Member Avatar for Jiggy1981

Hi all,
Would appreciate help. I have been unable to update any spyware software and popups keep coming up in my browser. It is getting really annoying and I want to get rid of this trojan once in for all. I ran hijackthix and here is the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:45:07 PM, on 22/02/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\Program Files\NinjaVideo\NinjaVideo Helper\NinjaVideo Helper.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\alg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe /H
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NinjaVideo Helper (NinjaVideo Helper.exe) - NinjaVideo - C:\Program Files\NinjaVideo\NinjaVideo Helper\NinjaVideo Helper.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 4795 bytes

  • 3 Contributors
  • 3 Replies
  • 252 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Short expert summary tied to the thread: the symptoms described by (blocked spyware updates, persistent browser popups) and ’s suggestion to look for a hidden TDSS driver are classic indicators of a kernel-level rootkit (TDSS/Alureon family). Not seeing a service named TDSSserv in Device Manager does not prove absence — TDSS variants commonly hide drivers and block or interfere with security tools and browser/DNS access. (myantispyware.com)

Practical, low-risk workflow (order matters): start with a clean boot environment — Safe Mode with Networking is preferred for initial attempts — then run an on-demand rootkit scanner and an on-demand anti‑malware scanner. Historically the sequence that works is a dedicated rootkit remover (Kaspersky’s on‑demand tool / KVRT) followed by a full Malwarebytes scan and cleanup; reboot and repeat scans until nothing is found. If security tools fail to run in normal mode, Safe Mode often lets them start. (support.kaspersky.com)

If the infected machine blocks downloads or program launches, use a clean PC to download tools onto a USB stick (or build a bootable rescue media) and run scanners from that media. A rescue/rescue-disk scan (for example, Kaspersky Rescue Disk or a similar rescue ISO) lets the scanner run outside Windows and find MBR/boot/rootkit components that in‑OS scanners miss. In stubborn cases the simple trick of renaming blocked installers (or running them from removable media) is a commonly used workaround in removal guides. After removal, inspect/reset the hosts file, DNS settings and browser helper objects. (support.kaspersky.com)

Recovery caveat and final measure: if the infection cannot be confidently removed (rootkits that alter the MBR or kernel are notoriously persistent), the safest long-term fix is to back up personal data (only non-executables), securely wipe the drive and reinstall Windows from known-good media. Microsoft’s investigation into the Alureon/TDSS family supports a reinstall if removal cannot be verified. (msrc.microsoft.com)

Recommended Answers

All 3 Replies

Member Avatar for jholland1964

Check for this:
Open Device Manager and on the VIEW Tab, select the Show hidden devices option.
Go down to non plug and play drivers and see if there is one called TDSSserv and disable it.

It it was there and you could disable it then try to download, install, update and run a Full System scan with Malwarebytes' Anti-Malware (MBA-M)
When the scan is complete be sure all items found are checked and then click the Remove button.
Reboot the computer.
Post back here with that log if you were able to run the program.
Judy

Member Avatar for Jiggy1981

Check for this:
Open Device Manager and on the VIEW Tab, select the Show hidden devices option.
Go down to non plug and play drivers and see if there is one called TDSSserv and disable it.

It it was there and you could disable it then try to download, install, update and run a Full System scan with Malwarebytes' Anti-Malware (MBA-M)
When the scan is complete be sure all items found are checked and then click the Remove button.
Reboot the computer.
Post back here with that log if you were able to run the program.
Judy

Thanks for reply. I don't see TDSSserv.

Member Avatar for crunchie

So, try to download and run MBA-M anyway :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.