system
November 13, 2010, 1:08am
1
Hello all. I am under the belief that the think point worm/virus (?) got a bit further than we thought. was running 4.8 and I think someone here clicked a ‘bogus’ survey on face_ook, and the rest is unfortunate history.
Anyway, now on 5.0 and MBAM, and ccleaner. at least 3 full boat scans and still from time to time with just firefox open 5.0 will give me the pop up window that states, “malicious url blocked”…(I will try and attach a pic for this).
Also a lot less now, but still an occasional redirect when I want to google certain websites…So of course I used another machine and have driven myself crazy trying to figure this thing out…so all I can come up with is a rootkit? virus? How can I get rid of this without reformating (not an option anywhere near the top of my list). I wanted to ask the experts because there are no less than 6 solutions on utube (using other programs)and who knows if those are any good…Thanks in advance.
machine is hp mini with xp home, sp3
1.Do dr.web cure it! scanhttp://www.freedrweb.com/cureit/?lng=en http://www.malwarebytes.org/mbam.php http://www.superantispyware.com/download.html http://www.usec.at/rootkit.html http://www.novirusthanks.org/products/hijack-hunter/
B_in Ohio
If you did a full scan with MBAM and avast! and still no luck. Do this:http://www.omidfarhang.com/computer/security/virus-removing and follow number #4 and #6 for a quick action, if no luck yet, start from number one to the end.
system
November 13, 2010, 12:28pm
4
last night (early this morning) ran avast, super anti spyware and mbam again) neither pick up anything. i also did ccleaner. I will try ccleaner again jsut now with the specifics listed from Omid.
system
November 13, 2010, 1:06pm
5
well if true hitman pro already found stuff that others did not…
Thinkpoint sometimes brings along the TDL4 bootkit for company - to check that out
DO NOT LET HITMANPRO DELETE THE MBR
Please read carefully and follow these steps.
[*]Download TDSSKiller TDSSKiller.exe to run the application, then on Start Scan.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillermain.png
[*]If an infected file is detected, the default action will be Cure , click on Continue.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerMal-1.png
[*]If a suspicious file is detected, the default action will be Skip , click on Continue.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerSuspicious.png
[*]It may ask you to reboot the computer to complete the process. Click on Reboot Now .
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerCompleted.png
[*]If no reboot is require, click on Report . A log file should appear. Please copy and paste the contents of that file here.TDSSKiller.[Version][Date] [Time]_log.txt ”. Please copy and paste the contents of that file here.
system
November 13, 2010, 1:11pm
7
i thought mbr was windows…i not delete…i will modify and then finis hit man
That is why i ask for an anti rootkit log Omid since the redirections may be a cause of a tdl rootkit
system
November 13, 2010, 2:59pm
9
ok Omid I am done with your recommendations…i am restarting comp now. BTW since previous posts…MBAM did not find anything and i ran the hitman and hosts pro…
what is good way to check system now, the only thing i can think of is to try and open firefox, and see if i get redirected…
superhacker i am also going to read your recommendations next…
No problem all helper here care about your system not the order of following
system
November 13, 2010, 3:11pm
11
reboot and firefox will not start…ie8 seems to load pages without redirects…(i tried going to some of the same websites that it redirected me from, google, search for cnet, major geeks, etc. well about 3 mins elapsed and a threat was just blocked…(a redirect)aaaaaaaaarrrrrrrgh!
how else can i check and see if my system is clean? will tdss killer find issue with outher programs installed> or just give it a go? and where do i get the tdss prog, from your link or cnet>>>?
system
November 13, 2010, 3:13pm
12
This is the same malware I have been fighting for two weeks on multiple customer machines.
System scans ends up clean but TDSSKiller shows infection. Remove the MBR infection and 30 minutes later is infected again.
Only F-Secure seems to detect a single file tempb.exe in network and local service profiles other than that it’s about as worthless.
system
November 13, 2010, 3:17pm
13
i did a restore to a restore point a couple of days ago and that did not help.l, seemed to still be locked up etc. maybe i did not go back far enough.
system
November 13, 2010, 3:22pm
14
Most viruses and malware infect the system restore points. It may have helped some damaged system files.
system
November 13, 2010, 3:31pm
15
here is the tdss log…
2010/11/13 10:18:55.0453 TDSS rootkit removing tool 2.4.7.0 Nov 8 2010 10:52:22
continued…
system
November 13, 2010, 3:32pm
16
C:\WINDOWS\system32\DRIVERS\kbdhid.sys
system
November 13, 2010, 3:32pm
17
2010/11/13 10:19:26.0781 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
sorry had to split log. it was over maximum…
Asyn
November 13, 2010, 3:54pm
18
Why didn’t you attach it…??
system
November 13, 2010, 4:02pm
19
i dunno…
system
November 13, 2010, 4:05pm
20
As i see the rootkit should be cure after reboot. So now reboot and tell us the new with another scan attach log. To see if the rootkit is there again.
