TDSS Trojan- Would Sincerly Appreciate Help

I apologize, I have read and tried everything I could find to remove this virus including posts on your site to no avail.

I can only run my machine in safe mode. I tried to get into normal mode to download tools on your site. Within minutes in normal mode my pc constantly locked so I could not get very far to install tools that you have recommended.

Thus far, I could only run malwarebytes. I followed directions to change the folder name of this program (in program files) and the file name. I ran this program in safe mode first. It did remove many of the infections. I preceded with the directions I had to then run malwarebytes in normal mode, and my pc locked down. Then as I recall 2 new TDSS malware entries were added.

I have spent literally hours to try to get through your steps in "Read and Run Me First" and I didn't get far.

The progress I made and or relevant information from here:

Basic computer maintenence, I do on a regular basis. Though at this juncture running any programs at all is a challenge since the TDSS virus shuts down just about everything.


Re: Uninstalling protection apps
As far as I know, I do not have any antivirus or firewalls on my pc to disable. I have run my pc without security for several years. I uninstalled Norton antivirus when my pc was brand new and I found over 300 infections. since then I never had a virus of any kind. though, I could have lingering Norton antivirus files on my pc.

Re: Housecleaning

I was able to get into normal mode long enough to uninstall all old Sun Java versions. However, I could not stay in normal mode long enough to install the new version of this product.

CC Cleaner, I was able to download and run this product.

I could not install or run any of the cleaning procedures that you provided in step 6.

___

Though, prior to me coming to your site I did run malwarebytes and I have only the following log that I have attached from this program to provide to you.

Note- I have attached a copy of the log from malwarebytes before it cleaned the trojan and/or malware files and after it cleaned them.

I am completely perplexed with this. The report that malwarebytes states that there is an exe file, in the following path that is the a trojan agent:

Windows/system32/uacint.dll

However, I have looked in my Windows/system 32 file and there is no dll file at all with this name. I hoped that I could delete this file manually and since there is no such file this can not be done.

Malwarebytes reports that I have a trojan agent in my 'memory module'. The scan reported that the file is in the following location:

//?/globalroot/systemroot/system32/UACkikomnqrry.dll

Malwarebytes will not remove this file and I can't find this anywhere in searches on my pc to manually remove this.

Where on earth is this path, //?/globalroot... and how can you access this area to view suspicious and/or infected files?

I am extremely interested in knowing how to access the memory module on my pc. Though for now I would be so very greatful if you can assist me in anyway to remove this virus.

I am literally shut down, in almost all ways I can see due to this virus. For the record, it did not disable my installer as notes on your site have stated with steps to solve this problem. I do get the error message that states:

system admin set policies to prevent installation.

this message populates anytime I try to download software to remove the virus. However, the above message does not occur when I change exe file names. thus, it seems that the virus gives the above message as yet another trick to attempt to prevent software to be downloaded to remove it.

my pc is 64 bit (it is a Sony Vaio desktop RA, VGC-RA840G) so per the instructions on your site, I expect that I could not utilize combofix, or root repeal.

Likewise I could not install Superantispyware since I can only run my machine in safe mode.

I so hope you can help me and my pc is not totally done for.

Thanks so much in advance and please forgive me for the very limited information I have provided to you. I do realize you need more but until I get help with this virus I have no idea how to get anything installed or running on this pc as this virus is extremely aggressive.

 

Disregard the above post please. I reguest that this thread be closed until I learn how to close it myself.

thanks in advance for your consideration. I do not need any assistance now. Aydyn

 

What is the motivation of a trojan/virus writer to destroy everything on someone's pc, I do not know.

but so be it. it is a done deal.

after weeks of this, frankly whatever the virus writer wants on my pc, it is theirs, c'est la vie.

to any admin that reviews this thread, please close this.
thanks so much!

 

Hi Chaslang

Thanks for your response. I became so disgusted with this, I have taken a break from trying to remove it. I felt I was pretty good at removing viruses. As I mentioned when my machine was new, and though I bought and had Norton and a Spyware program installed I found several hundred viruses, including several trojans on my machine. (My husband, ironically who is in IT transferred all the files from our other pcs to mine, hence where I expect the malware came from). I cleaned out everything, many manually. Though it took some time, it was pretty straight forward as to how to remove them. I became convinced then that trojans targeted machines with security (searching popular security exe files) and disabled them. Norton certainly let everything through, so I uninstalled all my security software. Also, as I have mentioned, in several yrs since I never had another problem, other then harmless spy programs. Regular maintenance of my machine always cleaned my machine and I had never once had another trojan.... until now.

