 Win32.TDSS.rtk, This won't go away! |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
  |
 Jul 8 2009, 09:40 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437  |
Win32.TDSS.rtk: [SBI $79B0E3AB] File (File, nothing done) C:\Windows\System32\drivers\SKYNETnhndplpb.sys Properties.size=0 Properties.md5=282B9FF0290D24DA0EA61120FD42024C Win32.TDSS.rtk: [SBI $49F1C28A] File (File, nothing done) C:\Windows\System32\SKYNETdrccaqim.dll Properties.size=0 Properties.md5=55B7F2C7B33EAE0D491835D31E22EF1F Win32.TDSS.rtk: [SBI $49F1C28A] File (File, nothing done) C:\Windows\System32\SKYNETpojiixvr.dll Properties.size=0 Properties.md5=731C7FD5006DF3CC3AB01134CA3F94DE Win32.TDSS.rtk: [SBI $00122603] File (File, nothing done) C:\Windows\temp\SKYNETpyfilfwito.tmp Properties.size=0 Properties.md5=9CAB8C63FC112DED4A0023F2231A36EC Win32.TDSS.rtk: [SBI $00122603] File (File, nothing done) C:\Windows\temp\SKYNETrsfefdylti.tmp Properties.size=0 Properties.md5=731C7FD5006DF3CC3AB01134CA3F94DE Win32.TDSS.rtk: [SBI $1A7ABF3C] File (File, nothing done) C:\Windows\System32\SKYNETlog.dat Properties.size=0 Properties.md5=F2308B7B83E58EF193FEB26054FAF576 Win32.TDSS.rtk: [SBI $1A7ABF3C] File (File, nothing done) C:\Windows\System32\SKYNETremyxosu.dat Properties.size=0 Properties.md5=9CAB8C63FC112DED4A0023F2231A36EC Win32.TDSS.rtk: [SBI $1A7ABF3C] File (File, nothing done) C:\Windows\System32\SKYNETrexpoxvh.dat Properties.size=0 Properties.md5=5330F8F2DB0EAFFE68636761F11498EF DoubleClick: Tracking cookie (Internet Explorer: Vincent) (Cookie, nothing done) BurstMedia: Tracking cookie (Internet Explorer: Vincent) (Cookie, nothing done) Zedo: Tracking cookie (Internet Explorer: Vincent) (Cookie, nothing done) Right Media: Tracking cookie (Internet Explorer: Vincent) (Cookie, nothing done) BurstMedia: Tracking cookie (Internet Explorer: Vincent) (Cookie, nothing done) ***************************************************************************** I let Spybot remove these files but when I open browser and do a google search and select another result, the same thing happens. How can I permanetly remove the above files so that they won't keep coming back? I also tried Ad-Aware without any luck either. I am running Vista Home Premium 32bit. I am unable to install Service Pack2 also. Thanks This post has been edited by VinnyP: Jul 8 2009, 10:14 AM -------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
 |
 
|
|
Jul 8 2009, 10:58 AM
Post
#2
|
|
 To INSANITY and BEYOND !! Group: Moderator Posts: 21,490 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
HJi Vinny,Please run Rootrepeal and then MBAM if possoble.
Next Please install RootRepeal Note: Vista users ,, right click on desktop icon and select "Run as Administrator." Go HERE, and download RootRepeal.zip to your Desktop. Tutorial with images ,if needed >> L@@K. Unzip that,(7-zip tool if needed) and then click RootRepeal.exe to open the scanner. Next click on the Report tab, now click on Scan. A Window will open asking what to include in the scan. Check all of the below and then click OK. Drivers Files Processes SSDT Stealth Objects Hidden Services Now you'll be asked which drive to scan. Check C: and click OK again and the scan will start. Please be patient as the scan runs. When the scan has finished, click on Save Report. Name the log RootRepeal.txt and save it to your Documents folder (it should automatically save it there). Please copy and paste that into your next reply. Next run MBAM (MalwareBytes): NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop. Please download Malwarebytes Anti-Malware and save it to your desktop. alternate download link 1 alternate download link 2 MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
-------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 8 2009, 01:20 PM
Post
#3
|
|
|
New Member Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437 |
Ok, Boop
I ran RootRepeal but couldn't get it to finish. Tried several times. It would get close and then a popup window would appear with no visible message. Waited and waited but nothing. When I click close program would crash and I would have to start over only to have same problem. Tried to attach image of program at time of crash but not sure how to do it. Ran MalwareBytes and am posting that report though. After scan I remove all problems and had to reboot to finish removal. AFter reboot I tried to run RootRepeal again and same thing happened. Malwarebytes' Anti-Malware 1.38 Database version: 2394 Windows 6.0.6001 Service Pack 1 7/8/2009 12:27:55 PM mbam-log-2009-07-08 (12-27-55).txt Scan type: Quick Scan Objects scanned: 82586 Time elapsed: 2 minute(s), 40 second(s) Memory Processes Infected: 0 Memory Modules Infected: 1 Registry Keys Infected: 12 Registry Values Infected: 12 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 9 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: \\?\globalroot\systemroot\System32\SKYNETpojiixvr.dll (Trojan.TDSS) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85a35eb1-11bb-4fa8-bddb-9332afa280fe} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{85a35eb1-11bb-4fa8-bddb-9332afa280fe} (Trojan.Vundo.H) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb4097 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd6734 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga1609 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc1936 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb7934 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd1297 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga6590 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc4748 (Trojan.TDSS) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb7807 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd9511 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga113 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc4301 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Windows\system32\kotobd.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully. \\?\globalroot\systemroot\System32\SKYNETpojiixvr.dll (Trojan.TDSS) -> Quarantined and deleted successfully. C:\Windows\System32\SKYNETpojiixvr.dll (Trojan.TDSS) -> Delete on reboot. C:\Windows\Temp\SKYNETporxqrdtrd.tmp (Trojan.TDSS) -> Delete on reboot. C:\Windows\System32\SKYNETlog.dat (Trojan.Agent) -> Delete on reboot. C:\Windows\hosts (Trojan.Agent) -> Quarantined and deleted successfully. c:\Users\Vincent\AppData\Roaming\msgwin.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Windows\System32\hosts (Trojan.Agent) -> Quarantined and deleted successfully. C:\Windows\npptools.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. -------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
|
|
|
|
Jul 8 2009, 02:15 PM
Post
#4
|
|
|
To INSANITY and BEYOND !! Group: Moderator Posts: 21,490 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Hi again ,I need to give you this advice now..
One or more of the identified infections is a backdoor trojan. This allows hackers to remotely control your computer, steal critical system information and download and execute files. I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation. Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information: How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? When Should I Format, How Should I Reinstall We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. -------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 8 2009, 02:56 PM
Post
#5
|
|
|
New Member Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437 |
I do not use this computer for banking and credit cards I have used in past have been cancelled re-issued with new account numbers. So lets go for it.
-------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
|
|
|
|
Jul 8 2009, 03:43 PM
Post
#6
|
|
|
To INSANITY and BEYOND !! Group: Moderator Posts: 21,490 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Ok run these next..
Please print out and follow these instructions: "How to use SDFix". <- This program is for Windows 2000/XP ONLY. When using this tool, you must use the Administrator's account or an account with "Administrative rights"
Rerun MBAM like this: Open MBAM in normal mode and click Update tab, select Check for Updates,when done click Scanner tab,select Quick scan and scan. After scan click Remove Selected, Post new scan log and Reboot into normal mode. -------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 9 2009, 09:56 AM
Post
#7
|
|
|
New Member Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437 |
I can not get SDFix to run. Did everything I could (Command Prompt flashes on then off again). SDFix help page suggest that this happens on XP or Windows 2000, but I have Vista Home Premium. I followed the direction anyway and it still didn't work so I tried the next step by checking the ComSpec value and it was as it should be. But still could not get it to run. Is there anything else I can do? Is there another method to fix this? I am going nuts with this.
