-10-09 00:46 --------- d-----w c:\program files\SopCast
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"EDS"="c:\program files\Samsung\Samsung EDS\EDSAgent.exe" [2006-03-28 634880]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-07 761947]
"MagicKeyboard"="c:\program files\SAMSUNG\MagicKBD\PreMKBD.exe" [2006-05-18 151552]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"AVG8_TRAY"="c:\progra~1\AVG8\avgtray.exe" [2008-12-04 1261336]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-01 136600]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2005-12-12 c:\windows\AGRSMMSG.exe]

c:\documents and settings\Justin\Start Menu\Programs\Startup\
YzDock.lnk - c:\program files\Y'z Dock\YzDock.exe [2007-10-19 386560]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2003-10-25 113664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Documents and Settings\\Justin\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\Justin\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-09-04 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG8\avgemc.exe [2008-09-04 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG8\avgwdsvc.exe [2008-09-04 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-09-04 76040]
R2 DOSMEMIO;MEMIO;\??\c:\windows\system32\MEMIO.SYS [2006-06-15 4300]
R3 DNSeFilter;DNSeFilter;c:\windows\system32\drivers\SamsungEDS.sys [2006-03-29 27648]
R3 SSB2413;SSB2413 Wireless Network Adapter Service;c:\windows\system32\DRIVERS\SSB2413.sys [2007-10-20 470112]
S4 Adpbcgru;Adpbcgru; []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eafcf2d0-853c-11dc-a869-001377066077}]
\Shell\Auto\command - E:\sxs.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-29 23:34]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Google Update - c:\documents and settings\Justin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
HKLM-Run-tsnp2std - c:\windows\tsnp2std.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\y3r36ttg.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ig
FF -: plugin - c:\documents and settings\Justin\Application Data\Mozilla\Firefox\Profiles\y3r36ttg.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll
FF -: plugin - c:\documents and settings\Justin\Application Data\Mozilla\plugins\npgoogletalk.dll
FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF -: plugin - c:\program files\VLC\npvlc.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-04 00:39:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(592)
c:\windows\system32\Ati2evxx.dll
.
r Running Proce
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG8\avgrsx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Samsung\MagicKBD\MagicKBD.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
.
**************************************************************************
.
Completion time: 2008-12-04 0:42:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-04 05:42:16

Pre-Run: 5,160,185,856 bytes free
Post-Run: 5,163,106,304 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

197 --- E O F --- 2008-12-04 05:14:50


Report •

#16
December 3, 2008 at 22:04:02

Open Notepad and copy/paste everything between the X"s into it and make sure the first word (such as KILLALL, Or File, etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\_delis32.ini

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eafcf2d0-853c-11dc-a869-001377066077}]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".

Your java is out of date and may have been exploited.
Download the latest version of java from this link Java
Click on the JRE 6 Update 11 download button.
Check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.
Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed
Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Please run Esets online scanner from this link:

ESET

1. Note: You will need to use Internet explorer for this scan
2. Tick the box next to YES, I accept the Terms of Use.
3. Click Start
4. When asked, allow the activex control to install
5. Click Start
6. Make sure that the option Remove found threats is unticked ( I want to see what is found first), and the option Scan unwanted applications is checked
7. Click Scan
8. Wait for the scan to finish
9. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
10. Copy and paste that log in your next reply.


Report •

#17
December 4, 2008 at 13:13:49

Hi.
Here's the ESET log you asked for.

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3664 (20081204)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=b43ebc5e1c16264aacd1032e707e1a64
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-12-04 06:40:25
# local_time=2008-12-04 01:40:25 (-0500, Eastern Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=234889
# found=19
# scan_time=2376
C:\SDFix\backups\catchme.zip multiple infiltrations 03330D392F67EE7120ED0DC8DC23A972
C:\SDFix\backups\catchme.zip »ZIP »TDSSnhhy.sys Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSSnaah.dll Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSSoiqh.dll Win32/Agent.OIK trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSSosvn.dll Win32/Agent.OIK trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSSnrse.dll Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS5134.tmp Win32/Patched.AE virus 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS31F8.tmp Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS48BC.tmp Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS4F92.tmp Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS508C.tmp Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS529F.tmp Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS5639.tmp Win32/Agent.OIK trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS5BA8.tmp Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS5F41.tmp Win32/Agent.OIK trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS5FED.tmp Win32/Agent.OIK trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS6358.tmp Win32/Agent.OIK trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS6D7A.tmp Win32/Agent.ODG trojan 00000000000000000000000000000000
C:\SDFix\backups\catchme.zip »ZIP »TDSS7133.tmp Win32/Agent.OIK trojan 00000000000000000000000000000000


Report •

#18
December 4, 2008 at 13:20:52

You computer appears to be clean, the entries from the Eset log are of course just SDFix's quarantine folder.

Navigate to and delete this folder:

C:\SDFix

Empty the recycle bin.

Go to start> run> combofix /u (note the space after combofix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run.

Go to start> control panel> add/remove programs and uninstall these programs:

Hijack This

Malwarebytes

Eset

You should keep AFT Cleaner and run it weekly.


You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster

Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

How is the computer operating?


Report •

#19
December 4, 2008 at 13:32:29

Great. Thank you so much for your time.

The computer is running fine, just a bit slow.


Report •


Ask Question