Показано с 1 по 11 из 11.

Rootkit.win32.TDSS.d reader_s.exe

  1. #1
    Junior Member Репутация
    Регистрация
    29.04.2010
    Сообщений
    6
    Вес репутации
    25

    Rootkit.win32.TDSS.d reader_s.exe

    Seems I contracted a virus, or a bunch of them. I think I got it when I for some reason didn't pay attention. I was trying to find a program or digital writer to convert pdf files to ordinary jpeg, so yeah, I dunno what I downloaded but it wasn't something good. I think I got fooled in download a fake acrobat reader version. hehe

    The virus also makes it impossible for me to access windows update. hehe
    At least a few hours ago.

    It was impossible for me to get rid of it myself, even with Norman. So I tried this Kaspersky virus removal tool and the AVZ, combined with hijackthis.
    And now I have read the "read before you post thread" and hopefully followed the instructions correctly.

    Thanks in advance for any kind of help to resolve this matter!

    Kalle, Sweden.
    Вложения Вложения

  2. #2
    VIP Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для Aleksandra
    Регистрация
    13.01.2007
    Сообщений
    7,662
    Вес репутации
    2817
    Make a log of GMER http://virusinfo.info/showthread.php?t=51878

    Цитата Сообщение от Clastro Посмотреть сообщение
    I was trying to find a program or digital writer to convert pdf files to ordinary jpeg, so yeah, I dunno what I downloaded but it wasn't something good. I think I got fooled in download a fake acrobat reader version.
    I need a link to this site.
    Наша служба, будто сердце, отдыха не знает никогда.

  3. #3
    Junior Member Репутация
    Регистрация
    29.04.2010
    Сообщений
    6
    Вес репутации
    25
    Цитата Сообщение от Aleksandra Посмотреть сообщение
    Make a log of GMER http://virusinfo.info/showthread.php?t=51878


    I need a link to this site.
    I tried the GMER, but I got blue screen twice now, I don't feel like trying a third time.

    Hm, well, about the link. I don't remember what it was. So, sadly I can't help you out with helping me out on that.

    Perhaps I had the virus earlier, but I do not think so.

    I got a bluescreen when I updated acrobat reader to version 9.3. I do not know if it had anything to do with it, but this was when I thought something was wrong. Bunch of stuff I do not know, perhaps it wasn't even a correct version of acrobat reader, but I think so.

  4. #4
    VIP Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для Aleksandra
    Регистрация
    13.01.2007
    Сообщений
    7,662
    Вес репутации
    2817
    Make a log of Vba32 AntiRootkit http://virusinfo.info/showthread.php?t=77373
    Наша служба, будто сердце, отдыха не знает никогда.

  5. #5
    Junior Member Репутация
    Регистрация
    29.04.2010
    Сообщений
    6
    Вес репутации
    25
    Thanks for the reply.

    I tried a third time to get GMER to work, but it didn't, so I started windows in safe mode and then GMER worked.

    So I attached both the gmer.log and the Vba32 log.

    One more thing, since before I tried this Kaspersky, I used my Norman antivirus program. Norman has some files now in quarantine, should I release those and let Kaspersky take care of them also? Or does Kaspersky already take care of them?
    Вложения Вложения

  6. #6
    VIP Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для Aleksandra
    Регистрация
    13.01.2007
    Сообщений
    7,662
    Вес репутации
    2817
    1. Replace C:\Windows\system32\DRIVERS\kbdclass.sys with a clean file from any similar system or from Windows CD using recovery console or Live CD.

    2. Make a new log of Vba32Arkit.
    Наша служба, будто сердце, отдыха не знает никогда.

  7. #7
    Junior Member Репутация
    Регистрация
    29.04.2010
    Сообщений
    6
    Вес репутации
    25
    Цитата Сообщение от Aleksandra Посмотреть сообщение
    1. Replace C:\Windows\system32\DRIVERS\kbdclass.sys with a clean file from any similar system or from Windows CD using recovery console or Live CD.

    2. Make a new log of Vba32Arkit.
    My Fujitsu-Siemens computer got delivered with no windows vista DVDs, so I had to make one of my own and I was only allowed to do it ONCE.
    But the thingie failed the burning process already on disc one!!! It still used up my ONE time ability. So I have no windows disc.

    I am not familiar with what you mean by "Live CD", and google it didn't help me much.

    "similar system", do you mean I can just have a copy sent to me from a friend with windows VISTA? or even windows 7 or xp?
    Последний раз редактировалось Clastro; 02.05.2010 в 04:02.

  8. #8
    VIP Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для Aleksandra
    Регистрация
    13.01.2007
    Сообщений
    7,662
    Вес репутации
    2817
    Check your system with Live CD Vba32 Rescue. Links to download:

    ftp://anti-virus.by/pub/vbarescue.iso
    ftp://vba.ok.by/vba/vbarescue.iso
    Наша служба, будто сердце, отдыха не знает никогда.

  9. #9
    Junior Member Репутация
    Регистрация
    29.04.2010
    Сообщений
    6
    Вес репутации
    25
    Okey, so now I have checked my computer with the VBA32 resvue, it took like 4-5 hours to scan it. It found two infections and deleted one and cured one. Thing is now though, the kbdclass.sys file have been alterred after the vba32-scan and that was my drivers for my keyboard so now the keyboard doesn't work anymore for some reason (I am writing this from my other computer ). I guess this isn't really such a big problem, I can fix it by myself probably.

    But I assume I should do the "2. Make a new log of Vba32Arkit. " step now.



    Vba32ArkitLog2
    Вложения Вложения
    Последний раз редактировалось Clastro; 02.05.2010 в 23:49. Причина: Добавлено

  10. #10
    VIP Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для Aleksandra
    Регистрация
    13.01.2007
    Сообщений
    7,662
    Вес репутации
    2817
    I don't see any problem in your log.
    Наша служба, будто сердце, отдыха не знает никогда.

  11. #11
    Junior Member Репутация
    Регистрация
    29.04.2010
    Сообщений
    6
    Вес репутации
    25
    Yes, it seems I am finally clean after one week of countless hours of struggling. I even released my quarantine files in norman and then run VBA32ARkit again, this time it took almost 7 hours.

    I could not have done this without you and the tools provided!!
    I am truly greatful!

    All the googling I did before reaching this page was alot about "nothing you can do about this viruses, I suggest you to reformat your computer".
    But with your help that was not need!!

    Thanks again.

Похожие темы

  1. Rootkit.Win32.TDSS cleaner, утилита для удаления троянца TDSS от eSage Lab
    От Kuzz в разделе Вредоносные программы
    Ответов: 26
    Последнее сообщение: 07.11.2010, 18:56
  2. rootkit.win32.tdss.d
    От pdesjardins в разделе Malware Removal Service
    Ответов: 1
    Последнее сообщение: 21.04.2010, 21:34
  3. rootkit.win32.tdss.d
    От niknok в разделе Malware Removal Service
    Ответов: 7
    Последнее сообщение: 20.04.2010, 21:58
  4. Rootkit.Win32.TDSS.d / BackDoor.Tdss.565
    От Shanna в разделе Помогите!
    Ответов: 11
    Последнее сообщение: 24.01.2010, 17:42
  5. Rootkit.Win32.TDSS.a
    От rebootoz в разделе Malware Removal Service
    Ответов: 1
    Последнее сообщение: 21.05.2009, 11:31

Метки для этой темы

Свернуть/Развернуть Ваши права в разделе

  • Вы не можете создавать новые темы
  • Вы не можете отвечать в темах
  • Вы не можете прикреплять вложения
  • Вы не можете редактировать свои сообщения
  •  
Page generated in 0.00474 seconds with 20 queries