[CompCav]

Quote

Shouldn't we try to remove those infected files that tdsskiller found?

Read the instructions carefully, when the scan completes you will have a choice for each item. Most items only have skip, move to quarantine, or delete. Only select cure on the ones that have cure as an option. You have to check each "threat file" individually for these options.

[helpme1962]

We have a big problem now. I'm on my desktop now. While I can get to the google page (barely) on my laptop, I can not type anything once there. It locks up, and no cursor is available. If I type in the address bar. Nothing happens. As for the tdsskiller reply above, I have been quarantiniong them. I guess I misunderstood your directions. What should I do?

[helpme1962]

Also, none of the 4 items tdss killer found had the cure option, so what do I do with them?

[CompCav]

There are many items that it "finds" that are generic and do not have a signature but they are not malware.

Step 1.

Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply



If it does not run rename it iexplore.exe and try it again.


Step 2.

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• Select Scan All Users
  
• Select Lop Check and Purity Check
  
• Under the Custom Scan box paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  consrv.dll
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
  hklm\software\clients\startmenuinternet|command /rs
  hklm\software\clients\startmenuinternet|command /64 /rs
  C:\Windows\assembly\tmp\U\*.* /s
  C:\Program Files\Common Files\ComObjects\*.* /s
  C:\windows\*. /RP /s
  %Temp%\smtmp\1\*.*
  %Temp%\smtmp\2\*.*
  %Temp%\smtmp\3\*.*
  %Temp%\smtmp\4\*.*
  >C:\commands.txt echo list vol /raw /hide /c
  /wait
  >C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
  /wait
  type c:\diskreport.txt /c
  /wait
  erase c:\commands.txt /hide /c
  /wait
  erase c:\diskreport.txt /hide /c
  CREATERESTOREPOINT
  
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open OTL.Txt.
    
  • Post the OTL.txt log

Step 3.

Please post:

aswMBR log
OTL.txt

Any new issues please let me know.

[helpme1962]

I am on my desktop because my laptop (which had the problem we were fixing) has become unusable. I can not access this forum with it.

Please help. That is my work computer. We were working on it today while I was in my office. I broght it home to work with y ou on it. Now its completey unusable. What happened?

[CompCav]

Did you delete or move to quarantine any items with TDSSKiller?

[helpme1962]

Yes, that is what I said in my previous two posts. Since there was no cure option, I used the quarantine option. I believe it shows that in the tdsskiller log I posted. Can you see those tdsskiller logs I posted a few messages ago?

Do you still want me to do these last instructions you just posted. I have the exe files loaded onto a usb key and I can go downstairs to my laptop and follow your most recent directions.

Please advise.

[CompCav]

Let's protect your desktop computer.

Panda Vaccine

• Please download Panda USB Vaccine (you must provide valid e-mail and they will send you download link to this e-mail address) to your desktop.
  
• Install and run the program.
  
• Double-click on the file USBVaccine.zip located on your desktop.
  
• A file viewer will open. Double-click on the file USBVaccineSetup.exe. Please select Yes if you are asked if you want to allow the program to make changes to the computer.
  
• Follow the steps on screen to install the program on your computer.

[helpme1962]

The desktop computer I am now working on is not infected with anything as far as I know. It works fine. Ive inserted a usb key into this desktop and downloaded the aswMBR.exe and otl.exe onto it. I can take these exe files to my laptop and run them if you want. I really dont want to mess with this desktop computer since nothing is wrong with it.

Please advise.

[CompCav]

Install panda vaccine on your desktop computer and then vaccinate the usb drive before you connect it to the laptop.

[helpme1962]

I need to sign off for tonight and will continue this exercise periodically throughout tomorrow if you will be answering my posts. One other question. Should I do a system restore to an earlier date and then start over with your original directions?

Thanks,

Chris

[CompCav]

No need we have a tool to help us recover all the files in quarantine.


Before doing any other logs we will want to run the program that will give us a log that I can use to make a batch file for recovery of the files in quarantine

When you get up tomorrow do this after you install the panda vaccine and vaccinate the usb drive:


Get information on quarantine:

Download this simple little tool 'TDDS Qlook' to your desktop.

Run TDSSQlook
It will open and you will see three options.
Type A
Press Enter
A log will be produced named TDSSQ.txt
Copy and paste the contents into your next post.



Regards,

CompCav

[helpme1962]

CompCav, Im using my home laptop now to help fix my work laptop. Ive intalled panda on my home laptop, vaccinated it, vacinnated the usb, installed tdslook on this computer and ran what you asked. I still can not get online with my work laptop. Lets call these computers good laptop and bad laptop to avoid any confusion. Log is below.




TDSSKiller Quarantine Information log
Version 1.0.0.4
***** START SCAN Sat 04/28/2012 9:39:47.22 *****

---------- Warning! ----------

TDSSKiller Quarantine folder not found

---------- TDSSKiller logs ----------


---------- TDSSStarter logs ----------


***** END SCAN Sat 04/28/2012 9:39:47.42 *****
- EOF -

[helpme1962]

Obviously the tdssqlook log is from the goodlaptop. I don't see where you asked me to install it on the bad laptop.

[CompCav]

Copy TDSSQlook from the good laptop onto the USB flash drive.
Insert the USB flash drive in the bad laptop.
On the bad laptop copy TDSSQlook on to the desktop.

Then

Run TDSSQlook
It will open and you will see three options.
Type A
Press Enter
A log will be produced named TDSSQ.txt
Save the log on the USB flash drive.

Now put the USB flash drive in the good laptop.
Open the log with notepad.
Copy and paste the contents into your next post.