Virus Problem Plz help me out

Discussion in 'Malware Help (A Specialist Will Reply)' started by Shani, Nov 14, 2007.

  1. Shani

    Shani Private E-2

    Virus and Hardware Problem PLz Help

    hi i have windos xp 2 when my computer starts and log on its shows an error in which computers says that tssrhe exe. have a problem and ask me to send report to microsoft or not.and at same time my antivirus norton 2006 which is updated with latest updates shows that tssrhe exe has virus which name is Infostealer and says unable to repair file and after it computers slow down and creat hanging problem plz can any one help me

    and my modem is not working when i click on dial it shows that modem is already in use or not configured properly plz help
     
    Last edited: Nov 14, 2007
  2. Lev

    Lev MajorGeek

    Re: Virus and Hardware Problem PLz Help

    For your hardware problem, post a new thread in the Hardware Forum.

    For you malware problem, please follow the instruction below, step by step, and if you are still experiencing problems, post up the logs as instructed for the Authorized Malware Fighters to take a look at. I am moving this thread to the Malware Forum for you.
    --------------

    Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

    After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

    Downloading, Installing, and Running HijackThis
    • Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..
    When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
    • CounterSpy Log - only for Windows XP, 2K, & NT users
    • AVG Antispyware Log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
    • Bitdefender Log - from step 6
    • Panda Scan Log - from step 6
    • runkeys.txt - the log from GetRunKey.bat
    • newfiles.txt - the log from ShowNew.bat
    • HijackThis Log
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
     
  3. Shani

    Shani Private E-2

    Hi my name is Shani i have win xp 2 and norton antivirus 2006 and i update it by downloading updates from norton website problem is that when my computer starts it shows that tssrhe.dll (C:\windows\system32\tssrhe.dll)has encounterd a problem and send it or not to microsoft and at same time norton shows that tssrhe.dll has a virus named "infostealer" and some times norton delete it but maximum it show access to file was denied and if i click ok it comes again and again i format my c drive and install new window and reinstall norton and make full scan but in starting norton shows 0 virus but when this problem came it detect 2 virus infostealer and trojan bat andrepair them but after restart computer it come again and decreas the speed of my pc iam sending three files which are created by "hijackthis" "ShowNew.Bat"
    "GetRunKeys.Bat" other programs size is big and i have dialup conection My cable conection is temporarily off So plz Plz Plz help
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You have a worm named W32.Slurk.A
    See: http://www.symantec.com/business/security_response/writeup.jsp?docid=2007-060614-5336-99&tabid=2

    I'll get back to you with a complete fix later tonight (below I will give a partial fix) but in the meantime I'm wondering why GetRunKey and ShowNew did not run properly on you computer. Are you logged in to an account with Administrator priviledges?


    Continue by downloading a tool we will need

    - Process Explorer

    Extract it to its own folder somewhere that you will be able to locate it later.


    Now back at the main Process Explorer window look for the below processes and if found right click on them and select Kill Process.
    C:\WINDOWS\system32\severe.exe
    C:\WINDOWS\system32\tssrhe.exe


    Now just exit Process Explorer.

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\drivers\conime.exe
    O4 - HKLM\..\Run: [akouow] C:\WINDOWS\system32\tssrhe.exe
    O4 - HKLM\..\Run: [tssrhe] C:\WINDOWS\system32\severe.exe

    After clicking Fix, exit HJT.

    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    Now download HostsXpert and then follow the below steps.
    • Unzip HostsXpert.zip
      [*]It will create a folder named HostsXpert in whatever folder you extract it to.
      [*]Run HostsXpert.exe by double clicking on it.
      [*]click the Make Writeable? button.
      [*]click Restore Microsoft's Hosts File and then click OK.
      [*]Click the X to exit the program
    Now run Ccleaner!

    Now attach the below new logs and tell me how the above steps went.

    1. Avenger
    2. GetRunKey
    3. ShowNew
    4. HJT


    Make sure you tell me how things are working now!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds