Author Topic: Tidserv (Read 20081 times)

evilfantasy · « **Reply #15 on:** October 29, 2010, 03:00:55 PM »

Just make sure it is in c:\mbr.exe. You can cut and paste it into C if needed.

Then just double-click it to run it.

luca · « **Reply #16 on:** October 30, 2010, 08:17:17 AM »

here mbr log:

Windows 5.1.2600 Disk: Hitachi_HTS541040G9AT00 rev.MB2OA61A -> \Device\Ide\IdePort0

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected hooks:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskHitachi_HTS541040G9AT00_________________MB2OA61A#5&66ae477&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
\Driver\atapi DriverStartIo -> 0x8A130292
user != kernel MBR !!!
sectors 78140158 (+255): user != kernel
Warning: possible TDL4 rootkit infection !
TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix.

luca · « **Reply #17 on:** November 02, 2010, 10:25:03 AM »

I just wanted to advise of a new problem occurring: My laptop speakers have always worked, I usually have the speakers muted. When I want to hear the speakers I click on the speaker in the system tray and uncheck mute and it always used to work. Now when I click the speaker in the system tray the following error message pops up:

"There are no active mixer devices available. To installmixer devices go to Control Panel, click Printers and Other Hardware and then click Add Hardware.

This program will now close."

Is this a symptom of this malware??

luca · « **Reply #18 on:** November 03, 2010, 07:30:41 AM »

turned the computer on this morning and it seems the speakers are working. I clicked on the speaker in the system tray and removed the mute and they work with no problems.(This is in regards to my previous post)
Just wanted to give you as much info as possible.
Thanks

luca · « **Reply #19 on:** November 05, 2010, 01:21:22 PM »

Symantec is sending error message from the system tray saying the following:

Traffic from IP address 91.212.226.6 is blocked from 04/11/2010 7:29:26 am to 04/11/2010 7:39:26am

also on other instances the balloon says

[SID: 23515] HTTP Tidserv Request 2 Detected

Just wanted to post all info I have to date.

SuperDave · « **Reply #20 on:** November 14, 2010, 01:31:26 PM »

In the absence of Evilfantasy, I will try to help you complete the cleaning of your computer. Let's do this while I'm reviewing your problem.

Please open Command Prompt (Start > Run and type CMD and press OK [Vista/7: Start search: CMD and press enter])
Enter the following in to the black box, pressing enter after each line:

Code: [Select]

cd desktop

mbr.exe -f

exit

Post a log (MBR.log).

luca · « **Reply #21 on:** November 15, 2010, 06:04:43 AM »

Thanks for your help SuperDave !!

Here is the log you requested:

Windows 5.1.2600 Disk: Hitachi_HTS541040G9AT00 rev.MB2OA61A -> \Device\Ide\IdePort0

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
detected hooks:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskHitachi_HTS541040G9AT00_________________MB2OA61A#5&66ae477&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
\Driver\atapi DriverStartIo -> 0x8A130292
user != kernel MBR !!!
sectors 78140158 (+255): user != kernel
Warning: possible TDL4 rootkit infection !

SuperDave · « **Reply #22 on:** November 15, 2010, 12:57:42 PM »

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
Click the Report button and copy/paste the contents of it into your next reply

Note:It will also create a log in the C:\ directory..

luca · « **Reply #23 on:** November 15, 2010, 01:14:35 PM »

Here is report from TDSSKILLER :

2010/11/15 15:12:54.0484   TDSS rootkit removing tool 2.4.7.0 Nov 8 2010 10:52:22
2010/11/15 15:12:54.0484   ================================================================================
2010/11/15 15:12:54.0484   SystemInfo:
2010/11/15 15:12:54.0484
2010/11/15 15:12:54.0484   OS Version: 5.1.2600 ServicePack: 3.0
2010/11/15 15:12:54.0484   Product type: Workstation
2010/11/15 15:12:54.0484   ComputerName: USER-AAFE7F374C
2010/11/15 15:12:54.0484   UserName: Tony
2010/11/15 15:12:54.0484   Windows directory: C:\WINDOWS
2010/11/15 15:12:54.0484   System windows directory: C:\WINDOWS
2010/11/15 15:12:54.0484   Processor architecture: Intel x86
2010/11/15 15:12:54.0484   Number of processors: 1
2010/11/15 15:12:54.0484   Page size: 0x1000
2010/11/15 15:12:54.0484   Boot type: Normal boot
2010/11/15 15:12:54.0484   ================================================================================
2010/11/15 15:12:54.0812   Initialize success

SuperDave · « **Reply #24 on:** November 15, 2010, 01:18:48 PM »

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

•Double-click on MBRCheck.exe to run it.

•It will open a black window...please do not fix anything (if it gives you an option).

•When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.

•A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
•Please copy and paste the contents of that log in your next reply.

luca · « **Reply #25 on:** November 15, 2010, 01:21:34 PM »

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version:      Windows XP Home Edition
Windows Information:      Service Pack 3 (build 2600)
Logical Drives Mask:      0x0000000c

Kernel Drivers (total 143):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806D0000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA4BC000 compbatt.sys
0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xBA670000 PCIIde.sys
0xBA328000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xBA5AC000 intelide.sys
0xB9F4A000 pcmcia.sys
0xBA0B8000 MountMgr.sys
0xB9F2B000 ftdisk.sys
0xBA330000 PartMgr.sys
0xBA0C8000 VolSnap.sys
0xB9F13000 atapi.sys
0xBA338000 cercsr6.sys
0xB9EFB000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xBA0D8000 disk.sys
0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9EDB000 fltmgr.sys
0xB9EC9000 sr.sys
0xB9EB2000 KSecDD.sys
0xB9E25000 Ntfs.sys
0xB9DF8000 NDIS.sys
0xB9DDE000 SysPlant.sys
0xB9DC4000 Mup.sys
0xBA178000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA554000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xB9BE9000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xB9BD5000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB9BAB000 \SystemRoot\system32\DRIVERS\b57xp32.sys
0xBA398000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB9B87000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3A0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB9B71000 \SystemRoot\system32\DRIVERS\gtipci21.sys
0xBA558000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS
0xB9955000 \SystemRoot\system32\DRIVERS\w29n51.sys
0xB9912000 \SystemRoot\system32\drivers\STAC97.sys
0xB98EE000 \SystemRoot\system32\drivers\portcls.sys
0xBA198000 \SystemRoot\system32\drivers\drmk.sys
0xB98CB000 \SystemRoot\system32\drivers\ks.sys
0xB9898000 \SystemRoot\system32\DRIVERS\HSFHWICH.sys
0xB979B000 \SystemRoot\system32\DRIVERS\HSF_DPV.SYS
0xB96EE000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xBA3A8000 \SystemRoot\System32\Drivers\Modem.SYS
0xBA1A8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA3B0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA3B8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA1B8000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA55C000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB96DA000 \SystemRoot\system32\DRIVERS\parport.sys
0xBA1C8000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA1D8000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA1E8000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA3C0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xBA754000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA1F8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA564000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB96C3000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA208000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA218000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA3C8000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB96B2000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA228000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA3D0000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA3D8000 \SystemRoot\system32\DRIVERS\raspti.sys
0xBA248000 \SystemRoot\system32\DRIVERS\termdd.sys
0xB956C000 \SystemRoot\system32\DRIVERS\teefer2.sys
0xBA5C4000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB950E000 \SystemRoot\system32\DRIVERS\update.sys
0xBA578000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA268000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA2C8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5C6000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xA90FC000 \SystemRoot\System32\Drivers\SRTSP.SYS
0xA90EB000 \SystemRoot\System32\Drivers\SRTSPX.SYS
0xBA3F0000 \SystemRoot\System32\Drivers\BTHUSB.sys
0xA90A8000 \SystemRoot\System32\Drivers\bthport.sys
0xB9D6F000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA318000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA3F8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA538000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA118000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0xBA400000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0xA908F000 \SystemRoot\system32\DRIVERS\bthpan.sys
0xA8F21000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xBA606000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA781000 \SystemRoot\System32\Drivers\Null.SYS
0xBA610000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA448000 \SystemRoot\System32\drivers\vga.sys
0xBA614000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA616000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA450000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA458000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA588000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xA8EDA000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xA8E81000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xBA128000 \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys
0xA8E5B000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA148000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA8E05000 \SystemRoot\System32\Drivers\SYMTDI.SYS
0xA8DDD000 \SystemRoot\system32\DRIVERS\netbt.sys
0xA8DBB000 \SystemRoot\System32\drivers\afd.sys
0xB929E000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA8D52000 \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys
0xA8D30000 \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
0xBA468000 \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
0xA8D05000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA8C95000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xB924E000 \SystemRoot\System32\Drivers\Fips.SYS
0xA8C37000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xA8C1A000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xB927E000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xA8C02000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA62C000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xBA53C000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA478000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA77F000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBA408000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xA8AD6000 \SystemRoot\system32\DRIVERS\s24trans.sys
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xA85BD000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA630000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xA85EA000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA838D000 \??\C:\WINDOWS\system32\drivers\WpsHelper.sys
0xA8246000 \SystemRoot\system32\DRIVERS\srv.sys
0xA8079000 \SystemRoot\system32\drivers\wdmaud.sys
0xA8545000 \SystemRoot\system32\drivers\sysaudio.sys
0xA7A61000 \SystemRoot\System32\Drivers\HTTP.sys
0xBA430000 \SystemRoot\System32\Drivers\SYMREDRV.SYS
0xA714F000 \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20101114.003\NAVEX15.SYS
0xA713B000 \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20101114.003\NAVENG.SYS
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 47):
0 System Idle Process
4 System
1172 C:\WINDOWS\system32\smss.exe
1220 csrss.exe
1244 C:\WINDOWS\system32\winlogon.exe
1288 C:\WINDOWS\system32\services.exe
1300 C:\WINDOWS\system32\lsass.exe
1448 C:\WINDOWS\system32\svchost.exe
1496 svchost.exe
1556 C:\WINDOWS\system32\svchost.exe
1668 C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
1704 C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
1744 C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
1772 C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
1892 svchost.exe
2020 svchost.exe
116 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
552 C:\WINDOWS\system32\spoolsv.exe
632 scardsvr.exe
716 svchost.exe
772 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
796 C:\Program Files\Bonjour\mDNSResponder.exe
808 svchost.exe
860 C:\Program Files\Java\jre6\bin\jqs.exe
1000 C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
1036 C:\WINDOWS\system32\svchost.exe
1152 C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
1456 C:\Program Files\Canon\CAL\CALMAIN.exe
2224 C:\WINDOWS\explorer.exe
2512 C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
3052 alg.exe
3140 C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
3188 C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
3196 C:\WINDOWS\system32\rundll32.exe
3216 C:\WINDOWS\system32\hkcmd.exe
3256 C:\WINDOWS\system32\igfxpers.exe
3308 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3320 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
3328 C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe
3812 C:\WINDOWS\system32\igfxsrvc.exe
3840 C:\Program Files\iTunes\iTunesHelper.exe
4052 C:\Program Files\PIXELA\Everio MediaBrowser\MBCameraMonitor.exe
3560 C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
2772 C:\Program Files\iPod\bin\iPodService.exe
4092 C:\Program Files\Mozilla Firefox\firefox.exe
3456 C:\WINDOWS\system32\wuauclt.exe
340 C:\Documents and Settings\Tony\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541040G9AT00, Rev: MB2OA61A

Size Device Name MBR Status
--------------------------------------------
37 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644 A

Done!

luca · « **Reply #26 on:** November 16, 2010, 07:22:57 AM »

Windows is trying to update my system, should I let it ?

SuperDave · « **Reply #27 on:** November 16, 2010, 12:59:47 PM »

Quote from: luca on November 16, 2010, 07:22:57 AM

Windows is trying to update my system, should I let it ?

Yes, get your updates. Where do we stand now? Any other issues?

luca · « **Reply #28 on:** November 16, 2010, 01:07:02 PM »

Actually haven't had any popups from symantec saying that "Tidserv Detected" So are we all good??

System seemed to be running slower this morning.

Also can I run a live update with "Symantec Endpoint" or will it interfere with all the programs that were installed to help resolve my issues?

Do I remove any of these programs that I was told to download or do I keep them?

Thanks for all your help !!!!!

luca · « **Reply #29 on:** November 17, 2010, 05:55:01 AM »

Also what do you suggest I use as a browser, Mozilla, Internet Explorer,Chrome ??

Also I am currently using Mozilla and it is asking me to upgrade, should I.

If I am to upgrade to latest Mozilla should I delete old one first.

Thanks again for all your help!!

Computer Hope Forum

News:

Author Topic: Tidserv (Read 20081 times)

evilfantasy

Re: Tidserv

luca

Re: Tidserv

luca

Re: Tidserv

luca

Re: Tidserv

luca

Re: Tidserv

SuperDave

Re: Tidserv

luca

Re: Tidserv

SuperDave

Re: Tidserv

luca

Re: Tidserv

SuperDave

Re: Tidserv

luca

Re: Tidserv

luca

Re: Tidserv

SuperDave

Re: Tidserv

luca

Re: Tidserv

luca

Re: Tidserv