Tidserv request

Hi,

I am getting the Tidserv request block from Norton. The problem I have is that I can't run dds (keeps opening up in notebook and says it cannot run in DOS) and when I tried to run gmer my computer reboots. The Norton forum pointed me to a thread in bleeping computer that suggested running XDelScan but it stops during the online analysis portion. Any suggestions would be appreciated.

Hello and welcome. Unfortunately I'm leaving now but will look back tomorrow.

>>>> Download this file and doubleclick on it to run it. Allow the information to be merged with the registry.

RKill....

Please download Rkill by Grinler and save it to your desktop.Link 2
Link 3
Link 4

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista, right-click on it and Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• If the tool does not run from any of the links provided, please let me know.

Do not reboot your computer after running rkill as the malware programs will start again.


Now run TDDS KILLER from the Automated Removal Instructions section HERE


Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware (v1.46) and save it to your desktop.alternate download link 1
alternate download link 2
MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

• If Malwarebytes Anti-Malware results in any error messages, check the Help file's list of error codes within its program folder first. If you do not find any information, please refer to Common Issues, Questions, and their Solutions, Frequently Asked Questions. If the error you are receiving is not in the list, please report it here so the research team can investigate.

• Some types of malware will target Malwarebytes Anti-Malware and other security tools to keep them from running properly. If that's the case, please refer to the suggestions provided in For those having trouble running Malwarebytes Anti-Malware.

Hi. Thanks for the quick response.

Ran the FixEXE.reg successfully.
Ran RKill from the 3rd link (1st link 404's, 2nd link brought up notebook)
Ran MBAM and it found nothing.

However, I still have the problem.

Edited by Ferdglob, 10 May 2010 - 09:22 AM.

Rats try one of these

http://www.boredomsoft.org/hosted/rkill.exe
http://www.boredomsoft.org/hosted/rkill.scr
http://www.boredomsoft.org/hosted/rkill.pif
http://www.boredomsoft.org/hosted/rkill.com

Sorry, you must have replied while I was editing my initial response. Here's the latest.

Hi. Thanks for the quick response.

Ran the FixEXE.reg successfully.
Ran RKill from the 3rd link (1st link 404's, 2nd link brought up notebook). Rkill did not find anything.
Ran MBAM and it found nothing.

However, I still have the problem.

Edited by Ferdglob, 10 May 2010 - 09:43 AM.

Ok, let's see if TDDS Killer gets it.

• Go to this page and Download TDSSKiller.zip to your Desktop.
• Extract its contents to your desktop and drag TDSSKiller.exe on the desktop, not in the folder.
• Vista Start logo >All Programs> Accessories> RIGHT-click on Command Prompt and Select Run As Administrator. Copy/paste the following bolded command and hit Enter.
  
  "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v
• If TDSSKiller alerts you that the system needs to reboot, please consent.
• When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.

Sorry boop and thanks for for patience. I ran TDDS Killer before MBAM and here is the log:

06:58:35:906 5620 TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
06:58:35:906 5620 ================================================================================
06:58:35:906 5620 SystemInfo:

