Main Forum > General Computer Support

Missing All Windows Firewall Predefined Rules

<< < (3/3)

Shane:
Run tdsskiller again, if it finds anything have it clean them and then reboot.

I find combofix is good and getting anything left over.

Shane

Zentard:
Running TDSSKiller.exe a second time came up with no hits.

Interestingly, when I searched ComboFix and clicked the search engine link to the website I was diverted to the Norton Antivirus site (or maybe an impressive mock-up).  So I copy-link-locationed the link instead and pasted that into the navbar.  That led me to the correct site.

ComboFix eliminated a number of files:
c:\users\USER\AppData\Roaming\defefc.dll
c:\users\USER\AppData\Roaming\shapr.dll
c:\windows\Installer\{289ca96a-9541-dde9-00a7-af80f2d9616f}\@
c:\windows\Installer\{289ca96a-9541-dde9-00a7-af80f2d9616f}\L\00000004.@
c:\windows\Installer\{289ca96a-9541-dde9-00a7-af80f2d9616f}\L\1afb2d56
c:\windows\Installer\{289ca96a-9541-dde9-00a7-af80f2d9616f}\L\201d3dde
c:\windows\Installer\{289ca96a-9541-dde9-00a7-af80f2d9616f}\U\00000008.@
c:\windows\SysWow64\SET809B.tmp
c:\windows\SysWow64\SETD55C.tmp
c:\windows\SysWow64\SETD688.tmp
c:\windows\SysWow64\SETE679.tmp
c:\windows\SysWow64\SETE97D.tmp

Tentatively, I can say this may have ripped out the rootkit.  I'm no-longer seeing evidence of redirection. I recognize some of these files which I have ripped out multiple times.

Shane:
Good :-)

Keep an eye on things, and now with the rootkit gone things should start acting like normal again :wink:

Shane

Zentard:
Ugh.  Sprang up again.  Sorry I keep spamming this thread with failure.  :tongue:  I'm looking into, diverting all firepower to the super star destroyer.

Shane:
Those didn't clean it up? VERY odd.

I wonder if you have something new.

Also always make sure your java and flash are always up to date. It is holes in those that allow infected ads or bad sites to infect you without you knowing. They are always plugging holes. So make sure they are up to date! :wink:

Shane

Navigation

[0] Message Index

[*] Previous page