1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.


Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by joe arnold, Dec 17, 2008.

  1. joe arnold

    joe arnold Private E-2

    No matter what I enter into the IE address field, it changes to slirsredirect.search.aol.com on my PC w/ Vista and I can not get on the Internet. PC seems to runs O.K. otherwise. Can not run Norton 360 as it wants internet. AVG, Malwarebytes, Cleanup!, Adaware, defrag have been ineffective.
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Please begin by clicking Start > Control Panel > System > Hardware > Device Manager > View > Show Hidden Devices.
    • Scroll down to “Non-plug and Play Drivers” and click the plus icon to open those drivers.
    • Then search forTDSSserv.sys
    • Let me know if you find this or not.
    • If you do find it, right click on it, and select Disable. Do not try to uninstall it.
    • Also if TDSSserv.sys is found and you disable it, then reboot.
    • After reboot continue on with the below cleaning instructions.

    Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.

    1. If you run into problems trying to run theREAD & RUN ME or any of the scans in normal boot mode. You can run steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
    2. If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
  3. joe arnold

    joe arnold Private E-2

    Thanks for help with this problem. I checked device manager in the Non-Plug and Play Drivers for TDSSserv.sys and it is not listed. So before I attempted any of the other steps that you listed, I stopped. I have not begun to follow the rest of your directions. Please advise if there is anything else I should do under Device Manager before I begin to follow the rest of your directions. Thanks Gizmo Joe
  4. joe arnold

    joe arnold Private E-2

    Hi, I sent a post earlier,noting that I do not have the file in device manager that you wanted me to turn off. So, I ran all of the utilities and I still am not able to connect to the internet. However, instead of getting the slirsredirect.search.aol.com loading into my my browser address bar and a page not found error, now I get;
    http://go.microsoft.com/fwlink/?LinkId=69157 and a page
    not found error. This is the first of two posts with the error logs.

    Attached Files:

  5. joe arnold

    joe arnold Private E-2

    Post # 4
    Hi, I sent a post earlier,with 3 of the logs, here is the fourth.

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It may not be malware. You may have broken things when you installed AVG8 while still having Norton 360 installed. You must never ever install more than one antivirus at a time. I suggest that you delete the below from AVG now. We will clean up the rest in my fix.
    "C:\Users\Mom and Dad\Desktop\"
    AVG           Dec 18 2008              "AVG"
    AVG-NEW       Dec 18 2008              "AVG-new"
    avg_fr~1.exe  Dec 16 2008    53682216  "avg_free_stf_en_8_176a1399.exe"
    That is unless your plans are to uninstall Norton 360 (which could be necessary anyway to fix your lost of internet).

    In Internet Explorer -> Tools -> Internet Options -> Connections -> LAN Settings, make sure you are not set to use a Proxy Server...... that is unless you need to use a Proxy Server and in that case, make sure it is configured.

    Now let's continue with your fixes!

    Uninstall the below old versions of software:
    Ad-Aware 2007 <-- out of date a not very useful anyway.
    Java(TM) SE Runtime Environment 6

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)

    After clicking Fix, exit HJT.

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
    Last edited: Dec 23, 2008

Share This Page

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds