Backdoor.tidserv!inf -- Big Trouble

Page 1 of 2 1, 2  Next

View previous topic View next topic Go down

Solved Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Mon Nov 24, 2008 11:24 pm

Hello,

I am new here--just logged on for the first time. I am using a different computer--from the one I am writing about--as my infected PC is just not cooperating to the extent that I can accomplish this simple task.

I have no idea what happened--or how--but I seem to be infected by a couple of trojans as follows:

Backdoor.Tidserv!inf
Bloodhound.Exploit.196
Bloodhound.Exploit.213

This PC has been a rock for me for years--so this is a bit out of left field. Each time I reboot the computer reacts differently. I am currently running a full system scan (Norton AntiVirus) and have just disabled system restore (as illustrated on the Symantec site). But this problem appears to be larger than a simple virus scan and remove.

When I sat down at the computer this afternoon, Norton had already popped open with the flagging of the above issues--yet could not remove them. Each time I tried to investigate via the web very strange things began to happen -- like Go-Google opening with each inquiry and basically not being able to load a web-page at all.

I am so freaked out by this. What is going on here and how can I begin to fix it? Again, I did manage to initiate a full system scan with my Norton Anti-Virus--and thus far it has detected 3 new viruses?!

Is it even safe for this computer to be on-line?

Where do I even begin?

Respectfully,
Kevin

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Mon Nov 24, 2008 11:24 pm

Hello.
Please read the following thread, and post a hijack this log in this thread:
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Mon Nov 24, 2008 11:28 pm

I'm not sure that will work as I've been unsuccessful in getting web pages to load since the arrival of these issues--

Again, I'm writing you from another computer.

HELP!

:-(

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Mon Nov 24, 2008 11:31 pm

You can't access the first two links?
You have the full rootkit in this case.

Can you download it from here?
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Mon Nov 24, 2008 11:38 pm

I'll try as soon as my Norton Full System Scan is complete. I don't want my PC to lock up trying to access the web (as it has been doing each time I try). I want to view the results of the virus scan before trying the links you provided.

Is that the right thing for me to do at this point? Again, I am NOT using the infected computer to write this note--I am on a different computer--as the infected one was not allowing me to access web sites--and in many cases was freezing up. Even some of my re-boots were not working. It's looking pretty bad.

Is it safe for that computer to even be on-line?

Thanks!

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Mon Nov 24, 2008 11:39 pm

No, not really.
The rootkit is horrible to fight off.
We can beat it, but it will take some time, so stay with me. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Mon Nov 24, 2008 11:43 pm

Ok, just disabled web access on the infected PC. Scan still running--again curious to see the results. Please let me know how I might go about getting the Hijackthis log for you? Shall I try the Sendspace file once the scan is complete?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Mon Nov 24, 2008 11:45 pm

Yes.
The sendspace HJT is renamed too, so it shouldn't be a problem.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Mon Nov 24, 2008 11:47 pm

Ok, will try--might be a good 20 minutes or longer (scan going slow) but as soon as its done I will try---THANKS!

P.S.--in commonspeak, what am I dealing with here?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Mon Nov 24, 2008 11:48 pm

One of the most horrible rootkits I fight with daily.
You may have the full rootkit in it's full form.
It's known as tdssserv.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Mon Nov 24, 2008 11:52 pm

Wow, ok. Is this PC doomed--or do we have a chance to save it? What is the risk (personal info compromised, keystrokes, et al)?

BTW: In Norton where it shows the location of the file it reads as follows:

c:\documents and settings\kevin klein\local settings\temp\tdssde33.tmp

for what it's worth--

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Mon Nov 24, 2008 11:53 pm

That's part of it.
But just a temp file.
You should be able to delete that easily.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Mon Nov 24, 2008 11:58 pm

Ok, should be able to provide more info momentarily---

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Mon Nov 24, 2008 11:59 pm

Norton probably won't be any help, but worth a try.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 12:06 am

Ok, the Norton scan came up with the following:

Detected 3 risks
Resolved 2
1 remaining

The remaining risk appears to be the-- Bloodhound.Exploit.213

The two Resolved Risks appear to be:
Backdoor.Tidserv (says repaired)
Trojan Horse (says Removed)

So where does this leave us? Shall I still attempt to run the Hijack this?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 12:13 am

