Need help with virus

bigguy 57 · Dec 14, 2008

Hi new at this my computer has virus and i have tried to get rid of them but they keep coming back. i went to hijack this and had a report done but i dont know what it means can someone help thanks.

Corporal Punishment · Dec 15, 2008

Welcome. The one log has some info, but it doesn't really help 100%

Please begin by clicking Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.

Scroll down to “Non-plug and Play Drivers” and click the plus icon to open those drivers.

Then search forTDSSserv.sys

Let me know if you find this or not.

If you do find it, right click on it, and select Disable. Do not try to uninstall it.

Also if TDSSserv.sys is found and you disable it, then reboot.

After reboot continue on with the below cleaning instructions.

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

READ & RUN ME FIRST. Malware Removal Guide

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

Notes:

If you run into problems trying to run theREAD & RUN ME or any of the scans in normal boot mode. You can run steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

bigguy 57 · Dec 16, 2008

Thanks CP will give it a try and let ya know.

Thanks bigguy

bigguy 57 · Dec 16, 2008

Cp went to device manager and look for TDSSserv,sys and it was not there.

dr.moriarty · Dec 18, 2008

bigguy 57

Please follow up Corporal Punishment's instructions by posting the requested logs.

You need to attach (See: HOW TO: Attach Items To Your Post ) the below logs created while running the requested scans

SASlog.txt log from SuperAntiSpyware.

Malwarebytes Anti-Malware log

ComboFix.txt (normally C:\ComboFix.txt)

MGlogs.zip - normally it is C:\MGlogs.zip - only attach this log from MGtools.exe DO NOT attach any logs seen in the MGtools folder.

You will need to post 2 messages to attach all four logs since only 3 attachments are allowed in any single message. Post all of them in one thread.

Be patient after posting your logs and wait for one of the helpers to get to you. It can take a while to read thru all of the logs and to create individual fixes for you.

Click to expand...

Thanks!
dr.m

bigguy 57 · Dec 22, 2008

Here's a copy of a log i did with sas now it got rid of most of it. but now im having a another problem when i start up my computer i get a pop up window that says installing
a program easy cd but when i click cancel it keeps coming back i tried to delete the program and it wont let me what would cause this. By the way thanks everyone for all your help.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/20/2008 at 07:08 AM

Application Version : 4.23.1006

Core Rules Database Version : 3680
Trace Rules Database Version: 1659

Scan type : Quick Scan
Total Scan Time : 00:21:31

Memory items scanned : 417
Memory threats detected : 0
Registry items scanned : 594
Registry threats detected : 24
File items scanned : 6099
File threats detected : 24

Adware.MyWebSearch
HKU\S-1-5-21-220523388-113007714-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
HKU\S-1-5-21-220523388-113007714-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
HKU\S-1-5-21-220523388-113007714-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

Unclassified.Unknown Origin
HKU\S-1-5-21-220523388-113007714-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E}

Adware.Tracking Cookie
F:\Documents and Settings\Gunter\Cookies\gunter@doubleclick[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@247realmedia[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@adopt.euroclick[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@burstnet[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@tribalfusion[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@atdmt[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@zedo[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@ad.fed.msn[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@network.realmedia[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@2o7[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@mediaplex[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@questionmarket[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@revsci[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@aff.primaryads[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@apmebf[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@media.adrevolver[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@specificclick[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@fastclick[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@advertising[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@adopt.specificclick[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@realmedia[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@rotator.adjuggler[2].txt
F:\Documents and Settings\Gunter\Cookies\gunter@specificmedia[1].txt
F:\Documents and Settings\Gunter\Cookies\gunter@tacoda[2].txt

Adware.MyWebSearch/FunWebProducts
HKU\S-1-5-21-220523388-113007714-725345543-1004\SOFTWARE\Fun Web Products
HKU\S-1-5-21-220523388-113007714-725345543-1004\SOFTWARE\FunWebProducts
HKU\S-1-5-21-220523388-113007714-725345543-1004\SOFTWARE\MyWebSearch
HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}\TreatAs
HKCR\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}
HKCR\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}\TreatAs
HKCR\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3}
HKCR\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3}\TreatAs
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib
HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib#Version
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib
HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib#Version

Unclassified.SpywareBot (Not A Threat)
HKU\S-1-5-21-220523388-113007714-725345543-1004\Software\SpywareBot

dr.moriarty · Dec 22, 2008

bigguy 57

Follow my previous instructions and attach all of the requested logs. Please do not post them inline.

Log in or Sign up

Need help with virus

bigguy 57 Private E-2

Attached Files:

hijackthis.log

Corporal Punishment Head of Software Shenanigans Staff Member

bigguy 57 Private E-2

bigguy 57 Private E-2

dr.moriarty Malware Super Sleuth Staff Member

bigguy 57 Private E-2

dr.moriarty Malware Super Sleuth Staff Member