06:58:35:906 5620 OS Version: 5.1.2600 ServicePack: 3.0
06:58:35:906 5620 Product type: Workstation
06:58:35:906 5620 ComputerName: JIMSLIFEBOOK
06:58:35:906 5620 UserName: Administrator
06:58:35:906 5620 Windows directory: C:\WINDOWS
06:58:35:906 5620 Processor architecture: Intel x86
06:58:35:906 5620 Number of processors: 2
06:58:35:906 5620 Page size: 0x1000
06:58:35:906 5620 Boot type: Normal boot
06:58:35:906 5620 ================================================================================
06:58:35:921 5620 UnloadDriverW: NtUnloadDriver error 2
06:58:35:921 5620 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
06:58:36:062 5620 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
06:58:36:062 5620 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
06:58:36:062 5620 wfopen_ex: Trying to KLMD file open
06:58:36:062 5620 wfopen_ex: File opened ok (Flags 2)
06:58:36:062 5620 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
06:58:36:062 5620 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
06:58:36:062 5620 wfopen_ex: Trying to KLMD file open
06:58:36:062 5620 wfopen_ex: File opened ok (Flags 2)
06:58:36:062 5620 Initialize success
06:58:36:062 5620
06:58:36:062 5620 Scanning Services ...
06:58:36:453 5620 Raw services enum returned 405 services
06:58:36:468 5620
06:58:36:468 5620 Scanning Kernel memory ...
06:58:36:468 5620 Devices to scan: 4
06:58:36:468 5620
06:58:36:468 5620 Driver Name: Disk
06:58:36:468 5620 IRP_MJ_CREATE : BA90EBB0
06:58:36:468 5620 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
06:58:36:468 5620 IRP_MJ_CLOSE : BA90EBB0
06:58:36:468 5620 IRP_MJ_READ : BA908D1F
06:58:36:468 5620 IRP_MJ_WRITE : BA908D1F
06:58:36:468 5620 IRP_MJ_QUERY_INFORMATION : 804F4562
06:58:36:468 5620 IRP_MJ_SET_INFORMATION : 804F4562
06:58:36:468 5620 IRP_MJ_QUERY_EA : 804F4562
06:58:36:468 5620 IRP_MJ_SET_EA : 804F4562
06:58:36:468 5620 IRP_MJ_FLUSH_BUFFERS : BA9092E2
06:58:36:468 5620 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
06:58:36:468 5620 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
06:58:36:468 5620 IRP_MJ_DIRECTORY_CONTROL : 804F4562
06:58:36:468 5620 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
06:58:36:468 5620 IRP_MJ_DEVICE_CONTROL : BA9093BB
06:58:36:468 5620 IRP_MJ_INTERNAL_DEVICE_CONTROL : BA90CF28
06:58:36:468 5620 IRP_MJ_SHUTDOWN : BA9092E2
06:58:36:468 5620 IRP_MJ_LOCK_CONTROL : 804F4562
06:58:36:468 5620 IRP_MJ_CLEANUP : 804F4562
06:58:36:468 5620 IRP_MJ_CREATE_MAILSLOT : 804F4562
06:58:36:468 5620 IRP_MJ_QUERY_SECURITY : 804F4562
06:58:36:468 5620 IRP_MJ_SET_SECURITY : 804F4562
06:58:36:468 5620 IRP_MJ_POWER : BA90AC82
06:58:36:468 5620 IRP_MJ_SYSTEM_CONTROL : BA90F99E
06:58:36:468 5620 IRP_MJ_DEVICE_CHANGE : 804F4562
06:58:36:468 5620 IRP_MJ_QUERY_QUOTA : 804F4562
06:58:36:468 5620 IRP_MJ_SET_QUOTA : 804F4562
06:58:36:484 5620 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
06:58:36:484 5620
06:58:36:484 5620 Driver Name: Disk
06:58:36:484 5620 IRP_MJ_CREATE : BA90EBB0
06:58:36:484 5620 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
06:58:36:484 5620 IRP_MJ_CLOSE : BA90EBB0
06:58:36:484 5620 IRP_MJ_READ : BA908D1F
06:58:36:484 5620 IRP_MJ_WRITE : BA908D1F
06:58:36:484 5620 IRP_MJ_QUERY_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_SET_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_EA : 804F4562
06:58:36:484 5620 IRP_MJ_SET_EA : 804F4562
06:58:36:484 5620 IRP_MJ_FLUSH_BUFFERS : BA9092E2
06:58:36:484 5620 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_DIRECTORY_CONTROL : 804F4562
06:58:36:484 5620 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
06:58:36:484 5620 IRP_MJ_DEVICE_CONTROL : BA9093BB
06:58:36:484 5620 IRP_MJ_INTERNAL_DEVICE_CONTROL : BA90CF28
06:58:36:484 5620 IRP_MJ_SHUTDOWN : BA9092E2
06:58:36:484 5620 IRP_MJ_LOCK_CONTROL : 804F4562
06:58:36:484 5620 IRP_MJ_CLEANUP : 804F4562
06:58:36:484 5620 IRP_MJ_CREATE_MAILSLOT : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_SECURITY : 804F4562
06:58:36:484 5620 IRP_MJ_SET_SECURITY : 804F4562
06:58:36:484 5620 IRP_MJ_POWER : BA90AC82
06:58:36:484 5620 IRP_MJ_SYSTEM_CONTROL : BA90F99E
06:58:36:484 5620 IRP_MJ_DEVICE_CHANGE : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_QUOTA : 804F4562
06:58:36:484 5620 IRP_MJ_SET_QUOTA : 804F4562
06:58:36:484 5620 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1
06:58:36:484 5620
06:58:36:484 5620 Driver Name: iaStor
06:58:36:484 5620 IRP_MJ_CREATE : BA626186
06:58:36:484 5620 IRP_MJ_CREATE_NAMED_PIPE : 804F4562
06:58:36:484 5620 IRP_MJ_CLOSE : BA626186
06:58:36:484 5620 IRP_MJ_READ : 804F4562
06:58:36:484 5620 IRP_MJ_WRITE : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_SET_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_EA : 804F4562
06:58:36:484 5620 IRP_MJ_SET_EA : 804F4562
06:58:36:484 5620 IRP_MJ_FLUSH_BUFFERS : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562
06:58:36:484 5620 IRP_MJ_DIRECTORY_CONTROL : 804F4562
06:58:36:484 5620 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562
06:58:36:484 5620 IRP_MJ_DEVICE_CONTROL : BA629896
06:58:36:484 5620 IRP_MJ_INTERNAL_DEVICE_CONTROL : BA629B58
06:58:36:484 5620 IRP_MJ_SHUTDOWN : 804F4562
06:58:36:484 5620 IRP_MJ_LOCK_CONTROL : 804F4562
06:58:36:484 5620 IRP_MJ_CLEANUP : 804F4562
06:58:36:484 5620 IRP_MJ_CREATE_MAILSLOT : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_SECURITY : 804F4562
06:58:36:484 5620 IRP_MJ_SET_SECURITY : 804F4562
06:58:36:484 5620 IRP_MJ_POWER : BA62EE66
06:58:36:484 5620 IRP_MJ_SYSTEM_CONTROL : BA62EFC6
06:58:36:484 5620 IRP_MJ_DEVICE_CHANGE : 804F4562
06:58:36:484 5620 IRP_MJ_QUERY_QUOTA : 804F4562
06:58:36:484 5620 IRP_MJ_SET_QUOTA : 804F4562
06:58:36:531 5620 C:\WINDOWS\system32\drivers\iaStor.sys - Verdict: 1
06:58:36:531 5620
06:58:36:531 5620 Driver Name: iaStor
06:58:36:531 5620 IRP_MJ_CREATE : 8A682EE4
06:58:36:531 5620 IRP_MJ_CREATE_NAMED_PIPE : 8A682EE4
06:58:36:531 5620 IRP_MJ_CLOSE : 8A682EE4
06:58:36:531 5620 IRP_MJ_READ : 8A682EE4
06:58:36:531 5620 IRP_MJ_WRITE : 8A682EE4
06:58:36:531 5620 IRP_MJ_QUERY_INFORMATION : 8A682EE4
06:58:36:531 5620 IRP_MJ_SET_INFORMATION : 8A682EE4
06:58:36:531 5620 IRP_MJ_QUERY_EA : 8A682EE4
06:58:36:531 5620 IRP_MJ_SET_EA : 8A682EE4
06:58:36:531 5620 IRP_MJ_FLUSH_BUFFERS : 8A682EE4
06:58:36:531 5620 IRP_MJ_QUERY_VOLUME_INFORMATION : 8A682EE4
06:58:36:531 5620 IRP_MJ_SET_VOLUME_INFORMATION : 8A682EE4
06:58:36:531 5620 IRP_MJ_DIRECTORY_CONTROL : 8A682EE4
06:58:36:531 5620 IRP_MJ_FILE_SYSTEM_CONTROL : 8A682EE4
06:58:36:531 5620 IRP_MJ_DEVICE_CONTROL : 8A682EE4
06:58:36:531 5620 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8A682EE4
06:58:36:531 5620 IRP_MJ_SHUTDOWN : 8A682EE4
06:58:36:531 5620 IRP_MJ_LOCK_CONTROL : 8A682EE4
06:58:36:531 5620 IRP_MJ_CLEANUP : 8A682EE4
06:58:36:531 5620 IRP_MJ_CREATE_MAILSLOT : 8A682EE4
06:58:36:531 5620 IRP_MJ_QUERY_SECURITY : 8A682EE4
06:58:36:531 5620 IRP_MJ_SET_SECURITY : 8A682EE4
06:58:36:531 5620 IRP_MJ_POWER : 8A682EE4
06:58:36:531 5620 IRP_MJ_SYSTEM_CONTROL : 8A682EE4
06:58:36:531 5620 IRP_MJ_DEVICE_CHANGE : 8A682EE4
06:58:36:531 5620 IRP_MJ_QUERY_QUOTA : 8A682EE4
06:58:36:531 5620 IRP_MJ_SET_QUOTA : 8A682EE4
06:58:36:531 5620 Driver "iaStor" infected by TDSS rootkit!
06:58:36:546 5620 C:\WINDOWS\system32\drivers\iaStor.sys - Verdict: 1
06:58:36:546 5620 File "C:\WINDOWS\system32\drivers\iaStor.sys" infected by TDSS rootkit ... 06:58:36:546 5620 Processing driver file: C:\WINDOWS\system32\drivers\iaStor.sys
06:58:36:546 5620 ProcessDirEnumEx: FindFirstFile(C:\WINDOWS\system32\DriverStore\FileRepository\*) error 3
06:58:36:906 5620 vfvi6
06:58:36:968 5620 !dsvbh1
06:58:37:328 5620 dsvbh2
06:58:37:328 5620 fdfb3
06:58:37:328 5620 Backup copy found, using it..
06:58:37:484 5620 will be cured on next reboot
06:58:37:484 5620 Reboot required for cure complete..
06:58:37:515 5620 Cure on reboot scheduled successfully
06:58:37:515 5620
06:58:37:515 5620 Completed
06:58:37:515 5620
06:58:37:515 5620 Results:
06:58:37:515 5620 Memory objects infected / cured / cured on reboot: 1 / 0 / 0
06:58:37:515 5620 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
06:58:37:515 5620 File objects infected / cured / cured on reboot: 1 / 0 / 1
06:58:37:515 5620
06:58:37:515 5620 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
06:58:37:515 5620 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
06:58:37:515 5620 UnloadDriverW: NtUnloadDriver error 1
06:58:37:531 5620 KLMD(ARK) unloaded successfully