Yes.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 12:17 am

Ok, is this what you need?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:12:38 PM, on 11/24/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\SYSTEM32\bgsvcgen.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
C:\Program Files\FinePixViewer\QuickDCF2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\PROGRA~1\NORTON~1\NORTON~3\navw32.exe
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Kevin Klein\Local Settings\Temporary Internet Files\Content.IE5\4DA8KDVA\Hijack(GP)This[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Norton Personal Firewall 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Personal Firewall 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-21-2252300840-3628307506-1833542573-500\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'Administrator')
O4 - HKUS\S-1-5-21-2252300840-3628307506-1833542573-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - Startup: 2WireSetup.lnk.disabled
O4 - Global Startup: 2Wire Wireless Client.lnk = C:\Program Files\2Wire 802.11g Wireless\PRISMCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Digital Line Detect.lnk.disabled
O4 - Global Startup: Exif Launcher 2.lnk = ?
O4 - Global Startup: Norton GoBack.lnk.disabled
O4 - Global Startup: WinZip Quick Pick.lnk.disabled
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} - [You must be registered and logged in to see this link.]
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [You must be registered and logged in to see this link.]
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\SYSTEM32\bgsvcgen.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 13081 bytes

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 12:22 am

No malware showing in that log.

I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.


  • Next, open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O4 - Startup: 2WireSetup.lnk.disabled
    O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
    O4 - Global Startup: Digital Line Detect.lnk.disabled
    O4 - Global Startup: Exif Launcher 2.lnk = ?
    O4 - Global Startup: Norton GoBack.lnk.disabled
    O4 - Global Startup: WinZip Quick Pick.lnk.disabled


  • Press "Fix Checked"
  • Close Hijack This.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 12:32 am

Ok, did that---now what?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 12:40 am

Lets update Java.

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

  • Download the latest version of [You must be registered and logged in to see this link.].
  • Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 10".
  • Click the "Download" button to the right.
  • In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    - Examples of older versions in Add or Remove Programs:
    - Java 2 Runtime Environment, SE v1.4.2
    - J2SE Runtime Environment 5.0
    - J2SE Runtime Environment 5.0 Update 2
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u10-windows-i586-p.exe that you downloaded to install the newest version.
Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from [You must be registered and logged in to see this link.]

  • First, unzip it.
  • Then run JavaRa.
  • Select English from the drop down menu and press Select.
  • This will open JavaRa.
  • Press Remove older versions
  • Press yes to the prompt.
  • It will make a log file of what it's removed.
  • Copy and paste the log back here.


What problems remain? Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 12:47 am

Ok, will do.

Am I virus/problem free? What about that Bloodhound.Exploit.213 that Norton could not resolve?

I'll complete this Java update now--thanks!

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 12:50 am

The tdss file in the temp folder?
Use this to clean it.

Download [You must be registered and logged in to see this link.]

  • Double-click ATF-Cleaner.exe to run the program.
  • Click Select All found at the bottom of the list.
  • Click the Empty Selected button.
If you use Firefox browser, do this also:

  • Click Firefox at the top and choose Select All from the list.
  • Click the Empty Selected button.
  • NOTE : If you would like to keep your saved passwords, please click No at the prompt.


If you are still having problems, we can go deeper. Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:03 am

Here's the log file from JavaRa:

JavaRa 1.11 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Nov 24 19:02:19 2008

Found and removed: C:\Program Files\Java\j2re1.4.2_03

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

------------------------------------

Finished reporting.

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 1:04 am

Did you run ATF-Cleaner?

What problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:05 am

No, not yet--going to do that now...

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:08 am

Ok, ran the ATF cleaner--seems to have eliminated some temps files, etc

How do I know if I have rid my PC of these issues? Another Norton scan?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:09 am

I'm assuming that I still have that Bloodhound.Exploit.213 that Norton could not resolve?

So I suppose I did not have the full root kit after all...?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 1:12 am

Nope, you don't have the full rootkit.
You can check yourself to see if it's gone.


    To Unhide Files and folders:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.

    Under the Hidden files and folders heading deselect "Show hidden files and folders".
  • Check the "Show hidden files and folders" option.
  • Hit the "Apply To All Folders" option.
  • Click Yes to confirm. Click OK.


Follow this path:
C:\Documents and Settings\admin\Local Settings\Temp

Open the temp folder and see what's in it.
There maybe some files left ATF-Cleaner couldn't delete, but leave them, your browser may need them.
Just make sure this file isn't there.
tdssde33.tmp

Try manually deleting it, if it won't die, let me know. Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:22 am

I got lost in the process of following that path (tdssde33.tmp)--

So I tried the search function--inputting the the file itself-- (tdssde33.tmp).

I went: documents and settings>administrator>local settings...then no option forTemp so I clicked Application Data--and then Application History--and figured I was lost...?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 1:24 am

I think my instructions are wrong. Goofy
These work:

    To Unhide Files and folders:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.

    Under the Hidden files and folders heading select "Show hidden files and folders".
  • Check the "Show hidden files and folders" option.
  • Hit the "Apply To All Folders" option.
  • Click Yes to confirm. Click OK.


You should be able to see hidden files and folders now, they will have a faint look to them icon wise.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:26 am

Ok, I think I found it (different path---documents and settings\kevin klein\local settings\temp)

All I see are files that begin with DF...

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:28 am

yup, I seem them--I think this one is gone--like I said I see files in there--but all begin with DF. Nothing in there looking like tdssde33.tmp

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:29 am

Would it be wise for me to now enable system restore (I disabled it before running the Norton System scan)?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 1:30 am

Ah, good. The tdss file is gone. Smile
Yes, you can enable it, this will also create a new restore point for you.

Rehide your hidden files by doing this.

Reconfigure Windows XP to hide hidden files:

  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.

    Under the Hidden files and folders heading select "Do not show hidden files and folders".
  • Press the "Apply to all folders" button.
  • Click Yes to confirm. Click OK.


What problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:31 am

Good question. I'll run another full system scan and see if anything pops up. But you have been an INCREDIBLE HELP--and I Thank You!

So in the end--what sort of garbage did I pick up on my PC?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 1:33 am

Luckily, the full tdssserv rootkit didn't get onto your machine, just a temp file of it.
I'm have to get offline now. If Norton picks up the bloodhound exploit, don't worry, it's not a major issue.

I'll probably be offline by the time Norton is done, so just post here and I'll see it tomorrow night. Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 1:36 am

Thanks again--any reason for an additional Hijack This log? Or am I more or less in the clear?

Much gratitude!

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 1:37 am

Nope, yout last log was clean. Smile


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 3:00 am

Norton scan was clean--however I noticed these problems are now in quarantine--any need to delete them? They each indicate files and registry locations of affected areas. Are these files and registry entries still potentially problematic? Would it be helpful for you to see them?

I'll now reboot and turn ststem restore back on.

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 3:44 am

One more thing (sorry)--
In following the paths of the above file and registry locations (of my quarantined items) I did happen to come across a few more tdss files (in Windows\System32\ ). Are these TDSS files a threat? I have 3 of them in this folder. Anywhere else I ought to check?

Thanks--

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 4:18 am

as follows:

At C:\WINDOWS\SYSTEM32 --

TDSSdxcp.dll
TDSSkkai
TDSSmtve

at Documents and Settings\Kevin Klein
TDSSkkai

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 9:13 am

Hello.
Just leftovers of the rootkit, the main driver for them isn't present otherwise you'd have more problems. Smile


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 2:55 pm

seem to be having trouble with ComboFix--but trying here...
So I DID have the rootkit after all? Perhaps Norton got rid of it before it showed up in the HijackThis log??

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 3:13 pm

combo fix is nearly done (preparing a log) but it just occured to me that I had already turned system restore back on and enabled tea timer--

Will this interfere with Combo fix??

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 3:17 pm

Combofix log as follows:

ComboFix 08-11-24.03 - Kevin Klein 2008-11-25 9:02:10.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.191 [GMT -6:00]
Running from: c:\documents and settings\Kevin Klein\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys


((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 )))))))))))))))))))))))))))))))
.

