Win32Trojan TDSS

[doac00]

Folks,

It seems my PC is infected with this bug (which has a variety of names). It will not allow me to run Malwarebytes but I think I may be able to get round that by changing the name of the exe file, as I suspect this bug is stopping me from running it as well as the likes of spybot etc..

The name itself is what Ad aware calls it, as it can detect but as it so happens not remove this pest.

I have Trend Hjacker available to run, if required, to get some reports.

All help to remove it would be appreciated as it would save me doing a clean install yet again.

Environment is Windows XP SP2.

Thanks

[Fatdcuk]

Hi and welcome to the MBAM help forums,

You almost certainly are infected with the CLB driver infection(WinNT.Alureon)

Please use the following walkthrough as a guide how to get MBAM back in action

http://www.malwarebytes.org/forums/index.php?showtopic=12709

[doac00]

Ok will do - I'll grab a hjack report while I'm on it this evening as well. If I get mbam running I'll ask for a report too. I'll cut and paste that onto a notepad txt file, pop onto pen drive and use my work laptop to send it in, if required.

Thx

[Fatdcuk]

Ok well if when you have HJT log + MBAM log please start a new topic in the HJT help forum here>>>

http://www.malwarebytes.org/forums/index.php?showforum=7

If you follow the instructions to remove the UAC CLB variant driver first then MBAM will come to the malware kicking party

[doac00]

Fatdcuk,

I will indeed run the rootrepeal program from desktop, look for the sys file and remove as suggested - I think from the Ad aware logs it's definetly looking like they start with uca+"load of characters" type files so it fits the bill you describe. Then run mbam to do it's stuff. I will not feel confident it's clean though until I get logs onto the HJT section for an expert to review.

cheers

[doac00]

ok found the sys file and wiped it out. I then was able to run MBAM and it found 7 objects which I asked it to remove. I thus have a report from MBAM. I have also run a HJack report - I'll post these both tomorrow in the HJK section for an expert to review and hopefully declare my PC "clean".

Thanks for the advice - so far so good.