OK. the killer needed a reboot to fish removal.

Let's get an online scan and tell me how it is after.


ESET
Please perform a scan with Eset Online Antiivirus Scanner.
(Requires Internet Explorer to work. If given the option, choose "Quarantine" instead of delete.)
Vista users need to run Internet Explorer as Administrator. Right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Click the green ESET Online Scanner button.
• Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
• Click on the Start button next to it.
• You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.
• A new window will appear asking "Do you want to install this software?"".
• Answer Yes to download and install the ActiveX controls that allows the scan to run.
• Click Start.
• Check Remove found threats and Scan potentially unwanted applications.
• Click Scan to start. (please be patient as the scan could take some time to complete)
• If offered the option to get information or buy software. Just close the window.
• When the scan has finished, a log.txt file will be created and automatically saved in the C:\Program Files\ESET\ESET Online Scanner\log.txt
  folder.
• Click > Run..., then copy and paste this command into the open box: C:\Program Files\EsetOnlineScanner\log.txt
• The scan results will open in Notepad. Copy and paste the contents of log.txt in your next reply.

Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

Ok, the scan is done. Found 8 and cleaned 7. Here is the log text.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=875b144f7826f6448042d9b69f725ac8
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-05-10 06:52:19
# local_time=2010-05-10 11:52:19 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033

Oh, and it is still giving me the message
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=768 16777215 100 0 70190323 70190323 0 0
# compatibility_mode=3584 16777175 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=150644
# found=8
# cleaned=7
# scan_time=11115
C:\Documents and Settings\All Users\Application Data\AOL Downloads\triton_suite_install\6.1.41.2\setup.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Bodog Casino\Install.exe a variant of Win32/CasOnline application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\$NtUninstallKB959426$\kernel32.dll Win32/Agent.NOU virus (deleted - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\dboy1.sys BAT/TrojanDownloader.Ftp.NAH trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\dsdmogt.dll a variant of Win32/BotSpeedometer trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\tzlcwg.bat probably a variant of BAT/TrojanDownloader.Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\tzlcwg.sys probably a variant of BAT/TrojanDownloader.Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
D:\USMT.TMP\DIR0003.TMP\00000\1BC.DAT VBS/TrojanDropper.Inor trojan (unable to clean) 00000000000000000000000000000000 I

Edited by Ferdglob, 10 May 2010 - 02:27 PM.

Ok, we will need something stronger to get that one.
Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

I can't run dds.scr. First it told me that an .scr was associated with Autocad scripts. I undid the association and now it just scans it with Spybot, even though I have spybot turned off.

Sorry to be such a pain but is there any other way to run the dds file?

If you cannot get DDS to work, please try this instead.

Please download OTL by OldTimer and save it to your Desktop.

• Close all other applications and windows so that you have nothing open and are at your Desktop.
• Double click on the OTL icon on your desktop.
• Select 30 days from the File Age: drop down menu.
• Click the "Scan All Users" checkbox.
• Click the button to start.
• Do not use the computer while the scan is in progress.
• When the scan is complete, two log files will open in Notepad:
  • OTL.txt <- (will be maximized)
  • Extras.txt <- (will be minimized in the Task Bar).
• Both logs are automatically saved to the Desktop.
• Please copy the contents of OTL.txt to the clipboard by highlighting everthing and pressing Ctrl+C or after highlighting, right-click and choose Copy and then paste it into a new topic in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here.
• Also copy and paste the contents of Extras.Txt in your next reply as well. If the Extras.Txt log is too long, you may need to add a second reply to your thread.
• Click the red X in the upper right corner to exit OTL.

Important: Be sure to mention that you tried to follow the Prep Guide but were unable to get DDS to run. If OTL did not work, then reply back here.

Ran OLT and posted the results here http://www.bleepingcomputer.com/forums/ind...p;#entry1751353

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/315961/tideserv-request-block/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom