Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

DNSChanger.o/ dlclk.dll - not being removed, no matter what


  • This topic is locked This topic is locked
13 replies to this topic

#1 bitChomp

bitChomp

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 20 December 2009 - 05:41 PM

Hi,

I have been digging through goolgle and running countless scans and still I cant get this virus removed.

I saw this post http://www.bleepingcomputer.com/forums/topic274661-15.html

and followed the directions and still when I run malwarebytes it says it has found and removed the virus - but yet another scan reveals that it is still there. Please help me.

Scans to date include, malwarebytes, combofix, and ESET to name a few - its just not leaving...

Edited by bitChomp, 20 December 2009 - 05:43 PM.


BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,807 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:46 PM

Posted 20 December 2009 - 05:55 PM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 bitChomp

bitChomp
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 20 December 2009 - 07:36 PM

Thank you for moving my post - sorry to post to the wrong forum. The instructions I thought I read said don't post any logs until told to do so. In my hast to try and get help I may have misread.

#4 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:09:46 PM

Posted 20 December 2009 - 07:46 PM

Quick question have they been scanned while in safe mode , as it may not be able to remove it as it is in use ?
Microsoft Certified Desktop Support Technician

#5 bitChomp

bitChomp
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 20 December 2009 - 08:49 PM

I am unable to boot in safe mode. I get a blue screen and something flashes by really quick and the computer restarts.

#6 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:09:46 PM

Posted 20 December 2009 - 09:00 PM

Download and install Avast Anti virus , you will be asked if it can do an on boot scan , allow this , this should find your issue , however it may take a long time to scan , and you will need to keep checking on it as it will ask you what you want to do to the virus its found
Microsoft Certified Desktop Support Technician

#7 bitChomp

bitChomp
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 20 December 2009 - 09:08 PM

Will do - Do you want me to post any logs when I am done?

#8 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:09:46 PM

Posted 20 December 2009 - 09:09 PM

if you are able to , i am unsure on the location of the log after avast has ran , but if it solves your issues there will be no need
Microsoft Certified Desktop Support Technician

#9 bitChomp

bitChomp
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 20 December 2009 - 09:12 PM

Ok - thanks I will let you know the outcome one way or another.

#10 bitChomp

bitChomp
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 20 December 2009 - 10:34 PM

Well I ran the scan on reboot - it found win32:ALUREON.EJ in the tdlclk.dll file and asked to delete and I confirmed, booted up, it updated its database and the virus popped up again. The box that popped up says its a root kit virus - so I told it to delete and it keeps popping back up.

#11 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,807 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:46 PM

Posted 20 December 2009 - 10:42 PM

Rootkits are bad business. You will need more powerful tools than we use in this forum.

Please go to step 6 in this guide: http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ and follow the steps provided there. Once you have the logs, please create a new topic in this forum: http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/ give it a relevant title, post the logs in the topic and provide a clear description of your computer issues. Also provide a link back to this topic.

If you have problems producing the logs, please post back here and you will receive additional instructions. Also, it would be appreciated if you posted back here with the link to your new topic.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#12 bitChomp

bitChomp
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 20 December 2009 - 10:59 PM

Thank you Orange Blossom. I will follow the instructions and get post back.

#13 bitChomp

bitChomp
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 21 December 2009 - 09:33 AM

Here is the link to the topic in the Malware forum. http://www.bleepingcomputer.com/forums/t/280453/infected-with-win32-alureon-enrtk/

#14 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,807 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:46 PM

Posted 21 December 2009 - 08:39 PM

Hello there,

Great. I'm glad you were able to get the logs. Now for the hard and frustrating part: waiting.

Now that you have posted a log, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days, up to two weeks perhaps less, to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users