Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Especially tough Redirect Virus

  • This topic is locked This topic is locked
4 replies to this topic

#1 chamr


  • Members
  • 3 posts
  • Local time:04:53 AM

Posted 04 June 2011 - 02:14 PM

I seem to be yet another victim of the latest strain of the redirect virus. It started off with a Windows XP Recovery infection. Got rid of that (with MalwareBytes, I think), but the redirect remains. I've tried TDSSKiller (won't even start), Combofix, SuperAntiSpware, Spybot, HitmanPro, Malwarebytes, CCleaner, RKill, Windows Malicious Software Removal, Windows Saftey Scan, Windows Secrutiy Essentials, GooredFix, ESET Online Scan, etc. A few trojans and other things were caught, but I suspect the base virus is still there and will continue to inject Trojans over time until I get rid of it.

A few items to note:

1) GMER, aswMBR and DDS trigger a BSOD when run in normal OS mode. Could only get them to complete in Safe mode. Not sure if this was because I ran Combofix out of order or what.

2) The DDS scan BSOD referred to mbr.sys. I've read some white papers on the TDL3/4 virus, and I think my master boot record may be comprimised. This idea is further bolstered by the fact that after I cleaned off Windows XP Recovery and rebooted, ScanDisk was invoked and indicated that one of my master boot sectors was corrupt.

3) Again, TDSSKiller won't even start, even with multiple rename and redownload attempts.

4) Sound has been acting funny ever since I got the virus. For instance, the windows start up and shut down .wavs sound staticy. They break up a little. Also, sound from certain sites, such as YouTube and ESPN, won't even play. The videos will run, but there's no sound. Maybe an infected sound driver?

Unfortunatley, because I could only run GMER in safe mode, the monitor resolution was so low that I couldn't get to the Save button (doh!). The best I could do was screen print some of the info. I've attached a Word doc with the screen prints in them.

DDS Attach file attached. Here's the DDS.txt followed by the aswMBR.txt:

