Malware Problem

Nolan36 · November 29, 2009

Hello,

Iv'e currently had alot of problems with malware and think I've gotten rid of most of them. It's just that one thing keeps creating itself after I delete it with Malwarebytes. It's called Rootkit.TDSS, tdlcmd.dll and it keeps appearing after every scan. It redirects my search engine results and Iv'e found my windows firewall magically disabled. I'd appreciate any help I can get cleaning my PC. Thanks in advance, here are the logs:

Malwarebytes' Anti-Malware 1.41

Database version: 3255

Windows 5.1.2600 Service Pack 3

11/29/2009 8:26:56 AM

mbam-log-2009-11-29 (08-26-56).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 388847

Time elapsed: 1 hour(s), 5 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 48

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP180\A0038883.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP180\A0038913.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP180\A0038956.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP180\A0039005.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP180\A0038963.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP180\A0038920.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP181\A0039046.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP181\A0039059.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP181\A0039067.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP181\A0039075.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP181\A0039102.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP182\A0039144.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP182\A0039106.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP182\A0039117.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP182\A0039175.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP182\A0039190.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP183\A0039194.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP183\A0039202.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP183\A0039214.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP183\A0039223.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP184\A0039379.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP184\A0039396.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP184\A0039405.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP186\A0039519.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP186\A0039542.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP186\A0039555.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP186\A0039574.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP187\A0039631.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP187\A0039642.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP187\A0039669.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP187\A0039687.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP188\A0039720.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP188\A0039709.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP188\A0039732.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP189\A0039772.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP189\A0039791.dll (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP190\A0039833.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP190\A0039815.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP190\A0039850.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP190\A0039864.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP190\A0039885.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP191\A0039897.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP191\A0039911.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP191\A0039928.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP191\A0039966.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP192\A0040244.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{9403B741-CDD5-4644-BE96-C6DB713B963B}\RP192\A0040256.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS.0\system32\tdlcmd.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

DDS (Ver_09-11-29.01) - NTFSx86

Run by Bj

Nolan36 · December 1, 2009

Problem getting worse, when I click on a search result on google it re-directs me to something else that disables my windows firewall and downloads even more maleware. <_<

Nolan36 · December 2, 2009

A quick status update, since it has been 48 hours. Problem still there, tdlcmd.dll keeps returning after every mbam scan and removal. Windows firewall keeps getting stoped; when I click on it via control panal a message pops up:

"Windows Firewall settings cannot be displayed because the associated service is not running. Do you want to start the Windows Firewall/Internet Connection Sharing (ICS) service? Yes No".

Oh and I have the "attach.txt" log if needed. Would really appreciate some help with this <_< .

Nolan36 · December 8, 2009

Still need help. I'm leaving for vacation on the 17th, hope to get it fixed by then.

Maurice Naggar · December 9, 2009

Hello Nolan36.

Do let me know if you have recently done a Windows repair install? as your Windows folder indicates that.

You will want to print out or copy these instructions to Notepad for offline reference!

If you are a casual viewer, do NOT try this on your system!

If you are not Nolan36 and have a similar problem, do NOT post here; start your own topic

Do not run or start any other programs while these utilities and tools are in use!

Do NOT run any other tools on your own or do any fixes other than what is listed here.

If you have questions, please ask before you do something on your own.

But it is important that you get going on these following steps.

=

Close any of your open programs while you run these tools.

Please start with the following:

Step 1

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 2

Set Windows to show all files and all folders.

On your Desktop, double click My Computer, from the menu options, select tools, then Folder Options, and then select VIEW Tab and look at all of settings listed.

"CHECK" (turn on) Display the contents of system folders.

Under column, Hidden files and folders----choose ( *select* ) Show hidden files and folders.

Next, un-check Hide extensions for known file types.

Next un-check Hide protected operating system files.

Step 3

Next,

Download this >> file << & extract TDSSKiller.exe onto your Desktop

Then create this batch file to be placed next to TDSSKiller:

----

Start NOTEPAD and copy/paste the text in the quotebox below into it:

@ECHO OFF
START /WAIT TDSSKILLER.exe -l Logit.txt -v
START Logit.txt
del %0

Save this as fix.bat Choose to "Save type as - All Files"

It should look like this:

Double click on fix.bat & allow it to run.

Step 4

Next Download OTL by OldTimer to your desktop: http://oldtimer.geekstogo.com/OTL.exe

Close all open windows on the Task Bar.
Please double-click OTL.exe to run it.
In the lower right corner of the Top Panel, checkmark "LOP Check" and checkmark "Purity Check".
Now click Run Scan at Top left and let the program run uninterrupted. It will take about 4 minutes.
It will produce two logs for you, one will pop up called OTL.txt, the other will be saved on your desktop and called Extras.txt.
Exit Notepad. Remember where you've saved these 2 files as we will need both of them shortly!
Exit OTL by clicking the X at top right.

Step 5

Download Security Check by screen317 and save it to your Desktop: here or here

Run Security Check
Follow the onscreen instructions inside of the command window.
A Notepad document should open automatically called checkup.txt; close Notepad. We will need this log, too, so remember where you've saved it!

If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.

Step 6

Then copy/paste the following into your post (in order):

the contents of Logit.txt
OTL.txt
Extras.txt
checkup.txt

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

Nolan36 · December 9, 2009

Hey, thanks for your reply. A windows repair install? I had to re-install windows a few months ago because it wasn't working anymore if you mean that. Anyways, here are the logs:

Host Name: BJORN-CA4D4CD76

OS Name: Microsoft Windows XP Professional

OS Version: 5.1.2600 Service Pack 3 Build 2600

OS Manufacturer: Microsoft Corporation

OS Configuration: Standalone Workstation

OS Build Type: Multiprocessor Free

Registered Owner: Bjorn's Computer

Registered Organization:

Product ID: 76487-OEM-0011903-00228

Original Install Date: 4/25/2009, 6:18:16 AM

System Up Time: 0 Days, 3 Hours, 3 Minutes, 27 Seconds

System Manufacturer: alienware

System Model: alienware

System type: X86-based PC

Processor(s): 1 Processor(s) Installed.

[01]: x86 Family 15 Model 35 Stepping 2 AuthenticAMD ~2211 Mhz

BIOS Version: Nvidia - 42302e31

Windows Directory: C:\WINDOWS.0

System Directory: C:\WINDOWS.0\system32

Boot Device: \Device\HarddiskVolume1

System Locale: en-us;English (United States)

Input Locale: en-us;English (United States)

Time Zone: (GMT-05:00) Eastern Time (US & Canada)

Total Physical Memory: 2,047 MB

Available Physical Memory: 1,548 MB

Virtual Memory: Max Size: 2,048 MB

Virtual Memory: Available: 2,000 MB

Virtual Memory: In Use: 48 MB

Page File Location(s): C:\pagefile.sys

Domain: WORKGROUP

Logon Server: \\BJORN-CA4D4CD76

Hotfix(s): 168 Hotfix(s) Installed.

