Author Topic: Found TDL4 Aluroot but can't remove  (Read 19938 times)

0 Members and 1 Guest are viewing this topic.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user
Re: Found TDL4 Aluroot but can't remove
« Reply #15 on: November 16, 2011, 11:01:11 AM »
Ahh seems I can't PM you. Any ideas? Oh and also most of my programs have disappeared!
you need 20 post`s before you can do that......forum spam protection

true indian

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #16 on: November 16, 2011, 11:34:53 AM »
The log is 672kb and I can't attach it due to the size

upload the log file here:

www.mediafire.com

and then give the link of your log file download from mediafire here at your topic...

masterchef

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #17 on: November 16, 2011, 11:41:18 AM »
Thank you! Here is the link: http://www.mediafire.com/?485vwg5bt4tgklp

true indian

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #18 on: November 16, 2011, 11:56:42 AM »
essexboy will check the log...when he is back at night ;D

masterchef

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #19 on: November 16, 2011, 11:58:24 AM »
Awesome - thank you very much  :)

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Found TDL4 Aluroot but can't remove
« Reply #20 on: November 16, 2011, 10:06:18 PM »
OK it has changed consrv.dll is no more they are using another one - ah variety

How is the computer behaving now ?

Could you run a fresh OTL scan for me to scan for orphans


masterchef

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #21 on: November 16, 2011, 10:21:40 PM »
Sure can - do I need to paste the same code into the custom box as before?

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Found TDL4 Aluroot but can't remove
« Reply #22 on: November 16, 2011, 10:24:59 PM »
Aye go on be a divil  ;D as long as all users is selected your choice

masterchef

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #23 on: November 16, 2011, 10:38:14 PM »
'Quick scan' or 'run scan'? And do I paste in this text:

:OTL
SRV - File not found [Auto | Stopped] -- -- (wkoeaprj)
O2 - BHO: (Reg Error: Value error.) - {405EA845-8131-40AD-B359-6433ADF1223D} - C:\WINDOWS\system32\bootvidd.dll File not found
O2 - BHO: (no name) - {6F2F8576-1CD5-4759-8802-21CB0BECC7F2} - c:\windows\system32\dmbandu.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - ID - No CLSID value found.
O4 - HKU\S-1-5-21-2247744071-1403820768-2080818773-1005..\Run: [ina2je7xgnmx] C:\WINDOWS\system32\ina2je7xgnmx.exe File not found
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
[2011/11/15 13:38:20 | 000,054,016 | ---- | M] () -- C:\WINDOWS\System32\drivers\kqdjhg.sys
[2008/04/03 20:08:48 | 006,490,880 | ---- | C] () -- C:\WINDOWS\System32\lyehbwaj.dat
[2008/03/27 22:09:50 | 000,035,584 | ---- | C] () -- C:\WINDOWS\System32\njthhniw.dat
[2008/03/27 22:09:49 | 000,638,208 | ---- | C] () -- C:\WINDOWS\System32\hdbevbrp.dat
[2008/03/27 22:09:49 | 000,043,264 | ---- | C] () -- C:\WINDOWS\System32\yhgdzaft.dat
[2008/03/27 22:09:49 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\mzalukpk.dat

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[CREATERESTOREPOINT]
[Reboot

Oh and to answer your question, computer is running well with no more redirects or Avast warnings.

Only worrying thing is that most of my programs have disappeared from the 'All programs' menu. One of them is Microsoft Office Accounting which now won't load and asks me to insert the Office disc to repair/reinstall - which I don't have as it was a (legitimate!) Microsoft download a few years ago and didn't come on a disc. Don't think it's available any more, or if it is it costs (they were offering it free back then)!



Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Found TDL4 Aluroot but can't remove
« Reply #24 on: November 16, 2011, 10:51:24 PM »
Just the quick scan  so that I can see if anything is left - no need for a script input, just select all users 

masterchef

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #25 on: November 16, 2011, 11:04:24 PM »
Thank you for all your help so far. Okay, OTL log attached.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Found TDL4 Aluroot but can't remove
« Reply #26 on: November 16, 2011, 11:29:08 PM »
How is it running now ?

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    Quote
    :OTL
    SRV - File not found [Auto | Stopped] -- -- (wkoeaprj)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Advanced\Folder\Hidden\SHOWALL: CheckedValue = 1

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [CREATERESTOREPOINT]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

masterchef

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #27 on: November 16, 2011, 11:44:27 PM »
It says processing complete at the bottom of the OTL window (beneath progress bar) but it's just hanging now - no desktop icons visible and I clicking anywhere on the screen just makes a 'fail' beep! Power off and on via the good old button?

masterchef

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #28 on: November 17, 2011, 12:10:48 AM »
Rebooted successfully after hitting the power on/off button and attached log was there waiting!

true indian

  • Guest
Re: Found TDL4 Aluroot but can't remove
« Reply #29 on: November 17, 2011, 09:38:05 AM »
Rebooted successfully after hitting the power on/off button and attached log was there waiting!

essexboy will be back by the night