DDS (Ver_2011-06-03.01) - NTFSx86 MINIMAL
Internet Explorer: 8.0.6001.18702
Run by Ryan Chambers at 9:47:30 on 2011-06-04
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1708 [GMT -7:00]
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
============== Running Processes ===============
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.my.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local;<local>
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\program files\yahoo!\messenger\yhexbmes0521.dll
mRun: [VAIO Recovery] c:\windows\sonysys\vaio recovery\PartSeal.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [WD Button Manager] WDBtnMgr.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
dRunOnce: [SRUUninstall] "c:\windows\system32\msiexec.exe" /x {6AF90EF6-F7F9-466C-99F4-1774826FBB40} /qn REBOOT=ReallySuppress
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\iespell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\iespell\wikipedia.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD} - c:\program files\yahoo!\messenger\yhexbmes0521.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {4F29DE54-5EB7-4D76-B610-A86B5CD2A234} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebPlayer.cab
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab
DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} - hxxps://kingsisle.hs.llnwd.net/e1/static/themes/wizard101A/activex/Wizard101GameLauncher.CAB
DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX28.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38095.931724537
DPF: {C8AEB218-8B7A-4E15-AC17-0EE8D99B80EB} - hxxp://archives.gametap.com/static/cab_headless/GameTapWebUpdater.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://pentaho.webex.com/client/T27L/event/ieatgpc.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-
TCP: DhcpNameServer =
TCP: Interfaces\{3E50F65C-564E-4643-BCD9-EBD9903085C1} : DhcpNameServer =
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxsrvc.dll
Notify: LMIinit - LMIinit.dll
Notify: rainit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
============= SERVICES / DRIVERS ===============
R0 sonypvl3;sonypvl3;c:\windows\system32\drivers\sonypvl3.sys [2006-11-10 19507]
R1 sonypvf3;sonypvf3;c:\windows\system32\drivers\sonypvf3.sys [2006-11-10 619390]
R1 sonypvt3;sonypvt3;c:\windows\system32\drivers\sonypvt3.sys [2006-11-10 423454]
R1 SSHDRV65;SSHDRV65;c:\windows\system32\drivers\SSHDRV65.sys [2006-12-14 120320]
R1 SSHDRV85;SSHDRV85;c:\windows\system32\drivers\SSHDRV85.sys [2006-12-14 78848]
S1 aecdSvc;aecdSvc;\??\c:\windows\system32\drivers\cdaa3149.sys --> c:\windows\system32\drivers\cdaa3149.sys [?]
S1 amstMgr;amstMgr;\??\c:\windows\system32\drivers\secthusb9.sys --> c:\windows\system32\drivers\secthusb9.sys [?]
S1 AsysAcd;AsysAcd;\??\c:\windows\system32\drivers\brpavc9.sys --> c:\windows\system32\drivers\brpavc9.sys [?]
S1 Audogon;Audogon;\??\c:\windows\system32\drivers\brfkedrv9.sys --> c:\windows\system32\drivers\brfkedrv9.sys [?]
S1 Evevice;Evevice;\??\c:\windows\system32\drivers\wmi8023x9.sys --> c:\windows\system32\drivers\wmi8023x9.sys [?]
S1 HTT154x;HTT154x;\??\c:\windows\system32\drivers\sliermdd9.sys --> c:\windows\system32\drivers\sliermdd9.sys [?]
S1 IDr78xx;IDr78xx;\??\c:\windows\system32\drivers\drmlnknb9.sys --> c:\windows\system32\drivers\drmlnknb9.sys [?]
S1 int1394;int1394;c:\windows\system32\drivers\sfleamip9.sys [2005-11-4 12288]
S1 mou2w2k;mou2w2k;\??\c:\windows\system32\drivers\cpqm13949.sys --> c:\windows\system32\drivers\cpqm13949.sys [?]
S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]
S1 Ntmmgmt;Ntmmgmt;\??\c:\windows\system32\drivers\ipfnxsxx9.sys --> c:\windows\system32\drivers\ipfnxsxx9.sys [?]
S1 PCIogon;PCIogon;\??\c:\windows\system32\drivers\sonydcam9.sys --> c:\windows\system32\drivers\sonydcam9.sys [?]
S1 PxH3550;PxH3550;\??\c:\windows\system32\drivers\modm13949.sys --> c:\windows\system32\drivers\modm13949.sys [?]
S1 PxHPSec;PxHPSec;\??\c:\windows\system32\drivers\kbd1mdxx9.sys --> c:\windows\system32\drivers\kbd1mdxx9.sys [?]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]
S1 sonypvd3;Sony DVD Handycam;c:\windows\system32\drivers\sonypvd3.sys [2006-11-10 64964]
S1 TDTd35x;TDTd35x;\??\c:\windows\system32\drivers\mrxcfltr9.sys --> c:\windows\system32\drivers\mrxcfltr9.sys [?]
S1 usbppoe;usbppoe;c:\windows\system32\drivers\enutbios9.sys [2005-10-17 12288]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-30 136176]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\rainfo.sys --> c:\program files\logmein\x86\RaInfo.sys [?]
S2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2008-4-11 46112]
S2 TTQWMADB;TTQWMADB;\??\c:\windows\system32\ttqwmadb.xjc --> c:\windows\system32\ttqwmadb.xjc [?]
S3 brfilt;Brother MFC Filter Driver;c:\windows\system32\drivers\BrFilt.sys [2004-4-18 2944]
S3 brparimg;Brother Multi Function Parallel Image driver;c:\windows\system32\drivers\BrParImg.sys [2004-4-18 3168]
S3 BrParWdm;Brother WDM Parallel Driver;c:\windows\system32\drivers\BrParwdm.sys [2004-4-18 39552]
S3 BrSerWDM;Brother WDM Serial driver;c:\windows\system32\drivers\BrSerWdm.sys [2004-4-18 60416]
S3 cdiskdun;cdiskdun;\??\c:\docume~1\ryanch~1\locals~1\temp\cdiskdun.sys --> c:\docume~1\ryanch~1\locals~1\temp\cdiskdun.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-8-30 136176]
S3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\system32\svchost.exe -k nosGetPlusHelper [2003-8-13 14336]
S3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys --> c:\windows\system32\drivers\radpms.sys [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
=============== Created Last 30 ================
2011-06-04 16:21:19 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{626cad9b-4185-4c7a-bdcc-14388197ba21}\mpengine.dll
2011-06-04 15:39:32 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-04 06:43:58 17480 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-06-04 06:41:53 -------- d-----w- c:\documents and settings\all users\application data\Hitman Pro
2011-06-04 05:04:05 -------- d-----w- c:\program files\ESET
2011-06-03 04:13:56 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2011-06-02 05:03:24 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-06-01 22:25:22 311880 ----a-w- c:\windows\system32\drivers\TrufosAlt.sys
2011-06-01 21:49:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-01 21:48:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-01 05:38:42 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-06-01 05:34:30 -------- d-----w- c:\program files\Microsoft Security Client
2011-06-01 04:48:38 -------- d-sha-r- C:\cmdcons
2011-06-01 04:43:36 98816 ----a-w- c:\windows\sed.exe
2011-06-01 04:43:36 518144 ----a-w- c:\windows\SWREG.exe
2011-06-01 04:43:36 256512 ----a-w- c:\windows\PEV.exe
2011-06-01 04:43:36 208896 ----a-w- c:\windows\MBR.exe
2011-05-30 23:04:27 -------- d-----w- c:\documents and settings\ryan chambers\local settings\application data\Unity
2011-05-12 04:12:30 2829 ----a-w- c:\windows\War3Unin.pif
2011-05-12 04:12:30 139264 ----a-w- c:\windows\War3Unin.exe
2011-05-09 02:54:57 -------- d-----w- c:\documents and settings\all users\application data\Gibraltar
==================== Find3M ====================
2011-04-13 22:40:10 4284416 ----a-w- c:\windows\system32\GPhotos.scr
2011-04-06 23:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 23:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-11 14:10:38 471552 ----a-w- c:\windows\apppatch\aclayers.dll
2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll
2007-04-13 02:44:11 774144 -c--a-w- c:\program files\RngInterstitial.dll
============= FINISH: 9:49:10.00 ===============

