Malware Discussions

[MJB877]

I have a Gateway desktop and it has Trend Micro Antivirus+.  I took the computer to Geek Squad and was told that the hardware was fine but the system needed a complete reinstall.  I had that done and the Google Redirect is still there. The computer seems to be working fine otherwise, but it sounds like it is constantly working even when it shouldn't have to

Thanks.

Matt

[malwarekiller]

Welcome aboard! 

 I would need some logs to analyze first....I think this is the new TDL4 varient

• Download RogueKiller and save it on your desktop.  
•     Quit all programs 
•     Start RogueKiller.exe.  
•     Wait until Prescan has finished ... 
•     Click on Scan

  
   

• Wait for the end of the scan.   
•     The report has been created on the desktop.   
•     Click on the Delete button.

  
   

• The report has been created on the desktop.

• Next click on the ShortcutsFix  
    
    
• The report has been created on the desktop.

Please post:  
  
All RKreport logs located on your desktop.

NEXT

Download OTL  to your Desktop.

http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe

netbt.sys

atapi.sys

volsnap.sys

redbook.sys

lsi_sas.sys

lsi_scsi.sys

cdrom*

tcpip.sys
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
C:\Windows\assembly\tmp\U\*.* /s

C:\Program Files\Common Files\ComObjects\*.* /s
CREATERESTOREPOINT

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • attach both logs

 NEXT

Download aswmbr.exe ( 1.8mb ) to your desktop. 

http://public.avast.com/~gmerek/aswMBR.htm
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan.

• 

• Click the [Scan] button to start scan

  

• On completion of the scan click [Save log], save it to your desktop and post in your next reply.

[malwarekiller]

Sorry the link to OTL is not working....New Link:

www.­geekstogo.­com/­forum/­files/­file/­398-­otl-­oldtimers-­list-­it/­

[MJB877]

Thanks. I will try to do this tonight. I have a 2-year-old and I need him asleep so I'm not interrputed.

[malwarekiller]

No worries! Time is not a problem!

[MJB877]

Here is the Rogue Killer Report