#1
Member
Profile: Join Date: May 2009
Posts: 15
Computer Experience:
[Resolved] tdss removal
Hello, im new here and would like to thank everyone in advance. im using spyware terminator currently because it is the only one that works on my system. it recognizes that i have tdss.asz,tdss.atb, and tdss.ade. the problem i have is that it can't remove it. the program suggest to run in safe mode and i have the same problem. is there a different way to remove these.Ad -Aware 2007\aawservice.exehttp://www.crawler.com/search/dispat...=%s&tbid=60341 http://www.crawler.com/search/ie.aspx?tb_id=60341 http://dnl.crawler.com/support/sa_cu...spx?TbId=60341 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.crawler.com/search/ie.aspx?tb_id=60341 http://dnl.crawler.com/support/sa_cu...spx?TbId=60341 Ad -Aware 2007\aawservice.exeAd -Aware 2007\aawservice.exe [Lavasoft] [Ad -Aware 2007 Service] MD5=0629361FAC4576BA48AB39F4903DCE9E SIZE=587096Ad -Aware 2007\CEAPI.dll [Lavasoft] [CEAPI Dynamic Link Library] MD5=759C45CA544A92DE4B88618894A15587 SIZE=738664Ad -Aware 2007\PKArchive85u.dll [PKWARE, Inc.] [PKWARE Archive API] MD5=46374252AFA0A37F4F7AF528F6F16B96 SIZE=907096Ad -Aware 2007\Update.dll [Update Dynamic Link Library] MD5=72CCE73551D24D7863369F3BFD6548C9 SIZE=525664
Didn't find the information you thought to find?Similar Threads
#2
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Hi and welcomeworksnow from HERE: * IMPORTANT !!! Save worksnow to your Desktop Disable your AntiVirus and AntiSpyware applications , usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
Quote:
AVG 8
Note : If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs Double click on worksnow & follow the prompts.Note: worksnow will run without the Recovery Console installed.
As part of it's process, combofix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. http://img.photobucket.com/albums/v7...d7/RcAuto1.gif http://img.photobucket.com/albums/v7...7/whatnext.png C:\ComboFix.txt in your next reply.copy/paste " a new HijackThis log file into this thread as well.Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall. ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely , the connection can be manually restored by restarting your machine.DDS save it to your desktop.Disable any script blocking protection
Double click dds.scr to run the tool.
When done, DDS will open two (2) logs: DDS.txt
Attach.txt
Save both reports to your desktop.
You may need several replies to post the requested logs, otherwise they might get cut off .
#3
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
bump....to display reply.
#4
Member
Profile: Join Date: May 2009
Posts: 15
Computer Experience:
ok here is my new report. will wait for further instructionsAMD Athlon(tm) XP 2800+ | Socket A | 2083/167mhzAd -AwareAd -aware 6 PersonalPCI Soft ModemSP2 (KB927978)SP2 (KB936181)SP2 (KB954430)Ad -Aware 2007 Service service terminated unexpectedly. It has done this 1 time(s).Ad -Aware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.TCP /IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.DNS Client service depends on the TCP /IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.TCP /IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.Ad -Aware 2007\aawservice.exeAd -Aware\AAWService.exeAd -Aware\AAWTray.exeHJT Report ===============http://www.yahoo.com Ad -Watch] c:\program files\lavasoft\ad -aware\AAWTray.exeTCP : {83998832-8C64-4EFB-9D19-570F38C35BFB} = 69.50.166.94,69.31.80.244TCP : {D477902B-9B27-4710-A845-919857A71B51} = 69.50.166.94,69.31.80.244js : browser.search.selectedEngine - js : keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60341&qkw=js : yahoo.homepage.dontask - trueAd -Aware 2007 Service;c:\program files\lavasoft\ad -aware 2007\aawservice.exe [2008-1-4 587096]Ad -Aware Service;Lavasoft Ad -Aware Service;c:\program files\lavasoft\ad -aware\AAWService.exe [2009-1-18 921936]
#5
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Welcome backCiD Help Combofix from any of the links below. desktop .Link 1 Link 2 Link 3
Quote:
AVG 8 AVG 8 Control Center , by right clicking on the AVG 8 icon on task bar.Click on Tools .