[01]: File 1

[02]: File 1

[03]: File 1

[04]: File 1

[05]: File 1

[06]: File 1

[07]: File 1

[08]: File 1

[09]: File 1

[10]: File 1

[11]: File 1

[12]: File 1

[13]: File 1

[14]: File 1

[15]: File 1

[16]: File 1

[17]: File 1

[18]: File 1

[19]: File 1

[20]: File 1

[21]: File 1

[22]: File 1

[23]: File 1

[24]: File 1

[25]: File 1

[26]: File 1

[27]: File 1

[28]: File 1

[29]: File 1

[30]: File 1

[31]: File 1

[32]: File 1

[33]: File 1

[34]: File 1

[35]: File 1

[36]: File 1

[37]: File 1

[38]: File 1

[39]: File 1

[40]: File 1

[41]: File 1

[42]: File 1

[43]: File 1

[44]: File 1

[45]: File 1

[46]: File 1

[47]: File 1

[48]: File 1

[49]: File 1

[50]: File 1

[51]: File 1

[52]: File 1

[53]: File 1

[54]: File 1

[55]: File 1

[56]: File 1

[57]: File 1

[58]: File 1

[59]: File 1

[60]: File 1

[61]: File 1

[62]: File 1

[63]: File 1

[64]: File 1

[65]: File 1

[66]: File 1

[67]: File 1

[68]: File 1

[69]: File 1

[70]: File 1

[71]: File 1

[72]: File 1

[73]: File 1

[74]: File 1

[75]: File 1

[76]: File 1

[77]: Q147222

[78]: KB929399

[79]: KB952069_WM9

[80]: KB954155_WM9

[81]: KB968816_WM9

[82]: KB973540_WM9

[83]: KB936782_WMP10

[84]: KB936782_WMP11

[85]: KB939683

[86]: KB954154_WM11

[87]: KB959772_WM11

[88]: KB923689

[89]: KB941569

[90]: KB968220-IE8 - Update

[91]: KB969897-IE8 - Update

[92]: KB971961-IE8 - Update

[93]: KB972260-IE8 - Update

[94]: KB974455-IE8 - Update

[95]: KB976325-IE8 - Update

[96]: KB976749-IE8 - Update

[97]: MSCompPackV1 - Update

[98]: KB936929 - Service Pack

[99]: KB923561 - Update

[100]: KB938464-v2 - Update

[101]: KB938759 - Update

[102]: KB946648 - Update

[103]: KB950760 - Update

[104]: KB950762 - Update

[105]: KB950974 - Update

[106]: KB951066 - Update

[107]: KB951376-v2 - Update

[108]: KB951748 - Update

[109]: KB951978 - Update

[110]: KB952004 - Update

[111]: KB952287 - Update

[112]: KB952954 - Update

[113]: KB954459 - Update

[114]: KB954550-v5 - Update

[115]: KB954600 - Update

[116]: KB955069 - Update

[117]: KB955839 - Update

[118]: KB956572 - Update

[119]: KB956744 - Update

[120]: KB956802 - Update

[121]: KB956803 - Update

[122]: KB956844 - Update

[123]: KB957097 - Update

[124]: KB958644 - Update

[125]: KB958687 - Update

[126]: KB958690 - Update

[127]: KB958869 - Update

[128]: KB959426 - Update

[129]: KB960225 - Update

[130]: KB960715 - Update

[131]: KB960803 - Update

[132]: KB960859 - Update

[133]: KB961118 - Update

[134]: KB961371 - Update

[135]: KB961373 - Update

[136]: KB961501 - Update

[137]: KB961503 - Update

[138]: KB963027 - Update

[139]: KB967715 - Update

[140]: KB968389 - Update

[141]: KB968537 - Update

[142]: KB969059 - Update

[143]: KB969898 - Update

[144]: KB969947 - Update

[145]: KB970238 - Update

[146]: KB970430 - Update

[147]: KB970653-v3 - Update

[148]: KB971486 - Update

[149]: KB971557 - Update

[150]: KB971633 - Update

[151]: KB971657 - Update

[152]: KB971737 - Update

[153]: KB973346 - Update

[154]: KB973354 - Update

[155]: KB973507 - Update

[156]: KB973525 - Update

[157]: KB973687 - Update

[158]: KB973815 - Update

[159]: KB973869 - Update

[160]: KB973904 - Update

[161]: KB974112 - Update

[162]: KB974318 - Update

[163]: KB974392 - Update

[164]: KB974571 - Update

[165]: KB975025 - Update

[166]: KB975467 - Update

[167]: KB976098-v2 - Update

[168]: XpsEPSC

NetWork Card(s): 4 NIC(s) Installed.

[01]: NVIDIA nForce Networking Controller

Connection Name: Local Area Connection 2

Status: Media disconnected

[02]: Marvell Yukon 88E8001/8003/8010 PCI Gigabit Ethernet Controller

Connection Name: Local Area Connection

DHCP Enabled: Yes

DHCP Server: 192.168.2.1

IP address(es)

[01]: 192.168.2.100

[03]: 1394 Net Adapter

Connection Name: 1394 Connection

DHCP Enabled: Yes

DHCP Server: N/A

IP address(es)

[04]: Cisco Systems VPN Adapter

Connection Name: Local Area Connection 3

14:46:19:765 2488 ForceUnloadDriver: NtUnloadDriver error 2

14:46:19:765 2488 main: Driver KLMD successfully dropped

14:46:19:781 2488 main: Driver KLMD successfully loaded

14:46:19:781 2488

Scanning Registry ...

14:46:19:796 2488 ScanServices: Searching service UACd.sys