Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Cannot DL and run DDS.scr and RootRepeal

  • Please log in to reply
1 reply to this topic

#1 Taktikool


  • Members
  • 3 posts
  • Local time:11:04 PM

Posted 27 December 2009 - 12:19 AM

I've read the preparation guide and heres my complete list of problems.

A few days ago this computer was receiving attack messages from nortons internet security every 30minutes to an hour. After that the web browsers installed would open up random windows, this computer uses firefox and IE. If you click a website on the google page it redirects you to another site, they're all different each time. When I searched google for the file or name of whatever is attacking the computer it would always redirect to more fake websites. Not all websites have problems, but other sites like Symantec and Wikipedia do not work. I have to cut/copy/paste into the browser bar to get it to work. Sometimes 6 different tabs are opened up everytime firefox is started up.

Now then, the problem with DDS.scr nortons thinks its a virus for some reason and removes it/deletes it everytime i try to install it. When I tried to install RootRepeal the computer restarted on its own! When I try to install either (the second time) it says its finished removing the virus and I now have to restart to fix the problem.

I've not had problems like this with a virus in the past so i'm at a loss as to what to do, is nortons corrupted? Is nortons the problem? Is a virus pretending to be nortons "pop ups"?

Steps taken:

1. Nortons scan, result nothing but tracking cookies.

2. Malwarebytes AntiMalware scan, result nothing but tracking cookies.

3. Outdated Adaware Lavasoft scan, result nothing but more tracking cookies.

4. This forum

I've just had the attack pop up, it says "a58990058.cn" is the attacker and risk name is listed as "HTTPS Tidserv C and C Domain Request" with application path \DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\SVCHOST.EXE

Let me know how to get the logs posted and I will, until then this is all the information I can give about my problem. I need further help, thanks.

BC AdBot (Login to Remove)


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Moderator
  • 37,110 posts
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:10:04 PM

Posted 27 December 2009 - 10:36 AM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Internet Security, NoScript Firefox ext.


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users