Select Advanced .
In the left hand pane, scroll down to "Resident Shield ".
In the main pane, deselect the option to "Enable Resident Shield ."To re-enable AVG 8, please select "Enable Resident Shield " again.
AVIRA ANTIVIR (looks to this: http://i94.photobucket.com/albums/l8...er/antivir.png )
(Click on this link to see a list of programs that should be disabled http://www.bleepingcomputer.com/forums/topic114351.html Combo-Fix.exe & follow the prompts.No Validation is Required. ** When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.
Please only run the tool once, ty. Extra note : After you have installed the Recovery Console - if you reboot your computer, right after reboot, you'll see the option for the Recovery Console now as well. You may need several replies to post the requested logs, otherwise they might get cut off .
#6
Member
Profile: Join Date: May 2009
Posts: 15
Computer Experience:
new data.SP3 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exehttp://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/yco.../www.yahoo.com Ad -Watch] C:\Program Files\Lavasoft\Ad -Aware\AAWTray.exehttp://www.update.microsoft.com/wind...?1212994192812 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://chat.yahoo.com/cab/yvwrctl.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exeAd -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exeAd -Watch"="c:\program files\Lavasoft\Ad -Aware\AAWTray.exe" [2009-05-21 516440]Ad -Aware Service]Ad -Aware Service;Lavasoft Ad -Aware Service;c:\program files\Lavasoft\Ad -Aware\AAWService.exe [1/18/2009 2:34 PM 953168]Ad -Aware Update (Weekly).jobAd -Aware\Ad -AwareAdmin.exe [2009-01-18 06:32]http://www.yahoo.com TCP : {83998832-8C64-4EFB-9D19-570F38C35BFB} = 69.50.166.94,69.31.80.244TCP : {D477902B-9B27-4710-A845-919857A71B51} = 69.50.166.94,69.31.80.244js : browser.search.selectedEngine - js : keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60341&qkw=js : yahoo.homepage.dontask - true.http://www.gmer.net
#7
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Welcome backhttp://vil.mcafeesecurity.com/vil/content/v_137764.htm My Computer->Tools->Folder Options->View tab: Under the Hidden files and folders heading:
Select - Show hidden files and folders. Uncheck - Hide protected operating system files (recommended) option.Also, make sure there is no checkmark beside Hide file extensions for known file types.
Click OK. (Remember to Hide files and folders once done)
VirusTotal http://i204.photobucket.com/albums/b...total2-SWI.png Click the Browse button and search for the following file: c:\program files\Common Files\ydobiwevys.sys
Click Open
Then click Send File
Please be patient while the file is scanned.
Once the scan results appear, please provide them in your next reply.
Next please have the below additional files scanned c:\program files\Common Files\veficefe._sy ATF Cleaner by Atribune From Here Desktop . Follow the instructions for the browser you use. ATF-Cleaner.exe Windows Temp "Select All" . Empty Selected . When you get the "Done Cleaning" message, click OK . Firefox or Opera browsers , you can use this program Exit button in the Main menu. *Note http://www.kaspersky.com/service?chapter=161739400 Kaspersky Online Scanner http://www.kaspersky.com/virusscanner Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan. Accept button and install any components it needs. The program will install and then begin downloading the latest definition
After the files have been downloaded on the left side of the page in the Scan section select My Computer .
This will start the program and scan your system.
The scan will take a while, so be patient and let it run. (At times it may appear to stall)
Once the scan is complete, click on View scan report To obtain the report:
Save Report As Save as Save in Desktop File name Save as type Text file [*.txt] Save Kaspersky Online Scanner Report http://i275.photobucket.com/albums/j...g/KAS/KAS9.gif Note .. for Internet Explorer 7 Accept " button of the license, click on the "Zoom " tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100% . ) https://addons.mozilla.org/en-US/firefox/addon/1419 C:\qoobox\ComboFix3HJT log taken after the above scans have run You may need several replies to post the requested logs, otherwise they might get cut off .
