Infected with Rootkit.Agent/tdlcmd.dll/Win32.TDSS.z --!!??

Iosif · November 22, 2009

Hello,

and thanks in advance for any help I might get with regard to this...

Primary symptom as far as I can make out is the redirection of search links

Iosif · November 29, 2009

Hello all,

I'm going to bump this as it has been a week since I first posted.

I hope I'm not seeming to be impolite or impatient!

At any rate, the search redirects are still going strong...

Would really appreciate some help.

-- Iosif

Maurice Naggar · December 9, 2009

Hello IOsif.

It appears your post was overlooked. Perhaps because you had posted a 2nd post before any helper responded to you.

Please re-confirm that you still have the same issue and need help.

Otherwise, let me know if this was resolved elsewhere.

If you wish guided help, start with the following.

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not Iosif and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Please start with the following:

Step 1

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 2

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 3

Next,

Download this >> file << & extract TDSSKiller.exe onto your Desktop

Then create this batch file to be placed next to TDSSKiller:

----

Start NOTEPAD and copy/paste the text in the quotebox below into it:

@ECHO OFF
START /WAIT TDSSKILLER.exe -l Logit.txt -v
START Logit.txt
del %0

Save this as fix.bat Choose to "Save type as - All Files"

It should look like this:

Double click on fix.bat & allow it to run.

Step 4

Next Download OTL by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTL.exe

Close all open windows on the Task Bar.
Please double-click OTL.exe to run it.
In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".
Now click Run Scan at Top left and let the program run uninterrupted. It will take about 4 minutes.
It will produce two logs for you, one will pop up called OTL.txt, the other will be saved on your desktop and called Extras.txt.
Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!
Exit OTL by clicking the X at top right.

Step 5

Download Security Check by screen317 and save it to your Desktop: here or here

Run Security Check
Follow the onscreen instructions inside of the command window.
A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Step 6

Then copy/paste the following into your post (in order):

the contents of Logit.txt
OTL.txt
Extras.txt
checkup.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

Iosif · December 10, 2009

O.k. I've gone through steps 1-5 and here are the logs.

One problem, though: OTL hangs up at "HKEY_CURRENT_USER\Uninstall List" and so I haven't been able to get an Extras.txt log...

Logit.txt:

22:13:28:46 3848 ForceUnloadDriver: NtUnloadDriver error 2

22:13:28:46 3848 main: Driver KLMD successfully dropped

22:13:28:203 3848 main: Driver KLMD successfully loaded

22:13:28:203 3848

Scanning Registry ...

22:13:28:203 3848 ScanServices: Searching service UACd.sys