-------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
|
|
|
|
Jul 9 2009, 10:05 AM
Post
#8
|
|
|
To INSANITY and BEYOND !! Group: Moderator Posts: 21,490 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Ok that was my bad,sorry, Can you try runnnig the Rootrepeall again?
Run part 1 of S!Ri's SmitfraudFix Please download SmitfraudFix Double-click SmitfraudFix.exe Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. http://www.beyondlogic.org/consulting/proc...processutil.htm -------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 9 2009, 10:29 AM
Post
#9
|
|
|
New Member Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437 |
Still can not run RootRepeal but here is report from SmitFraudFix:
SmitFraudFix v2.423 Scan done at 10:25:23.21, Thu 07/09/2009 Run from C:\Users\Vincent\Desktop\SmitfraudFix OS: Microsoft Windows [Version 6.0.6001] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\svchost.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\svchost.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Windows\system32\svchost.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\taskeng.exe C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe C:\Program Files\ASUS\AASP\1.00.32\aaCenter.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\System32\rundll32.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Sunbelt Software\VIPRE\SBAMTray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\cmd.exe C:\Windows\system32\wbem\wmiprvse.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Vincent »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Vincent\AppData\Local\Temp »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Vincent\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\Users\Vincent\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix !!!Attention, following keys are not inevitably infected!!! Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="kotobd.dll" "LoadAppInit_DLLs"=dword:00000001 »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\SYSTEM32\\userinit.exe," »»»»»»»»»»»»»»»»»»»»»»»» RK [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter DNS Server Search Order: 192.168.11.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{C0D04378-DB87-4D80-9D46-F83BA441DD9E}: DhcpNameServer=192.168.11.1 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End -------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
|
|
|
|
Jul 9 2009, 10:50 AM
Post
#10
|
|
|
To INSANITY and BEYOND !! Group: Moderator Posts: 21,490 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Ok,that's good. Run DrWeb and post the log. Then do Part 2 of Siri
You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site. Please reboot your computer in Safe Mode by doing the following :
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files. You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter". The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply. The report can also be found at the root of the system drive, usually at C:\rapport.txt -------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 9 2009, 11:10 AM
Post
#11
|
|
|
New Member Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437 |
Where do I get DrWeb and what is Siri?
-------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
|
|
|
|
Jul 9 2009, 11:29 AM
Post
#12
|
|
|
To INSANITY and BEYOND !! Group: Moderator Posts: 21,490 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Siri smitfraudfix are the instructions I just posted and here is DRWeb
Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page. Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet. alternate download link Note: The file will be randomly named (i.e. 5mkuvc4z.exe). Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode". Scan with Dr.Web CureIt as follows:
-------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 9 2009, 12:49 PM
Post
#13
|
|
|
New Member Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437 |
I can not get DrWeb CureIt to run either. I get to the Start/Update window and once Start is selected, after a few seconds, I get popup window stating that
"t8c54.exe has stopped working" "A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available." I tried to run in Safe Mode as per instructions. Are we running out of fixes here? -------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
|
|
|
|
Jul 9 2009, 12:54 PM
Post
#14
|
|
|
To INSANITY and BEYOND !! Group: Moderator Posts: 21,490 Joined: 10-September 04 From: NJ USA Member No.: 2,608 |
Well looks like we need specialized tools here. You will need to run HJT/DDS.
Please follow this guide.Preparation Guide For Use Before Using Hijackthis. Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title and post that complete log. Let me know if it went OK. -------------------- Can you spare some PC cycles to help FIND A CURE .. BC FOLDING TEAM Click me /info..
ThoughtVent a goodplace to discuss.<<>>>Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 9 2009, 01:44 PM
Post
#15
|
|
|
New Member Group: Members Posts: 12 Joined: 7-July 09 Member No.: 349,437 |
Thanks so much for your time and attempts to solve this. You are a tribute to those who are willing to help peeps like me who are dazed and confused.
Vinny -------------------- Life is tough, but it's tougher when you're stupid - John Wayne
|
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 7th November 2009 - 05:24 PM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.