aswMBR version Copyright© 2011 AVAST Software
Run date: 2011-06-04 13:21:30
13:21:30.812 OS Version: Windows 5.1.2600 Service Pack 3
13:21:30.812 Number of processors: 2 586 0x209
13:21:30.812 ComputerName: SONY-PCV-RS430G UserName: Ryan Chambers
13:21:31.734 Initialize success
13:23:30.984 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:23:31.000 Disk 0 Vendor: SAMSUNG_SP1203N TL100-23 Size: 114498MB BusType: 3
13:23:31.031 Disk 0 MBR read successfully
13:23:31.046 Disk 0 MBR scan
13:23:31.062 Disk 0 unknown MBR code
13:23:31.078 Disk 0 scanning sectors +234484740
13:23:31.156 Disk 0 scanning C:\WINDOWS\system32\drivers
13:23:41.890 Service scanning
13:23:53.640 Disk 0 trace - called modules:
13:23:53.671 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8ab1f1ed]<<
13:23:53.687 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8abcd958]
13:23:53.703 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\00000070[0x8abd1318]
13:23:53.718 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8aba4940]
13:23:53.734 \Driver\atapi[0x8aba5bb0] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8ab1f1ed
13:23:53.765 Scan finished successfully
13:25:04.781 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Ryan Chambers\Desktop\MBR.dat"
13:25:04.796 The log file has been saved successfully to "C:\Documents and Settings\Ryan Chambers\Desktop\aswMBR.txt"

Attached Files

Edited by chamr, 04 June 2011 - 03:32 PM.