At this juncture, my machine is useless. Unfortunately, if I reinstall everything, I will loose a great deal of my software that was very pricey, some programs costing several hundred dollars. I have a ton of programs, including Corel Paint, Photoshop, Paintshop and a slew of other photography programs, plugins etc in which I don't have the keycodes for. The same is true for registry cleaners I have, Windows washer and just too many to list. A friend bought everything for me. He gave me most of the codes on messenger. I copied them and entered them when installing the programs but stupidly I did not document the keycodes. Needless to say, if I reinstall none of these programs will work.

Also, I learned that my father gave me this virus through an attachment in email. (I know! Shame on me for opening the email! grrrr) A person that worked on my fathers machine tried to uninstall and the virus even thought of this and prevented him from taking out his operating system.

I have gone back and spent another full day, trying to get around that miserable virus to get anything installed to try to take it out. Though, it always locks up my pc and or stops me from everything. Even when I tried to click the icon for Superantispyware, my machine crashed. And now, I can't even get to my program files to change the exe file back to the correct name for Malwarebytes (which directions suggest to do before you reboot, I assume so that Malwarebyte will finish the cleaning stage when the machine is rebooted).

I am a photographer. I have 300,000 files on the machine where the majority of them are digital photos downloaded to my machine that can not be replaced if I loose them. To me these low life virus writers either steal what they want, and or break in and don't get what they want, but they burn the house down to the ground~ since the fact is it sure seems that they missed absolutely Nothing in preventing repair of the machine.

There were 2 files with that globalroot path (that I listed above) that I can find NOWHERE on my machine, which is in my memory module~ wherever that is. Now 2 more were added with the same path. As well, the file malewarebytes reports as being in my system 32 folder, is not there. Last, malewarebytes reports there is a UAC folder in my registry. That folder simple doesn't exist in my registry, at least not where malewarebytes reports that it is. I do have my machine set to allow viewing of all hidden folders. So it beats the heck out of me how to get rid of this miserable SOB of a trojan.

After literally weeks of trying to fix this problem, I have become so disgusted I haven't turned on that useless box to attempt anymore work on it.

Thanks so much for the thoughtful time you have taken to reply to my post Chaslang!!

 

Hi Chaslang,

Thank you for providing me with your Read and Run malware removal guide. I will try this procedure again tomorrow (with a fresh mind ;-)

I did go through this guide before I posted to this forum. I was not at all very successful, I suspect due to the aggressive stage of this trojan. You are absolutely right that my pc situation has become worse with my further (unsuccessful) attempts to remove it :-(.

I am amazed at how this trojan appears to have accounted for everything to prevent removal of it. For example, at first I was able to get malwarebytes downloaded on my machine. However, after I was unsuccessful in removing the virus with malwarebytes, more recently I have been unable to download other malware removal programs, specifically I could not download Super-Anti Spyware. Thus, it is clear to me the trojan did react and has now made it more difficult for me to get anywhere here in trying to get rid of it.

Again, I will go through your steps again tomorrow, and this time if I am unsuccessful, I will note this in order to give you the information you need to assist you, with assisting me, lol

Question-
Btw, if you do receive this comment before tomorrow, as I recall I do have a 64 bit machine. To reiterate, my pc is a Sony Vaio VGC-RA840G. (My operating system is Windows XP- Media edition)

I believe the instructions in the read and run guide stated that there are 2 steps that I might not be able to complete due to having a 64 bit machine. I did not attempt these steps due to the information provided. Is this correct that I will be limited as to what I can do in the guide due to the having 64 bits?

I do understand that the malwarebytes report that the 'UAC' folder that the software claims is in my registry is part of the same trojan. The trouble is that this folder does not physically exist on my machine. I did follow the path to the location in my registry, and there is no 'UAC' folder.

However, I do realize that you need more information from me if there is any chance this trojan can be removed. So, I will give you what I can attain in my next reply to this forum.

Thank you so much again for giving your thoughtful time to me, most especially when I have become so completely perplexed and unfortunately disgusted with this trojan. In the past, I have found fixing problems like this a challenge. This time, I am not at all amused. :-(

 

Oh Man!!

I am sorry, I tried to reply to you in safe mode where I just can't THINK in that mode, as well I loose so much fx. I missed part of what you said here. You So Nailed It!! The virus had to do just that and replace an exe file. I can't even run any programs I do have now, let alone download any new ones. :cry

This trojan keeps kicking it up a notch. Today, I had a new surprise in store for me, I have something that has been added to my start menu which starts to instantly download if I try to run in normal mode. Yeah, it is the virus claiming it is Microsoft that wants me to download software because I am infected, where it claims that I risk my files being deleted if I don't run it. It starts to attempt to download immediately on boot-up and locks me down from running anything.

I tried to get to anything at all, I do have hijack this on my system from long ago, I am desperate for anything at this point, but who would have guessed it wouldn't run. grrrrr

There must be someway to get in to get in some doorway to get around that vile trojan, but so far it has my backside kicked as to how to find that way. :confused

I am back to the drawing board I suppose tomorrow, but now it seems I have to find something that is running in my start up menu to get another fake program out, which I can bet anything this virus has it very well concealed.

First and foremost, it might be a wise idea for me to break out the external hard drive I bought when I purchased my system which I have never used Duh! I am a brainy act no? lol (Not Funny :-o). Though, I can already see the writing on the wall with that. If I try to transfer any folder while that infection is on my machine to the external then back again to any pc, I am thinking the virus has something in non-suspecting files and/or folders to reinfect my machine, and worse infect others in the house. Like you said, they replace windows exes. When I started the original cleaning of the virus, lurking in a 600 dollar software program, indeed was part of this virus.

Oh joy!


Thanks again for your thoughtful time and help Chaslang

~Linda

 

Hi Chaslang,

I apologize for the confusion. I replied within your quote the last time. Hopefully this is better.

Originally before I posted to this site, I did follow through the Read and Run directions. Though, at the time I could not do almost any of the steps because due to the virus I could not install anything.

I think I have finally made some progress. (SAS wouldn't install in the past). I ran Malwarebytes in safemode again. It seemed to do the trick, at least thus far I have been able to get SAS installed.

I became hungup though because I had messed around with the folder name of Malwarebytes. I resolved the problem and I am back on track now that is running ok, so far (the scan is running now).

****
RE- 64 BIT My husband had told me when I purchased my system that it was a 64 BIT. I took his word for it because he had been in IT for 30 years. Now, I went to preferences as you instructed me to do and I am not so sure he is correct.

Here is the info- I am not seeing 64 BIT here, is this correct?

