Win32.TDSS Trojans! PLEASE HELP!

Welcome to Major Geeks!

You should have read the sticky/pinned threads since you are causing yourself additional delay by adding unnecessary posts instead of waiting your turn in the queue. See: Don't Bump! It Only Hurts You!!!

Your second thread was deleted since it is a dupe and it wasn't going to get answer before you first thread anyway.


Also you should have run the READ & RUN ME FIRST cleaning process as required; however do the below.



Go to TDSSKiller and Download TDSSKiller.zip to your Desktop

• Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
• Click Start > Run and copy/paste the following bold command into Run box and hit Enter.

"%userprofile%\Desktop\TDSSKiller.exe" -v

• Follow the instructions to type in "delete" when it asks you what to do when if finds something.
• When done, a log file should be created on your C: drive named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

 

Please remember to stay in one thread.

Also please only follow the instructions given. Run only what we request. We did not ask for nor do we need a HijackThis log. You need to finish running things in the READ & RUN ME sticky thread. You need to run ComboFix, RootRepeal and MGtools and attach the requested logs. See the cleaning procedure part of the below sticky:

READ & RUN ME FIRST. Malware Removal Guide

 

The problems with ComboFix were resolved last Sunday night. We would not be asking you to run it if there were still problems.

There are no malware problems showing in any of your logs other than "Messenger Plus! Live" which we consider unsafe as stated in the READ & RUN ME.

Are you actually still having malware problems? If yes, what exactly are they.

If you had run ComboFix, it most likely would have removed the below files you complained about but you can delete them yourself if they let you delete them
C:\Documents and Settings\All Users\Application Data\h8srtmainqt.dll
C:\Documents and Settings\All Users\Application Data\h8srtkrl32mainweq.dll

 

Yes we know what it is and we know that lots of people use it. It is unsafe due to the practices of having sponsor programs that install by default unless you are sure to tell them not to install. These sponsor programs install malware. Many thousands of PCs have been unknowingly infected by this program when people did not read the license agreement. While the program itself "may be fine", the problems that this program has caused for malware fighters for many years have given it a bad reputation in our eyes and we consider it unsafe for those reasons. It's up to you in the end, but just be very aware that if you are not careful with installing and updating this program, you could infect yourself. To remove it, you would just uninstall it.

Problems with Windows Update should be posted in the Software Forum but what I sugest that you do is go to Windows Update yourself and see if you can figure out which update is not installing.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 6 of the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!