BC AdBot (Login to Remove)


#2 chamr

  • Topic Starter

  • Members
  • 3 posts
  • Local time:04:53 AM

Posted 07 June 2011 - 05:47 PM

After working on it some more, I decided to just pull the plug and do a fresh install. For others pondering this option, I can tell you it seems to have worked for me. I have not put any of my old data files back on the new install, but the redirect no longer happens, TDSSKiller will run, and overall PC performance does not seem to be degrading over time, which eliminates three key symptoms of the strain I had. I did not have a Windows XP disc as mine was OEM. I used the Sony recovery discs I made 7 years ago for this system. But after about a couple hundred Microsoft Windows Updates and the dozen reboots they invoke, I seem to be back in business.

Thanks for all the work you guys do on this site. As a last resort for a lot of folks, you've done a lot of good. I certainly learned a lot here. Thanks again!


#3 SweetTech


    Agent ST

  • Members
  • 13,421 posts
  • Gender:Male
  • Location:Antarctica
  • Local time:08:53 AM

Posted 08 June 2011 - 11:34 AM


Thanks for posting back to inform us of your decision to reformat and re-install. At times it can be the fastest and best option to take with your computer.

This is what I usually provide to my users when they are all clean.

I hope you find this information valuable;

All Clean Speech

===> Make sure you've re-enabled any Security Programs that we may have disabled during the malware removal process. <===

Below I have included a number of recommendations for how to protect your computer against malware infections.

Updated Anti-Virus Program
It's essential that you have an updated anti-virus program running on your computer. You don't want to run more than one as it can cause program conflicts, as well as false positives

You can view an excellent list of Free Security Software programs that has been compiled by GeekstoGo.

Avoid P2P Programs

Remember that no matter how clean the program you're using for peer-to-peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via p2p filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

If you have any of these programs installed then I highly suggest you uninstall them.

NOTE: Take care when answering any questions posed by an uninstaller. Some questions may be worded to deceive you into keeping the program.

Internet Browsers

Many of the users that I assist here on the forums, ask me which programs they can use to prevent themselves from getting infected again in the future. The best answer I can give you is too practice safe browsing.

Please consider using an alternative browser such as Google Chrome or Opera. They are both much more secure than Internet Explorer, immune to almost all known browser hijackers, and also have great built-in pop-up blockers.

I also suggest you make your Internet Explore more secure.

Make Internet Explorer more secure

  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

Extra Goodies

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at: http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • You should run an updated scan with MalwareBytes' Anti-Malware weekly. Instructions are included below:

    • Open Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Check for Updates

  • Be weary of e-mails from unknown senders. Keep the following in mind as well: If it's to good to be true, then it more than likely is.

  • FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.
  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for Chrome and Opera.
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security--What Do I Need?.
**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.


Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image

The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.

#4 chamr

  • Topic Starter

  • Members
  • 3 posts
  • Local time:04:53 AM

Posted 09 June 2011 - 12:44 PM

Thanks, SweetTech! Will do, and cheers to you!

#5 SweetTech


    Agent ST

  • Members
  • 13,421 posts
  • Gender:Male
  • Location:Antarctica
  • Local time:08:53 AM

Posted 09 June 2011 - 01:08 PM

You're more than welcome!

Please take care!

Kindest Regards,


Since it appears that the issues you were experiencing with your computer have been resolved, I am going to close this thread. If you should need the thread re-opened please send me a Private Message (PM) with a request to re-open the thread, as well as the link to the thread in question, and I'd be happy to re-open the thread.

Have I helped you? If you'd like to assist in the fight against malware, click here Posted Image

The instructions seen in this post have been specifically tailored to this user and the issues they are experiencing with their computer. If you think you have a similar problem, please first read this topic, and then begin your own, new thread. I do not offer private support via Private Message.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users