TDSS Removal

thorir · Jun 18, 2009

Hello Malware Guru,

First off, thank you for your assistance to the masses.

I am attempting to repair my father's computer, unfortunately I don't know how he got it so thoroughly infected to begin with but I hope to prevent having to do a complete HD wipe, which is my next option.

I have followed the READ & RUN instructions and the WinXP Instructions. The system seems fairly stable now but I am still getting some odd results including in my RootReveal logs.

Worth noting, Since running these logs I have run the disable windows messenger application and removed windows messenger, but I have not done anything else.

Thank you for your help. SAS, MB etc. got me considerably farther than my initial efforts.

Zone Alarm, and AVG were running when my father's computer initially got infected. I have uninstalled everything anti-virus/spyware/firewall that was not listed in your R&R before beginning the cleaning instructions. I worked through the cleaning instructions with his machine offline, but I updated SAS and MB manually.

The log files are attached. Please advise.

Thank you.

View attachment saslog.txt

View attachment rrlog.txt

View attachment combofixlog.txt

View attachment mbam-log-2009-06-17 (23-46-55).txt

thorir · Jun 18, 2009

MGLogs

TimW · Jun 20, 2009

Your logs are clean. I suggest that you now install an AV program and work thru the below:

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

TDSS Removal

thorir Private E-2

thorir Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member