2008-11-24 23:02 . 2008-11-24 23:02 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-24 23:02 . 2008-11-24 23:02 d-------- c:\documents and settings\Kevin Klein\Application Data\Malwarebytes
2008-11-24 23:02 . 2008-11-24 23:02 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-24 23:02 . 2008-10-22 16:10 38,496 --a------ c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-11-24 23:02 . 2008-10-22 16:10 15,504 --a------ c:\windows\SYSTEM32\DRIVERS\mbam.sys
2008-11-24 21:22 . 2008-11-24 21:25 d-------- c:\windows\LastGood.Tmp
2008-11-24 18:59 . 2008-11-24 18:58 410,976 --a------ c:\windows\SYSTEM32\deploytk.dll
2008-11-24 18:59 . 2008-11-24 18:58 73,728 --a------ c:\windows\SYSTEM32\javacpl.cpl
2008-11-12 21:29 . 2008-10-24 05:21 455,296 --------- c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-11-12 21:27 . 2008-09-04 11:15 1,106,944 --------- c:\windows\SYSTEM32\DLLCACHE\msxml3.dll
2008-11-10 15:41 . 2008-11-10 15:55 d-------- c:\program files\DivX
2008-10-29 20:13 . 2008-10-29 20:13 d-------- c:\program files\Windows Media Connect 2
2008-10-29 20:10 . 2008-10-29 20:10 d-------- c:\windows\SYSTEM32\LogFiles
2008-10-29 20:10 . 2008-10-29 20:11 d-------- c:\windows\SYSTEM32\DRIVERS\UMDF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 15:08 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-25 14:58 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-25 03:08 --------- d-----w c:\program files\Norton SystemWorks
2008-11-25 01:02 --------- d-----w c:\program files\Java
2008-11-24 22:10 --------- d-----w c:\program files\Privacy Guardian
2008-11-17 13:08 --------- d-----w c:\program files\Norton Personal Firewall
2008-11-13 05:43 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 02:44 --------- d-----w c:\program files\FinePixViewer
2008-10-16 20:13 1,809,944 ----a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 20:13 1,809,944 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 20:09 51,224 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\SYSTEM32\wups.dll
2008-10-15 16:34 337,408 ------w c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2008-10-13 18:06 --------- d-----w c:\program files\WinAce
2008-10-03 17:41 6,066,176 ------w c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
2008-09-25 08:03 161,096 ----a-w c:\windows\SYSTEM32\DivXCodecVersionChecker.exe
2008-09-23 23:46 245,408 ----a-w c:\windows\SYSTEM32\unicows.dll
2008-09-19 21:57 120,056 ------w c:\windows\SYSTEM32\pxcpyi64.exe
2008-09-19 21:57 118,520 ------w c:\windows\SYSTEM32\pxinsi64.exe
2008-09-15 12:12 1,846,400 ----a-w c:\windows\SYSTEM32\win32k.sys
2008-09-15 12:12 1,846,400 ------w c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\SYSTEM32\msxml6.dll
2008-09-10 01:14 1,307,648 ------w c:\windows\SYSTEM32\DLLCACHE\msxml6.dll
2008-09-08 10:41 333,824 ------w c:\windows\SYSTEM32\DLLCACHE\srv.sys
2008-09-04 17:15 1,106,944 ----a-w c:\windows\SYSTEM32\msxml3.dll
2008-08-27 08:24 3,593,216 ----a-w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
2008-08-25 08:38 13,824 ------w c:\windows\SYSTEM32\DLLCACHE\ieudinit.exe
2008-08-25 08:37 70,656 ------w c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
2008-08-22 18:28 32,768 --sha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012008082220080823\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"msnmsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]
"RegistryMechanic"="c:\program files\Registry Mechanic\RegMech.exe" [2008-07-08 2828184]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 53096]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-14 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-24 136600]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
2Wire Wireless Client.lnk - c:\program files\2Wire 802.11g Wireless\PRISMCFG.exe [2005-10-11 335979]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"DellSupport"="c:\program files\Dell Support\DSAgnt.exe" /startup
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"RealTray"=c:\program files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"PRISMSVR.EXE"="c:\windows\system32\PRISMSVR.EXE" /APPLY
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"igfxpers"=c:\windows\system32\igfxpers.exe
"Dell Photo AIO Printer 922"="c:\program files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe"
"REGSHAVE"=c:\program files\REGSHAVE\REGSHAVE.EXE /AUTORUN
"RegistryMechanic"=
"MsgCenterExe"="c:\program files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=

