AV redirect: No Safe Mode and can't open anything

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Dalig, May 13, 2010.

  1. Dalig

    Dalig Private E-2

    I have helped several people clean up some pretty messed up machines in the past. Usually by simply browsing your forums and following the steps that you have laid out. But I am stumped.

    My parents have some sort of redirect virus going on. Here are the details that I know.

    OS is Wimdows XP Home Service Pack 2 32bit. IE gets 100% redirected to AV site, FireFox will operate. I cannot get any .exe to run, even beyond that I can't even get msconfig, regedit or taskmanager to open. I can actually see them open on the Desktop and then they are forced close. It blocks anything from running from the CD/DVD drive and I can't get it to start up in safemode. I have pounded on the F8 key at start up and it won't trigger it and obviously I can't do it through msconfig. I have found a variation of a tssd.exe file, I can't remember the exact name but was something like hsssddtssd.exe and of course I can't delete it.

    I have tried running CCcleaner, Hijackthis, Panda online scan (can't update) and Housecall. They even went out and bought the Trend Micro AV from a electronics store. Basically the issue as I see it (which I am no expert by any means) I can't seem to get into safe mode and I can't get anything to run in regular ole Windows.

    Any help would be appreciated.
     
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    http://www.dougknox.com/xp/file_assoc.htm

    Scroll down to the 9th fix ( the EXE File Association Fix) see if you can run that.

    Then:

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click and choose Run as Administrator

    You only need to get one of them to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
    1. Rkill.exe
    2. Rkill.com
    3. Rkill.scr
    4. Rkill.pif
    Once you've gotten one of them to run then try to immediately run the following.

    Now download and Run exeHelper from Raktor
    • Please download exeHelper to your desktop.
    • Double-click on exeHelper.com to run the fix.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file named log.txt will be created in the directory where you ran exeHelper.com
    • Attach the log.txt file to your next message.
    Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

    Now run this: Using Malwarebytes Anti-Malware

    Now run this: Using MGtools


    Now you need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created while running the above scans
    • exeHelper log
    • Malwarebytes Anti-Malware log
    • MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.
     
  3. Dalig

    Dalig Private E-2

    Thank you for your response.

    I attempted to run Rkill.exe, Rkill.com and Rkill.scr and none of them were able to run. I can see them open and then they are forced close and give me the AV error trying to redirect me to the AV site. When it came to the Rkill.pif I got a 404 when I attempted to dl it.

    I appreciate your help.
     
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    So continue on with the other steps after Rkill :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds