Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Antimalware Doctor Removal Problems


  • Please log in to reply
5 replies to this topic

#1 stumblebunk

stumblebunk

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:08:03 AM

Posted 27 September 2010 - 04:04 PM

Hi,

I've been infected by Antimalware Doctor on a machine running XP 5.1. I began by following the instructions here:

http://www.bleepingcomputer.com/virus-remo...imalware-doctor

which basically says run rkill and then MBAM. MBAM (V 1.46) found 30 some infected objects. However, when I tried to "Remove Selected", MBAM hung. I let it run several times, including overnight for about 8 hours and it hung every time. I then made several manual registry edits as described here:

http://www.ehow.com/how_6067077_remove-ant...ctor-virus.html

In addition, I manually deleted any registry entries and files that had "Antimalware Doctor", or "mainfull70707" in their names. There was also an "enemies list" that I deleted. Then I went back and ran rkill & MBAM. This time it only found about 15 infected objects, and Remove Selected got rid of them all. After a reboot, rkill does not terminate any processes, an MBAM scan finds no infected objects, and the evil Antimalware Doctor popup does not appear. So far so good.

Unfortunately, some remnant is redirecting my browser. Sometimes a random browser will open. In addition, certain sites, including beepingcomputer.com and pctools.com, are completely inaccessable. They are redirected to such locations as cdn.stopadwares.com and local.com.

Both MBAM and AVG scans show no problems, but something is still redirecting my browser.

Any assistance would be greatly appreciated. Thanks.

BC AdBot (Login to Remove)

 


#2 stumblebunk

stumblebunk
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:08:03 AM

Posted 28 September 2010 - 01:19 PM

Additional info - Occassionally I get the following error message:

Generic Host Process for Win32 Services encountered a problem and needs to close...

Sometimes this is followed by a hung machine. Other times the machine continues to run.

Edited by stumblebunk, 28 September 2010 - 01:20 PM.


#3 stumblebunk

stumblebunk
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:08:03 AM

Posted 28 September 2010 - 04:19 PM

Update
My firewall notified me of smss32.exe, so I ran Hijack This and had it fix the following:

F2 REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon32.exe
O4 HKLM\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe

Now I can get to this website without redirection. I'm still getting popups telling me I have Trojan SPM/LX and I need to download IDS software. I can try to grab a screenshot next time it pops up if that's helpful.

#4 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:03 AM

Posted 28 September 2010 - 04:24 PM

Try this:

http://www.bleepingcomputer.com/virus-remo...sing-tdsskiller
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#5 stumblebunk

stumblebunk
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:08:03 AM

Posted 30 September 2010 - 10:43 AM

Thanks! tdsskiller eventually did the trick, although it hung the first time and had to be rerun. You rock Buda!

#6 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:03 AM

Posted 30 September 2010 - 04:00 PM

:thumbsup:
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users