System Properties

OS- XP
Media Center Edition
Version 2002
Service Pack 3

Sony Vaio
Intel (R)
Pentium (R) D CPU 2.80 GHz
2.79 GHz 1.00 GB of RAM

Physical Address extension

~~~~~~~
I hope to finish up the steps today. I know you are very busy out here and you might not get the 64 bit answer to me today- so here is where I am stuck unless it is safe for me to assume since I don't see anything that states 64 BIT, hopefully my system is not.

I am so sorry this has been such a struggle but absolutely Nothing would download and/or install on my machine. Thankfully I had malwarebytes on it, I guess before the infection got too bad, that is before I posted to this site. And it seemed to finally get me out of the worst of the jam. I will keep my fingers crossed that I will have everything for you later today.

Thanks so much again for all your help!!

 

Re: TDSS Trojan- Would Sincerly Appreciate Help/Follow UP

Hi,

Re- 64 bit. I misunderstood my husband. He said my pc is 64 bit capable. He said that my operating system is not 64 bit.

I finally got through a bit more of the cleaning procedures. Though, I still had some problems.

SAS and Malwarebytes-

I ran SAS and Malwarebytes several days ago. (The logs are attached). I don't recall why I have 2 Malwarebytes logs, but I included them both.

I ran SAS today again. I am not sure but it doesn't appear it ran correctly. I ran it twice, and it said that it scanned a little over 50,000 files. The problem is that I have over 300,000 files. Both times the software stated that I had 0 infections and it did not give me a report today. I don't know what to make of this.

Because I do have SAS downloaded on my pc, I did not do the online scan. Do you still want me to download and run online scan?

Root Repeal-

The first time I tried to click the Root Repeal link, I received the following message:

The bandwidth or page view limit for this site has been exceeded and the page cannot be viewed at this time. Once the site is below the limit, it will once again begin serving normal.

I tried it later and it seems to have worked but I had an error when I went to run this that said,
"Invalid PE image found!"
However, the program did create a log which is attached.

MG Tools-

I didn't have much luck with this

-I double clicked 'Disable UAC.reg and it asked me,
"Are you sure you want to add info to the registry". I clicked yes.

Then it said, "Information in C: MG Tools/Disable UAC.reg has been successfully entered"

The next step said that I would see a Security Center icon in System Tray alerting you to turn UAC back on. I did not get this. (Nothing happened at this point).

I rebooted my pc and right clicked on "Get logs.bat". It did not give me run as an Admin option. (It gave me the standard menu when you right click).

AVP log- It appears this ran correctly. I was only allowed to download 4 files so I will add this log in a second comment.

Combofix- I read through the instructions on this software. When it talked about Windows recovery, it made me very nervous to run this. I don't want to chance loosing my system because there is so much on this that I can't replace. As I stated, I am a photographer and I have just tons of photos that are downloaded on my pc. As well, I just have a LOT of software and as I stated earlier, most of it I did not write down the key codes (they were gifts from a friend). So, thus far I have not run this program due to my concern for a risk of loosing things that I can't replace on my pc.


hmmm I uploaded 4 logs once, and they didn't appear to be in the preview, so I just did this again. Hopefully they post.

 

The Avp log is attached in this comment. I think that is it for now unless you want me to still also try the SAS online scan as well.

Thanks so much again Chaslang for all of your help and patience

 

Oops!

Chaslang, I just read a link where you are helping another person with the TDSS virus and it appears that I followed the instructions for Vista to run MG tools (where I have XP).

I read your instructions to double click analyze.exe and followed through to scan. (I did not do anything else that you gave for instructions to the other person in the event the instructions were specific to him).

I hope posting this new report doesn't bump me. But if it does oh well... I just found the right way to get you the MG tools report, as I stated per your instructions to someone else.

Note: I did not go through any further and 'fix checked' because you have not instructed me to do so.

I will await your response before proceeding with anything else. Thanks again!

 

My computer has been running great, Thanks so very much!! I don't see any signs that the virus is still on my pc. I have been running it for over a week and there has been no problems at all.

Re: MG Tools

Apparently I did do something wrong in following the instructions. Though at the time, I was not aware of this and I thought it was due to the virus that I wasn't getting the results that the directions had stated that I would. In fact, because I wanted to be sure I was understanding the directions correctly, I asked my husband to oversee what I was doing. Thus, as far as I know I followed them the way they were written.

I posted the results I attained in my former post where I said I didn't have much luck with MG tools. As I recall the directions state that if something doesn't run, to let you know what happened. I included the steps that I took, and how I wasn't getting the results that you were looking for.

You have told me to follow the directions correctly. I guess I will have to figure out how to do that. I apologize for looking at other posts to see if it might be clearer to me seeing your instructions to someone else to run MG tools.

I guess we can chalk this up to 'Stupid User' as one of my husbands IT employees use to call people when they didn't do things correctly for the techs. :-o

(Btw, my husband was an IT Director, with more certifications that I could keep track of. Though for the last many years of his career he was NOT at all a desk top guy. His tech guys always did this element of the work in his career. Well he was a DOS guy way back when, wrote software for banks, finance orgs etc, he knows a lot about languages that are all Greek to me. lol Though he is brilliant with servers the size of small homes, that doesn't mean he is any better with desktop work then I am, lol).

Actually, I do know some html, have learned a lot over the years, but with this TDSS virus and getting rid of it I have felt like an utter moron. grrr

In any event, will follow up when I can figure out how to run MG Tools.

I do realize I need to back up my system. But as I stated, I have several hundred dollars in photo software (and other software, reg cleaners etc) that was all given as a gift to me. My friend that purchased the products for me gave me the keycodes on messenger. I stupidly just cut and pasted them to enter them and never got around to documenting the keycodes. For months now my friend has been very ill and I haven't felt he has been up to giving me this list of keycodes for my records. Further, a tree landed on his house in June of this year and it did a lot of damage to his office. The codes were all written in a notebook he had. So, I am not even sure he has them any longer. So, as I said, backing up my software will not really do me much good since I don't have many of the key codes.

As I stated, the instructions for combofix seemed to indicate that there was a good risk that I could loose, even my OS. (ha ha for that matter, I have moved several times over the last few years and I don't even know if I have my OS disk anymore).

In any event, it would be helpful for me to know how great the risk is that I could loose things that I might not be able to replace on my pc by running Combofix. Since, it is clear I have made errors, I don't trust myself enough to not do something stupid and wipe things out.

Thus far, even though I removed all of my security from my pc shortly after I bought it, I had never had one virus until this recent incident with the TDSS virus. I can bet anything that TDSS would have sailed right through Norton, and other security I had~ and very thankfully to date, I have had no damage done to my pc. So, I would just hate to cause irreversible damage when trying to fix things.

Thanks again for everything. I am so very grateful to you as there is no way I could have just wiped out my OS and rebuilt this for reasons mentioned above.

You totally rock!! I will be in touch again as soon as I can make progress with the other information you need. Again, if there are tips you can give me to help me thru being sure that I would run combofix without annilating my system, it would help me a lot (because if it can happen, I just know it would happen to me!!)

If it is just a fact that there is a risk to loosing even my OS by running combofix, it seems that for me, I risk loosing potentially thousands of dollars in software I depend on.