Computer Hope

Software => Computer viruses and spyware => Topic started by: arun8283 on December 05, 2009, 05:54:51 PM

Title: Laptop affected by virus (logs attached)
Post by: arun8283 on December 05, 2009, 05:54:51 PM

Hi!
My laptop was affected by some virus which identified itself as an antivirus and now i underwent all processes you specified. The 3 logs are attached with the thread. Please verify the logs and let me know if my laptop is free from any virus/malware.
Thanks.

one update from my side:
I tried full-scan with my AV (norton) and I still have a problem..

Event:  Security Risk Found!
Risk: Backdoor.Tidserv.I!inf
File:  c:\windows\system32\drivers\atapi.sys
Action taken:  Clean failed : Quarantine failed



[Saving space, attachment deleted by admin]

Title: Re: Laptop affected by virus (logs attached)
Post by: SuperDave on December 07, 2009, 04:56:44 PM

Hello arun8283 and welcome to Computer Hope Forum. My name is Superdave but you can just call me SD. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

The first thing I will need you to do is this:

Download Disable/Remove Windows Messenger  (http://www.majorgeeks.com/DisableRemove_Windows_Messenger_d2327.html) to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

link # 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link # 2 (http://subs.geekstogo.com/ComboFix.exe)

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link (http://www.bleepingcomputer.com/forums/topic114351.html) to see a list of security programs that should be disabled and how to disable them.

Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts.
Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

Title: Re: Laptop affected by virus (logs attached)
Post by: arun8283 on December 07, 2009, 08:39:14 PM

Hi SD,
 It wont be of any use any more as I formatted the system this morning as i had to take it to office.

 Thanks for your time, effort and timely help.
Thanks again!

Title: Re: Laptop affected by virus (logs attached)
Post by: harry 48 on December 08, 2009, 02:23:01 PM

thanks dave sorry for the trouble