Forum Guidelines
Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.
Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic
will be looked at and responded to. So please be patient.
DO NOT RUN ComboFix unless requested to.
Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.
When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.
Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
Infected with Trojan Agent_r.XJ
Can't get rid of it
Group:
Malware Response Instructor
Posts:
29,103
Joined:
24-July 08
Gender: Male
Location: London, UK
Posted 09 May 2011 - 06:58 PM
I'm thinking there may be a rootkit holding the redirections
Download TDSSKiller and save it to your Desktop. Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop. Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK."%userprofile%\Desktop\TDSSKiller.exe" -l report.txt Now click Start Scan. If Malicious objects are found, ensure Cure is selected then click Continue > Reboot now. Click Close Finally press Report and copy and paste the contents into your next reply. If you've rebooted then the log will be found at C:\ And then run aswMBR
Please download
aswMBR ( 511KB ) to your desktop.
Double click the aswMBR.exe Click the Scan On completion of the scan, click the save log desktop and post it in your next reply.
If I have helped you fix your PC then please donate m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)
New Member
Group:
Members
Posts:
10
Joined:
25-April 11
Posted 10 May 2011 - 11:02 AM
2011/05/10 11:54:55.0822 2064 TDSS rootkit removing tool 2.5.0.0 May 1 2011 14:20:16
Group:
Malware Response Instructor
Posts:
29,103
Joined:
24-July 08
Gender: Male
Location: London, UK
Posted 10 May 2011 - 05:17 PM
Yes, TDSS is involved. I note that the MBR (master boot record) is not being recognised. That doesn't mean that there's a problem but we need to check.
Please download
MBRCheck to your desktop.
1. Double click MBRCheck.exe to run it (Right click and run as Administrator for Vista).
2. It will open a black window, please do not fix anything (if it gives you an option).
3. Exit that window and it will produce a log (MBRCheck_date_time).
4. Please post that log when you reply.
Has the redirecting stopped now?
If I have helped you fix your PC then please donate m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)
New Member
Group:
Members
Posts:
10
Joined:
25-April 11
Posted 10 May 2011 - 09:51 PM
MBRCheck, version 1.2.3
Group:
Malware Response Instructor
Posts:
29,103
Joined:
24-July 08
Gender: Male
Location: London, UK
Posted 11 May 2011 - 04:52 PM
The MBR needs fixing.
Download NTBR_CD noahdfear to the desktop. Click on the NTBR_CD.exe to extract its contents to the desktop. Once extracted, open the NTBR_CD folder and click on the BurnItCD application. Insert a blank CD when prompted. The .iso image will be burned to the CD. Boot the computer with the CD you just burned and follow the prompts. Press Enter for English . At the menu type 1 to select MBRWORK then hit Enter Type 5 to Install standard MBR code then hit Enter Type 1 to select Standard then hit Enter Type Y then hit Enter to confirm Type E then hit Enter to exit Back at the menu, type 6 to Quit . Press Ctrl+Alt+Del to restart the machine. Eject the CD upon restart and boot normally.
Then please rerun MBRCheck and post the log.
If I have helped you fix your PC then please donate m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)
Group:
Malware Response Instructor
Posts:
29,103
Joined:
24-July 08
Gender: Male
Location: London, UK
Posted 14 May 2011 - 08:58 PM
Hi,I have not had a reply from you for 4 days. If you like you can PM me. m0le
If I have helped you fix your PC then please donate m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)
Group:
Malware Response Instructor
Posts:
29,103
Joined:
24-July 08
Gender: Male
Location: London, UK
Posted 16 May 2011 - 05:01 PM
Due to the lack of feedback, this topic is now closed.
In the event you still have problems, please send me or any
Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
If I have helped you fix your PC then please donate m0le is a proud member of UNITE (Unified Network of Instructors and Trusted Eliminators)
Share this topic:
1 User(s) are reading this topic0 members, 1 guests, 0 anonymous users
Help
Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.
This topic is locked
Back to top
