Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Rootkit help


  • This topic is locked This topic is locked
4 replies to this topic

#1 StephenLeon

StephenLeon

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:06 PM

Posted 13 January 2011 - 09:08 PM

I need some help getting rid of a rootkit problem. I've run malwarebytes, and virus scan utilities but they found no infections.

Symptoms:
- Windows Update will not run
- Google Chrome/Firefox complete stopped running
- I cannot uninstall most programs
- IE will redirect on Google searches
- Extra HOST processes will make computer run slow

I've run DDS and GMER and attached logs below. Please let me know if there's anything else I can provide to assist.
THanks!
Stephen

EDIT: I tried to paste the DDS log directly into this post, but the forum errored on every attempt. So I just attached it as a ZIP file.

Attached Files


Edited by StephenLeon, 13 January 2011 - 09:11 PM.


BC AdBot (Login to Remove)

 


#2 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:04:06 PM

Posted 13 January 2011 - 09:53 PM

Hello StephenLeon ,

Posted Image

Download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • If Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)

Please let me know how it's running after that. :)

Thanks,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#3 StephenLeon

StephenLeon
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:06 PM

Posted 18 January 2011 - 10:52 PM

teacup:

Running TDSSKiller in Safe Mode did the trick. Identified the root kit, removed it, and when I rebooted everything returned to normal working condition.


THANK YOU SO MUCH FOR YOUR HELP!

Stephen

#4 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:04:06 PM

Posted 19 January 2011 - 01:16 PM

Hi there,

Glad it's better, and you're welcome. :thumbup2: Can I please see a new DDS report so I can be sure all is well before you go?

Thanks,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#5 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:04:06 PM

Posted 12 February 2011 - 02:56 PM

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users