Here they are, only SAS found 5 tracking cookies.

Attached Files

	mbam-log-2009-02-17 (13-59-02).txt (833 Bytes, 1 views)
	SUPERAntiSpyware Scan Log - 02-17-2009 - 14-08-59.log (857 Bytes, 2 views)

Should have removed the tracking cookies but basically harmless..

OK the SDFix and combofix if they are clean we are finished.

Mike

Here they are. Please let me know if we are finished, thanks.

I removed the two RegCure entries in the Tasks folder in Windows.

you are lucky you didn't have recent virut version
win32virut56? so far nothing picks it up, rmvirut.exe completely useless, same as drweb
seems like you had older one that was solved

Attached Files

	ComboFix.txt (9.3 KB, 2 views)
	report.txt (3.1 KB, 2 views)
	hijackthis.log (6.8 KB, 1 views)

OK we may be finished but ComboFix found several and cleaned.

I need another combofix run and log to confirn it found no more and now has clean log.

You had mor ethan you thought!

Mike

Here it is...I'm not sure exactly how this one is to be read though.

Attached Files

ComboFix.txt (8.3 KB, 3 views)

That was clean!

Good job! We are finished.

Thread closing-------------------------------------------------------------------

Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

Remove ComboFix
Start-Run
type
combofix /u
Hit enter or click OK.

Please download OTCleanIt http://download.bleepingcomputer.com.../OTCleanIt.exe

Save to desktop.

This will remove all the tools we used to clean your computer.


Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

If prompted to Reboot click, Yes.
OTCleanit will delete itself when finished, If not delete it by yourself.

-------------------------------------------------------------------------------------
Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner.
-------------------------------------------------------------------------------------
The issues can and are likely found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.
-------------------------------------------------------------------------------------

Every two weeks or so, run MBAM and SAS until clean.

They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

If they find something they can not clean, then get back to us.

Additionally run CCleaner. ATF-Cleaner and KCleaner.
----------------------------------------------------------------------------------------
I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

It was designed to be used with and to co-exist with other Virus scanners.

Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

It's like looking at it with 2 sets of eyes and from a different angle.

It works like some Firewalls do to learn what is good/bad.

After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

As it queries you about the prompt to help you determine to approve or not you can google it with one click.

http://www.threatfire.com/Download/
-------------------------------------------------------------------------------------
Look at http://www.javacoolsoftware.com/spywareblaster.html

Run SpyBot ocassionally and use the Immunize function.
http://www.safer-networking.org/en/download/

I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

A Disk Scan (chkdsk) and Defrag are in order.

Mike

Your help is highly appreciated and I will make sure to do the cleanup process ASAP! Thanks again!

I have the TDSSserv.sys virus, but when I try to use the guide to remove it, I get stuck.
Because I don't have any “TDSSserv.sys”, or "clbdriver.sys", "oUltraf", "seneka.sys", drivers in my Non-plug and Play Drivers section.

And I constantly get a message from my Norman antivirus that explorer.exe in system32 folder is infected with TDSSserv.sys.

How can I remove this, since I cant find any of the drivers in the Hardware monitor overview?

All help is greatly appreciated!

--
John Martin

Are you able to download this program from download.com and install it? If so, try and update it and run a scan with it, then do the same with malware bytes.

Have downloaded malware bytes and had a scan.
Nothing found.. Doing a scan with Super anti spyware now..
Will post a new thread with more info and more things I have tried

are you showing hidden devices also in device manager?

yes, I have "turned on" the hidden devices.

JohnMartin, please start you own thread, Follow the steps on
http://www.techspot.com/vb/topic58138.html

When through attach the 3 logs and leave description of your particular problem.

This thread is for the use of nlarchey only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our Virus and Malware Removal Forum.


Although problem may sound similar, cleaning is specific for one person.

yes. Sorry
I realized that after my first post in this thread.
Have already posted a new thread with my problems.