rootkit.patched.tdss.gen — malwareremoval.com Archive

aeiro

April 24, 2010, 3:13 AM UTC

Hello my virus protector has detected a virus that is called rootkit.patched.tdss.gen
it says it cannot remove the virus here is my hijack this log

http://go.microsoft.com/fwlink/?LinkId=69157

res://C

http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

askey127

April 26, 2010, 8:30 PM UTC

Hi aeiro,
-----------------------------------------------------------
There are some Issues with infections in relation to PunkBuster:
Your computer has installed gaming tools. Some of these, like Punkbuster, use spyware techniques to engage in the anti-piracy battle.
In the process, they take control of much of your PC, and they actually meet the definition of spyware/malware.
They are sometimes designed to prevent orderly removal or modification, and they have only limited respect for retaining the overall security and integrity of your machine.
It is not a certainty that your computer can be cleaned without breaking or removing some of these programs, and this could result in not being able to play the associated games, or corruption of your system.
Since we are dedicated to causing No Harm, we won't normally work on machines with this type of program installed without explicit permission from the owner.
If you want to continue using the machine in this way, you should consider using imaging software like Norton Ghost or Acronis TrueImage, or Terabyte Image, which can put your entire C: drive back into an earlier state whenever the infections or malfunctions get too severe.

If you really want to clean this machine, I will help, but if you so choose, understand there is NO assurance you will be able to do games afterwards.
Not only that, but rootkits are risky to remove. If you want to try, then proceed as follows:
--------------------------------------------
TDSSKiller

Download the file TDSSKiller.zip and save it on your desktop
Extract the file tdskiller.zip, it will create a folder named tdsskiller on your desktop

Don't do anything with it yet.
-----------------------------------------------------------
Retrieve the List of Installed programs Using HJT
Open HijackThis, click Open The Misc Tools Section. Then scroll down the list if you need to, click Open Uninstall Manager and Save List...
The List of installed programs will automatically be saved as uninstall_list.txt in your HiJackThis folder.
In addition, the list opens in Notepad so you can also save as another name in another location if you wish.
Please paste the contents into your next reply.
askey127

aeiro

April 26, 2010, 9:25 PM UTC

ok i have unzipped the folder to my desktop and here is what you asked

askey127

April 26, 2010, 10:59 PM UTC

aeiro,
-----------------------------------------------
Please Note Our Policy on the Use of P2P (Person to Person / Peer to Peer) file sharing programs
It is posted here: http://malwareremoval.com/forum/viewtopic.php?f=11&t=33112
As a condition of receiving our help, I have included the P2P programs Frostwire and Limewire in the removal instructions below, so we are not wasting our time.
You can be fairly confident this is a principal reason your computer is infected
------------------------------------------------
Remove Programs Using Control Panel(Vista)
From Start, Control Panel, click on Uninstall a program under the Programs heading.
Right click each Entry, as follows, one by one, if it exists, choose Uninstall/Change, and give permission to Continue:

Ask Toolbar
FrostWire 4.18.6
Java(TM) 6 Update 7
Java(TM) SE Development Kit 6 Update 16
LimeWire 5.5.6

Take extra care in answering questions posed by any Uninstaller. Some questions may be worded to deceive you into Keeping the program.
---------------------------------------------
Run CKScanner
Download CKScanner from HERE
Important - Save it to your desktop.
Right-Click CKScanner.exe, choose Run as administrator and click Search For Files.
After a couple minutes or less, when the cursor hourglass disappears, click Save List To File.
A message box will verify the file saved.
Double-click the CKFiles.txt icon on your desktop, give permission if asked, and copy/paste the contents in your next reply.
--------------------------------------------
TDSSKiller

Double-click the tdsskiller Folder on your desktop.
Right-click on tdsskiller.exe and click Copy then Paste it directly on to your Desktop.

Highlight and copy (Ctrl+C) the text in the codebox below.

"%userprofile%\desktop\tdsskiller.exe" -l "%userprofile%\desktop\tdsskiller.txt"

Click Start, click Run... and paste (Ctrl+V) the text above into the Open: line and click OK.
Wait for the scan and disinfection process to be over.
Open tdskiller.txt on your desktop and post the contents in your next reply

----------------------------------------------------------------------------------
Run MalwareBytes' Anti-Malware

Start Malwarebytes Anti-Malware by right click and "Run as administrator", click the updates tab and let it update.
Once the program has started up again, select Perform Quick Scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
If it found any malware items. Check all items except items in the C:\System Volume Information folder... and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location, and post the contents in your reply.
The log can also be found using the "Logs" tab in the program. You can click any log listed to open its contents. The logs are listed and named by time/date stamp.

Please post back the CKScanner log, and the logs from TDSSKiller and Malwarebytes Anti-Malware.
askey127

aeiro

April 27, 2010, 1:40 AM UTC

here is the malwarebytes log

www.malwarebytes.org

here is the tds.txt

and here is the ckfiles.txt

askey127

April 27, 2010, 10:33 AM UTC

aeiro,
-------------------------------------------------
Please download GMER Rootkit Scanner from Here.

Right click the .exe file and chose Run as Administrator. If asked to allow gmer.sys driver to load, please consent
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
Save it where you can easily find it, such as your desktop, and post it in your next reply

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Note: Do not run any programs while Gmer is running.
---------------------------------------------
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:



:filefind

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

askey127

askey127

April 30, 2010, 7:19 PM UTC

Lack of Response