antispyware 2008, again and more!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Pennyman, Dec 20, 2008.

  1. Pennyman

    Pennyman Private E-2

    So I'm certain my laptop has that stupid Antispyware 2008 program, it will not allow me to run or install the antivirus programs you've suggested, and it also prevents me from going to any antivirus-related websites (including majorgeeks!!!) and redirects google quite a bit. It's also preventing me from doing a system restore, oh boy.

    I'm posting this from my dad's computer, and I'm hoping you guys can help me out. I will wait for further instructions like the direction-following engineering student that I am ;)

    BTW, Because the virus prevents me from downloading installers by preventing my access to this site, which installers would you suggest I transfer via thumbdrive?

    Any help is appreciated. This computer has all my CAD and analysis for my senior project, and I'd love for it not to die, hehe.
     
    Last edited: Dec 20, 2008
  2. Pennyman

    Pennyman Private E-2

    I emailed combofix and MGtools to myself. Combofix would not open, and MGtools is stuck mid-scan after c:\MGtools\temp\xrkey15.txt

    Here's an image of what I'm seeing in the MGtools window for the past 30min.

    [​IMG]

    Suggestions?
     
  3. Pennyman

    Pennyman Private E-2

    Ok, if its any help to anyone, I have a version of HijackThis on my computer that I just ran. Here's the logfile. Someone help!
     

    Attached Files:

  4. Pennyman

    Pennyman Private E-2

    OK, ignore the previous post.

    C:\MGtools\analyse.exe works, and I ran it.

    The following is the logfile from that scan. Sorry if I'm bothering you guys, I'm just really concerned.
     

    Attached Files:

    Last edited: Dec 20, 2008
  5. Pennyman

    Pennyman Private E-2

    SOMEONE PLEASE READ:

    Here is a detailed description of my symptoms. I've spent all day on this stupid thing. I could really use some help.

    Regarding the READ and RUN ME:

    To clarify, Superantispyware.exe doesn't open, instead I get the "has encountered a problem and needs to close" error. This occurs in normal AND safemode.

    Regarding Combofix, I dragged the windows setup disk file onto the Combofix file as instructed. Nothing pops up.

    HOWEVER: The Task Manager says combofix is running (In the process list) but no window pops up. Same holds true with Malwarebytes and SpybotS&D. No windows, but processes running.

    Whenever I start the computer in normal mode, I get an error. "explorer.exe The application failed to initialize properly (Oxc0000005)" However, this error does not occur in safemode!! I can get back to the explorer in normal mode through the taskmanager: run: explorer.exe.

    Now regarding the browser: Google redirects me whenever I try to go to an anti-malware website. Including Majorgeeks.

    I ran CCleaner and that worked fine. The computer is running XP SP2 with BSafe online filtering service.

    As i mentioned, the analyse.exe HJT scan runs fine. The previous post contains the log.

    Would someone please look at the above HJT log or give me some suggestions??
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Each time you post another message, you prevent yourself from getting an answer. You need to read the stickies!!!!! See this Don't Bump! It Only Hurts You!!! We work in oldest to newest oder and we will never get to your thread if you keep posting.

    A HijackThis log alone is of no use to us. Especially when posted like you did which is not a valid HJT log. You loaded it into some editor (maybe Wordpad) and changed the formatting. Look at what you posted. It is just one continuous line of text. Our stickies say we are not a HijackThis reading forum and that you should not be posting one.




    Please begin by clicking Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.
    • Scroll down to “Non-plug and Play Drivers” and click the plus icon to open those drivers.
    • Then search forTDSSserv.sys
    • Let me know if you find this or not.
    • If you do find it, right click on it, and select Disable. Do not try to uninstall it.
    • Also if TDSSserv.sys is found and you disable it, then reboot.
    • After reboot continue on with the below cleaning instructions.

    When you now attempt to do the below, make sure you download and use the current version of MGtools because you have two versions back.

    You also need to disable Spybot's Teatimer as requested in the READ & RUN ME.


    Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.
    Notes:



    1. If you run into problems trying to run theREAD & RUN ME or any of the scans in normal boot mode. You can run steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
     
    Last edited: Dec 23, 2008
  7. Pennyman

    Pennyman Private E-2

    Thanks for the reply.

    I found that it was TDSSserv.sys that was causing most of the trouble, which I then removed using MBAM. Nice program. I should really make it a habit to check this forum ever couple months to see how the READ and RUN me changes over time. I remember a while back when it was pretty much SpyBotS&D and HJT. Now there's a few more.
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Then you should finish the process and attach all the longs to be sure you are clean. While recent versions of MBAM and SAS have improved a bunch in finding and removing most of this infected, sometimes a few things were missed and also other malware has sometimes come along with this infection.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds