Member Avatar for Adam619

When it all started, my protection was AVG 8.5. I went to google to search for an article. Google then brought up the search results page. I clicked on one of the links and it then redirected me to a site that had nothing to do with what I searched. I tried multiple times and it kept bringing up these other search engines/advertisements. I used yahoo search as well and had the same result. Now, google or yahoo won't even open. So I downloaded Spybot hoping it would remove whatever I have on my computer. I ran a scan, but midway through the scan the program just closed itself. There wasn't any notice at all, it just vanished from my screen. Then when I tried to open Spybot again, it said that I may not have permission to access or something. So then I downloaded Ad-Aware and had the same outcome...stopped midway through scan, then closed, and unable to open the program.

During the Spybot problem, I then received a notice that the Resident Sheild in AVG was turned off. I went to AVG to turn it on, clicked the ticker, saved the changes, and it remained disabled. I also downloaded CCleaner. I ran CCleaner but it didn't seem to do much, but I am still able to open it. I went to Symantec and got a free scan. The results showed I had a Trojan named Backdoor.Tidserv. After learning this, I went to http://www.symantec.com/security_response/writeup.jsp?docid=2008-091809-0911-99&tabid=3 to try and remove it. Following those instructions, I disabled Windows XP System Restore. I then went on to download a trial version of Norton Anti-Virus 2010. While running a scan through Norton, AGAIN, the program closed itself midway through the scan and I could no longer access it.

I was going to attach a log file from HijackThis, but when I downloaded the program, it maybe ran a scan for 1-2 seconds then closed itself, just like the other applications. I couldn't open it back up.

On top of all this, I believe my email is infected. I learned that an email apparently sent from my email address contained advertisements and I would assume it's the virus. I really don't want to infect anyone else's computer. I've been trying to battle this for the past two days.

I've learned that one option is to reformat windows. I would hope this would wipe the virus away and in turn it would wipe all of my information. If I do that, would my email be clean? Or would it still be infected?

Basically, I have no idea how to take this virus or whatever it is off. I'm hoping there's another solution out there.

Thanks,

Adam

  • 2 Contributors
  • 1 Reply
  • 305 Views
  • 8 Hours Discussion Span
  • Latest Post Latest Post by PhilliePhan

Dani AI

Generated

The pattern described by — security tools terminating mid-scan, browser redirects and shields getting disabled — is classic for a persistent backdoor that actively blocks removal utilities. ’s point that a full reinstall is often the most reliable cure is sound, but a short triage and safe backup workflow can preserve important data and reduce the chance of re-infection.

Immediate triage: isolate the infected PC from the network. Passwords for email, banking and other critical accounts should be changed from a separate, known-clean device and two-factor authentication enabled where possible. The email account itself should be inspected via webmail for unknown sent messages, automatic forwarding rules or linked apps and those removed; affected contacts should be notified to treat unexpected messages as suspicious.

Safe backup and scanning: copy only personal, non-executable files (documents, photos) to external media — do not back up programs, installers or system files. Scan those backups on a different, up-to-date machine and, if available, with bootable offline rescue media that runs outside Windows (offline scans are far more effective against software that hides while the OS runs). Keep System Restore disabled during cleaning because restore points can reintroduce infected files.

Recovery path: when a rootkit/backdoor is suspected, a full disk wipe and reinstall from trusted media gives the highest assurance of cleanliness — prefer a full format or secure wipe rather than a quick format. After reinstall, fully patch the OS, install security software, and change all account passwords again from a clean device. For business-critical machines or irreplaceable data, professional remediation or forensic imaging before wiping should be considered.

Member Avatar for PhilliePhan

I've learned that one option is to reformat windows. I would hope this would wipe the virus away and in turn it would wipe all of my information. If I do that, would my email be clean? Or would it still be infected?

A format is always the best and easiest option in cases like these with rootkit components.

Infected emails not stored on your computer would not be affected by a format.

There are ways to attack and clean this baddie, but they would not guarantee 100% that your machine is clean, again due to rootkits...

If you want to have a go at cleaning your machine, I'm sure a volunteer would be happy to help you.

Best Luck :)
PP

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.