Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
11-Nov-2009, 11:51 AM
#1 | ||||||
| IE Getting Hijacked - tdlwsp.dll reported by Avast |
| |
14-Nov-2009, 04:17 AM
#3 | |||||
| Hello there  Welcome to the TSG Forums. My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me. Please note the following:
Step 1 Download OTS to your Desktop
Code: %SYSTEMDRIVE%\eventlog.dll /s /md5 %SYSTEMDRIVE%\scecli.dll /s /md5 %SYSTEMDRIVE%\netlogon.dll /s /md5 %SYSTEMDRIVE%\cngaudit.dll /s /md5 %SYSTEMDRIVE%\sceclt.dll /s /md5 %SYSTEMDRIVE%\ntelogon.dll /s /md5 %SYSTEMDRIVE%\logevent.dll /s /md5 %SYSTEMDRIVE%\iaStor.sys /s /md5 %SYSTEMDRIVE%\nvstor.sys /s /md5 %SYSTEMDRIVE%\atapi.sys /s /md5 %SYSTEMDRIVE%\IdeChnDr.sys /s /md5 %SYSTEMDRIVE%\viasraid.sys /s /md5 %SYSTEMDRIVE%\AGP440.sys /s /md5 %SYSTEMDRIVE%\vaxscsi.sys /s /md5
Please attach the log in your next post. To do so click on the blue "Reply" button or "Go Advanced" and click on the "Manage Attachments" button To ensure that I get all the information this log will need to be attached. If it is too large to attach then upload it to Dropio and post the sharing link/url (The Drop's URL will be similar to : http:://drop.io/daerk) Step 2 Download SysProt Antirootkit from the link below (you will find it at the bottom of the page under attachments, or you can get it from one of the mirrors). http://sites.google.com/site/sysprotantirootkit/ Unzip it into a folder on your desktop. Start the Sysprot.exe program.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
14-Nov-2009, 04:01 PM
#5 | |||||
| Are you still experiencing the same symptoms? I'm not seeing it in the logs. Please do the following: NOTE: ComboFix should NOT be used without supervision by someone trained in its use. It does a whole lot more to a system than just remove infected files. Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you please let me know. A increasing number of infections are spreading using Autoplay and leaving it disabled is a good idea. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
16-Nov-2009, 11:18 PM
#13 | |||||
| Good. Let's do the following: 1. Close any open open programs before running the fix. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open Notepad (Start > Programs > Accessories) and copy/paste the text in the codebox below into it: Code: FCopy:: C:\Program Files\Gigabyte\Silicon Image Base Driver\Si3112\Si3112.sys | C:\WINDOWS\OemDir\si3112.sys Folder:: c:\documents and settings\All Users\Application Data\98043428 C:\WINDOWS\System32\jogezane File:: c:\windows\system32\povufuyu.dll C:\WINDOWS\System32\jogezane Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Also, let me know if Avast still detects tdlwsp.dll
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
17-Nov-2009, 01:08 AM
#15 | |||||
| You're welcome. We should run a couple more things to be sure you're clean. When you get a chance, please do the following:  Please download Malwarebytes' Anti-Malware from Here.Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 12:21 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile