Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With AntiMalware Doctor


  • Please log in to reply
14 replies to this topic

#1 exal85

exal85

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 21 July 2010 - 06:11 PM

Hi,

I followed the step by step instructions on how to remove antimalware doctor but I am still having computer issues.

AVG will catch trojan installers that come up every 10-12 hrs. I have ran malwarebytes and can post the log which found the virus if needed.

My main computer issue is that I can not access the internet with IE or Google Chrome, however Mozilla and AIM work fine. Also, I can update malwarebytes but SuperAnti-Spyware updates do not work. When I run the windows connection diagnostics it says that there is a firewall blocking the connection. I assume this is tied to the virus.

I can most likely proceed without help and remove this with combofix ect. however I would rather not risk it and let you guys assist me.

The computer I am currently posting on is not the infected computer. I have a flash drive if anything needs to be transfered and posted here, or if any programs need to be installed on the infected computer.

Thank you for the assistance.

~exal85

BC AdBot (Login to Remove)

 


#2 exal85

exal85
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 27 July 2010 - 08:12 PM

Hey I know you guys prefer not to have a second post but I was wondering when this will be addressed.

I know you are constantly swamped but even a "we got the message" would be helpful.

Sorry for being anxious, and annoying.

~exal

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:33 PM

Posted 27 July 2010 - 10:00 PM

Hello, Hi I am typing with fingers worn to the knuckles :thumbsup:

Run TFC by OT
Please download TFC by Old Timer and save it to your desktop.
alternate download link
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

>>>> Download this file and doubleclick on it to run it. Allow the information to be merged with the registry.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.


Now an online scan with ESET
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the ESET Online Scanner button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Export to text file... to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Eset Smart Installer icon on your desktop.
  • Check the "YES, I accept the Terms of Use"
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push "List of found threats"
  • Push "Export to text file", and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the "<<Back" button.
  • Push Finish
In your next reply, please include the following:
  • Eset Scan Log

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#4 exal85

exal85
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 27 July 2010 - 10:34 PM

Okay, so I got up to the ESET scan, but upon trying to run it, it freezes on the update page asking if the proxy is properly configured.

So, some more info...the only browser that I am able to open is Mozilla, AIM works and Malwarebytes updates, but AVG can't update, and now ESET says proxy problems. When I try to run diagnostics on IE it says I am blocked by a firewall. I checked everything regarding firewalls and I don't see anything that should be a problem. Of course I could be missing something. For now I have the computer shut down.

Thank you for the response, I hope we can resolve this quickly!

Here is my malwarbyte log, probably not too helpful (if you want me to find the log with the initial virus I am pretty sure I saved that, and I definitely know I have an AVG log with the most recent attack from the virus):




Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4361

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/27/2010 11:21:33 PM
mbam-log-2010-07-27 (23-21-33).txt

Scan type: Quick scan
Objects scanned: 135962
Time elapsed: 4 minute(s), 34 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:33 PM

Posted 28 July 2010 - 09:38 AM

Please click Start > Run, type inetcpl.cpl in the runbox and press enter.

Click the Connections tab and click the LAN settings option.

Verify if "Use a proxy..." is checked, if so, UNcheck it and click OK/OK to exit.

Now check if theyare working again.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 exal85

exal85
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 28 July 2010 - 05:15 PM

okay internet works but ESET found no virus.

I am concerned that there is still something on the machine. Unless the first two programs were able to delete viruses which I don't think they were, I think there is still something on the machine.

I say this because ESET and malwarebytes both found nothing and only 2 days prior AVG kept coming up with various attacks on the computer.

I am going to let it run for a while and see if anything happens, but I am still concerned the machine is not clean.

EDIT: I let the computer sit, and I got an error message, I haven't touched the computer but when I came back to it I found: "Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience."

In more info it reads:
szAppName: svchost.exe szAppVer: 5.1.2600.5512
szModName: Flash10b.ocx szModVer: 10.0.22.87 offset 000e5ac0

Files Included:

C:\DOC.....TEMP\\WER7f9.dir00\svchost.exe.mdmp
C:\ "" "" "" ""\appcompat.txt

????------Thoughts-------???

Edited by exal85, 28 July 2010 - 08:24 PM.


#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:33 PM

Posted 29 July 2010 - 10:16 AM

I think the PC is lacking a Hotfix.
http://support.microsoft.com/?kbid=894391#top
Scroll down and install yours, I believe it is ,,Windows XP, 32-bit versions
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 exal85

exal85
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 29 July 2010 - 10:23 AM

okay, I am going to do this when I get to that computer later today.

Do you think that the virus is removed being that both scans said it is clean?

I ran the computer over night and AVG came up with nothing, last time I had the computer running this long a few trojan installers were caught.

Is there a chance that those first two programs you had told me to install were able to remove the virus?

I just don't want to start using the computer again until I can be certain it is clear.

Thank you so much for your help!

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:33 PM

Posted 29 July 2010 - 12:18 PM

I think it is clean. If you still have issues wiyh this area.. Start a new topic in XP I know they know how to work this out.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 exal85

exal85
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 31 July 2010 - 10:12 AM

So apparently the virus isn't gone. When I first opened the computer AVG detected a threat and sent me an alert. The following is the alert information. What should I do next. Thank you.


File name: 209.17.171.107

Threat name: Exploit Rogue Scanner type 1178

Process name: C:\WINDOWS\system32\svchost.exe

Process ID: 1208

#11 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:33 PM

Posted 31 July 2010 - 01:54 PM

Hi, this is a long deep scan.

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:
  • Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
  • Read the anti-virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  • The Express scan will automatically begin.
    (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  • If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  • If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
  • After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
  • In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
  • Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  • Please be patient as this scan could take a long time to complete.
  • When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
  • Click Select All, then choose Cure > Move incurable.
  • In the top menu, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#12 exal85

exal85
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 01 August 2010 - 11:59 PM

Process in memory: C:\WINDOWS\Explorer.EXE:824;;BackDoor.Tdss.565;Eradicated.;
rdpcdd.sys;C:\WINDOWS\system32\drivers;BackDoor.Tdss.2459;Will be cured after restart.;
rdpcdd.sys;c:\windows\system32\drivers;BackDoor.Tdss.2459;Cured.;
rdpcdd.sys;C:\WINDOWS\system32\drivers;BackDoor.Tdss.2459;Cured.;

Looks like it got it!

#13 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:33 PM

Posted 02 August 2010 - 01:32 PM

Good,good... now sometimes the kill of that opens are few more so...
Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#14 exal85

exal85
  • Topic Starter

  • Members
  • 54 posts
  • OFFLINE
  •  
  • Local time:03:33 PM

Posted 02 August 2010 - 01:51 PM

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4382

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/2/2010 2:44:49 PM
mbam-log-2010-08-02 (14-44-49).txt

Scan type: Quick scan
Objects scanned: 148705
Time elapsed: 9 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#15 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,428 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:03:33 PM

Posted 02 August 2010 - 02:19 PM

If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Tips to protect yourself against malware and reduce the potential for re-infection:Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read:
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users