R2 BCMNTIO;BCMNTIO;\??\c:\progra~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2005-01-03 3744]
R2 MAPMEM;MAPMEM;\??\c:\progra~1\CheckIt\DIAGNO~1\MAPMEM.sys [2005-01-03 3904]
R3 WlanUIG;2Wire 802.11g USB Driver;c:\windows\system32\DRIVERS\WlanUIG.sys [2005-10-11 347648]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce75fd4c-3dec-11dc-82f7-98c4808f77e0}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL [You must be registered and logged in to see this link.]
.
Contents of the 'Scheduled Tasks' folder

2008-11-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-22 c:\windows\Tasks\McAfee.com Scan for Viruses - My Computer (HENRIETTA-Hilary Klein).job
- c:\program files\mcafee.com\vso\mcmnhdlr.exe []

2008-11-22 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Kevin Klein.job
- c:\progra~1\NORTON~1\NORTON~3\Navw32.exe [2007-05-23 11:13]

2008-11-24 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job
- c:\program files\Norton SystemWorks\OBC.exe [2005-10-05 22:02]

2008-11-25 c:\windows\Tasks\Symantec Drmc.job
- c:\program files\Common Files\Symantec Shared\SymDrmc.exe [2005-10-03 20:20]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Kevin Klein\Application Data\Mozilla\Firefox\Profiles\8go5dk1d.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2008-11-25 09:07:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\CCSETMGR.EXE
c:\program files\Common Files\Symantec Shared\CCEVTMGR.EXE
c:\program files\Common Files\Symantec Shared\CCPROXY.EXE
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\windows\SYSTEM32\bgsvcgen.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Norton SystemWorks\Norton GoBack\GBPoll.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Norton SystemWorks\Norton AntiVirus\NAVAPSVC.EXE
c:\program files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMNTOR.EXE
c:\progra~1\NORTON~1\NORTON~2\NPROTECT.EXE
c:\program files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
c:\progra~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.exe
c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
c:\program files\Symantec\LiveUpdate\AUPDATE.EXE
c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\program files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-11-25 9:14:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-25 15:14:26

Pre-Run: 16,523,575,296 bytes free
Post-Run: 16,381,468,672 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

206 --- E O F --- 2008-11-13 04:05:54

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 5:37 pm

Hello.
Can't see anymore problems from here.
I think the files you mentioned were in the quarantine folder, so they are not active and aren't a threat.
Delete everything inside the quarantine folder, and delete this folder too.
C:\Qoobox


Last edited by Belahzur on Tue Nov 25, 2008 5:59 pm; edited 1 time in total


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 5:57 pm

So we're done with the Combo Fix? I thought there was another step (as I've seen in other threads)?

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 6:01 pm

CFScript? Nope, no need to in your case. I think TeaTimer may have stopped some files creeping in and protected you.
One last thing I want to remove from your registry, so please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.


  • Now open a new notepad file.
  • Input this into the notepad file:

    Windows Registry Editor Version 5.00

    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ce75fd4c-3dec-11dc-82f7-98c4808f77e0}]

  • Save this as fix.reg, save it to your desktop.
  • Double click fix.reg to run it.
  • Select yes to the registry merge prompt.


Please re-enable TeaTimer. Smile

What problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by mrklahye on Tue Nov 25, 2008 6:14 pm

Ok, done!

Just curious now, did Norton actually remove the rootkit before you were able to see it in the Hijackthis log? Because you said that came back clean. I'm wondering why my PC was acting so unstable yesterday--it really seemed messed up--and now it seems ok. Whatever we removed (and however it was done) it seems to have worked.

mrklahye
Novice
Novice

Posts Posts : 30
Joined Joined : 2008-11-24
OS OS : windows XP
Points Points : 29320
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Backdoor.tidserv!inf -- Big Trouble

Post by Belahzur on Tue Nov 25, 2008 6:20 pm

I can't answer that question, only you really knows what happened. Norton may have removed or maybe TeaTimer just stopped it entering your system.
Either way, the rootkit is gone and your machine is cleaned up. I had you update Java on page 2, so I'm assuming you've done that now.
===

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.
===

Everything looks great --- your HijackThis log appears to be clean. Smile
Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Page 1 of 2 1, 2  Next

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum