#1
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
[Resolved] Antivirus Live removal
Hi, I'm trying to rid my girlfriend's computer of that antivirus live trojan that seems to be going around. I myself am a Mac user, and it has been years since I've been on a Windows machine, so I'm a little out of practice when it comes to actually using one. This being said, she's trying to run a super antispyware scan now, but it seems to be stalling. DDS: HJT Report ===============http =127.0.0.1:5555http ://www.candystand.com/play/boardwalk-bowling"LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [2006-8-20 69692]
Last edited by MandaPanda; 5th December 2009 at 16:46 .
Reason: Attching DDS logs
Didn't find the information you thought to find?Similar Threads
#2
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Hi MandaPandaHere disable realtime protection applications this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouse click combofix's window while its running. That may cause it to stall If you are prompted to install the Recovery Console, Please do so.
#3
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
Ran ComboFix, here's the log:atapi .sys was found and disinfected http://www.macromedia.com\bin\airapp...pinstaller.exe LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [8/20/2006 7:52 PM 69692]http =127.0.0.1:5555http://www.gmer.net SP2 -Pro-BootDisk-ENU.exe
#4
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Higbgchm
#5
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
It appears to be empty.
#6
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
HiRootRepeal from the following location and save it to your desktop.Open RootRepeal on your desktop.
Click the ReportTab tab.
Click the Scan button.
Check all seven boxes
Push Ok
Check the box for your main system drive (Usually C: ), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the SaveReport. button .
#7
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
Finished running RootRepeal, the log follows:AD , 2007-2009SP3 ms
#8
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
HiATF Cleaner by Atribune and save it to your Desktop.Windows Temp Now the scan. Kaspersky WebScanner disable real time protection applications as they sometimes interfere with the scan. this link for any applicable programs you may have.Click on “Accept” If your pop –up blocker blocks any windows from opening. Read then Click Accept on the Information page .Windows Vista users you must open the web browser using the Run as Administrator command.The program will launch and then begin downloading the latest definition files:
Under Scan on the left side, Click on My Computer
This will start the program and scan your system.
Click the “Scan Report” On the left side.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected. Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file . Click OK to save the file.:
Save the text file to your desktop.
Copy and paste that information in your next post.
#9
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
Hey, sorry it took so long. The scan took over 11 hours to complete. No problems so far, but it did find three issues. The text from the report follows.atapi .sys.vir Infected: Rootkit.Win32.TDSS.y 1
#10
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Hi HijackThis installer from here and save it to your Desktop. Save HJTInstall.exe to your desktop.
Double-click on the HJTintall.exe icon on your desktop.
Continue to click Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
Put a check by Create a desktop icon and then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch HijackThis.
Click on the Do a system scan and save a log file button.
Click on "Edit " > "Select All " to highlight the entire Notepad contents.
Then click on "Edit " > "Copy ".
Come back here to this thread and Paste the log in your next reply.Right -click in the message body field and select "Paste ".)
CAUTION: DO NOT have HijackThis "fix" anything without carefully following expert guidance. Otherwise, you might render your computer unstable or even unbootable. Most of what HijackThis finds will be harmless or even required.
#11
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
I don't see a Select Additional Tasks option. After HijackThis installs, I accept the tos and it brings me to a window with the following options:
#12
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Do a system scan and save a logfile
#13
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
Here's the contents of the log file from hijack this, should I close the HJT window, or leave it open?SP3 (WinNT 5.01.2600)http://www.livejournal.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http =127.0.0.1:5555http ://www.candystand.com/play/boardwalk-bowling"http://go.microsoft.com/fwlink/?LinkID=39204 http://download.ewido.net/ewidoOnlineScan.cab http://www.shockwave.com/content/bal...webinstall.cab http://hoylegames.sierra.com/cab/WON...herControl.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
#14
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
HiDo a scan only . Check the boxes next to all the entries listed below. O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://hoylegames.sierra.com/cab/WON...herControl.cab close all windows other than HiJackThis , then click Fix Checked. HJT .ComboFix /Uninstall C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file. If they weren't please delete them manually.
#15
Member
Profile: Join Date: Dec 2009
Posts: 8
Computer Experience:
Everything is removed, and the machine is running better than before the malware! My girlfriend and I both thank you so much!
All times are GMT +1. The time now is 08:45 .