#8
Member
Profile: Join Date: May 2009
Posts: 15
Computer Experience:
new report. i also removed spyware term.Ad -Watch"="c:\program files\Lavasoft\Ad -Aware\AAWTray.exe" [2009-01-18 506712]Ad -Aware Service]Ad -Aware Service;Lavasoft Ad -Aware Service;c:\program files\Lavasoft\Ad -Aware\AAWService.exe [1/18/2009 2:34 PM 921936]Ad -Aware Update (Weekly).jobAd -Aware\Ad -AwareAdmin.exe [2009-01-18 21:34]http://www.yahoo.com TCP : {83998832-8C64-4EFB-9D19-570F38C35BFB} = 69.50.166.94,69.31.80.244TCP : {D477902B-9B27-4710-A845-919857A71B51} = 69.50.166.94,69.31.80.244js : browser.search.selectedEngine - js : keyword.URL - hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&tbid=60341&qkw=js : yahoo.homepage.dontask - true.http://www.gmer.net SP3 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exehttp://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/yco.../www.yahoo.com Ad -Watch] C:\Program Files\Lavasoft\Ad -Aware\AAWTray.exehttp://www.update.microsoft.com/wind...?1212994192812 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://chat.yahoo.com/cab/yvwrctl.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exeAd -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exe
#9
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
The logs have shown me you had a nasty rootkit infection on your computer.HJT log.Avira AntiVir Personal
#10
Member
Profile: Join Date: May 2009
Posts: 15
Computer Experience:
"Did you remove Spyware Terminator before or after you ran Combofix? It's still showing in your HJT log."ad -adware and malwarebytes. also i just bought norton 360 3.0 that i havent installed. im waiting for this issue to be resolved first.
#11
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Welcome back
Quote:
computer is loading and running faster
Good dealOTMoveIt3 by OldTimer Double-click OTMoveIt3.exe to run it.
Copy the lines in the codebox below. ( Make sure you include :Processes )
Code:
:Processes
explorer.exe
:Files
c:\documents and settings\All Users\Application Data\avg8
c:\windows\system32\drivers\AVGIDSErHr.sys
:services
AVGIDSErHr
AVGIDSWatcher
AVGIDSDriver
AVGIDSFilter
AVGIDSShim
AVGIDSAgent
AntiVirScheduler
AntiVirService
:Commands
[Purity]
[EmptyTemp]
[Start Explorer]
[Reboot] Return to OTMoveIt3, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste .
- Close ALL open windows (especially Internet Explorer!)-
Click the red Moveit! button.
Copy everything in the Results window (under the green bar), and paste it in your next reply. Close OTMoveIt3
Yes. c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log HJT log
#12
Member
Profile: Join Date: May 2009
Posts: 15
Computer Experience:
here is my new report.SP3 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exeAd -Aware\AAWService.exeAd -Aware\AAWTray.exehttp://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/yco.../www.yahoo.com Ad -Watch] C:\Program Files\Lavasoft\Ad -Aware\AAWTray.exehttp://www.update.microsoft.com/wind...?1212994192812 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://chat.yahoo.com/cab/yvwrctl.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exeAd -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exe
#13
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
Welcome backhere here here HijackThis Click Do a system scan only , checkmark these. Then close all other windows and browsers except HijackThis and press fix checked. Click START then RUN
Now type Combofix /u in the runbox and click OK . Note the space between the x and the /u , it needs to be there.
http://billy-oneal.com/Canned%20Spee...n/removecf.png OTMoveIt CleanUp! ". Then reboot your computer. <--Important
#14
Member
Profile: Join Date: May 2009
Posts: 15
Computer Experience:
"* Click START then RUN
#15
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 975
Computer Experience:
We'll just have to manual delete the related files/folders.Qoobox <--delete the folderquarantined_files.txt <--file Combofix <--delete the foldercombofix.txt <--file
All times are GMT +1. The time now is 06:14 .
